Fault-Tolerant Quantum Computer Technical Plan

A twelve-year program to build a machine that finishes a useful computation.

How to check this document instead of trusting it

Every number in this plan is tagged. [SRC] is a cited public source. [EST] is arithmetic performed here on top of cited inputs, with the derivation shown. [ASM] is a design assumption we chose, not something measured.

The arithmetic is machine-checkable. Two scripts re-derive the numeric claims from their cited inputs:

verify/part-a-arithmetic-check.py     108 assertions, 0 failing
verify/part-b-arithmetic-check.py      28 assertions, 0 failing
assembly/assemble.py                   rebuilds this document and re-checks its integrity

Each was written by the author of the other part where possible. Part B's checker in particular recomputes from Codex's sources rather than reading his stated results, which is the only way a check means anything.

Run them:

python verify/part-a-arithmetic-check.py
python verify/part-b-arithmetic-check.py

Executive summary

What we are proposing to build

A fault-tolerant, gate-based, superconducting quantum computer of roughly 1.31 million physical qubits yielding on the order of 1,500 logical qubits, delivered in four phases over about twelve years, at a Phase 3 capital cost of $1.8B low, $2.6B base, $6.1B high, with programme capital of $2.2B to $6.5B and about $1.3B of operating cost. [EST]

That spread is not padding. It is driven almost entirely by one unresolved number in a cryogenic control-electronics power budget (see finding 2), and naming it is more useful than averaging it away.

The acceptance criterion is deliberately not a qubit count. It is a finished computation whose answer can be checked: an exactly verifiable fault-tolerant workflow first, then RSA-2048, then chemistry beyond classical reach. A result no classical computer can reproduce is a result nobody can check, so it proves the machine works only after the checkable ones have passed.

The three things worth knowing

1. The binding constraint is wiring, not qubits.

At today's practice of roughly 2.1 cryogenic signal paths per qubit, a million-qubit machine needs 2,520,000 coaxial paths [EST]. At the best available wiring density, 256 channels per cryostat side-loader [SRC], that is 9,844 side-loader ports. No cryostat geometry exists in which that is buildable. The same arithmetic in thermal terms: at the ~3 uW per qubit at 100 mK implied by commercial cryostat capacity [EST], the machine needs 3.6 W of cooling at 100 mK, which is 1,200 top-end dilution refrigerators, about $9 billion in refrigerators alone before a single qubit is fabricated.

The entire hardware plan is therefore organized around one requirement, CRY-1: get to 100 physical qubits per feedthrough and 0.05 uW per qubit, a 210x wiring and 60x thermal improvement, via multiplexing, then cryo-CMOS control at 4 K, then photonic links. If CRY-1 fails, the correct move is to switch modality to neutral atoms, not to build 200 refrigerators. That trigger is written down in advance in A2.4 so it cannot be rationalized away later.

2. This is a semiconductor and control-electronics program, not a physics program.

At Phase 3 scale the cost shape inverts against intuition [EST]:

Cryogenics is 30 to 50 percent of capital at small scale [SRC] and becomes a rounding error at scale. Any org chart or vendor strategy that treats this as a physics effort with an engineering department attached will fail on cost before it fails on physics.

3. Clock speed decides the architecture, and the argument is weaker than it looks.

Both reference workloads are depth-limited, so runtime scales linearly with the error-correction cycle time. Scaling from the published sub-week RSA-2048 figure at a 1 us cycle [SRC]: at 100 us the same run takes about 2 years, at 1 ms about 19 years [EST]. That table is why the plan selects superconducting qubits.

The modality scores are 385 against 380 out of 500, a tie inside the noise of any scoring exercise, and the document says so rather than dressing it up. Neutral atom is carried as a live fallback with a written trigger.

Three separate findings then undercut the argument, and all three came from the second author reviewing the first:

• **An earlier draft claimed a 676x neutral-atom overhead advantage. It is

withdrawn. It divided a low-distance qLDPC memory ratio by a distance-25 active surgery tile. The quantities are not commensurable, and the honest position is that neither modality's advantage has been converted into a like-for-like comparison** at equal workload and equal logical reliability.

• The RSA runtime claim is withdrawn. The source estimate assumes one square

nearest-neighbor grid [SRC]. This is a 20-cryostat machine joined by links, and it does not inherit that runtime. A distributed-overhead multiplier of only 1.41 consumes the entire margin to seven days, and nobody has measured it.

• The control loop may not close. Measured practice shows a **63 us average

final-decoder latency at distance 5** [SRC], 6x over the entire 10 us reaction budget the architecture depends on.

Those are risks H15 and H13, tied with the wiring wall for the highest exposure in the plan. None is resolved. The modality decision therefore rests on less quantitative ground than a 385-to-380 score implies.

What this plan does not claim

• No hardware was built or measured. This is a plan.
• The RSA-2048 runtime on this topology is unknown, bounded below by 4.96

days with no modelled upper bound (A3.4).



• The Phase 3 machine cannot do FeMoco. It is 3.05x too small for the

published full-stack estimate [EST]. The original draft claimed otherwise; that claim was false. A Phase 4 is defined and priced at $3.8B incremental, and deliberately not baselined.

• CRY-1 has no demonstration behind it. It is a requirement, not a result.
• The 4 K stage is not closed, and the 20 mK stage was never budgeted. The

two published cryo-CMOS per-channel figures differ by 13.75x and straddle buildability: 3.1 W per cryostat is engineerable, 43.3 W is not (A5.4).

• The cryostat count is a 65.5x extrapolation beyond the vendor's published

scale for the same hardware (A3.3).

• Seam equivalence is unmeasured, so no seam-spanning mission layout is

justified (A3.1).

• The 1e-15 logical error figure is extrapolated. Directly bounding it would

need 3e15 trials [EST], 95 years of continuous running at 1 us per trial.

• The cost model has no vendor anchor above small-system scale. Its only

quoted figures describe 5 to 20 qubit systems.

• Fab yield and decoder installed power are declared unknowns, not estimates,

because the second author declined to invent figures that do not yet exist.

What cross-verification changed

The two parts were written independently, then each author re-derived the other's numbers. This was not ceremony. It found:

• 4 cost errors in Part A, caught only by running the arithmetic. One fix

changed a headline conclusion (the 7 percent qubit-cost finding above).

• 1 arithmetic error in Part B (B2.1's weighted total was 440, recomputes to

415), corrected by its author; the decision it supports is unchanged.

• 4 interface conflicts between the parts, including Part A conflating three

error quantities that differ by eight orders of magnitude.

• 1 false scope claim: Gate 3 promised a workload the machine cannot run.
• 1 new top-tier risk (H13) that reordered the risk register.
• 2 invented numbers removed from Part A. Asked for a fab defect-tolerance

figure and a decoder power figure, Codex declined to supply either, on the grounds that neither exists yet. Both are now explicitly bounded unknowns with defined closure gates instead of confident-looking estimates.

• 1 wrong mental model corrected. Part A assumed a compiler could route

around a lost cryostat mid-job. It cannot: a logical state lives in specific physical qubits. Fixing this surfaced three hardware requirements neither part had captured, all currently unpriced.

Then the reverse pass, Codex's independent review of Part A, found 11 more (A10.1): a withdrawn runtime claim, a phase gate whose device was too small to run it, an uncosted cryogenic stage, an invalid headline comparison, a cryostat count 65.5x beyond vendor scale, a single-point cost estimate replaced by a $1.8B to $6.1B range, and 4 of the 5 highest-exposure risks in the register.

The arithmetic checker passed 73 of 73 throughout all of that, and now passes 108 of 108. It could not have caught any of those eleven, because each was a sound calculation resting on an unexamined premise. Checking the arithmetic and checking the premises are different jobs. This document needed both, and the second one required an author who had not written the thing being checked.

Reading guide

Part A: Physical Layer Technical Plan

Owner: Claude Code Status: corrected against Codex's Part B. Codex's independent review of Part A is outstanding; see A10 and A11.4 for what that leaves unverified. Companion part: part-b-logical-software.md (owner: Codex)

Evidence policy used throughout Part A: every hard number is tagged. [SRC] means taken from a cited public source. [EST] means an engineering estimate derived in this document from cited inputs, with the derivation shown. [ASM] means a design assumption chosen by us, not measured.

A1. Mission statement and target machine specification

A1.1 What we are building

A fault-tolerant, universal, gate-based quantum computer whose acceptance criterion is a completed application run, not a qubit count. The machine is specified by the two workloads it must finish, because qubit count alone is a vanity metric that has already been revised by a factor of 20 in a single paper.

Reference workload 1, cryptanalytic. Factor a 2048 bit RSA integer. Gidney 2025 shows this needs fewer than 1 million noisy physical qubits and under one week of runtime, assuming a square nearest-neighbor grid, uniform 0.1 percent gate error, a 1 microsecond surface code cycle, and a 10 microsecond control system reaction time. [SRC] This is a 20x qubit reduction from the same author's 2019 estimate of roughly 20 million qubits and 8 hours. [SRC]

Reference workload 2, scientific. Compute the ground state energy of the FeMo cofactor of nitrogenase to chemical accuracy. Published estimates have moved from roughly 111 logical qubits and about 1e14 T gates (Reiher et al. 2017), to 2142 logical qubits and 5.3e9 Toffoli gates (Lee et al. 2021, roughly four days on 4 million physical qubits), to 1972 logical data qubits and 1.4e13 T gates for FeMoco-76 via double factorization qubitization, to roughly 1137 logical qubits and 3.4e8 logical T gates with spectral amplification. [SRC]

A1.2 The one number that sets the whole architecture

Both reference workloads are dominated by circuit depth, not by width. That makes the quantum error correction cycle time the single most architecture-defining parameter in this plan.

Derivation [EST]. Gidney's sub-week RSA-2048 runtime assumes a 1 microsecond QEC cycle. Runtime scales linearly with cycle time for a depth-limited circuit. Therefore:

A machine that cannot finish the run inside a useful human timescale is not a machine, it is an experiment. This table is the reason the modality choice in A2 weights clock speed as heavily as it does, and it is the first thing Codex should attack if he disagrees.

A1.3 Target specification, Phase 3 machine

Codex: A1.3 is my side of the interface contract. Your B1 should either accept these or send back the values your code choice actually needs, and I will rework A4 through A6 against yours.

Post-cross-verification note. Codex's B1.2 came back with tighter and better justified values on four rows, and the table above has been corrected to his. The important one is that my original draft listed a single "logical error rate per logical operation of 1e-9," which conflated three different quantities: logical memory error per round, non-Clifford resource error, and cultivated T-state error. They differ by eight orders of magnitude and they land on completely different parts of the hardware. That was my error, it is fixed above, and A11.2 records it. My original 5e-3 readout figure was also too loose by 5x.

