When is Q-Day coming, according to what can be measured today? (Rosetta’s pre-registered bet)

As of October 9, 2026, zero RSA-2048 keys have been broken by any quantum computer; the largest error-corrected logical register on public record holds 48 logical qubits (Quantinuum Helios, Quantum Computing Report, November 5, 2025); and the best published requirement estimate for breaking RSA-2048 is a machine with under one million noisy qubits running for under a week (Gidney, arXiv:2505.15917, May 2025) — about 128× today’s logical record, measured against the ≈6,144 logical qubits of the 2019 baseline estimate. Rosetta Quantum turns that gap into a position it can be scored on: no verified RSA-2048 break before January 1, 2031; a central window of 2033–2039; a late bound at the end of 2040 — sealed today under hash 9b7113dcb85bb478… and re-scored every six months, whichever way the record moves.

Status as of: October 9, 2026. Every number in this post carries its source and date beside it. The bet itself is frozen in seal RQ-PRED-QDAY-001 (sha256 9b7113dcb85bb478…), committed at 2026-10-09T12:29:52Z, before publication. Nine earlier Rosetta Quantum posts are cross-linked below and not re-litigated here.

What is Q-Day, and what counts as «arrived»?

Q-Day, as this bet scores it, is the first public, independently verifiable factorization of an RSA modulus of 2048 bits or more in which a quantum computer performs the order-finding step of the attack. The verification test is deliberately boring: the published factors must multiply back to the modulus — anyone can check that on a laptop — and the quantum role must be documented in enough detail for independent audit. Two scope rules are part of the definition, declared up front. First, the clock reads the public record only: a classified break would not be announced, so no public bet can score it — that limitation is stated here rather than discovered later. Second, the yardstick is RSA-2048, not elliptic curves: ECC resource estimates differ (we mapped them in our Bitcoin post), and a first break on ECC would be noted in a review but would not score this bet. Why a bet at all? Because «when is Q-Day» is one of the most asked questions in this field and almost every published answer is either a vendor roadmap or an undated opinion. Rosetta Quantum’s position is that a date claim is only worth reading if its author can be caught being wrong — the same rule our own detector was held to in our prospective-validation post.

What can be measured today?

Nine numbers, each with a source and a date — they are the entire evidentiary basis of the bet, so they are printed before the bet is.

Two of those rows are worth re-reading. The Shor hardware record is 21 — a two-digit number, factored on machines a reader can rent by the shot — and larger claimed factoring records use hybrid or annealing shortcuts whose own authors wrote «the quantum speedup is unknown, it is still a long way to break RSA quantumly» (the 48-bit SQIF claim, quoted in the PostQuantum review above). And the expert prior is an opinion poll of 26 people, which this post treats as a prior, not a measurement: it enters the derivation of the window below and nowhere else. The two regulatory dates on the dashboard are migration clocks, not break forecasts: NIST IR 8547 (initial public draft, 2024-11-12) schedules RSA-2048-class cryptography for deprecation after 2030 and disallowance after 2035 — the clock we mapped in our RSA post — and the UK NCSC’s 2028/2031/2035 migration milestones are mapped, with the other agency postures, in our QKD post. Regulators schedule migrations earlier than anyone forecasts breaks, by design.

What does the requirement curve say?

That the finish line moves — toward the hardware. In 2019, Gidney and Ekerå estimated that «2048 bit RSA integers could be factored in eight hours by a quantum computer with 20 million noisy qubits». In May 2025, Gidney alone cut that to «less than a week» on «less than a million noisy qubits» — a 20× reduction in qubits in six years, with the hardware assumptions held fixed: «a uniform gate error rate of 0.1%», «a surface code cycle time of 1 microsecond». Nothing got built to cause that drop; the entire cut came from algorithms and error-correction bookkeeping, including a Toffoli-count reduction «over 100x compared to Chevignard+Fouque+Schrottenloher 2024». That is the single most important measured fact about Q-Day: the requirement is not a wall, it is a curve, and it has been falling at a measured rate while the hardware record climbs at a measured rate. Both rates are on the ladder below — and so is the gap, which remains enormous: the largest error-corrected register ever operated holds 48 logical qubits against the ≈6,144 logical of the 2019 estimate, and the largest declared machine of this decade, IBM Starling (200 logical qubits, declared for 2029), would still be ≈31× short of that figure — our arithmetic, declared, on the sourced numbers above.

What exactly is Rosetta’s bet?

Three clauses, one seal, and a scoring rule for every outcome — including the ones where Rosetta Quantum loses. The floor is the strong claim: no verified RSA-2048 break will occur before January 1, 2031. The central window is the calibration claim: the first qualifying break will fall between 2033 and 2039 inclusive. The late bound closes the loop: if nothing has happened by December 31, 2040, the window will be scored as missed — and published as missed. Every six months, under this same URL, the checkpoint metrics in the table above will be re-measured and printed whichever way they move; the lesson of our negative-calibration post applies to ourselves first: a forecast whose author never specifies what would refute it licenses nothing.

How were the floor and the window derived?

