Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Han's Structure-Induced Quantum Blindness Conjecture

Han Bo Jun

Published Apr 9, 2026• 0 citations
Publisher

Abstract

This upload contains the full preprint "Han's Structure-Induced Quantum Blindness Conjecture (Han-SIQB)" (version v6), a technical report from the Mnemosyne research project. The paper formally introduces and systematically studies Han's Structure-Induced Quantum Blindness Conjecture (Han-SIQB), a central open problem in product quantization security theory. The core statement of the conjecture is that, for any product quantization codebook C trained by k-means or LBG and a publicly known Soft-ZCA whitening transformation W, the composite function PQ_C composed with W admits no quantum algorithm that achieves a search speedup beyond Grover's algorithm (that is, no acceleration factor alpha_Q greater than 2). The conjecture currently lacks a complete proof and is positioned as a structural working hypothesis supported by the convergence of multiple independent lines of evidence from quantum query complexity, computational geometry, statistical physics, cryptography, and neuroscience. The work organizes the conjecture into five concrete sub-obligations (exclusion of known quantum paradigms, statistical structure testing, reduction to known hard problems, formal reduction of quantum mode-finding to unstructured search, and experimental verification of near-uniform conditional entropy), honestly assesses the formalization level of each piece of supporting evidence, and identifies the critical open problems on the path to a full proof. For the Mnemosyne post-quantum distributed computing architecture, Han-SIQB constitutes the sole remaining condition required to fully close its dual physical security barriers (Landauer thermodynamic bound and Margolus-Levitin operation-count bound) in the time dimension, potentially enabling a security system grounded solely in physical laws rather than mathematical hardness assumptions. The paper also provides a detailed epistemological positioning of the conjecture, discusses historical precedents, and explicitly outlines fallback mechanisms (hybrid post-quantum cryptography mode) should the conjecture eventually be falsified. It invites collaboration from the quantum query complexity, algebraic geometry, and machine learning theory communities to advance its formalization or disproof. This upload includes the complete manuscript with all appendices, tables, and references. Keywords: product quantization, quantum blindness, structural conjecture, post-quantum security, Grover lower bound, whitening transformation, physical security, Mnemosyne

DOI
10.5281/zenodo.19483649

Related papers

Constraint Network Cryptography D: Information Barriers, Computational Complexity Phase Transitions, and a Constraint-Network Formulation of P vs BQP

changzheng zhou, ZIQING zhou

The threat mechanism of quantum computers to symmetric cryptography differs fundamentally from their penetrating attacks on asymmetric cryptography.Within the constraint network framework, this paper formalises the AES key spaceas a high-dimensional hypercube graph Qn, decomposes the AES round functionas a sequence of local rewiring operators, and reconstructs Grover’s algorithm asa quantum diffusion operator DQ. The central working hypothesis is that, undera custom metric of traversal entropy, Grover’s acceleration of AES key search canbe understood as a linear compression of traversal entropy—the classical bruteforce search has traversal entropy n bits, which quantum diffusion compresses ton/2 bits, so that the information barrier depth is linearly rescaled from n to n/2;this behaviour is termed in this paper a semi-penetrating response (Working Hypothesis 5.1, condition depth = 2). Consequently, AES-256 has an effective quantum security strength of 128 classical bits, and its immunity strategy is entropygrowth rather than algorithm replacement. The immunity of lattice cryptographyto quantum attacks, in contrast, is a composite strategy of structural replacement and entropy growth. The five fundamental operators (cohere, fission, rewire,spectral diagnosis, quantum diffusion) are closed under finite composition in thefree monoidal category defined by the algebra; whether they exhaust all knownquantum speedup mechanisms remains an open conjecture (Conjecture 8.1). Thisframework upgrades the quantum security assessment of symmetric cryptographyfrom a static taxonomy to a dynamical–categorical formalism, although the dimensional normalisation of the MBU inequality is currently heuristic in nature, and thedirection of the inequality and the physical meaning of ˆκ require further hardening.