A2. Qubit modality trade study

A2.1 Candidates and their 2026 state of the art

Superconducting transmon. Google Willow, 105 qubits, December 2024: two below-threshold surface code memories, a distance-7 code and a distance-5 code with a real-time decoder, error suppression factor Lambda = 2.14 +/- 0.02 per distance-2 increase, 0.143 +/- 0.003 percent error per cycle on a 101-qubit distance-7 code, and 2.4 +/- 0.3 times beyond breakeven against its own best physical qubit. [SRC] IBM Nighthawk, 120 qubits, November 2025, and IBM Loon, an experimental processor integrating multi-layer on-chip routing, long-range c-couplers, and fast qubit reset as the testbed for its qLDPC scheme. [SRC] Materials: tantalum-on-silicon transmons at 1.68 ms coherence. [SRC]

Trapped ion. Quantinuum Helios, 98 barium ions in a QCCD architecture, all-pairs two-qubit gate fidelity 99.921 percent, 48 error-corrected logical qubits from 98 physical. [SRC] Roadmap: Sol 2027, Apollo 2029 to 2030 with thousands of physical qubits and hundreds of logical qubits. [SRC]

Neutral atom. Harvard and MIT ran a 3,000-atom array continuously for more than two hours by reloading up to 300,000 atoms per second, defeating the atom loss lifetime that used to cap run duration. [SRC] QuEra and collaborators: 96 active distance-4 logical qubits on 448 physical atoms (Nature, November 2025), and a 2:1 physical-to-logical ratio using ultra-high-rate qLDPC codes in April 2026. [SRC]

Photonic. Room temperature optics, natural networking, but probabilistic entangling gates and severe loss budgets. No below-threshold logical memory demonstration comparable to the three above.

Spin in silicon. Best long-run CMOS foundry compatibility story of any modality, but qubit counts remain two to three orders of magnitude behind and two-qubit fidelity is not yet in the 99.9 percent class at array scale.

A2.2 Decision matrix

Weights chosen from A1.2: clock speed and fidelity dominate because our acceptance criterion is a finished application run.

A2.3 Decision

Primary modality: superconducting transmon, tantalum-on-silicon, tunable coupler, modular multi-chip.

Named fallback: neutral atom.

The scores are 385 against 380. That is a tie inside the noise of any scoring exercise, and we should say so plainly rather than dress up a 1.3 percent margin as a clear win. The decision is therefore not "superconducting is better." It is:

1. Superconducting wins on the one axis that cannot be fixed later. Clock speed

is set by physics and readout, not by engineering effort. A 1 us cycle is demonstrated. Neutral atom cycle time is currently limited by mid-circuit measurement and atom rearrangement, and no credible path to 1 us exists today.

2. Neutral atom wins on the axis where superconducting is weakest: code

efficiency. The size of that win is not currently quantifiable, and an earlier draft of this section overstated it.

That draft divided the neutral-atom 2:1 physical-to-logical ratio [SRC] by the 1,352:1 of a distance-25 active surface-code tile and called the result a 676x overhead advantage. Codex's cross-review rejected that comparison and he is right. The two ratios are not commensurable: the 2:1 figure is a low-distance qLDPC memory result, and 1,352:1 is an active lattice-surgery tile at mission distance. They differ in code distance, logical reliability, available logical gates, routing, factory overhead, and experimental maturity. Dividing them produces a number with no operational meaning, and it was the most misleading figure in the draft.

What can honestly be said: neutral atoms have demonstrated materially better code efficiency at the distances tested so far, and superconducting qubits have demonstrated materially better clock speed. Neither advantage has been converted into a like-for-like comparison, which would require the same workload at the same logical reliability, compared on total spacetime volume and energy. That comparison does not exist in this document and should be built before the fallback in A2.4 could ever displace the baseline.

Codex's B1.4 also corrects the tile figure itself: 2d^2 - 1 = 1,249 is the raw memory patch, while active lattice-surgery planning needs 2(d + 1)^2 = 1,352. I have adopted 1,352 throughout.

1. Therefore the fallback is not a consolation prize. It is a live hedge with a

real trigger, defined in A2.4.

A2.4 Fallback trigger, stated in advance so it cannot be rationalized away

Switch the primary to neutral atom if, at the Phase 2 gate (A8), any two of:

• Cryogenic I/O density (A5) fails to reach 100 physical qubits per cryostat

feedthrough line, making the Phase 3 fridge count exceed 400.

• Neutral atom QEC cycle time is demonstrated at or below 20 us with a logical

error rate matching our A1.3 target.

• Superconducting Phase 2 logical error rate misses 1e-6 per logical operation

by more than one order of magnitude.

Trapped ion is not a Phase 3 candidate under A1.2 arithmetic, but it is the best available platform for early logical algorithm development, and we should buy access rather than build it. See A8 Phase 0.

A3. Chip and module architecture

A3.1 Module definition

The unit of manufacture is a module, not a chip and not a fridge.

Module size is a gated design variable, not a fixed choice. [ASM]

The 1,024 figure came from a rationale that Codex's cross-review correctly took apart. The original argument was that since a distance-25 active tile needs 1,352 physical qubits, a 1,024-qubit module deliberately does not contain a whole logical qubit, which forces every logical patch across a module seam and so exercises the inter-module link from Phase 2 rather than discovering it is inadequate at Phase 3.

The half of that which is sound: integration risk should be pulled forward, not deferred. The half which is not: it dresses up a liability as a virtue. Putting a seam through every mission-distance logical patch means every logical operation in the machine depends on seam fidelity being equivalent to on-die fidelity, and no such equivalence has been demonstrated. If it fails, it fails everywhere at once, with no fallback layout.

Revised position:

• The default module target becomes **one distance-25 active tile plus boundary

margin**, so at least 1,352 physical qubits and preferably around 1,600, and the exact figure is set at the Phase 1 gate. [ASM]

• 1,024 is retained only as the test configuration, precisely because it

forces seams, which is what makes it a good instrument for measuring them.

• Promotion of any seam-spanning layout to the mission configuration requires

demonstrated seam equivalence: logical error rate for a patch spanning two modules statistically indistinguishable from the same patch on one die, at mission distance, under simultaneous operation.

Until that is measured, a seam-spanning mission layout is not baselined.

A3.2 Scaling tiers

The system tier at 1.31 million physical qubits covers the 1.2 million target of A1.3 with roughly 9 percent margin [EST].

A3.3 The load-bearing assumption, stated against the vendor's own numbers

The 65,536 qubits per cryostat figure in the table above is the single most aggressive claim in Part A, and the honest way to present it is against what the vendor actually publishes rather than against a vague sense of "commodity practice."

Bluefors KIDE published specification [SRC]:

Set against the A3.2 system tier [EST]:

Two things follow, and they should be read together.

First, 20 KIDE-class cryostats support about 20,000 qubits at the vendor's published scale, not 1.31 million. This plan's cryostat tier is a 65.5x development extrapolation, not a procurement-ready configuration, and A8.3 prices it as though 20 units were sufficient. That is a stated assumption [ASM], not a quotation, and it is called out again in A11.4.

Second, and more usefully, the RF line rows show precisely what CRY-1 buys. At today's 2.1 paths per qubit the plan needs 34x more feedthroughs than 20 KIDE systems provide. At CRY-1's 0.01 paths per qubit it needs 13,107 lines against 80,000 available, which fits comfortably. The wiring wall is therefore not a vague scaling worry: it is the specific difference between a configuration that is 34x impossible and one that fits inside published vendor capacity.

The mixing-chamber row is the tightest constraint and was missing from the earlier draft. At > 90 uW at 20 mK per KIDE, a 65,536-qubit cryostat has a budget of about 1.4 nW per qubit at 20 mK [EST]. Nothing in this plan has been costed against that number, and it is a gap.

A5 is where these claims are earned or the plan collapses, and A5.5 states what happens if they are not.

A3.4 The topology gap: this machine does not inherit Gidney's runtime

This subsection exists because of Codex's cross-review, and it invalidates a headline claim the earlier draft made without qualification.

The problem. The RSA-2048 resource estimate this plan is sized against assumes a square grid of qubits with nearest neighbor connections, uniform 1e-3 gate error, a 1 us cycle, and a 10 us reaction time. [SRC] Those assumptions produce 897,864 physical qubits and 4.96 expected days. The A3.2 architecture is not a square nearest-neighbor grid. It is 1,280 modules, in 160 clusters, across 20 cryostats, joined by multi-chip couplers and microwave photonic links.

A distributed machine does not inherit a monolithic machine's resource count or runtime for free. Every logical operation whose lattice surgery crosses a link pays in extra rounds, extra ancilla, and extra failure probability, and none of that is in the 897,864 or the 4.96 days.

Consequence for this plan. The A1.3 wall-clock target of under 7 days and the Gate 3 RSA criterion are therefore not currently supported for the 20-cryostat topology. They are supported for the topology the source assumes, which we are not building. This is now labelled unresolved rather than baseline, and it is risk H15 in A9.

Requirement LNK-1, the link acceptance gate. [ASM] Before any distributed RSA runtime is baselined, every inter-module and inter-cryostat link class must have a measured budget for:

The last row is the one that matters and it is the honest hole: we do not currently know the runtime multiplier for running this circuit on this topology. It is not 1.0. Until Codex's resource estimator is run against the real connectivity graph rather than a square grid, the correct statement is that RSA runtime on the Phase 3 machine is unknown and bounded below by 4.96 days.

Sensitivity case to carry until it is closed [EST]:

A multiplier of only 1.41 consumes the entire margin to 7 days. That is a narrow tolerance for a quantity nobody has measured, and it should be treated as one of the two or three most important open numbers in this document.

This also feeds back into A2. The modality trade study in A2.2 scored superconducting 5 of 5 on clock speed on the strength of a 1 us cycle. If the distributed overhead multiplier is large, some of that advantage is returned at the architecture level, which narrows an already 385-to-380 decision. A1.2 and A3.4 should be reviewed together, alongside H13.

A4. Cryogenics, thermal budget, and the physical plant

A4.1 Stage structure and commercial baseline

Five stages: 50 K, 4 K, still at roughly 700 mK, cold plate at roughly 100 mK, mixing chamber at 10 to 20 mK. [SRC]

All figures [SRC]. Industry range for dilution refrigerator cooling power is 250 to 600 uW at 100 mK for standard units, with a roadmap to higher powers specifically for large qubit counts. [SRC]

A4.2 Deriving the thermal budget per qubit

From the KIDE row: 3,000 uW at 100 mK supports on the order of 1,000 qubits. That implies a working allowance of roughly 3 uW at 100 mK per qubit with conventional coaxial wiring. [EST]

Applying that unchanged to the Phase 3 machine:

1,200,000 qubits x 3 uW = 3.6 W at 100 mK [EST]

Against a 3,000 uW best-in-class cryostat, that is 1,200 KIDE-class cryostats [EST]. At $7.5M each that is $9 billion in refrigerators alone, before a single qubit is fabricated. This number is the reason the rest of Part A exists.

A4.3 Why the scaling limit is wiring, not refrigeration

The mixing chamber load is not dominated by the qubits. It is dominated by heat conducted down the control wiring and dissipated in the attenuators that must sit on the cold stages to suppress room-temperature thermal noise. The standard drive line attenuation budget is 62 dB, distributed as 20 dB at 50 K, 6 dB at 4 K, 6 dB at the still, 10 dB at the cold plate, and 20 dB at the mixing chamber. [SRC] Every one of those attenuators is a resistor turning signal power into heat at the coldest, most expensive place in the machine.

Line count per qubit, tunable-coupler architecture: one drive line, one flux line, and a readout line shared across a multiplexed group. [SRC] A 20-qubit system with tunable couplers already needs 80 to 120 distinct cryogenic paths. [SRC] That is 4 to 6 paths per qubit at small scale. With aggressive readout multiplexing we take the asymptote to be:

2.1 cryogenic paths per qubit = 1 drive + 1 flux + (1 readout / 10-way multiplex) [EST]

1,200,000 qubits x 2.1 = 2,520,000 coaxial paths [EST]

Best available wiring density today is Delft Circuits Cri/oFlex flex ribbon: 8 channels per ribbon on NbTi superconducting stripline, 0.3 mm polyimide, 64 to 256 channels per side-loader. [SRC] At 256 channels per side-loader, 2.52 million paths need 9,844 side-loader ports [EST]. There is no cryostat geometry in which that is buildable. The wiring wall, not the qubits, is the thing this program has to defeat.