By declared judgment anchored on the measured rows above — a derivation is not a measurement, and this section exists so the difference stays visible. The floor comes from the roadmaps: the earliest declared machine with a triple-digit logical-qubit count is IBM Starling, built by 2028 and available in 2029 per IBM’s own statements (The Next Platform, 2025-11-12), and 200 logical qubits is ≈31× short of the 2019 requirement. For a verified break to land before 2031, either an undisclosed machine or an algorithmic collapse of the requirement far beyond the measured 20× step would have to exist — possible, which is exactly why the floor is phrased to be refutable rather than safe. The window opens in 2033 because that is when the first declared machine enters the requirement’s neighborhood: IBM Blue Jay, ≈2,000 logical qubits and one billion operations, «expected to be introduced after 2033» (Stocktwits summary of IBM’s roadmap, updated 2026-03-05) — still ≈3× short of the 2019 logical figure, but inside the range that one more algorithmic cut of the already-measured size could close. The window closes in 2039 so that it ends before the expert prior’s own 15-year mark: the GRI panel puts «likely (51-70%)» at 2041, so if those 26 experts are right, our window will prove slightly aggressive — a choice Rosetta Quantum prefers to make visible rather than hide inside a rounder number. The format — freeze, hash, declare the refutation condition, publish the score whichever way it falls — is the same one our own molecular engine is held to weekly in the prospective scoreboard.

What does the bet not depend on?

Four things, each a common confusion. It does not depend on classical supercomputers getting faster: RSA-2048’s classical margin is a separate race, and the quantum requirement curve in our RSA post moves independently of it. It does not depend on Microsoft’s topological program: that roadmap declares utility-scale machines on its own schedule while the public record showed 0 demonstrated topological qubits at our last reading (our Majorana post) — if it lands early, the floor is refutable and will say so. It does not depend on vendor «quantum advantage» milestones: IBM declares advantage «by the close of 2026» (The Next Platform, 2025-11-12), but advantage claims are about beating classical baselines on chosen workloads, not about cryptanalysis — the cryptanalysis row of our usage map stood at 0 keys broken on October 6 and stands at 0 today. And it does not depend on the energy debate: published estimates of a code-breaking run’s power draw disagree by ≈18× (125 MW vs ≈7 MW, both sourced in our energy post) — that is a cost question, not a feasibility gate.

What would move the dates?

In the early direction: another algorithmic cut — the 20× qubit reduction of 2019→2025 is the measured precedent, and a step of that size against the 2025 estimate would strain the floor, which is what the floor is for. Cheaper error correction — qLDPC-style codes are the declared mechanism of IBM’s roadmap, and the supporting classical decode has been demonstrated «in under 480 nanoseconds», delivered a year ahead of schedule (The Next Platform, 2025-11-12). And error-rate records — Gidney’s machine assumes 0.1% uniform gate error, a figure Helios already beats (99.921% fidelity = 0.079% error) on 98 qubits; the entire open question is that number at a million-qubit scale, where no public device has shown it. In the late direction: slippage. Every date in the right-hand column of the dashboard above is a promise in the future tense, and the record of this industry’s dates is mixed — the six-month reviews will print the slips with the same font as the hits.

What we don’t know

We don’t know what classified programs hold: a state actor that broke RSA-2048 would likely not announce it, so this bet scores the public record only — that is a declared limitation of the definition, not a discovery. We don’t know whether the expert prior is calibrated: 26 experts is a structured opinion poll, and this post uses it only to place the window’s far edge. We don’t know the 2025 estimate’s logical-qubit count: Gidney’s abstract prints physical qubits and runtime, so our 128× ratio is computed against the 2019 baseline’s ≈6,144 logical — the true current ratio may differ. We don’t know whether the fidelity and QEC records above generalize: the Nature error-correction results relied partly on post-selection, and their authors say scalable alternatives exist but «are not yet demonstrated» (The Quantum Insider, 2026-06-13). And we don’t know what we haven’t priced: a first break on ECC rather than RSA, a dequantization-style surprise in either direction, or a geopolitical disclosure — any of which would be noted, dated and scored at the next review. The bet is not a claim to foresight; it is a claim that Rosetta Quantum is willing to be graded.

Sources

• Gidney — How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917 (2025-05-21)
• Gidney & Ekerå — How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits, arXiv:1905.09749
• Global Risk Institute — Quantum Threat Timeline Report 2025 (26 experts; 2026-03-09)
• Quantum Computing Report — Quantinuum launches Helios: 98 physical, 48 error-corrected logical qubits, 99.921% (2025-11-05)
• The Quantum Insider — Microsoft and Quantinuum report 11×–800× QEC gains, Nature study (2026-06-13)
• The Next Platform — IBM Nighthawk and Loon QPUs; advantage by close of 2026; Starling built by 2028 (2025-11-12)
• Stocktwits — IBM Starling 2029 (200 logical qubits, 100M ops) and Blue Jay after 2033 (2,000 logical, 1B ops) (upd. 2026-03-05)
• NIST IR 8547 (initial public draft) — Transition to Post-Quantum Cryptography Standards (2024-11-12)
• PostQuantum — quantum factoring records: Shor at 21/35; the 48-bit SQIF claim and its caveat (mod. 2025-09-04)
• Willsch et al. — The State of Factoring on Quantum Computers, arXiv:2410.14397 (v2, 2025-05-16)
• Seal RQ-PRED-QDAY-001 — sha256 9b7113dcb85bb478deadcf37281178397de5f2943c9805e61eb15d977817f3fc, committed 2026-10-09T12:29:52Z (project archive)
• Rosetta Quantum — How many qubits does it take to break RSA-2048?
• Rosetta Quantum — Can a quantum computer break Bitcoin?
• Rosetta Quantum — What is a logical qubit?
• Rosetta Quantum — What is QKD and does your company need it?
• Rosetta Quantum — Topological qubits and Majorana: where does Microsoft really stand?
• Rosetta Quantum — How much energy does a quantum computer use?
• Rosetta Quantum — What does it mean to validate a model with data that did not exist?
• Rosetta Quantum — When does a model’s «no» not mean «stop looking there»?
• Rosetta Quantum — What is quantum computing used for today?

Rosetta Quantum publishes verdicts with raw, reproducible data. This is educational content, not a product claim.