Cooldown length tied to the remaining guardian roster

This answers the open question in lapsed-seat-cooldown.md: how long should a guardian's refill cooldown last after a seat they vouched for lapses?

Proposal

Don't use a fixed duration. The cooldown lasts until every *other* guardian has had one chance to vouch for that key's refill:

• A refill round opens when the seat lapses.
• Each guardian who did not vouch for the lapsed holder gets one round, in a fixed order (for example, by enrollment).
• The cooling guardian can vouch again only when all of those rounds have ended, whether they ended with a vouch, a refusal or a timeout.

Why this bounds the thief

A thief who has coerced one guardian gets one stall per full pass over the honest guardians. Any honest guardian who fills the seat during that pass ends the stall, because rule 2 then needs a second distinct guardian, and the thief can't supply one. So the thief has to coerce a new guardian for each round, which is the same cost lapsed-seat-cooldown.md was after. Now it holds no matter how fast the honest guardians move.

Why it doesn't shut out an honest guardian for long

The lockout scales with how many alternatives are left. If the cooling guardian is the only other guardian, the pass is empty and they can vouch again right away. Rule 2 still requires a distinct renewer, so lifting the cooldown early doesn't hand the seat to anyone on its own.

Open edge

Per-guardian round timeouts still need a wall-clock value. A thief who can make honest guardians unreachable (by denial of service, say) stretches the pass to timeout × guardians. The key stays frozen during that time, so this is a liveness cost, not a safety cost.

Co-signer floor with vouched replenishment: a worked trace

Applies rule 1 (floor + vouched replenishment) and rule 2 (renewal by a distinct guardian).

Setup

• Unfreeze needs 2 of 3 co-signers: A (honest), B (honest), T (stolen by the thief).
• Guardians: G1, G2, G3.
• The thief rotates the key; A contests. Both replacement keys draw zero guardian vouches.

Trace

1. Tie at zero vouches. Both A and T are revoked. Only B remains, and unfreezing needs 2.
2. Floor holds (rule 1). With 1 left, below the floor of 2, the key stays frozen. Revoking A and T does not hand the key back to the old set, so the thief has nothing to restart.
3. Replenishment (rule 1). Seat candidates C and T' (the thief's new identity) apply.

• G2 vouches for C, so C is seated.
• T' gets no vouch and is refused. The floor never seats anyone with zero vouches.

1. Unfreeze. B and C sign, and the key is released to the vouched replacement key.
2. Renewal (rule 2). Suppose G1 vouched for the key that was revoked. Then C's seat lapses unless G2 or G3 renews C's vouch. If one guardian was coerced, the thief still can't keep a seat alive alone.

What the thief can still do

• Coerce two distinct guardians. That costs two compromises, compared with zero before rule 1.
• Stall. While the set is below the floor, the key stays frozen, so the thief can deny service but cannot spend.

Open question

Should a seat that lapses under rule 2 reopen replenishment immediately, or wait a cooldown? Without a cooldown, a thief holding one guardian can churn seats.

Lapsed-seat cooldown

Follows cosigner-floor-replenishment.md, which ended asking whether a seat that lapses under rule 2 should wait out a cooldown before it can be refilled.

The cycling attack

Rule 1 refills a drained co-signer set only with guardian-vouched newcomers. Rule 2 makes such a seat lapse unless a *different* guardian renews the vouch. A thief who coerces one guardian can still:

1. get a fresh identity vouched into the open seat,
2. let it lapse when no second guardian renews,
3. coerce the same guardian again for another fresh identity, and repeat.

Each round the key stays frozen (good), but the honest holder cannot finish an unfreeze either, because the seat is always occupied by a thief-placed holder that is waiting for a renewal that will never come.

Proposal: per-guardian cooldown, not per-seat

A cooldown on the *seat* also slows the honest refill. A cooldown on the *guardian* whose vouch let a lapsed seat in targets the attack directly:

• When a seat lapses, the guardian who vouched it in may not vouch another refill for that key until the cooldown ends.
• Any other guardian may vouch a refill immediately.

The thief now needs a newly coerced guardian for every round, so the cost of stalling grows with each lapse instead of staying flat.

Traversal

• Honest holder, two cooperative guardians: refill and renewal happen in the same window; no seat lapses; the cooldown never fires.
• Thief with one coerced guardian: one stalled round, then that guardian is benched and an honest guardian's vouch fills the seat.
• Thief with two coerced guardians: rule 2 is already beaten; the cooldown does not help. This is the residual risk and sets the guardian count floor.

Open question

How long should the bench last? Too short and a single coerced guardian keeps cycling; too long and an honest guardian who vouched in good faith for a holder who simply went offline is shut out when the key needs them most.