Confirmation trace: thief vs honest revoker (K = 3)

Rules applied: rule 1 (independent pre-registered co-signer confirms; no-refile bar only on keys whose revocation expired unconfirmed; refiling with confirmation attached lifts the bar) and rule 2 (co-signer registered at least K positions before filing, not controlled by the revoked key, confirmation before filed + K).

Thief (stolen key A, co-signer C registered at position 0)

Denied span: 2..4 only. The repeat forgeries at 5 and 8 from cycle 55 can't happen.

Honest revoker (key B, co-signer D registered at position 0)

The honest revoker loses time but can still act: the bar blocks a filing with no confirmation, not a confirmed one.

Remaining gap

If D is lost for good, B can never be revoked. Rule 2 needs a co-signer that was registered in advance, so the owner has to register a replacement before filing. Positions settled before this point are unchanged.

Key-signed co-signer registration: anchoring eligibility to the first filing

Follows up the open gap in lost-cosigner-replacement-window.md: if registering a co-signer needs a signature from the key itself, the honest holder and the thief both produce valid registrations, and rule 2's "not controlled by the revoked key" cannot tell them apart. Window K = 3.

Thief under rule 2 as written

• Position 1: theft. Thief registers co-signer C_t, signed with the key.
• Position 2: thief files a forged revocation, no confirmation.
• Position 5: it expires unconfirmed; rule 1's no-refile bar applies.
• Position 5: thief refiles with C_t's confirmation attached. C_t was registered 4 positions earlier (>= K), and nothing marks it as thief-controlled, so rule 2 accepts it. The bar is lifted. Denied span runs 2..8 and can repeat.

Candidate fix: anchor to the earliest filing

A co-signer is eligible only if it was registered at least K positions before the first revocation filing on that key, not just the current one.

• Thief: first filing at 2, C_t registered at 1. Ineligible for every later refile. The bar holds and exposure stays capped at K positions (2..5).
• Honest holder with a long-standing co-signer (registered at -10): eligible, confirmed, never barred.
• Honest holder who replaces a lost co-signer first (registers at 0, files at 3): eligible, confirmed.
• Honest holder who files first and replaces after (files at 2, registers at 3, refiles at 6): ineligible. The anchor closes the thief's path and also the honest file-first path that rule 2 had opened.

Result

The earliest-filing anchor stops key-signed co-signer laundering and leaves settled cuts unchanged, but it trades back the file-first honest holder. Still open: some registration signal that the thief cannot produce from the key alone (e.g. a co-signer registered through an existing eligible co-signer), so the honest file-first holder can recover without reopening the thief's route.

Lost co-signer: when the honest revoker can still recover (K = 3)

Rules 1 and 2 leave one honest case open: the key's only co-signer is gone. This traces what a replacement co-signer buys, and what it cannot.

Setup

• Key A registered at position 0 with co-signer C1.
• C1 is lost at position 4 (keys destroyed, unreachable).
• A's holder discovers the theft of A at position 6.

Trace: honest holder replaces C1 first

Exposure: the thief can use A for positions 6..9, i.e. K + 1 positions after discovery. No bar ever applies, because nothing expired unconfirmed.

Trace: honest holder files immediately with no eligible co-signer

The honest revoker is delayed, not silenced: rule 1's "refile with confirmation attached" is the exit, and rule 2 only requires C2 to predate the *refiling*, not the original filing.

Trace: thief tries the same move

The thief holds A, so any co-signer they register *from A* is controlled by the revoked key and is ineligible under rule 2. The thief cannot use the honest exit.

What remains open

The distinction above relies on "not controlled by the revoked key". If co-signer registration requires a signature from A, the honest holder and the thief both sign with A, so the rule cannot tell C2 from C3 by origin. A candidate fix: replacement co-signers must be endorsed by an existing eligible co-signer *or* by K positions of no filings against A. The second branch favours whoever waits longer, which a patient thief can also do.