•Sep 4, 2026•0 citations

Physical Impossibility of Exhaustive Reconstruction Attacks on Product-Quantized Embeddings: A Dual Thermodynamic Barrier

Han Bo Jun

his paper proves that exhaustive reconstruction attacks on product-quantized (PQ) embeddings transmitted in federated learning settings are physically impossible for any attacker conforming to the laws of physics. The proof establishes two independent physical barriers targeting distinct attacker classes. The first barrier, derived from Landauer's principle (Landauer, 1961), shows that irreversible classical attackers must expend energy exceeding 10 to the power of 38,778 joules to perform exhaustive reconstruction. This surpasses the total energy of the observable universe by 10 to the power of 38,709 orders of magnitude, making the attack thermodynamically impossible. The second barrier, derived from the Margolus-Levitin theorem (Margolus and Levitin, 1998), closes the reversible computation loophole identified by Bennett (1973, 1982). It shows that reversible classical and quantum attackers -- including fault-tolerant quantum computers using the optimal Grover algorithm -- require more operations than the entire observable universe can perform in its lifetime. Even with Grover acceleration, the required operations exceed the universal computational ceiling by at least 10 to the power of 19,277 orders of magnitude. Advances in quantum error correction, including recent below-threshold demonstrations, do not affect this conclusion: the Margolus-Levitin bound constrains operation rate for any physical system regardless of hardware architecture or error rates. The two barriers are physically independent. The first rests on the second law of thermodynamics; the second rests on the time-energy uncertainty relation of quantum mechanics. Neither can be invalidated by any computational or engineering advance. The information loss quantity driving both barriers -- 128,886 bits -- is derived from first principles from the mutual information upper bound of the PQ quantization mapping, accounting for side-channel leakage and encryption key entropy. A conditional security certificate (T14-C) integrates both barriers with an explicit premise dependency matrix. The principal open problem is the MC4b structural conjecture, which asserts that the PQ codebook presents as a black box to the attacker; all conclusions are conditional on this premise, which is under active investigation by the authors. The framework applies directly to value caches in transformer architectures. Application to RoPE-modulated key caches requires additional treatment and is declared out of scope. This work represents, to the authors' knowledge, the first application of a dual thermodynamic and quantum mechanical barrier to privacy guarantees for product quantization in federated learning, and the first systematic closure of the reversible computation loophole in this security context. The closest prior work, Coiteux-Roy (2022), applies Landauer's principle to general cryptographic protocols but does not address reversible computation, quantum attackers, or the specific information-loss structure of PQ quantization. This preprint is part of the Mnemosyne Project, a post-quantum distributed computing architecture grounding cryptographic security in physical laws rather than mathematical complexity assumptions.

•Apr 8, 2026•0 citations

Post-Quantum Cryptography Addendum

Michael I Aksman

This addendum provides targeted technical extensions and mathematical clarifications to themain monograph “Deterministic Spectral Manifold for Post-Quantum Cryptography” (ResearchGate, 2026) without altering its core structural results. Five core claims are updated with June 2026 technical precision to support rigorous intellectual property auditing. Section 1 formalizes the UMetric (arithmetic firewall) and corrects the characterization of ε0 = |δ| = 1/24 as a configurable system sensitivity parameter rather than an absolute topological lower bound. Section 2 evaluates the 220-dimensional protected subspace: the nf −nb = 220 mode count is explicitly reconciled, and the Grover security level is constrained to 2110, identifying the precise structural adjustments required for absolute NIST Level 1 compliance. Section 3 reframes the 72-phase entropy harvester, demonstrating that the structural δ = −1/24 defect bounds the deterministic grid while physical thermal jitter across boundary transitions provides the true randomness. Section 4 replaces the probabilistic “zero-knowledge” framing with a mathematically rigorous “computationally private projection”protocol. Section 5 scales back the side-channel evaluation from “immune” to “reduced attack surface,” detailing the benefits of fixed-N computational metrics. All extensions derive directly from the rigid DSM-861 baseline: Heegner discriminant D = −163, projection matrix P, and the 72-fold synchronization clock.

