The Error Correction Revolution: Why qLDPC Codes, Magic State Cultivation, and Algorithmic Fault Tolerance Are Rewriting the Quantum Timeline

This article is part of my Quantum Utility Map Deep Dive series. It examines the three error correction advances that are compressing the physical-to-logical qubit ratio faster than any hardware roadmap anticipated. It also covers what that means for the timelines established in The Quantum Utility Ladder.

The tax that determines everything

Every fault-tolerant quantum computation pays a tax. Each logical qubit, the error-protected unit that actually stores and processes quantum information, is constructed from hundreds or thousands of physical qubits running continuous error detection cycles. Clifford gates are cheap inside most codes. The non-Clifford gates that make a computation universal are not: they are usually supplied by magic states, a kind of special resource state that takes dedicated physical qubits to manufacture. Distillation is the standard route and not the only one, and the code determines which alternatives exist. Each error correction cycle takes time, extending the runtime of every computation proportionally.

This tax is the single most important number in quantum computing. It determines how many physical qubits you need to build a useful machine and how long each computation takes. From those two figures you can read off which applications from the Quantum Utility Ladder become reachable on which hardware timelines. For years, the standard assumption was that surface codes would impose a physical-to-logical ratio of roughly 1,000:1, meaning a useful 2,000-logical-qubit machine would require 2 million physical qubits. At typical manufacturing rates and qubit densities, that placed useful fault-tolerant quantum computing in the late 2030s or beyond.

Three developments published between 2024 and 2025 are compressing that tax by an order of magnitude or more. Each addresses a different component of the overhead. Together, they interact multiplicatively, and their combined effect is to pull the timeline for useful fault-tolerant quantum computing forward by years. A fourth wave arrived through 2026, and it changed the character of the evidence more than the size of the numbers: the field moved from proofs and simulations toward hardware, benchmarks, and definitions. I cover that in its own section below.

Breakthrough 1: qLDPC codes and the end of surface code dominance

For more than a decade, the surface code has been the assumed error correction code for fault-tolerant quantum computing. Its appeal is practical: it works on a 2D grid of qubits with only nearest-neighbor connections, matching the physical layout of superconducting processors. Its weakness is efficiency. The surface code encodes exactly one logical qubit per code block, requiring d² physical data qubits for code distance d. At the distances needed for useful computation (d = 15–25), that translates to 225–625 physical data qubits per logical qubit, before accounting for ancillas and routing space. The total overhead, including magic state factories and routing, typically reaches 1,000 physical qubits per logical qubit or more.

Quantum low-density parity-check (qLDPC) codes change this calculation. Instead of encoding one logical qubit per code block, qLDPC codes encode many logical qubits in a single block, achieving encoding rates that the surface code cannot match.

IBM’s bivariate bicycle code [[144,12,12]] demonstrated the concept concretely: it encodes 12 logical qubits in a block of 288 physical qubits, 144 for data and 144 for checks, or 24 per logical qubit in the memory experiment. The honest comparison is the surface-code memory experiment in the same paper, which used nearly 3,000 physical qubits for the same 12 logical memories. That is a roughly tenfold reduction, measured on memory in circuit-level numerical simulation, not in a hardware experiment. The 200-to-1,000:1 surface-code figure this article used to compare against is a full-architecture overhead, including factories and routing, and does not compare with a memory-only number.

Memory is also where this result stops. Encoding twelve logical qubits in a block says nothing yet about computing with them: universal gates, lattice surgery between blocks, routing, and magic state factories all have to fit the same connectivity, and the rate does not automatically carry over. The 2026 results below are mostly attempts to close exactly that gap.

The Pinnacle Architecture, posted in February 2026 by Webster, Berent, and colleagues at Iceberg Quantum, pushed this further. Using generalized bicycle codes with efficient measurement gadgets, they estimated that RSA-2048 can be factored with fewer than 100,000 physical qubits under standard hardware assumptions (physical error rate 10⁻³, code cycle time 1 μs). The previous best surface code estimate required close to one million. For the Fermi-Hubbard model at lattice size L=16, the paper’s May revision puts the Pinnacle Architecture at 58,000 physical qubits at p=10⁻³, against 940,000 in the surface-code estimate it cites. An order-of-magnitude reduction in both cases.