A4.4 The consequence

Part A therefore commits to a hard engineering requirement, and A5 is written to satisfy it:

> Requirement CRY-1. Reduce cryogenic feedthrough paths from 2.1 per qubit to > 0.01 per qubit or fewer (at least 100 physical qubits served per > feedthrough), and reduce the 100 mK thermal allowance from 3 uW per qubit to > 0.05 uW per qubit or less, a 60x reduction. [ASM]

Under CRY-1, the Phase 3 machine needs:

1,200,000 x 0.05 uW = 60 mW at 100 mK 60 mW / 3 mW per KIDE-class unit = 20 cryostats [EST]

That is the 20-cryostat system tier in A3.2. The entire architecture stands or falls on CRY-1.

A4.5 Helium-3 and consumables

A Bluefors XLD1000sl holds roughly 40 litres of helium-3 at about $2,500 per litre, roughly $100,000 of working fluid that must be recovered rather than vented at every servicing event. [SRC] Initial charge plus recovery system plus one spare charge runs about $280K per system, with $15K to $30K per warm-up for handling and $15K to $50K annual. [SRC]

Phase 3 helium-3 inventory [EST]: 20 cryostats at KIDE scale, assume 60 litres each, is 1,200 litres, roughly $3.0M of fluid, plus spares. Helium-3 is a decay product of tritium from weapons stockpiles, so supply is inelastic and not responsive to price. Procurement of the full helium-3 inventory must start at Phase 1, five or more years before Phase 3 needs it. This is a schedule risk, not a cost risk, and it is in the A9 register.

A4.6 Facility and power

Per-cryostat support load [EST]: pulse tube compressors, gas handling, and chilled water at roughly 12 to 15 kW per large cryostat.

Required infrastructure: online double-conversion UPS with a 20 minute minimum ride-through, a redundant dedicated chilled-water loop, closed-loop gas handling, and at least one spare helium-3 charge on site. [SRC] Floor space [EST]: roughly 4,000 to 6,000 square metres for the quantum hall, plant, and control room, with 5 m clear height for cryostat top-loading and crane access.

Note the shape of this: the quantum computer's refrigerators draw 300 kW while its classical control and decoding draw 3 to 5 MW. This machine is a classical data centre with a cold spot in it. Any plan that budgets for cryogenics and treats the classical side as an accessory has the ratio backwards.

A5. Control and readout, and how CRY-1 is actually met

A5.1 Baseline signal chain (Phase 0 and Phase 1, commodity)

A5.2 The three-layer plan to meet CRY-1

Layer 1, multiplexing (Phase 1, TRL 6 today). Frequency-multiplexed readout of 10 to 20 qubits per readout line is standard practice. Extend the same idea to drive lines by frequency-domain addressing within a shared feedline. Expected gain: 2.1 paths per qubit down to roughly 1.1. [EST]

Layer 2, cryo-CMOS control at 4 K (Phase 2, TRL 4 today). Move waveform synthesis inside the cryostat. A control ASIC at the 4 K stage receives a digital instruction stream over a small number of high-bandwidth links and generates many analog drive and flux waveforms locally. What crosses from 300 K is then digital data, not one analog line per qubit. Expected gain: 1.1 paths per qubit down to roughly 0.02. [EST]

The cost is that a control ASIC dissipating even 1 mW per channel over 1.2 million channels is 1.2 kW at 4 K [EST], which is far beyond any 4 K stage. So Layer 2 requires a per-channel power budget of order 10 to 100 uW at 4 K, which is the central device-physics research problem of Phase 2 and should be funded as such from Phase 1.

Layer 3, photonic links (Phase 2 to 3, TRL 3 today). Replace the remaining electrical feedthroughs with optical fibre. Fibre carries far more bandwidth per unit cross-section than coax and conducts substantially less heat. The 2026 literature describes a cryogenic hybrid photonic and CMOS controller architecture aimed at scalable superconducting qubit control. [SRC]

Maturity label, added after cross-review. That source is an architecture-level, first-order feasibility preprint (arXiv:2606.10114v2, June 2026), discussing fan-out groups of 8 to 10 channels replicated to scale, with no stated overall system size target. [SRC] It is not a demonstrated million-channel solution and the earlier draft came close to presenting it as one. Its own scope statement is explicit that the 4 K to millikelvin microwave packaging, which is exactly the interface this plan most needs closed, is left outside its power model. [SRC]

The earlier draft also claimed Layer 3 "eliminates the remaining thermal conduction term." That is too strong and is withdrawn. Optical fibre reduces conducted heat; it does not eliminate the heat load, because the optical-to- electrical conversion at the cold end dissipates power exactly where it is least affordable. Corrected claim: Layer 3 is a candidate architecture for reaching the CRY-1 100 mK allowance, contingent on measured whole-stack heat-load tests that include the conversion stage and the 4 K to millikelvin packaging. [EST]

A5.3 Classical control plant sizing

The 10 us reaction time is a joint requirement: it spans my readout chain and Codex's decoder. Revised allocation after Codex's B1.2 [EST]: 600 ns measurement acquisition plus reset (his number, not my original 1.0 us), 0.5 us cable and digitizer latency, 0.5 us return path and pulse issue. That leaves 8.4 us for Codex's decoder, slightly more than the 8 us I originally offered.

Not "comfortable." The earlier draft called 8.4 us comfortable by comparing it to a reported 124 ns FPGA neural-network decoder latency, a 184 ns throughput period, a 550 ns deterministic closed-loop latency, and a 2.2 us LDPC decode. [SRC] Codex's cross-review rejected that framing and it was wrong: those are small-distance and component-level demonstrations, and mission operation is at distance 25 with surgery traffic, bursts, and simultaneous operation. A sub-microsecond result at distance 3 says very little about distance 25 under load. 8.4 us is an end-to-end acceptance target, not a margin, and it is only demonstrated when measured at mission distance under representative burst and surgery load, per Codex's B3.3 backlog conditions.

Codex's B3.2 correctly points out the harder number I had not confronted: Google reported an average final-decoder latency of 63 us for distance 5 over million-cycle runs [SRC via B3.2]. That is 6x over the whole reaction budget, not just his share. The 10 us target is therefore aggressive against measured practice, and B3.2 is right to call it "aggressive but grounded." It is a real program risk and I have added it to A9 as H13.

On syndrome bandwidth, Codex's instruction to extract detector events next to the readout electronics and ship sparse events rather than raw ADC traces is a hard requirement on my design, not a software preference. At 0.66 Tb/s of raw syndrome, centralized export is not buildable. This is now a constraint on the cryo-CMOS ASIC in A5.2 Layer 2: it must do detector extraction on-die.

A5.4 Closing the 4 K stage, which the earlier draft left open

Codex's cross-review asked for every thermal stage to be closed with uncertainty ranges, not just 100 mK. The 4 K stage is where cryo-CMOS actually lands, and it is the stage the earlier draft never costed. Doing so now produces the most uncomfortable number in Part A.

The cited controller architecture gives per-channel dissipation at 4 K of about 48 uW/ch nominal and about 0.66 mW/ch conservative [SRC], against an RF-AWG reference baseline of 0.53 mW/ch nominal and 2.10 mW/ch conservative. [SRC] Applying those to this plan [EST]:

For scale, a large dilution refrigerator's 4 K stage is served by pulse tubes delivering on the order of 1.5 to 2 W each at 4.2 K [EST], so a KIDE-class system with three cooling units is in the several-watts class, not the tens or hundreds of watts class.

Reading the table honestly:

• The nominal cryo-CMOS case is marginal but conceivable. 3.1 W per cryostat

at 4 K is roughly a whole 4 K plant devoted to control electronics, which is demanding but is the right order of magnitude to engineer toward.

• The conservative case fails outright. 43.3 W per cryostat at 4 K is roughly

an order of magnitude beyond a large system's 4 K capacity. If cryo-CMOS lands at 0.66 mW/ch rather than 48 uW/ch, the A3.2 architecture does not close.

• The RF-AWG baseline fails in both cases, which is the quantitative reason

this plan cannot simply scale up conventional room-temperature control.

This vindicates the A5.2 Layer 2 requirement of 10 to 100 uW per channel at 4 K, which was written before this source was consulted and turns out to bracket the nominal figure. But it converts that requirement from an engineering preference into a binary architectural dependency: at 48 uW/ch the machine is buildable, at 0.66 mW/ch it is not, and the gap between those two published cases is a factor of 13.75. Closing it is the highest-value research item in the programme.

Two further stages remain incompletely closed and are recorded as gaps:

• 20 mK. KIDE provides > 90 uW at 20 mK. [SRC] At 65,536 qubits per

cryostat that is 1.4 nW per qubit [EST]. Nothing in this plan has been costed against that budget.

• 4 K to millikelvin packaging. Explicitly outside the cited model's scope

[SRC] and unaddressed here.

A5.5 What we do if CRY-1 fails

Stated now, in writing, so it is not improvised later. If at the Phase 2 gate we have achieved only Layer 1 and partial Layer 2, say 1 feedthrough per 20 qubits and 0.5 uW per qubit at 100 mK, then Phase 3 needs 200 cryostats rather than 20 [EST], capital cost roughly triples, and the fallback trigger in A2.4 fires. The correct response in that case is to switch the primary modality to neutral atom and accept the slower clock, not to build 200 cryostats. A neutral atom machine has no dilution refrigerator in the qubit path at all, which is precisely why it is the right hedge against a cryogenic wiring failure.

A6. Fabrication, materials, packaging, and yield

A6.1 Materials stack

Tantalum base layer on high-resistivity silicon substrate, selected because it delivers millisecond-class lifetimes and coherence with an explicit path to wafer-scale fabrication. [SRC] Losses in this class of device are dominated by two-level systems with comparable contributions from surface and bulk dielectrics [SRC], so the process control priorities are, in order: surface preparation and interface cleanliness, chemical mechanical planarization of the tantalum [SRC], junction barrier uniformity, and packaging-induced loss.

Chosen over the tantalum-on-sapphire variant because sapphire does not ride the silicon CMOS supply chain, and Phase 3 needs 1,200 wafers of yielded parts, not laboratory one-offs.

A6.2 Process outline

1. High-resistivity Si wafer, 200 mm, clean and HF dip.
2. Tantalum deposition, alpha-phase, followed by CMP. [SRC]
3. Pattern capacitors, resonators, feedlines.
4. Josephson junctions, Al/AlOx/Al, with in-line room-temperature resistance

screening as the junction uniformity proxy.



5. Airbridge and crossover formation.
6. TSV formation for 3D signal delivery from the back side. [SRC] IBM Loon

demonstrates multi-layer routing on chip.

7. Indium bump bonding of the qubit die to the interposer. [SRC] Mechanically

intermixed indium superconducting connections are demonstrated for microwave quantum interconnects.

8. Singulate, mount to oxygen-free copper carrier, wire out via SMP. [SRC]

A6.3 Yield model

There is no published wafer-scale yield figure for this device class that we should treat as authoritative, so this is an explicit model [EST], and it is the number most likely to be wrong in Part A.