•Jun 12, 2026•0 citations

A Comprehensive Review of Post-Quantum Cryptography Algorithms

Samandeep Kaur, Jaswinder Singh

The development of quantum computing has been rapid, and an existential threat to computational hardness assumptions that underlie today's public-key cryptography has been encountered. This manuscript is a complete and thoroughly organized review of Post-Quantum Cryptography (PQC), discussing the mathematical concepts, complexity, and mechanisms of the algorithms that underpin quantum-safe security infrastructures. Rather than the principles of quantum mechanics, the analysis mathematically defines the basic principles of qubits, superposition, and entanglement, and clarifies common misunderstandings of the theory of parallelism in quantum mechanics. The research places cryptographic problems into the Bounded-Error Quantum Polynomial-Time (BQP) complexity class, thus highlighting the exact defects of classical algorithms. The quantum gate complexity of Shor's algorithm is compared to classical bounds as in Pollard's rho algorithm for the Elliptic Curve Discrete Logarithm Problem (ECDLP), for a detailed comparative cryptanalysis. The comparison highlights a very important “quantum security inversion” in that Elliptic Curve Cryptography (ECC) is much more susceptible to the early-stage fault-tolerant quantum computer as compared to the approach used today in RSA. It unfolds the architectural dependency of quantum algorithms, one by one, from the Quantum Fourier Transform (QFT) to Quantum Phase Estimation (QPE) and Shor's algorithm to Grover's algorithm. Last but not least, the manuscript examines emerging attack primitives such as lattice-based, code-based, and hash-based cryptography, their security models, side channel vulnerabilities, and the recently finalised Federal Information Processing Standards (FIPS 205, 203, and 204) that have been published by the National Institute of Standards and Technology (NIST).

Journal of Computer Science•Sep 1, 2026•0 citations

Explainable PQC: A Layered Interpretive Framework for Post-Quantum Cryptographic Security Assumptions

Daisuke Ishii, Rizwan Jahangir

This paper studies how post-quantum cryptographic (PQC) security assumptions can be represented and communicated through a structured, layered framework that is useful for technical interpretation but does not replace formal cryptographic proofs. We propose ``Explainable PQC,'' an interdisciplinary framework connecting three layers: (1) a complexity-based interpretive model that distinguishes classical security, quantum security, and reduction-backed hardness, drawing on computational complexity classes as supporting language; (2) an exploratory mathematical investigation applying combinatorial Hodge theory and polyhedral geometry to study structural aspects of lattice hardness; and (3)~an empirical experimentation platform, implemented in Julia, for measuring the behavior of lattice basis reduction algorithms (LLL, BKZ) in low-dimensional settings. The motivating case study throughout the paper is lattice-based PQC, including ML-KEM (FIPS 203) and ML-DSA (FIPS 204). The contribution of this paper is conceptual and organizational: it defines a layered interpretive framework, clarifies its scope relative to formal cryptographic proofs and reduction-based security arguments, and identifies mathematical and implementation-level directions through which PQC security claims may be more transparently communicated. This paper does not claim new cryptographic hardness results, new attacks, or concrete security parameter estimates.

arXiv:2604.03665•Apr 4, 2026•0 citations

SoK: The Atomic Cryptographic Substrate of Blockchains: A Post-Quantum Vulnerability and Migration Analysis

PARTH MAURIA SAXENA

Public debate on the quantum threat to blockchains—and much of the survey literature—is dominated by chain-level claims that mislocate the risk. We relocate the problem to the level at which an algorithm actually acts, showing that the post-quantum fate of any chain decomposes into three layers: which hardness assumption secures its signatures (Shor-vulnerable discrete-log/factoring, hash, or lattice); that assumption's status under the physically-realizable computational model (classical BPP vs quantum BQP); and the physical floor beneath it—unstructured-search lower bounds and serial-depth constraints, not a claim of unconditional security. At ground zero, the abelian-hidden-subgroup atom is efficiently broken under BQP (Shor), while no efficient BQP break is known for hash or lattice; hash security rests on the most conservative, best-tested conjecture; discrete-log rests on exploitable algebraic structure; and lattice assumptions, though buttressed by worst-case reductions unevenly across the lattice family, carry a much shorter cryptanalytic record. We locate the vulnerability in a single object—the exposed public key—and formalize compromise as a conjunction of exposure, feasibility, and non-revocation. Under a floor assumption (generic, unstructured search stays infeasible) this factors into four conjuncts answering to four distinct authorities—mathematics, the ledger, engineering, and the owner or protocol—with feasibility entailing brokenness. Each per-asset cryptanalytic defense we survey denies the primary one of these four conjuncts—an accounting identity over the four predicates (some defenses touch more than one; we classify by the primary), not a claim of exhaustiveness over an open-ended literature. We give an exposure taxonomy checked against the reference implementations and a first-party, reproducible measurement of the full Bitcoin UTXO set (block 957,269, July 2026): 1.93M BTC (≈9.6% of supply) carries a standing exposed public key—the defensible, structurally unambiguous figure—rising to 5–7M BTC (25–35%) once key-reuse is included, the range's width set by the P2SH/P2WSH script-hash upper bound. This decomposes exactly along the taxonomy's structural-versus-operational axis and quantifies Taproot's hidden-key regression (a directional shift on the exposure axis, minor by value); current resource estimates and a CRQC timeline; and a per-chain migration survey. A recurring result: account and governance architectures migrate most easily while immutable/UTXO chains are hardest—the property prized as a security virtue is the migration handicap. No unconditional security exists; all verdicts are contingent on unproven conjectures and the assumption that BQP is the physical ceiling of computation.