Every physical-qubit figure here, Pinnacle’s included, counts qubits that work. A team led from the University of Sydney measured what happens when they do not. On ibm_miami, the first of IBM’s 120-qubit Nighthawk processors, the median two-qubit gate error in June 2026 was 2.83×10⁻³ while the worst couplers ran at 1.69×10⁻¹, about sixty times higher, and the team could not place a standard distance-5 rotated surface code anywhere on the chip without using a component they had already flagged as defective. Excluding the defective components recovered up to a factor of 2.8 in logical error rate. Every estimate above was calculated with one error rate for every qubit and coupler. qLDPC codes are more exposed to that assumption than the surface code, because a high-rate block has fewer places to route around a dead coupler.

The practical constraints are real. qLDPC codes require connectivity beyond nearest-neighbor interactions in a 2D plane. The bivariate bicycle codes need connections across a torus-like topology. The Pinnacle Architecture requires bounded-distance connections within processing blocks. Current superconducting processors do not natively support these topologies, though modular approaches with inter-module connections could provide the required connectivity. Trapped-ion platforms may be better positioned to exploit qLDPC codes in the near term, and IonQ’s Walking Cat Architecture is a complete fault-tolerant blueprint built on this premise: 110 logical qubits encoded in 2,514 physical qubits using qLDPC codes on trapped ions, with their photonic interconnect demonstration providing the inter-module connectivity the architecture requires. Neutral-atom platforms, with their ability to rearrange qubits dynamically, offer a similar structural advantage.

Despite these engineering challenges, the direction of the architecture work is clear: high-rate codes are now taken seriously as a route to lower physical-qubit requirements, and the surface code’s two decades as the default assumption are ending. That is my reading of the trend, but the outcome is not settled. The surface code itself satisfies the sparse-check definition of qLDPC. It differs from the codes above in rate: one logical qubit per block, where a high-rate code encodes many.

The compression race is accelerating across multiple platforms, mostly on paper. QuEra has published ultra-high-rate qLDPC codes with data-qubit encoding rates above one half, studied under a circuit-level noise model and aimed at neutral atoms; it is the most aggressive encoding rate reported to date and it is not a machine. The rate also counts data qubits, so it excludes the checking, routing and factory resources a processor needs. For applications where moderate error suppression suffices, a rate above one half would mean fewer than two data qubits per logical qubit. For applications requiring very low logical error rates, the practical encoding rate will be less extreme. The trajectory is real, but the ratios above are drawn at different accounting boundaries. The 1,000:1 figure is a full-architecture surface-code overhead. The 24:1 and QuEra figures are data-qubit or memory accountings, and IonQ’s is an architecture proposal. Compared on their own terms each is a step down, and the steps do not compose into a single curve. qLDPC codes have also been studied for two decades; what accelerated in the last two years is the practical high-rate architecture work.

Breakthrough 2: Magic state cultivation

Every universal fault-tolerant quantum computation needs a non-Clifford gate such as the T gate or the Toffoli gate. These non-Clifford operations cannot be implemented transversally in most error correction codes. Instead, they consume magic states: special resource states prepared at high fidelity, conventionally by distillation.

Conventional distillation uses dedicated “factory” regions of the quantum processor: large blocks of physical qubits that continuously produce magic states through multi-round distillation protocols. How much of the physical qubit budget these factories take depends on how fast an algorithm consumes magic states and how clean they must be. In the 2019 Gidney-Ekerå RSA factoring estimate (20 million physical qubits), about a quarter of the qubits were used for distillation.

Magic state cultivation, developed by Gidney, Shutty, and Jones (2024), takes a different approach. Cultivation fits inside a surface-code patch and grows one T state at a time: the state is injected into a small color code, checked repeatedly as the color code grows, and then grafted into the surrounding surface-code patch. At a uniform circuit noise of 10⁻³, the paper reaches logical error rates as low as 2×10⁻⁹ with roughly as many physical gates as a lattice-surgery CNOT of the same reliability, and the authors suggest that further distillation may never be needed in practice.

The impact on Gidney’s 2025 RSA factoring estimate is concrete. Cultivation lets that paper allocate less space to magic state distillation, one of the changes behind its drop from the 2019 estimate’s 20 million physical qubits to under 1 million.

For chemistry applications, the implications are equally direct. Every entry on the Utility Ladder that quotes T-gate or Toffoli counts implicitly depends on the overhead of producing those gates. If cultivation halves the factory footprint, every application on the ladder becomes reachable with fewer physical qubits.