Let p be the probability that one physical qubit lands within its frequency and coherence acceptance window. A module of 1,024 qubits is usable if a repair-free core plus a spare pool meets spec. With frequency-tunable couplers, individual dead qubits can be masked out of the lattice at a code-distance cost.

The right-hand column previously asserted that 10 dead qubits per module were "absorbable by defect-aware surface code" and that 5 were "comfortable." Both claims are withdrawn. They were unsupported, and Codex's cross-review is correct that they cannot be recovered from a per-qubit yield figure at all, for the reasons in the next paragraph. Only the top row survives, and only because 102 dead qubits in a 1,024-qubit module is implausible under any layout.

Note also that this table counts qubit yield only. It says nothing about coupler, readout, reset, junction-correlation, crosstalk, or frequency-collision defects, each of which can render a physically working qubit unusable.

Requirement FAB-1. Achieve p >= 0.99 at module scale by the Phase 2 gate. [ASM]

Codex's answer, and why FAB-1 stays an assumption. I asked him for a single defect-tolerance number to size this spec against. He declined to give one, and the refusal is better engineering than a number would have been. His B1.4 states: do not convert a bare fabrication-yield percentage into logical capacity; ingest the measured qubit, coupler, readout, reset, crosstalk, and frequency-collision defect map, then rerun routing and circuit-level logical simulation, because a region is usable only if its deformed patches retain their effective distance. The reserve stays an uncertainty band until measured spatial defect correlations and layout Monte Carlo support a specific allowance.

He is right, and the reason exposes something the table above hides: it treats dead qubits as independent, which is the assumption most likely to be false. Fab defects cluster, and frequency collisions are not independent of layout. A module with 10 scattered dead qubits and a module with 10 dead qubits in one corner have identical p and completely different logical capacity.

FAB-1 therefore remains [ASM] and unvalidated, and the honest statement is that Part A cannot presently justify its own fab spec. Closing it needs the measured defect map and layout Monte Carlo that B1.4 specifies, which is Phase 1 work. Recorded in A11.4.

A6.4 Packaging and shielding

Oxygen-free copper carrier with PCB and SMA or SMP connectors. [SRC] Nested shielding: innermost superconducting niobium or lead can for high-frequency field rejection, outermost mu-metal can for DC field rejection. [SRC] Eccosorb IR filters at cold plate and mixing chamber with cutoff above 100 GHz. [SRC]

At cluster scale (8 modules) the shielding problem changes character: the cans must enclose a much larger volume while maintaining the same residual field, and crosstalk between modules becomes a first-order design constraint rather than an afterthought. Budget dedicated electromagnetic modelling from Phase 1.

A7. Facility, power, floor space, and safety

Covered quantitatively in A4.6. Safety items specific to this build:

• Oxygen deficiency hazard. Bulk helium in a confined hall. Requires

distributed oxygen monitoring with local alarms, forced ventilation interlocked to the monitors, and a written confined-space procedure.

• Cryogenic burn and cold-surface exposure during warm-up and service.
• Overpressure. Every cryogenic volume needs a relief path sized for the

worst-case vacuum-jacket failure.

• Helium-3 as a controlled and scarce material. Closed-loop recovery is a

legal and financial requirement, not good practice. [SRC]

• RF exposure from high-power pump and drive lines at the racks.
• Laser safety applies only in the neutral atom fallback branch, where it

becomes a dominant facility concern instead of the helium hazards.

Uptime and maintenance drivers [SRC]: pulse-tube cold-head service every 18 to 24 months, annual compressor adsorber replacement, annual helium-3 mixture check, gas-handling filter replacement every 12 months, and at least one planned warm-up per year costing 5 to 10 days of downtime. Unplanned recovery runs 5 to 10 days at $10K to $50K per day. [SRC]

At 20 cryostats, staggered maintenance means the Phase 3 machine is never fully available. I originally wrote here that the system should let a cryostat go offline while the logical layout is "recompiled around the missing cluster," and asked Codex to add that to B6.

He added it, and corrected me in the process. His B6.3 now states that losing a module or cryostat during a job is not transparent: the runtime may migrate a live logical state only through a tested fault-tolerant protocol with budgeted link operations, and otherwise must reach a syndrome-safe checkpoint, abort the affected execution segment, and restart from a verified checkpoint. Recompiling around an offline region is valid only before state placement or after such a restart.

That correction matters and my original framing was wrong. A logical qubit is not a process that can be rescheduled onto other hardware mid-flight. Its state lives in a specific patch of physical qubits, and if that patch goes away, the state is gone unless it was moved by an explicit, budgeted, fault-tolerant operation first. "The compiler routes around it" was hand-waving on my part.

The real Part A requirements that follow are therefore harder than what I asked for, and they are hardware requirements, not compiler ones:

• Maintenance must be schedulable at job boundaries, not imposed by

equipment. A pulse-tube service window that lands mid-job destroys the job.

• The machine needs enough declared spare capacity that admission control can

place a job only on regions that will stay healthy for its full duration. At a 4.96 day RSA run [SRC], that is a five-day no-touch guarantee on 20 cryostats.

• Checkpointing needs somewhere to put the state, which is a hardware cost in

cold-storage patches, not a software feature.

These are unpriced in A8.3 and are a known gap.

A8. Bill of materials, cost model, staffing, and schedule

A8.1 Anchored cost inputs

All [SRC]:

Published reference points [SRC]: entry 5-qubit system year-0 capex about $1.96M; five-year TCO about $5.1M for 5 qubits and about $10.1M for 20 qubits; ten-year TCO $50M to $150M at industrial scale; for every dollar of hardware expect $1.60 of operating cost over five years.

A8.2 Phase plan with gates

Every gate is a functional criterion, not a build criterion. "The fridge is cold" and "the chip yielded" are not gates. Codex owns the acceptance test design in B7, and I will hold the hardware to whatever he specifies.

Phase 0. Foundation. Months 0 to 12.

Scope: one XLD1000sl-class cryostat, one 96 to 128 qubit QPU, commodity control electronics, full commissioning discipline. Buy cloud access to a Quantinuum Helios-class trapped-ion machine in parallel so the Part B software stack has a high-fidelity target to develop against from month 1 rather than month 36. [SRC]

Corrected after cross-review. The earlier draft specified a 20 to 30 qubit device and then set a gate requiring a distance-3 to distance-5 surface code memory. Those are incompatible and Codex caught it. A distance-5 rotated patch needs 2d^2 - 1 = 49 physical qubits as raw memory and 2(d+1)^2 = 72 as an active tile [EST], before leakage-removal ancillas, of which the Willow distance-7 experiment used four [SRC]. A 30-qubit device cannot host a distance-5 code at all. The device is resized to 96 to 128 qubits, which also brings it in line with the 105-qubit Willow class that the gate is benchmarked against [SRC], and stays within the 30 to 400 qubit range of an XLD1000sl. [SRC]

Commissioning timeline [SRC]: cryostat install 1 month, wiring tree 1 month, QPU install days, cooldown and readout verification 1 to 2 weeks, single-qubit characterization days to weeks, two-qubit calibration weeks, benchmarking and acceptance 1 to 2 weeks. Total roughly 5 to 8 weeks of commissioning.

Procurement lead time, corrected after cross-review. The earlier draft quoted a generic 3-month site-prep-and-procurement window alongside cryostat lead times of 4 months for an LD450sl and 6 to 12 months for XLD1000sl and KIDE class [SRC], which is internally inconsistent: procurement cannot complete in 3 months when the long-lead item takes 6 to 12. The binding constraint is the cryostat. Phase 0 is therefore planned against a 6 to 12 month cryostat lead, with site prep running inside it, and control-platform FPGA allocation at 8 to 16 weeks [SRC] and TWPA and HEMT spares at multi-month leads [SRC] scheduled inside the same window. Commissioning starts when the cryostat lands, not at month 3.

Gate 0: reproduce a distance-3 surface code memory with real-time decoding, and show error suppression when moving to distance-5. Not "a logical qubit exists," but Lambda > 1 measured on our own hardware.

Cost: $6M capex, $2M opex. [EST] Staff: 6 FTE. [SRC] for the 3 to 5 FTE single-system figure, scaled up for the QEC work.

Phase 1. Logical qubit. Months 12 to 42.

Scope: 1,024-qubit module. One KIDE-class cryostat. Layer 1 multiplexing. In-house tantalum-on-silicon fab line or a firm foundry partnership. Start helium-3 procurement for Phase 3 now (A4.5). Fund the cryo-CMOS per-channel power research (A5.2 Layer 2) as a dedicated workstream from month 12, because it has the longest lead time of anything in the program.

Gate 1, recast as an evidence and scaling gate after cross-review:

1. Match or beat the Willow result on our own hardware: Lambda >= 2.14 and

distance-7 error per cycle <= 0.143 percent. [SRC]

2. Demonstrate below-threshold scaling at three or more distances on the

production module with fitted uncertainty bounds and an explicit test for an error floor, per Codex's B1.4, rather than asserting a single distance.

3. Demonstrate a logical two-qubit gate between two logical qubits by lattice

surgery, with the logical error rate measured, not extrapolated.

4. Measure seam equivalence per A3.1 if the module is seam-spanning.

The earlier draft asked for a logical error rate <= 1e-6 per logical operation on a 1,024-qubit module. Codex rejected that on two grounds and both are right. First, capacity: two distance-15 active tiles are 2 x 512 = 1,024 physical qubits [EST], exactly the whole module, leaving zero qubits for surgery workspace, routing, or factories, so the configuration the gate implies does not fit. Second, inference: the measured distance-7 result does not imply a distance-15 two-logical-gate error of 1e-6, and Codex's B1.4 explicitly forbids extrapolating mission performance from a single below-threshold distance. The numeric target is therefore withdrawn and replaced by the measurement programme above, which is what actually determines whether Phase 2 is justified.

Cost: $60M capex, $25M opex. [EST] Staff: 45 FTE.

Phase 2. Logical processor. Months 42 to 84.

Scope: 8-module cluster, then multi-cluster. Cryo-CMOS control at 4 K. First photonic link. This is the phase where CRY-1 and FAB-1 are won or lost, and where the A2.4 fallback trigger is evaluated.

Gate 2, corrected after cross-review:

1. CRY-1 met at 100 qubits per feedthrough and 0.05 uW per qubit at 100 mK,

with the 4 K and 20 mK stages closed as well, per A5.4.

2. FAB-1 closed by measured defect map and layout Monte Carlo per A6.3, not

by a per-qubit yield percentage.

3. LNK-1 link acceptance gate closed per A3.4, including a measured

distributed-overhead multiplier.

4. An exactly checkable small fault-tolerant workflow, run end to end on the

production software stack, with the result verified against an independent classical method. Codex specifies these in B7.2: a small factoring workflow on a classically known composite, and a chemistry workflow such as H2 checked against exact diagonalization within the requested tolerance.

The earlier draft made Gate 2 "a chemistry problem that a classical computer cannot do." Codex was right to reject that. A result no classical computer can reproduce is a result nobody can check, which makes it useless as an acceptance criterion: passing it would be indistinguishable from a silent compiler, calibration, or decoder fault producing plausible numbers. The gate that proves the machine works is the one whose answer we already know. Beyond-classical runs are the product; exactly checkable runs are the proof, and they must come first.

Cost: $350M capex, $150M opex. [EST] Staff: 200 FTE.

Phase 3. Utility scale. Months 84 to 144.

Scope: 20 cryostats, 1.31 million physical qubits, roughly 1,500 logical qubits.

