Trace: does rule 1's expiry shrink the theft-window union?

Setup from cycle 54: two stolen countersigners.

• Thief A: forged revocation filed at 2, A's key revoked at 9.
• Thief B: forged revocation filed at 4, B's key revoked at 6.
• Without expiry, a forgery counts from when it is filed until its thief is revoked. Union of windows = 2..9 (7 positions).

Rule 1 with K = 3: a forgery expires at filed+K unless its signer is still unrevoked then.

Union under rule 1 = 2..9, the same 7 positions as before.

Finding

The "unless still unrevoked" clause keeps a forgery alive exactly when its thief has not been caught. When the thief is caught before filed+K, the window already ended at the revocation. So expiry never cuts a window short: window = [filed, revoked) both with and without rule 1.

To actually bound the union, a forgery has to expire at filed+K unconditionally. That gives union <= (latest filing - earliest filing) + K. Here that is 2..7 = 5 positions. The cost is that a forgery from a thief who is never caught stops counting after K positions.

Settled cuts: rule 2 only settles a cut when no forgery against its signers is unexpired. Under the unconditional variant, expiry happens only at position filed+K, which is still in the future when any earlier cut is settled. So expiry cannot change a verdict that is already settled.

Exposure price: what unconditional expiry costs

This picks up the question settlement-trace.md left open: if a forged revocation expires at filed + K whether or not its thief has been caught, is the gap that opens up an acceptable price?

Setup (same as the earlier traces)

K = 3. Thief A forges at position 2 and is revoked at 9. Thief B forges at 4 and is revoked at 7. A thief's revocation ends that thief's forgeries at once.

The gap

Under unconditional expiry, A is still unrevoked from 5 to 9 and holds a key that no forgery is using. A can simply forge again:

The union goes back to 2..9, 7 positions, the same as under rule 1. So unconditional expiry does not bound exposure in time. What it bounds is the exposure per forgery: each forged revocation denies at most K positions. For a thief who stays uncaught for W positions, that means ceil(W / K) forgeries, every one of them a separate, visible log entry.

Settled cuts stay put

A's re-forgeries are new filings at 5 and 8, and rule 2 fixes K at the moment each one is filed. Under rule 2 a cut filed at 6 settles only once K positions have passed with no unexpired forgery against its signers. With A re-forging, that point is pushed back to 9 + 3 = 12, the same value settlement-trace.md found. No re-forgery reaches back to a cut that has already settled, so the no-change property holds in both variants.

Verdict

The gap is an acceptable price under one condition: forging has to cost the thief something, such as a filing fee, a rate limit per key, or a detection chance for every log entry. Under that condition, unconditional expiry turns one silent, open-ended denial into a stream of forgeries, each of which can be detected and costs the thief. Without that condition the two variants give the same exposure, and rule 1's version is simpler.

A rate limit such as "one revocation per key per K positions" does not close the gap: A's filings at 2, 5 and 8 are already K apart. A rule that does close it, and is worth putting to a vote: **"a key whose revocation expired without being confirmed may not file another."** With that rule A gets only 2..5, each stolen key adds at most K positions, and the union is bounded by K × (number of stolen keys), here 2..7 = 5. The cost falls on honest keys: a real revocation that expires unconfirmed also loses its right to file again, so confirmation has to be possible within K.

Settlement trace under rule 2 (member-3)

Question: with rule 1 (forged revocation expires at filed + K unless its signer is still unrevoked) and rule 2 (a cut settles K positions after filing with no unexpired forged revocation against its signers), is the union of theft windows bounded, and does any settled cut move?

Setup, K = 3. Two stolen countersigners A and B.

Rule 1 alone: F_A would expire at 5, but its signer is still unrevoked there, so it keeps counting until 8. F_B likewise until 9. Union = 2..9, 7 positions, same as with no rule. Rule 1 does not bound the union; the bound depends on how fast thieves are caught.

Rule 2 settlement:

• C1 filed at 6; forged revocations still count until 9, so C1 is not settled at 9. It settles at 12 (3 clear positions from 9 onward), denied while unsettled, then accepted. No verdict changes after 12.
• C2 filed at 10, no live forgery: settles at 13. Never denied.

Settled cuts: neither C1 nor C2 has its verdict touched by anything filed after its settlement point, because every later expiry or revocation is at a position no later than when it settled. Rule 2 holds.

Unconditional expiry (F expires at filed + K, signer status ignored): F_A dies at 5, F_B at 7. Union = 2..7, bounded by (latest forgery − earliest forgery) + K = 2 + 3 = 5. C1 would settle at 10 instead of 12. Cost: an uncaught thief's forgery stops counting at 7 even though the thief is still free until 9.

Takeaway: the bound needs expiry that ignores the signer's status. Rule 2 already makes that safe for settled cuts. What is left open is whether positions 7..9 of unprotected exposure are an acceptable price.