Breakthrough 3: Algorithmic fault tolerance

Standard fault-tolerant protocols perform d rounds of error syndrome extraction per logical operation, where d is the code distance. If d = 25 (a typical value for serious computations), each logical gate requires 25 error correction cycles. This is a significant time overhead: it means that logical gate rates are roughly 25× slower than the underlying physical cycle time.

Algorithmic fault tolerance (AFT), published in Nature in September 2025 by Zhou et al. (QuEra, Harvard, Yale), demonstrates that this factor of d can be eliminated for a broad class of operations. By combining transversal gate execution with correlated decoding (where a joint decoder processes the pattern of all syndrome measurements across the computation rather than treating each round in isolation), AFT proves that each logical layer of an algorithm can be executed with a single round of error checking rather than d rounds.

The runtime reduction is a factor of d for the operations the theorem covers, which is often 20–30 in practical architectures. Mapped onto reconfigurable neutral-atom hardware, the paper reports 10–100× reductions in execution time for logical algorithms. The theorem has conditions on codes, gates, state preparation and decoding. Some operations already avoid a d-round latency, which means workloads do not all get the same distance-fold speedup from a constant-round result.

For applications on the Utility Ladder, the effect would flow through every runtime estimate, but only for the part of a workload the theorem covers. No chemistry compilation using it has been published. Where it applies, the binding constraint shifts from runtime back to qubit count, which is where qLDPC codes and magic state cultivation provide relief.

AFT has been demonstrated in simulations and formally proven for a broad class of codes that includes the surface code and the color code, but it has not yet been implemented on physical hardware. The correlated decoder required for AFT must process syndrome data from the entire computation jointly, which places demands on classical processing speed. The QuEra team’s companion paper applied AFT to Shor’s algorithm on a reconfigurable neutral-atom architecture and found the expected order-of-magnitude improvements, but physical demonstrations remain ahead.

How the three interact

The three breakthroughs compress different dimensions of the overhead, and their effects multiply.

qLDPC codes reduce the number of physical qubits per logical qubit. In a surface code architecture the overhead is ~1,000 physical qubits per logical qubit; in a qLDPC architecture it can be 50–100. Compression factor: 10–20×.

Magic state cultivation reduces the physical qubit budget allocated to magic state production. It shrinks distillation or, for algorithms that can use cultivated states directly, removes it. Compression factor: roughly an order of magnitude fewer qubit-rounds per T state than prior work, at the error rates Gidney, Shutty and Jones report. How much of an algorithm’s total footprint that removes depends on how much of it the factories took.

Algorithmic fault tolerance reduces the time overhead per logical gate from d rounds to 1 round, for the operations the theorem covers. Compression factor: 20–30× in runtime for those operations.

These three advances are not all used in the same architecture, but they represent parallel breakthroughs attacking the same problem from different angles. They also do not stay in their lanes. The current revision of the Pinnacle Architecture reaches its sub-100,000 physical qubit footprint for RSA-2048 with qLDPC codes and its own Magic Engines. For most parameter settings, with a stated exception, the Magic Engines use fold-transversal cultivation. Gidney’s 2025 RSA estimate uses surface codes with cultivation and puts the count under 1 million physical qubits, down from 20 million. Gidney and Ekerå’s 2019 estimate called for 20 million physical qubits and the 2026 Pinnacle estimate for under 100,000, a drop of more than 200-fold. The two estimates use different architectures, codes and assumptions, so the ratio measures the field’s direction, not one machine getting better. The physical qubits themselves have not gotten dramatically better in this period. The way we use them has.

What this means for the Utility Ladder

The practical consequence: applications that appeared to require hardware projected for the late 2030s may become accessible in the early 2030s or even the late 2020s.

Consider battery degradation spectra at roughly 414 logical qubits. Under surface code assumptions at 1,000:1 overhead, this requires about 414,000 physical qubits. Under qLDPC assumptions at 50–100:1, it requires roughly 21,000–41,000 physical qubits. That is within range of hardware that IBM, Google, and Quantinuum project for 2028–2030 on qubit count; the 2×10¹⁰ Toffolis each shot needs is the harder constraint.