Gate 3, as corrected twice below: RSA-2048 factored, executed against a test modulus we generated, under a written disclosure and authorization framework agreed with the sponsor before the run, because a working cryptanalytic capability is a policy artifact and not only a technical one. Plus a chemistry problem sized to the 1.31M machine. No wall-clock target is attached to the RSA criterion at this gate, for the reason in A3.4.

Cost: $2.6B capex, $1.1B opex over the phase. [EST] Staff: 600 FTE.

Scope correction after cross-verification. As originally drafted, Gate 3 claimed both reference workloads. Re-deriving Codex's B5 numbers showed that is false for chemistry, and the arithmetic is in verify/part-b-arithmetic-check.py:

First correction, scope. Gate 3 originally claimed both reference workloads. It cannot claim FeMoco: that would have been a promise the hardware cannot keep.

Second correction, runtime. The intermediate revision then read "RSA-2048 in under one week." That is also withdrawn, per A3.4. The under-one-week figure belongs to a monolithic square-lattice machine, and this is 20 linked cryostats. Attaching it to Gate 3 would have reintroduced through the back door exactly the claim A3.4 removed from A1.3.

Gate 3 therefore reads: RSA-2048 factored, plus a chemistry problem sized to the 1.31M machine. A wall-clock criterion is added only once LNK-1 closes and the distributed-overhead multiplier is measured. Until then the honest position is that we can say what the machine will compute but not yet how long it takes.

Phase 4. Chemistry scale. Months 144 to 192. (added after cross-verification)

Scope: expand to 62 cryostats and roughly 4 million physical qubits to reach the Lee et al. FeMoco configuration. Cryogenic plant rises to 0.9 MW, syndrome bandwidth to 2.0 Tb/s [EST].

Gate 4: FeMoco ground state energy to chemical accuracy, checked against an independent method per Codex's B7.2.

Incremental cost: $3.8B capex [EST], excluding the fab line already capitalized in Phase 3. Program capex through Phase 4 becomes $6.8B.

Recommendation: do not commit Phase 4 at program start. Fund it as an option, not a baseline. The reasoning is that the FeMoco requirement is the least stable number in this entire plan. It has moved from ~1e14 T gates (Reiher 2017) to 3.4e8 logical T gates (spectral amplification) [SRC], a factor of roughly 300,000, while the RSA requirement moved 20x in the same period. Spending $3.8B to hedge against an estimate improving that fast is poor capital allocation. Build the modular Phase 3 machine, which is architecturally able to grow, and re-run Codex's resource estimator at the Gate 3 review before committing.

A8.3 Phase 3 capital breakdown

A8.4 Cost ranges, and what a single number was hiding

The earlier draft presented a single $4.3B figure. Codex's cross-review was right to reject that: the estimate rests on a 65.5x cryostat extrapolation (A3.3), an unclosed 4 K budget spanning a factor of 13.75 (A5.4), an unvalidated decoder line, and no vendor quote for the fab, ASIC, or facility, which are 40 percent of Phase 3 capital. A point estimate on those foundations is false precision.

Three cases [EST]. The high case is not a percentage uplift; it is derived from the conservative cryo-CMOS figure in the cited source.

The high case derivation: at 0.66 mW per channel and 65,536 channels per cryostat, the 4 K load is 43.3 W against roughly 5 W of realistic 4 K capacity, a factor of 8.7. Carrying the same total load then needs about 174 cryostats rather than 20 [EST]. The cost of this machine is not primarily driven by qubit count. It is driven by one unresolved number in a cryo-CMOS power budget.

Explicit exclusions from all three cases: Phase 4 (A8.2), decommissioning, helium-3 price escalation, the checkpoint-storage and spare-capacity costs identified in A7, and any distributed-overhead cost arising from A3.4.

Program total across all four phases, base case [EST]: roughly $3.0B capital and $1.3B operating over 12 years, about $4.3B combined, with the range above.

Items in A8.3 and A8.4 that are assumptions, not quotations [ASM], flagged after cross-review: the 1,200-wafer figure in A6.1, the per-wafer and per-module costs, the defect reserve, the 95 percent availability target, all staffing numbers, the entire schedule, and the fab, ASIC, photonic, decoder, and facility lines. The only quoted figures in the cost model are the small-system anchors in A8.1 [SRC], which describe 5 to 20 qubit systems.

The cost shape is the interesting result, and it is not the one most people expect. The QPU modules, the actual qubits, are $192M, which is 7 percent of Phase 3 capital [EST]. The fab line, control ASIC program, and facility are 40 percent; add the photonic interconnect and room-temperature racks and the control and infrastructure block is 57 percent [EST]. Refrigerators are 6 percent.

This inverts the small-scale published ratio, where the cryostat and its support systems are 30 to 50 percent of capital [SRC]. At Phase 3 scale, cryogenics has become a rounding error and the machine is overwhelmingly a control-electronics and semiconductor-manufacturing program that happens to have qubits in it. Any org chart, vendor strategy, or hiring plan that treats this as a physics program with an engineering department attached will fail on cost grounds before it fails on physics.

On the decoding compute line, after Codex's B3.4. I asked Codex to replace my $200M and 1 to 3 MW placeholder. He declined to give a number, and he is right to decline. What he supplied instead is a feasibility anchor: a Collision Clustering decoder ASIC at 0.06 mm^2 and 8 mW covering a surface-code memory of up to 1,057 physical qubits [SRC via B3.4], which linearly projected is about 7.6 W of decoder-core power per million physical qubits. I recomputed this independently: 8 mW x (1e6 / 1057) = 7.57 W, and at our 1,310,720 qubits, 9.9 W [EST].

That number is worth pausing on. The decoder cores for the entire Phase 3 machine draw about ten watts, roughly one millionth of my 1 to 3 MW placeholder. The placeholder is not thereby wrong. It means essentially none of the decoding power is the decoding. It is all detector extraction, I/O, memory, network fabric, hosts, redundancy, the audit decoder, power conversion, and cooling, which is exactly the list B3.4 says its anchor excludes.

The engineering consequence for Part A: the classical side of this machine is a data-movement problem, not a computation problem. That reinforces the A5.3 requirement that detector extraction happen on the cryo-CMOS die. Every syndrome bit that has to travel is far more expensive than the arithmetic performed on it.

Per B3.4, the $200M line is reclassified from an estimate to a facility reservation. It stays in the total so the total is not understated, but it is not a validated figure and must not be presented as one until the B3.4 gate passes: operate a decoder service at no less than one percent of the next phase's syndrome load, measure power at the facility feed, and obtain dated vendor quotes.

A8.5 Staffing shape

Baseline production role mix [SRC]: 1 facility and cryogenic engineer, 1 to 2 quantum control specialists, 1 HPC/DevOps engineer, 1 to 2 software engineers, and 1 site-reliability rotation, per operating system.

A9. Hardware risk register

Probability and impact are [ASM] judgments. Exposure is probability times impact on a 1 to 5 scale each.

Highest exposure is now a three-way tie at 20 between H1 (the wiring wall), H13 (the reaction time budget), and H15 (distributed topology).

The shape of that result is worth stating plainly. The original draft of this register had none of H13, H15, H16, or H17 in it, and rated H9 at exposure 8 instead of 16. Four of the five highest-exposure risks in this plan were invisible to its own author and were found by an adversarial reader. They were not found by the arithmetic checker either, which passed 73 of 73 while the document contained an unsupported runtime claim, an uncosted cryogenic stage, and a phase gate whose device was too small to run it. Arithmetic verification and assumption verification are different activities, and only the second one found these.

If H1 lands, A2.4 fires and we build a different machine rather than a more expensive version of this one. If H13 or H15 lands, the modality choice in A2.3 is weakened at its foundation, because A1.2's clock-speed argument assumes both that the control loop closes at 1 us and that the distributed machine inherits a monolithic machine's runtime. H13, H15, and A1.2 should be reviewed together at the Phase 1 gate. If H16 lands, the machine costs $6.1B instead of $2.6B.

A10. Review resolution log

Items 3 and 4 came back as reasoned refusals rather than numbers, and in both cases the refusal is the better answer: it converted two figures this document had invented into two explicitly bounded unknowns with a defined way to close them. That is a net improvement in honesty even though it removed two numbers.

Item 6 produced the most consequential result. The request was for a counter- estimate showing whether a slower, lower-overhead machine wins on total cost to solution. What came back instead was the finding that neither side of that comparison is currently computable, because the 676x figure was not a valid advantage and the distributed-topology overhead on the superconducting side has never been modelled. The modality decision therefore rests on less quantitative ground than the 385-to-380 score implied, and A2.3 has been rewritten to say so.

A10.1 The eleven corrections from the Part A cross-review

Codex's independent review of Part A raised eleven required corrections. All were independently confirmed before being accepted, including refetching the Bluefors KIDE specification and the cryo-CMOS preprint from their primary sources.

One correction in that list was accepted with a caveat rather than in full: on item 6, the KIDE 20 mK figure of > 90 uW [SRC] was not in Codex's review and was found while verifying it. It produces a tighter constraint than the 100 mK budget the plan had been working to, and it is now risk H17.

A11. Cross-verification record

This section exists so that a reader can check our claims instead of trusting our summaries. Both scripts are in verify/ and both are runnable.

A11.1 Part A checked against itself

verify/part-a-arithmetic-check.py, 58 assertions, 0 failures at time of writing. Output saved to part-a-arithmetic-check.output.txt.

The first run failed 4 of 58, all in the A8.3 cost table: contingency was stated as $144M when 15 percent of the subtotal is $338M, the Phase 3 total was stated as $2.4B against a computed $2.6B, program capex was stated as $4.1B against a computed $3.0B, and a claimed "60 percent" cost share was actually 40 percent. All four are corrected in the current text. Correcting the share error is what surfaced the genuinely interesting finding now in A8.3: the QPU modules are only 7 percent of Phase 3 capital.

A11.2 Part B checked by Part A's author

verify/part-b-arithmetic-check.py re-derives every numeric claim in Part B from its cited inputs rather than reusing Codex's stated results. Output saved to part-b-arithmetic-check.output.txt.

Reproduced independently and confirmed: all ten 2d^2-1 and 2(d+1)^2 values in B1.4; the 0.5 Tb/s syndrome aggregate; the 0.0065 union bound; the 28p^2 suppression to 2.8e-13; the six-factory bank at one CCZ per 25 us and 40,000 CCZ/s; the full RSA layout reconstruction 1,280 x 430 + 131 x 1,352 + 170,352 = 897,864; both Toffoli demand rates (15,168/s and 15,336/s); both 8T-to-CCZ candidate counts; the FeMoco footprint 2,142 x 1,352 = 2,895,984; and the rule-of-three bound requiring 3e15 trials, which I extend to note that at 1 us per trial this is 95 years of continuous running.

One arithmetic error found in Part B, and fixed by its author. B2.1's surface-code weighted total was stated as 440 of 500. Recomputing from Codex's own weights and scores gives 25x5 + 20x5 + 20x2 + 15x4 + 10x5 + 10x4 = 415. The bivariate bicycle total of 260 was correct. The decision was never in doubt: 415 against 260 still selects the surface code as the production baseline, and by a wider relative margin than my own 385-against-380 modality call. I did not edit his file. I sent the correction over the handoff channel and Codex corrected it himself, along with substantive additions to B1.4, B3.4, and B6.3 answering three further gaps I had raised. Part B now reads 415.

