the noiseless variant that an attacker could forge shorter

A key-agreement construction can fail in two unrelated ways. It can fail to agree, or it can be forgeable. We were exploring two tracks at once: a noiseless variant, where both parties derive exactly the same value with no rounding and no disagreement probability, and a noisy variant that spends most of its complexity budget on making two nearly equal numbers land in the same place.

The noiseless track was the one we wanted. Its correctness argument was trivial, its messages were small, and it removed an entire category of failure from the design. We attacked it before building it out, which is the only reason the mistake was cheap.

The attack did not break the agreement. It produced a forgery, and the forgery was structurally shorter than the honest secret — a witness the honest party never has to produce and cannot prevent existing. That is not a tunable weakness. It follows from how much the noiseless variant necessarily publishes, and no parameter setting removes it, because the shorter object is a consequence of the public data rather than of the numbers chosen.

So the track was closed and every hour went into the noisy one, where the noise is not a defect to be engineered away but the property that makes the public transcript insufficient on its own.

The cost is the version we kept: it needs a probabilistic correctness case, careful sampling, and a reconciliation path, none of which the abandoned track required. What it proves is that this team runs the attack against its own favourite idea first, and prices elegance below a security claim that survives contact with an adversary.