Consider FeMoco simulation at 2,142 logical qubits. Under surface code assumptions, this requires over 2 million physical qubits. Under qLDPC assumptions, it requires 100,000–200,000 physical qubits. That is the same order of magnitude as the machine the Pinnacle Architecture paper sizes for RSA-2048, under 100,000 physical qubits.

The runtime compression from AFT would shift these calculations further, and I am not going to put a number on it. Dividing a published FeMoco runtime by a code distance does not produce a compiled AFT estimate. Memory compression, factory spacetime volume, syndrome rounds and wall-clock time are different quantities, and only the affected part of a workload improves. No compilation combining qLDPC codes, cultivation and AFT for a chemistry target has been published.

For cryptanalysis, the implications are equally direct. The CRQC Quantum Capability Framework tracks ten dimensions that a cryptographically relevant quantum computer requires. Three of those dimensions (quantum error correction, magic state production, and decoder performance) are directly advanced by these three breakthroughs. The Q-Day timeline needs to be reassessed in light of these developments, and the urgency of PQC migration increases accordingly.

What 2026 added

The 2024 and 2025 results above are proofs, simulations, and architecture papers. Most of the 2026 results are hardware. Two are documents for comparing claims: a stricter definition of the logical qubit and a common benchmark for machines on different platforms.

Two more compression results, both simulated

Mitten codes, posted in July 2026 by a Caltech and Oratomic team, build qLDPC codes from non-abelian group algebras and reach a 20% encoding rate at check weight 9, with a family running from [[150,30,10]] through [[540,108,18]] to [[975,195,≤24]]. In simulation at a 0.4% physical error rate, the 975-qubit block outperformed 195 distance-24 rotated surface-code patches, which would need 112,320 data qubits. The paper also reports two logical failures across 15 billion simulated lattice-surgery operations on the [[540,108,18]] code at 0.1%. The comparison counts data-qubit blocks on both sides and uses different decoders for each, so it compares codes, not processors. The paper’s main contribution, in my reading, is the fault-tolerant processor design the authors built on these codes. With it, they address the gap I described under Breakthrough 1, between storing logical qubits in a high-rate block and computing with them.

Google’s boundary-connected planar modules, posted in October 2026 by fourteen researchers across Google Quantum AI, DeepMind, and MIT, take the opposite approach: build high-rate memories out of small flat chip modules wired together at their edges, so the long-range connectivity qLDPC codes need is supplied by the wiring between modules instead of by the chip. In circuit-level simulation, a memory built this way needed ten times fewer physical qubits per logical qubit than the paper’s own modularized surface-code baseline, with 42-qubit modules and inter-module links allowed to be as bad as 1%. Oscar Higgott and Hasan Sayginel are the corresponding authors; Craig Gidney, who wrote Google’s 2025 RSA estimate, and Hartmut Neven, who founded Quantum AI, are among the co-authors. It has not been peer reviewed, and the paper itself separates what was simulated from what was projected and from what was designed without being simulated.

Hardware, and what the hardware actually showed

Three 2026 reports put encoded qubits on real machines, and the detail that matters in each case is what the code was doing.

Quantinuum validated its Helix architecture on Helios, its 98-qubit trapped-ion processor. The code is the [[20,2,6]] $$C_4$$-Helix, a concatenated symplectic double code pairing a [[10,2,3]] twisted toric code with a [[4,2,2]] block, designed so that certain logical transformations reduce to physical single-qubit gates and permutations of ion roles. The parallel error-checking schedule uses 32 ancilla alongside the 20 data qubits, for a block of 52 physical qubits encoding two logical ones. Three demonstrations: protected memory, logical Clifford operations, and entanglement between two different error-correcting codes. Each beat its unencoded physical baseline with every run counted, successful and unsuccessful, and no postselection. Decoding was offline.

Infleqtion announced 30 logical qubits entangled in 80 atoms on its Sqale neutral-atom machine, grouping the atoms into 10 blocks of eight, prepared in the distance-3 [[8,3,3]] code and then operated in the distance-2 [[8,3,2]] code. A distance-2 code detects errors; it cannot correct an arbitrary unknown single-qubit error, though it can correct a located erasure under the right conditions. The company’s own original 2026 target called for error-corrected logical qubits, and Harvard ran the same code and circuit type at 48 logical qubits in 2023. The entanglement result is real, but qubits in a code that only detects errors do not meet that target.