A11.3 What cross-verification actually changed

Worth recording, because it is the argument for doing it at all. Reading Codex's summary would have caught none of these:

• 4 cost errors in Part A, found only by running the arithmetic.
• 4 interface conflicts between the parts, found only by putting both sets of

numbers in the same script.

• 1 conflation in Part A of three quantities eight orders of magnitude apart.
• 1 arithmetic error in Part B, corrected by its author.
• 1 scope claim in Part A that was simply false: Gate 3 promised FeMoco on a

machine 3.05x too small.

• 1 new top-tier risk (H13) that reordered the risk register.
• 2 invented Part A numbers (the fab yield spec and the decoder power line)

converted into explicitly bounded unknowns with defined closure gates, because Codex declined to supply figures that do not yet exist.

• 1 wrong mental model in Part A: that a compiler can route around a lost cluster

mid-job. Correcting it produced three new hardware requirements that neither part had captured.

Then the reverse pass, Codex's independent review of Part A, found eleven more (A10.1), including:

• A withdrawn runtime claim. The plan asserted RSA-2048 in under 7 days on a

20-cryostat machine, using an estimate whose source assumes a single square nearest-neighbor grid. A distributed-overhead multiplier of 1.41 erases the entire margin, and nobody has measured it.

• A phase gate its own device could not run. Phase 0 specified 20 to 30

qubits and then required a distance-5 code needing at least 49.

• An uncosted cryogenic stage. The 4 K budget, where cryo-CMOS actually

lands, was never closed. Closing it revealed that the two published per-channel figures straddle buildability by a factor of 13.75.

• An invalid headline comparison, the 676x neutral-atom overhead advantage,

which divided two incommensurable quantities.

• 4 of the 5 highest-exposure risks in the register, which its author had not

seen.

The arithmetic checker passed 73 of 73 throughout all of that. It could not have caught any of it, because every one of those defects was a sound calculation resting on an unexamined assumption. Checking the arithmetic and checking the premises are different jobs. This document needed both, and needed a second author to do the second one.

A11.4 What remains unverified

Stated plainly rather than implied by omission.

• No hardware was built or measured. This is a plan. Every [SRC] figure is

someone else's measurement, and every [EST] is arithmetic on top of those.

• The cost model is unvalidated above the small-system scale. Anchors are

real vendor quotes for 5 to 20 qubit systems [SRC]. Extrapolating them to 1.31 million qubits is an assumption, and the fab, ASIC, and facility lines, which are 40 percent of Phase 3 capital, have no vendor anchor at all.

• CRY-1 has no demonstration behind it. A 60x thermal and 210x wiring density

improvement is asserted as a requirement, not shown to be achievable.

• The yield model in A6.3 is invented, and worse, it assumes independence.

No published wafer-scale yield figure for this device class was found, and Codex's B1.4 correctly points out that clustered defects and frequency collisions make a single per-qubit yield number insufficient regardless. FAB-1 cannot be justified until Phase 1 produces a measured defect map.

• The decoder capital and power lines are reservations, not estimates.

B3.4's gate has not been passed. The $200M sits in the $2.6B total so the total is not understated, but it is not validated.

• Checkpoint storage and maintenance-window spare capacity are unpriced.

Identified only after Codex corrected my graceful-degradation framing in A7.

• The RSA runtime on this topology is unknown (A3.4). The plan is sized

against an estimate for a machine we are not building. Bounded below by 4.96 days, upper bound unmodelled.

• The 4 K stage is not closed (A5.4). The two published per-channel figures

differ by 13.75x and straddle buildability.

• The 20 mK stage has never been budgeted (H17).
• Seam equivalence is unmeasured (A3.1), so no seam-spanning mission layout

is currently justified.

• **The modality decision rests on weaker ground than its 385-to-380 score

suggests** (A2.3). The comparison that would settle it, same workload and same logical reliability compared on spacetime volume and energy, has not been done by either author.

• The cost model spans $1.8B to $6.1B (A8.4) and the spread is driven by one

unresolved cryo-CMOS number, not by qubit count.

A12. Sources

Source class matters, and the earlier draft did not distinguish it. Codex's cross-review is right that a secondary aggregator page cannot support a technical claim. Sources below are split accordingly.

Class 1, primary technical. Peer-reviewed papers, preprints, and vendor datasheets. These may support technical claims.

Class 2, secondary commercial. Industry aggregator and cost-guide pages. These may support rough-order-of-magnitude cost anchors only, and every figure in A8.1 drawn from them is a ROM estimate for 5 to 20 qubit systems, not a validated price at this plan's scale. No technical requirement in Part A rests on a Class 2 source.

A12.1 Class 1, primary technical

• Bluefors KIDE cryogenic platform datasheet: > 3,000 uW at 100 mK, > 90 uW at 20 mK, > 1,000 qubits, over 4,000 RF lines, 10 mK base, 1.6 m^2 flange, 500 kg payload. https://bluefors.com/products/kide-cryogenic-platform/
• "A Cryogenic Hybrid Photonic/CMOS Controller Architecture for Scalable Superconducting Qubit Control," arXiv:2606.10114v2, June 2026. Architecture-level first-order feasibility study. 48 uW/ch nominal and 0.66 mW/ch conservative at 4 K; RF-AWG baseline 0.53 and 2.10 mW/ch. 4 K to millikelvin packaging explicitly outside its model. https://arxiv.org/html/2606.10114v2
• Lee et al., FeMoco resource estimate. https://arxiv.org/abs/2011.03494
• Google Quantum AI, "Quantum error correction below the surface code threshold," Nature, December 2024. https://www.nature.com/articles/s41586-024-08449-y and https://arxiv.org/pdf/2408.13687
• Craig Gidney, "How to factor 2048 bit RSA integers with less than a million noisy qubits," arXiv:2505.15917, May 2025. https://arxiv.org/abs/2505.15917
• Gidney, Shutty, Jones, "Magic state cultivation: growing T states as cheap as CNOT gates," arXiv:2409.17595. https://arxiv.org/abs/2409.17595
• IBM Quantum, "IBM lays out clear path to fault-tolerant quantum computing." https://www.ibm.com/quantum/blog/large-scale-ftqc
• IBM Nighthawk and Loon announcement coverage. https://postquantum.com/industry-news/ibm-loon-nighthawk/
• Quantinuum Helios, "A 98-qubit trapped-ion quantum computer with all-to-all connectivity," Nature. https://www.nature.com/articles/s41586-026-10676-4
• Quantinuum accelerated roadmap to 2030. https://www.quantinuum.com/press-releases/quantinuum-unveils-accelerated-roadmap-to-achieve-universal-fault-tolerant-quantum-computing-by-2030
• Harvard and MIT continuous 3,000-qubit operation. https://postquantum.com/quantum-research/harvard-mit-continuous-3000-qubit/
• QuEra neutral atom logical qubit progress. https://www.quera.com/blog-posts/neutral-atoms-and-the-path-to-fault-tolerant-quantum-computing
• "Neutral Atom Quantum Computing: Principles, Routes, Progress, and Challenges," arXiv:2608.05010. https://arxiv.org/abs/2608.05010
• "Millisecond lifetimes and coherence times in 2D transmon qubits," Nature 2025. https://www.nature.com/articles/s41586-025-09687-4
• Tantalum and silicon coherence result, August 2026. https://thequantuminsider.com/2026/08/05/researchers-improve-superconducting-qubit-coherence-tantalum-silicon/
• "Chemical Mechanical Planarization for Ta-based Superconducting Quantum Devices," arXiv:2302.07732. https://arxiv.org/pdf/2302.07732
• "Engineering cryogenic setups for 100-qubit scale superconducting circuit systems," arXiv:1806.07862. https://arxiv.org/pdf/1806.07862
• "A Cryogenic Hybrid Photonic/CMOS Controller Architecture for Scalable Superconducting Qubit Control," arXiv:2606.10114. https://arxiv.org/pdf/2606.10114
• "Enabling Technologies for Scalable Superconducting Quantum Computing," arXiv:2512.15001. https://arxiv.org/abs/2512.15001
• "Modular superconducting-qubit architecture with a multichip tunable coupler," Phys. Rev. Applied 21, 054063. https://link.aps.org/doi/10.1103/PhysRevApplied.21.054063
• "Mechanically-intermixed indium superconducting connections for microwave quantum interconnects," arXiv:2409.04634. https://arxiv.org/pdf/2409.04634
• "Real-time Surface-Code Error Correction Using an FPGA-based Neural-Network Decoder," arXiv:2605.04892. https://arxiv.org/html/2605.04892
• "FPGA-tailored algorithms for real-time decoding of quantum LDPC codes," arXiv:2511.21660. https://arxiv.org/pdf/2511.21660
• "Local clustering decoder as a fast and adaptive hardware decoder for the surface code," Nature Communications. https://www.nature.com/articles/s41467-025-66773-x
• Oxford Instruments, "Enabling quantum scale-up, why high 4 K cooling powers are standard on Proteox dilution refrigerators." https://nanoscience.oxinst.com/resources/blog/enabling-quantum-scale-up-why-high-4-k-cooling-powers-are-standard-on-proteox-dilution-refrigerators
• Bluefors dilution refrigerator measurement systems. https://bluefors.com/products/dilution-refrigerator-measurement-systems/
• FeMoco resource estimate lineage, summarized at https://postquantum.com/quantum-utility-map/quantum-chemistry-drug-discovery-catalysis/ and "Reducing the runtime of fault-tolerant quantum simulations in chemistry through symmetry-compressed double factorization," arXiv:2403.03502. https://arxiv.org/html/2403.03502

A12.2 Class 2, secondary commercial (ROM cost anchors only)

• PostQuantum, "Building a Superconducting Quantum Computer Guide." https://postquantum.com/building-quantum-computers/building-superconducting-quantum-computer/
• PostQuantum, "Quantum Computer Cost: Build and Operations Guide." https://postquantum.com/building-quantum-computers/quantum-computer-cost-procurement/
• PostQuantum, "Quantum Cryogenic Infrastructure and Helium-3 Guide." https://postquantum.com/building-quantum-computers/quantum-cryogenic-infrastructure-helium3/
• Industry roundups used only for orientation on modality status: https://thequantuminsider.com/2026/06/12/trapped-ion-quantum-computing-companies-technology-and-where-it-stands-in-2026/ and https://quantumzeitgeist.com/top-neutral-atom-quantum-computing-companies/

B. Logical architecture, software, and proof plan

This part turns the physical machine into a fault-tolerant computing service. It deliberately separates three kinds of number:

• Published result: measured or estimated in a cited primary source.
• Derived value: arithmetic reproduced from cited inputs, with the derivation shown.
• Engineering target: a requirement for this program, not a claim that present hardware already achieves it.

The production baseline is a rotated surface-code architecture on a local two-dimensional qubit lattice. Bivariate bicycle quantum low-density parity-check (qLDPC) codes remain a gated research branch because their memory density is compelling, but their connectivity, logical gates, and real-time decoding must be proven on the selected hardware before they can displace the baseline.

B1. Physical error model and error budget

B1.1 Noise model

Do not design against a single average gate fidelity. The engineering noise model shall contain all of the following and shall be refit from hardware data after every material process, packaging, wiring, or pulse-stack change:

1. Pauli and coherent error for each one-qubit gate, two-qubit gate, idle, reset, and measurement.
2. Leakage out of the computational subspace, leakage lifetime, propagation through entangling gates, and leakage-removal error.
3. Spatial crosstalk, spectator shifts, residual couplings, and simultaneous-operation error.
4. Time correlations from calibration drift, two-level-system motion, control drift, and thermal transients.
5. Rare correlated bursts from radiation, impact events, shared electronics, clock faults, and power disturbances.
6. State-preparation and measurement confusion matrices, including correlated readout.
7. Missing, duplicated, late, or corrupted syndrome data in the classical path.