•Jul 15, 2026•0 citations
This upload contains the full preprint "Han's Structure-Induced Quantum Blindness Conjecture (Han-SIQB)" (version v6), a technical report from the Mnemosyne research project. The paper formally introduces and systematically studies Han's Structure-Induced Quantum Blindness Conjecture (Han-SIQB), a central open problem in product quantization security theory. The core statement of the conjecture is that, for any product quantization codebook C trained by k-means or LBG and a publicly known Soft-ZCA whitening transformation W, the composite function PQ_C composed with W admits no quantum algorithm that achieves a search speedup beyond Grover's algorithm (that is, no acceleration factor alpha_Q greater than 2). The conjecture currently lacks a complete proof and is positioned as a structural working hypothesis supported by the convergence of multiple independent lines of evidence from quantum query complexity, computational geometry, statistical physics, cryptography, and neuroscience. The work organizes the conjecture into five concrete sub-obligations (exclusion of known quantum paradigms, statistical structure testing, reduction to known hard problems, formal reduction of quantum mode-finding to unstructured search, and experimental verification of near-uniform conditional entropy), honestly assesses the formalization level of each piece of supporting evidence, and identifies the critical open problems on the path to a full proof. For the Mnemosyne post-quantum distributed computing architecture, Han-SIQB constitutes the sole remaining condition required to fully close its dual physical security barriers (Landauer thermodynamic bound and Margolus-Levitin operation-count bound) in the time dimension, potentially enabling a security system grounded solely in physical laws rather than mathematical hardness assumptions. The paper also provides a detailed epistemological positioning of the conjecture, discusses historical precedents, and explicitly outlines fallback mechanisms (hybrid post-quantum cryptography mode) should the conjecture eventually be falsified. It invites collaboration from the quantum query complexity, algebraic geometry, and machine learning theory communities to advance its formalization or disproof. This upload includes the complete manuscript with all appendices, tables, and references. Keywords: product quantization, quantum blindness, structural conjecture, post-quantum security, Grover lower bound, whitening transformation, physical security, Mnemosyne
The threat mechanism of quantum computers to symmetric cryptography differs fundamentally from their penetrating attacks on asymmetric cryptography.Within the constraint network framework, this paper formalises the AES key spaceas a high-dimensional hypercube graph Qn, decomposes the AES round functionas a sequence of local rewiring operators, and reconstructs Grover’s algorithm asa quantum diffusion operator DQ. The central working hypothesis is that, undera custom metric of traversal entropy, Grover’s acceleration of AES key search canbe understood as a linear compression of traversal entropy—the classical bruteforce search has traversal entropy n bits, which quantum diffusion compresses ton/2 bits, so that the information barrier depth is linearly rescaled from n to n/2;this behaviour is termed in this paper a semi-penetrating response (Working Hypothesis 5.1, condition depth = 2). Consequently, AES-256 has an effective quantum security strength of 128 classical bits, and its immunity strategy is entropygrowth rather than algorithm replacement. The immunity of lattice cryptographyto quantum attacks, in contrast, is a composite strategy of structural replacement and entropy growth. The five fundamental operators (cohere, fission, rewire,spectral diagnosis, quantum diffusion) are closed under finite composition in thefree monoidal category defined by the algebra; whether they exhaust all knownquantum speedup mechanisms remains an open conjecture (Conjecture 8.1). Thisframework upgrades the quantum security assessment of symmetric cryptographyfrom a static taxonomy to a dynamical–categorical formalism, although the dimensional normalisation of the MBU inequality is currently heuristic in nature, and thedirection of the inequality and the physical meaning of ˆκ require further hardening.