A group from the University of Southern California, Quantum Elements, and the Instituto de Física Teórica in Madrid ran the surface code below threshold on IBM Heron processors whose heavy-hex connectivity does not match the code, published in Nature Communications on July 29. Arian Vezvaee and Cesar Benito are equal first authors, with Alejandro Bermudez and Daniel Lidar supervising. They embedded the code on 156-qubit Heron chips using a depth-minimizing fold-unfold SWAP strategy with bridge ancillas, paired with robust dynamical decoupling to suppress coherent ZZ crosstalk during the routing delays. Subthreshold scaling appeared in one direction at a time, not both. That caveat is the whole engineering problem of mismatched connectivity in one sentence, and it applies with more force to qLDPC codes than to the surface code.

The classical half of the loop stopped being hypothetical

AFT’s joint decoder, like real-time decoders generally, has long been expected to need specialized hardware such as FPGAs or custom ASICs. During 2026 that hardware arrived as products. Altera and Riverlane validated QECi on Agilex FPGAs, and Qblox closed a real-time error-correction loop the day after. Several vendors now supply the classical loop as a product, which changes the procurement question from whether a decoder exists to which one.

The most interesting result is a simulation, and in it one laptop CPU does the decoding instead of dedicated hardware. IonQ showed that a single commercial CPU, an Apple M4 Max in a 2024 MacBook Pro, can keep up with the syndrome stream of a simulated fault-tolerant trapped-ion computer of up to 408 logical qubits, under that platform’s timing assumptions. No such machine exists to decode. The preprint by Min Ye, Andrii Maksymov, and Nicolas Delfosse was posted on 25 August and revised on 3 September, and has not been peer reviewed. The workloads are compiled for IonQ’s Walking Cat architecture, with memory blocks using a [[70,6,9]] code. A decoder that falls behind builds a backlog that slows the computation exponentially, so the usual assumption is that real-time decoding at scale needs a rack. If one laptop CPU covers 408 logical qubits for a qLDPC trapped-ion machine, the decoder is not the bottleneck anyone thought it was, for that architecture. Google also had its Willow processor learn its own calibration through reinforcement learning, which attacks a different part of the same classical overhead. At least half a dozen different things are now called decoders, and each claim above has to be checked for which one it means.

Two documents about what counts

Two of 2026’s most useful outputs produced no qubits at all.

Matthias Troyer and Chetan Nayak of Microsoft Quantum and John Martinis of Qolab proposed a stricter term, the scalable logical qubit, for the encoded qubits a real algorithm needs. It is their proposal and not an adopted standard, which is why the criteria matter more than the label. Under their definition, a scalable logical qubit is sustained through a computation by repeated error correction and supports a universal set of fault-tolerant logical operations. Its errors must also be decoded in real time, fast enough for the program to branch on a measurement result. Microsoft’s own headline logical-qubit results fail that definition, as does the Infleqtion result above, and the Quantinuum demonstration fails the real-time criterion because its decoding was offline. The Department of Energy’s $215 million competition defines a logical qubit loosely and leaves the test to negotiation.

Sandia led a 30-author collaboration, with Timothy Proctor as first author and Robin Blume-Kohout as senior author, that proposed QUOPS, for quantum universal operation performance system, as a unit: how many quantum operations a device can execute with the error behavior of the whole machine accounted for, reported alongside the rate. Google’s Willow scored 216 QUOPS at 2.0×10⁷ per second. IBM’s ibm_boston scored 204 at 3.1×10⁵ per second. Quantinuum’s H2-1 scored 1,320 at 353 per second and Helios-1 scored 1,504 at 303 per second, rising to 1,824 at 247 per second once leakage-detected shots were discarded. It also assessed a fault-tolerant processor using up to eight [[7,1,3]]-encoded logical qubits on Helios-1, as a separate measurement, and that encoded architecture scored 40.

Those are physical-computation scores, so a score in the hundreds or thousands says nothing about whether a machine can run the millions or billions of reliable logical operations the Utility Ladder asks for. The paper’s abstract puts that gap at five orders of magnitude of capability still to be found. The advances described above reduce that gap, and no machine has yet closed it.

What CTOs and quantum strategists should monitor

Each of the three advances has active research programs pushing further, and the pace of publication in error correction has accelerated sharply since 2024. Here is what to watch.