This breadth is mandatory. Google Quantum AI measured a distance-7 surface-code memory at 1.43e-3 logical error per cycle and found that correlated errors contributed an estimated 17 percent of its error budget; its long repetition-code runs also exposed a logical error floor near 1e-10 from rare bursts. Those observations show why an independent and identically distributed depolarizing model is useful for sizing but insufficient for acceptance (Acharya et al., 2024).

B1.2 Hardware to logical-layer interface

B1.3 End-to-end failure allocation

For a compiled job, compute an error ledger by operation class. In the low-error regime, the conservative first check is the union bound

P_fail <= sum_i(N_i * p_i)

where N_i is the number of opportunities for failure of class i and p_i is its validated logical failure probability. Correlated mechanisms require a joint model and may not be multiplied as if independent.

Use this planning allocation for a mission job with required success probability of at least 90 percent. These percentages are engineering allocations, not measurements:

No phase may consume the reserve by changing a spreadsheet alone. A changed allocation requires new circuit counts, measured error distributions, and a reviewed failure-budget calculation.

B1.4 Distance selection and overhead

Select code distance from measured logical scaling, not from a threshold slogan. The raw rotated planar memory uses approximately 2d^2 - 1 data and measurement qubits. For active lattice-surgery planning, use the more conservative 2(d + 1)^2 physical qubits per logical tile, as used in the RSA study. Neither expression includes all routing, factory, spare, or defective-device reserve.

Do not convert a bare fabrication-yield percentage into logical capacity. Before placement, ingest the measured qubit, coupler, readout, reset, crosstalk, and frequency-collision defect map and rerun routing plus circuit-level logical simulations. A region is usable only if its deformed patches retain their effective distance and pass the logical-scaling gate. The physical-qubit reserve remains an uncertainty band until measured spatial defect correlations and layout Monte Carlo results support a specific allowance.

The distance-7 Google experiment used 101 qubits after four leakage-removal qubits were added, which is consistent with the raw 97-qubit patch plus mitigation hardware (Acharya et al., 2024). Its measured suppression factor was only Lambda = 2.14 +/- 0.02 for each distance increase of two. Therefore, this program shall not claim 1e-15 logical performance by extrapolating the present distance-7 result. Before mission sizing is frozen, demonstrate below-threshold behavior at three or more distances on the production module, fit uncertainty bounds, test for an error floor, and repeat under simultaneous operations and long-duration drift.

B2. QEC code selection

B2.1 Decision matrix

Scores are program judgments on a 1 to 5 scale, where 5 is best. They must be revisited at every architecture gate.

The qLDPC opportunity is real. Bravyi and colleagues estimate that a [[144,12,12]] BB memory can preserve 12 logical qubits for nearly one million syndrome cycles using 288 total physical qubits at 1e-3 physical error, compared with nearly 3,000 physical qubits for comparable surface-code memories. They also require weight-6 checks and degree-6 connectivity made from two edge-disjoint planar subgraphs (Bravyi et al., 2024). That tenfold memory comparison does not yet prove a tenfold saving for universal computation.

B2.2 Baseline and upgrade gate

Use rotated surface-code patches with lattice surgery for the production path. Maintain a BB qLDPC branch in simulation and on a dedicated test module. Promote BB to production only after it independently passes all of these gates on the selected physical modality:

1. Below-threshold memory scaling at two useful BB distances, with measured circuit-level noise rather than a uniform-noise simulation alone.
2. A complete logical Clifford instruction set, logical measurement, state injection, and a non-Clifford path.
3. Real-time decoding with bounded backlog under steady state, burst errors, and calibration drift.
4. A compiled representative application showing lower total physical qubits, wall-clock time, control hardware, and energy than the surface-code implementation.
5. A failure-budget audit that includes couplers, syndrome ancillas, surgery ancillas, spares, routing, factory space, and yield loss.

B3. Decoder architecture

B3.1 Production decoder

Start with correlated minimum-weight perfect matching (MWPM) using a validated sparse-blossom implementation. At 1e-3 circuit-level depolarizing noise, Sparse Blossom processed both X and Z syndromes for a distance-17 surface-code circuit in less than 1 us per syndrome round on one CPU core (Higgott and Gidney, 2023). Treat that as an algorithm benchmark, not proof of end-to-end controller latency.

Use two independent decoder paths:

• Real-time path: sharded MWPM in FPGA, ASIC, or tightly coupled CPU accelerators, producing Pauli-frame updates and feed-forward bits.
• Audit path: a slower, higher-accuracy decoder using correlated matching, an ensemble, or a learned model. It redecodes sampled and failed runs offline and detects production-decoder bias.

A learned decoder may graduate to the real-time path only after it beats MWPM on held-out hardware data, adversarial drift cases, and rare correlated events, while meeting deterministic latency and versioned-model requirements.

B3.2 Data path and timing

ADC/discriminator -> syndrome bit -> detector event -> local queue -> decoder shard -> Pauli frame -> feed-forward controller

Keep detector extraction next to the readout electronics. Send sparse detector events to decoder shards, not raw ADC traces to a central service. Retain a sampled trace stream for audit and model refitting.

The decoder service-level objectives are engineering targets:

Published demonstrations show both progress and the remaining gap. An FPGA-integrated decoder reported mean decoding below 1 us per round and 9.6 us response after nine rounds (Caune et al., 2024). Google reported average final-decoder latency of 63 us for distance 5 over runs as long as one million cycles (Acharya et al., 2024). The program's 10 us reaction target is therefore aggressive but grounded, and it must be measured end to end.

B3.3 Backlog and fail-safe behavior

Model arrival and service distributions from detector-event data, including bursts. Average throughput alone is insufficient because a decoder can appear fast while its tail creates an unbounded queue. For each code distance and noise regime, publish the queue-depth distribution, p99.9 latency, maximum observed latency, and recovery time after injected bursts.

If a Pauli-frame update is late but no non-Clifford feed-forward boundary has been reached, continue syndrome extraction while retaining order. If a hard feed-forward deadline will be missed, enter a syndrome-safe hold when the hardware supports it; otherwise abort the shot, mark it invalid, preserve the trace, and return an explicit runtime error. Never substitute a stale frame or silently drop a syndrome.

B3.4 Capacity, power, and cost gate

Current demonstrations support feasibility anchors, not a defensible installed-power or capital quote. A Collision Clustering ASIC design was reported at 0.06 mm^2 and 8 mW while simulating megahertz decoding for a surface-code memory of up to 1,057 physical qubits (Liyanage et al., 2025). A naive linear projection is about 7.6 W of decoder-core power per million physical qubits, but it excludes detector extraction, input and output, memory, network fabric, hosts, redundancy, the audit decoder, power conversion, and cooling. It is therefore a research anchor, not an installed-power estimate. An FPGA local-clustering implementation used less than 10 percent of a high-end device for a distance-17 patch in simulation, but likewise does not close whole-system power or cost (Smith et al., 2025).

Size the production service from measured detector-event traffic. If R_peak is the burst-conditioned event rate and one validated shard sustains r_shard while meeting the latency target, use

N_shards = ceil(2 R_peak / r_shard) + N_spare

where the factor of two enforces the 50 percent utilization ceiling. Compute installed power and capital from the selected bills of material:

P_installed = sum(N_i P_i) + P_network + P_storage + P_audit + P_cooling

C_installed = sum(N_i C_i) + C_network + C_storage + C_integration + C_spares

Before freezing either number, operate a decoder service at no less than one percent of the next phase's syndrome load using representative distance, surgery, physical error, leakage, and burst traces. Measure power at the facility feed, obtain dated vendor quotes, project low, base, and high cases, and repeat the end-to-end latency and backlog tests after a shard failure. Until that gate passes, any fixed decoder dollar or megawatt line is a separately identified facility reservation or management contingency, not a validated decoder estimate and not part of a precise baseline total.

B4. Non-Clifford resource

Clifford operations alone are not universal. The baseline universal path consumes injected T or CCZ resource states, with a factory design selected by phase.

B4.1 Two-stage strategy

1. Early logical-gate phase: implement conventional distillation as a conservative reference. Its larger footprint is acceptable while the goal is correctness and characterization.
2. Scale phase: use magic-state cultivation followed, when required, by 8T-to-CCZ distillation. Cultivation simulations report T-state error as low as 2e-9 at 1e-3 uniform circuit noise, with roughly an order-of-magnitude lower qubit-round cost than earlier approaches (Gidney, Shutty, and Jones, 2024). A later superconducting-processor preprint experimentally reported state fidelity 0.9999(1) while retaining 8 percent of attempts, which is promising but also exposes a yield and throughput risk (Rosenfeld et al., 2025).

For the mission configuration, set cultivated T-state error to at most 1e-7 and apply 8T-to-CCZ suppression. The RSA design uses the approximation 28p^2, so p = 1e-7 gives CCZ error below 1e-12 (Gidney, 2025). Verify the actual factory under the measured, correlated device noise before relying on this equation.

B4.2 Factory sizing

For a compiled schedule, size the number of factories using

factories >= ceil(required_CCZ_rate / validated_factory_rate * margin)

where the margin covers heralded rejection, maintenance, routing stalls, and drift. Do not size from nominal cycle time alone.

The 2025 RSA layout uses six factories, budgets 150 code rounds per accepted CCZ across the bank, and therefore supplies one CCZ every 25 us at distance 25 with a 1 us code cycle. The target workloads in B5 consume about 15,000 Toffolis per second on average, while this cited six-factory layout is budgeted for about 40,000 CCZ states per second. Those are derived average rates; burst demand and circuit dependency depth still require schedule simulation.

Every factory must expose accepted and rejected attempts, inferred output error, input calibration identifiers, decoder version, and buffer age. A factory that falls outside its validated yield or error envelope is quarantined automatically, with the application rescheduled or failed explicitly.

B5. Logical resource estimates for two target algorithms

These are architectural north stars, not first-release promises. Reproduce each source's calculation and rerun the resource estimator whenever the algorithm, code, error model, cycle time, or factory changes.

The FeMoco raw logical-data footprint at the distance-25 active-tile allowance is a derived 2,142 * 1,352 = 2,895,984 physical qubits. Factories, routing, and workspace bring the cited plan to about four million. Its average Toffoli demand is a derived 5.3e9 / (4 days) = 15,336 per second.

The RSA physical arithmetic is independently reproducible from the cited layout:

1,280 cold logicals 430 + 131 hot logicals 1,352 + 170,352 compute qubits = 897,864 physical qubits

Its average Toffoli demand is a derived 6.5e9 / 4.96 days = 15,168 per second. The cold-storage density relies on yoked surface codes and remains a study assumption with workload details left open by the author. Keep one million as the planning floor, not a procurement promise.

B5.1 Scale gates

Move through these logical capability gates. Physical counts are deliberately ranges until Part A closes yield, packaging, and control density.

B6. Software stack

B6.1 Layered design

Use Stim for high-throughput stabilizer and detector-error-model testing; it can sample large stabilizer circuits efficiently and is designed for QEC workloads (Gidney, 2021). Use PyMatching or an independently validated sparse-blossom implementation for the baseline decoder. Pin exact versions at each phase gate, but avoid freezing product choices in this plan before benchmark and licensing review.