his paper proves that exhaustive reconstruction attacks on product-quantized (PQ) embeddings transmitted in federated learning settings are physically impossible for any attacker conforming to the laws of physics. The proof establishes two independent physical barriers targeting distinct attacker classes. The first barrier, derived from Landauer's principle (Landauer, 1961), shows that irreversible classical attackers must expend energy exceeding 10 to the power of 38,778 joules to perform exhaustive reconstruction. This surpasses the total energy of the observable universe by 10 to the power of 38,709 orders of magnitude, making the attack thermodynamically impossible. The second barrier, derived from the Margolus-Levitin theorem (Margolus and Levitin, 1998), closes the reversible computation loophole identified by Bennett (1973, 1982). It shows that reversible classical and quantum attackers -- including fault-tolerant quantum computers using the optimal Grover algorithm -- require more operations than the entire observable universe can perform in its lifetime. Even with Grover acceleration, the required operations exceed the universal computational ceiling by at least 10 to the power of 19,277 orders of magnitude. Advances in quantum error correction, including recent below-threshold demonstrations, do not affect this conclusion: the Margolus-Levitin bound constrains operation rate for any physical system regardless of hardware architecture or error rates. The two barriers are physically independent. The first rests on the second law of thermodynamics; the second rests on the time-energy uncertainty relation of quantum mechanics. Neither can be invalidated by any computational or engineering advance. The information loss quantity driving both barriers -- 128,886 bits -- is derived from first principles from the mutual information upper bound of the PQ quantization mapping, accounting for side-channel leakage and encryption key entropy. A conditional security certificate (T14-C) integrates both barriers with an explicit premise dependency matrix. The principal open problem is the MC4b structural conjecture, which asserts that the PQ codebook presents as a black box to the attacker; all conclusions are conditional on this premise, which is under active investigation by the authors. The framework applies directly to value caches in transformer architectures. Application to RoPE-modulated key caches requires additional treatment and is declared out of scope. This work represents, to the authors' knowledge, the first application of a dual thermodynamic and quantum mechanical barrier to privacy guarantees for product quantization in federated learning, and the first systematic closure of the reversible computation loophole in this security context. The closest prior work, Coiteux-Roy (2022), applies Landauer's principle to general cryptographic protocols but does not address reversible computation, quantum attackers, or the specific information-loss structure of PQ quantization. This preprint is part of the Mnemosyne Project, a post-quantum distributed computing architecture grounding cryptographic security in physical laws rather than mathematical complexity assumptions.
This addendum provides targeted technical extensions and mathematical clarifications to themain monograph “Deterministic Spectral Manifold for Post-Quantum Cryptography” (ResearchGate, 2026) without altering its core structural results. Five core claims are updated with June 2026 technical precision to support rigorous intellectual property auditing. Section 1 formalizes the UMetric (arithmetic firewall) and corrects the characterization of ε0 = |δ| = 1/24 as a configurable system sensitivity parameter rather than an absolute topological lower bound. Section 2 evaluates the 220-dimensional protected subspace: the nf −nb = 220 mode count is explicitly reconciled, and the Grover security level is constrained to 2110, identifying the precise structural adjustments required for absolute NIST Level 1 compliance. Section 3 reframes the 72-phase entropy harvester, demonstrating that the structural δ = −1/24 defect bounds the deterministic grid while physical thermal jitter across boundary transitions provides the true randomness. Section 4 replaces the probabilistic “zero-knowledge” framing with a mathematically rigorous “computationally private projection”protocol. Section 5 scales back the side-channel evaluation from “immune” to “reduced attack surface,” detailing the benefits of fixed-N computational metrics. All extensions derive directly from the rigid DSM-861 baseline: Heegner discriminant D = −163, projection matrix P, and the 72-fold synchronization clock.