In qLDPC codes, the key metric is demonstrated logical error rates on real hardware. IBM plans to demonstrate qLDPC error correction on its Kookaburra processor in 2026 and on Cockatoo in 2027. Quantinuum and neutral-atom platforms may demonstrate alternative qLDPC implementations earlier. The gap between theoretical encoding rates and demonstrated error suppression on physical hardware is the critical unknown. Through 2026 that gap narrowed on compact concatenated codes and barely moved on the high-rate blocks: Infleqtion and NVIDIA built a qLDPC compiler pipeline whose code has not yet run on hardware, and the two best compression results of the year are both simulations.

Ask every logical-qubit announcement the four questions from the Microsoft and Qolab definition. Is error correction running repeatedly during the computation, or was the state prepared and measured? Are the logical operations universal, or Clifford only? Is decoding real time, or offline? And is the result a code distance that suppresses errors, or a distance-2 code that only detects them? Those four questions sort almost every 2026 announcement correctly, and most announcements fail at least one.

In magic state production, the demonstration I said to watch for has already happened, and on the platform I said was least likely. Emma Rosenfeld and colleagues reported magic state cultivation on a superconducting processor in December 2025, reaching a magic state fidelity of 0.9999(1), a fortyfold error reduction, with code-switching into a surface code and a fault-tolerant measurement protocol to bound the fidelity. About 8% of attempts were retained. The open questions are now the retention rate and the throughput a factory needs. A third is whether the same protocol works inside a running algorithm as well as in a dedicated experiment. The 2024 Gidney, Shutty and Jones protocol cultivates through color-code stages before transitioning into surface-code protection; fold-transversal surface-code cultivation, which the Pinnacle Architecture uses, is a separate line of work.

In algorithmic fault tolerance, the critical milestone is a physical demonstration of correlated decoding at code distances sufficient for meaningful error suppression. The decoder speed requirement (processing syndrome data from the entire computation jointly, in real time) is a classical computing challenge; the 2026 FPGA and CPU decoders above are a start, and none has yet run AFT’s joint decoding at scale.

Beyond these three specific advances, the broader trend to monitor is the convergence of error correction techniques. The most powerful architectures will combine qLDPC codes, cultivation, and AFT in a single system. The Pinnacle Architecture already incorporates qLDPC codes and cultivation. AFT-style correlated decoding would add its time saving on top; it shortens runtimes and does not reduce qubit counts. On qubit count alone, IonQ’s Walking Cat proposal puts 110 logical qubits on 2,514 physical ones, about 23 per logical qubit.

A machine of that size is within range of hardware that already exists today in terms of raw qubit count, though not yet in terms of error rates or connectivity. Hardware is scaling up while the error correction tax is compressing down. Where those two curves meet is where fault-tolerant quantum computing begins in practice.

The acceleration is real, but so are the caveats

I want to close with appropriate calibration. The error correction advances described here are genuine and technically sound, though several of them, including most of the 2026 results, are still preprints. Their combined effect on resource estimates is dramatic and well-documented. The trend in physical-to-logical overhead is moving firmly in the right direction.

But three important caveats apply.

First, none of these advances have been demonstrated at scale on physical hardware. The gap between theoretical proof and engineering implementation is real, and the history of quantum computing is full of ideas that worked beautifully in theory but required years of engineering to translate into practice.

Second, the qLDPC and AFT advances place new demands on hardware that current platforms do not fully meet. Non-local connectivity for qLDPC codes, high-fidelity mid-circuit measurement for cultivation, and fast classical decoders for AFT are all engineering challenges that must be solved. Solving them will take time and investment.

Third, resource estimates are moving targets. The same algorithmic creativity that produced these three breakthroughs will continue to improve them, but it could also reveal new obstacles or tighter lower bounds. Caution about projecting current trends indefinitely is warranted.

With those caveats registered, the direction is unmistakable. The error correction tax that has been the primary barrier to useful fault-tolerant quantum computing is being reduced faster than hardware is scaling up. For anyone planning quantum strategy on timelines longer than five years, these advances matter more than any hardware announcement.

For how these advances affect specific applications, see The Quantum Utility Ladder. For the competitive implications by industry, see Quantum Computing by 2033. For the implications for cryptanalysis timelines, see the CRQC Quantum Capability Framework and Q-Day predictions.

From the author