B6.2 Compiler correctness

Every lowering pass shall emit a checkable equivalence witness or be covered by property tests and differential simulation. The pipeline shall preserve:

• unitary or channel semantics within the allocated synthesis error;
• classical branch conditions and measurement ordering;
• timing constraints and feed-forward deadlines;
• logical observables through surgery and Pauli-frame changes;
• error-budget annotations and code-distance choices;
• qubit ownership, reset, leakage-removal, and lifetime rules.

For circuits small enough to simulate exactly, compare the compiled distribution with an independent simulator. For larger Clifford regions, use stabilizer equivalence. For non-Clifford regions, use cut points, tensor or decision-diagram checks where feasible, algebraic identities, and randomized differential tests. A compiler mismatch blocks hardware execution.

B6.3 Runtime and calibration behavior

The runtime accepts a job only when its calibration snapshot is valid for every physical operation in the schedule and its predicted failure budget passes. It shall refuse, rather than silently approximate, unsupported dynamic control, expired calibrations, missing channels, insufficient factory capacity, or a decoder configuration that cannot meet the latency envelope.

Store enough provenance to replay a result: source program hash, compiler and pass versions, target topology, calibration snapshot, pulse and controller images, decoder binary and weight set, resource-state batches, timestamps, environmental alarms, raw counts, syndrome summary, and result post-processing version.

Calibration is a closed loop. Fast canaries monitor readout, selected gates, leakage, and detector statistics between jobs. A drift alarm invalidates dependent calibrations, drains new jobs, and either recalibrates or rolls back. Long jobs use predeclared safe checkpoints; never splice incompatible calibration regimes without marking a new execution segment in the error ledger.

Admission control places a job only on healthy regions and leaves declared spare capacity. Losing a module or cryostat during a job is not transparent: the runtime may migrate a logical state only through a tested fault-tolerant protocol with budgeted link operations. Otherwise it must reach a syndrome-safe checkpoint, abort the affected execution segment, and restart from a verified checkpoint or from the beginning. Recompiling around an offline region is valid only before state placement or after such a restart.

B6.4 Delivery sequence

1. Build the device model, compiler skeleton, Stim circuits, MWPM decoder, resource estimator, and provenance schema before multi-qubit hardware is ready.
2. Integrate pulse scheduling, result capture, and calibration on one and two qubits.
3. Add repeated syndrome extraction, detector streaming, and real-time decoding for repetition and small surface codes.
4. Add logical operations, lattice surgery, state injection, and factory scheduling.
5. Add application front ends and HPC workflows only after the logical primitives have functional proof.
6. Optimize throughput and replace components only behind stable data contracts and reproduced benchmarks.

B7. Verification and benchmarking

B7.1 Evidence hierarchy

A build, type check, process launch, green status, HTTP success, unit test, or short smoke run proves only that check. Machine acceptance requires the representative workflow to produce the expected quantum output, state change, persistence, and recovery behavior.

Use randomized benchmarking for average physical gate error (Magesan, Gambetta, and Emerson, 2011), simultaneous randomized benchmarking for addressability, and cycle benchmarking for multi-qubit layer error and crosstalk (Erhard et al., 2019). These characterize components. They do not replace logical memory, logical gate, decoder, and application tests.

B7.2 Phase acceptance matrix

B7.3 Statistical discipline

Pre-register the metric, shot count, confidence level, exclusion rules, and stopping rule. Report confidence intervals and all tried variants, not only the best device region. Keep a holdout interval of hardware data for decoder and noise-model validation.

When zero failures are observed in N independent opportunities, the approximate one-sided 95 percent upper bound is 3/N. This means direct demonstration of a 1e-15 rate would require an impractical number of independent trials. Mission confidence must therefore combine lower-distance scaling, targeted accelerated tests of rare mechanisms, validated physical models, redundancy, and conservative reserve. Label the resulting 1e-15 figure as extrapolated until direct evidence exists.

B7.4 Completion criteria

The machine is functionally useful only when an external user can submit a versioned job, receive an interpretable result with uncertainty and provenance, replay its classical processing, and see explicit failure when any prerequisite is not met. For each major phase, independently reproduce at least one end-to-end workflow after a cold controller restart and after restoring the calibration database from its persisted state.

B8. Software and algorithmic risk register

The risk register is reviewed at every scale gate. A risk closes only with observed evidence against its trigger, not because a mitigation task was scheduled.

B9. Primary-source index for Part B

1. Acharya et al., Quantum error correction below the surface code threshold, 2024
2. Bravyi et al., High-threshold and low-overhead fault-tolerant quantum memory, 2024
3. Higgott and Gidney, Sparse Blossom, 2023
4. Caune et al., Demonstrating real-time and low-latency quantum error correction with superconducting qubits, 2024
5. Gidney, Shutty, and Jones, Magic state cultivation, 2024
6. Rosenfeld et al., Magic state cultivation on a superconducting quantum processor, 2025 preprint
7. Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits, 2025
8. Lee et al., Even More Efficient Quantum Computations of Chemistry Through Tensor Hypercontraction, 2021
9. OpenQASM 3 specification
10. QIR Alliance
11. Gidney, Stim: a fast stabilizer circuit simulator, 2021
12. Magesan, Gambetta, and Emerson, Scalable and robust randomized benchmarking of quantum processes, 2011
13. Erhard et al., Characterizing large-scale quantum computers via cycle benchmarking, 2019

Joint appendix: the interface between the two halves

Written jointly. Part A owns the hardware side of each row, Part B owns the logical side. Where the two authors disagreed, the resolution and the reason are recorded rather than smoothed over.

J1. Agreed interface contract

These are the numbers both halves are built against. Where Part A's first draft differed, Part B's value was adopted and the reason is given.

J2. Machine size against the reference workloads

Recomputed independently in verify/part-b-arithmetic-check.py.

Gate 3 was rescoped accordingly: RSA-2048 plus a chemistry problem sized to the machine. Phase 4 closes the FeMoco gap at $3.8B incremental and is deliberately not baselined, on the reasoning in A8.2.

Read the RSA row narrowly. It says the qubit count fits. It does not say the workload runs in the published time, because both the count and the 4.96 day runtime come from a source assuming a single square nearest-neighbor grid, and this machine is 20 linked cryostats. The qubit-count margin is real; the runtime is unresolved (A3.4, J3 item 1). Those two facts are easy to conflate and the earlier draft conflated them.

J3. Open items

These are unresolved. They are listed here rather than buried so that a reader does not have to discover them.

Closed during cross-verification

Still open

Both review passes are now complete: Claude Code reviewed Part B and Codex acted on it; Codex reviewed Part A and Claude Code acted on it (A10.1). What follows survived both passes.

J4. Verification evidence

What was actually exercised, with what inputs, and what was observed.

Part A, checked by its own author. verify/part-a-arithmetic-check.py, 108 assertions covering the trade-study weighted totals, the thermal and wiring derivations, the scaling tiers, the yield model, the full capital breakdown, the staffing tables, the clock-speed scaling table, the latency split, and every figure arising from Codex's cross-review: the KIDE vendor comparison, the phase-gate patch sizes, the 4 K per-channel cases, the distributed-overhead sensitivity table, and the three cost cases. Current result: 108 pass, 0 fail.

The first run failed 4 of 58, all in the cost table: contingency stated as $144M against a computed $338M, Phase 3 total stated as $2.4B against $2.6B, program capex stated as $4.1B against $3.0B, and a claimed 60 percent cost share that was actually 40 percent. All four corrected. Fixing the last one is what surfaced the 7-percent-qubit-cost finding in the executive summary.

The limit of this checker, stated plainly. It passed 73 of 73 on a version of Part A that contained an unsupported RSA runtime claim, a phase gate whose device was too small to run it, an uncosted 4 K stage, an invalid 676x comparison, and a cryostat count 65.5x beyond vendor scale. Every one of those was arithmetically sound and premised on something nobody had checked. A passing arithmetic checker is evidence about arithmetic and nothing else, and reporting it as though it were evidence about correctness would have been the single most misleading thing in this document.

Part B, checked by Part A's author. verify/part-b-arithmetic-check.py, 28 assertions. Each recomputes from Codex's cited inputs rather than reading his stated results. Independently reproduced: all ten patch and tile sizes in B1.4; the 0.5 Tb/s syndrome aggregate; the 0.0065 union bound; the 28p^2 suppression to 2.8e-13; the six-factory bank at one CCZ per 25 us and 40,000 CCZ/s; the RSA layout reconstruction to the exact qubit (897,864); both Toffoli demand rates (15,168/s and 15,336/s); both 8T-to-CCZ candidate counts; the FeMoco footprint (2,895,984); and the rule-of-three bound of 3e15 trials, extended here to note that at 1 us per trial that is 95 years of continuous running. One error was found, B2.1's weighted total, and Codex corrected it in his own file. Current result: 28 pass, 0 fail.

Also independently recomputed: Codex's B3.4 decoder-power anchor. From his cited 8 mW covering up to 1,057 physical qubits, the linear projection is 7.57 W per million, against his stated 7.6 W. Confirmed. At this plan's 1,310,720 qubits that is 9.9 W of decoder cores for the entire machine, which is what makes the data-movement point in A8.3.

What was not verified. No hardware. No simulation of the quantum circuits themselves. No vendor quotes obtained for the fab line, control ASIC program, or facility, which together are 40 percent of Phase 3 capital. The yield model in A6.3 is invented, because no published wafer-scale yield figure for this device class was found. CRY-1, the requirement the entire architecture rests on, has no demonstration behind it.

Method note. Both authors' first drafts contained arithmetic errors that survived their own proofreading and were caught only by executing the arithmetic. Part A's rate was worse than Part B's. Any future revision of this document should re-run both scripts before it is circulated, and should extend them rather than replace them.

J5. One-page summary of the argument

1. Specify the machine by the computation it finishes, not by a qubit count,

because qubit-count targets have already moved 20x in one paper and 300,000x in T-count for chemistry.



2. Both target workloads are depth-limited, so cycle time is the architecture-

defining parameter.

3. That selects superconducting qubits, narrowly (385 to 380), with neutral atoms

as a live fallback carrying a pre-written trigger. The margin is thinner than the score suggests, because no like-for-like comparison exists.

4. At a million qubits the machine is not limited by qubits. It is limited by

2.5 million cryogenic wires and 3.6 W of heat at 100 mK.

5. Defeating that with multiplexing, cryo-CMOS at 4 K, and photonic links is

requirement CRY-1, and it is the program.

6. Meanwhile the logical layer picks the rotated surface code over qLDPC on

maturity grounds, keeps qLDPC behind an explicit upgrade gate, and sizes magic-state production by cultivation rather than distillation.

7. The classical side, decoders and control, is bigger than the quantum side in

both power and capital. Plan it first, not last.

8. Three numbers decide whether any of this works, and none is measured: the 4 K

per-channel control power (13.75x of published spread, straddling buildability), the distributed-overhead multiplier (1.41 erases the runtime margin), and the end-to-end reaction time (10 us needed, 63 us measured).

9. Everything above is a plan. The strongest claim this document can honestly

make is that its arithmetic is checkable, its assumptions are labelled, and both authors tried to break the other's half.

This website article preserves the complete consolidated technical plan. Every visual is an editorial concept created from the technical plan. The images support comprehension and curiosity, but they are not photographs of built hardware, measured experiments, or finalized engineering drawings.