The development of quantum computing has been rapid, and an existential threat to computational hardness assumptions that underlie today's public-key cryptography has been encountered. This manuscript is a complete and thoroughly organized review of Post-Quantum Cryptography (PQC), discussing the mathematical concepts, complexity, and mechanisms of the algorithms that underpin quantum-safe security infrastructures. Rather than the principles of quantum mechanics, the analysis mathematically defines the basic principles of qubits, superposition, and entanglement, and clarifies common misunderstandings of the theory of parallelism in quantum mechanics. The research places cryptographic problems into the Bounded-Error Quantum Polynomial-Time (BQP) complexity class, thus highlighting the exact defects of classical algorithms. The quantum gate complexity of Shor's algorithm is compared to classical bounds as in Pollard's rho algorithm for the Elliptic Curve Discrete Logarithm Problem (ECDLP), for a detailed comparative cryptanalysis. The comparison highlights a very important “quantum security inversion” in that Elliptic Curve Cryptography (ECC) is much more susceptible to the early-stage fault-tolerant quantum computer as compared to the approach used today in RSA. It unfolds the architectural dependency of quantum algorithms, one by one, from the Quantum Fourier Transform (QFT) to Quantum Phase Estimation (QPE) and Shor's algorithm to Grover's algorithm. Last but not least, the manuscript examines emerging attack primitives such as lattice-based, code-based, and hash-based cryptography, their security models, side channel vulnerabilities, and the recently finalised Federal Information Processing Standards (FIPS 205, 203, and 204) that have been published by the National Institute of Standards and Technology (NIST).
This paper studies how post-quantum cryptographic (PQC) security assumptions can be represented and communicated through a structured, layered framework that is useful for technical interpretation but does not replace formal cryptographic proofs. We propose ``Explainable PQC,'' an interdisciplinary framework connecting three layers: (1) a complexity-based interpretive model that distinguishes classical security, quantum security, and reduction-backed hardness, drawing on computational complexity classes as supporting language; (2) an exploratory mathematical investigation applying combinatorial Hodge theory and polyhedral geometry to study structural aspects of lattice hardness; and (3)~an empirical experimentation platform, implemented in Julia, for measuring the behavior of lattice basis reduction algorithms (LLL, BKZ) in low-dimensional settings. The motivating case study throughout the paper is lattice-based PQC, including ML-KEM (FIPS 203) and ML-DSA (FIPS 204). The contribution of this paper is conceptual and organizational: it defines a layered interpretive framework, clarifies its scope relative to formal cryptographic proofs and reduction-based security arguments, and identifies mathematical and implementation-level directions through which PQC security claims may be more transparently communicated. This paper does not claim new cryptographic hardness results, new attacks, or concrete security parameter estimates.
Public debate on the quantum threat to blockchains—and much of the survey literature—is dominated by chain-level claims that mislocate the risk. We relocate the problem to the level at which an algorithm actually acts, showing that the post-quantum fate of any chain decomposes into three layers: which hardness assumption secures its signatures (Shor-vulnerable discrete-log/factoring, hash, or lattice); that assumption's status under the physically-realizable computational model (classical BPP vs quantum BQP); and the physical floor beneath it—unstructured-search lower bounds and serial-depth constraints, not a claim of unconditional security. At ground zero, the abelian-hidden-subgroup atom is efficiently broken under BQP (Shor), while no efficient BQP break is known for hash or lattice; hash security rests on the most conservative, best-tested conjecture; discrete-log rests on exploitable algebraic structure; and lattice assumptions, though buttressed by worst-case reductions unevenly across the lattice family, carry a much shorter cryptanalytic record. We locate the vulnerability in a single object—the exposed public key—and formalize compromise as a conjunction of exposure, feasibility, and non-revocation. Under a floor assumption (generic, unstructured search stays infeasible) this factors into four conjuncts answering to four distinct authorities—mathematics, the ledger, engineering, and the owner or protocol—with feasibility entailing brokenness. Each per-asset cryptanalytic defense we survey denies the primary one of these four conjuncts—an accounting identity over the four predicates (some defenses touch more than one; we classify by the primary), not a claim of exhaustiveness over an open-ended literature. We give an exposure taxonomy checked against the reference implementations and a first-party, reproducible measurement of the full Bitcoin UTXO set (block 957,269, July 2026): 1.93M BTC (≈9.6% of supply) carries a standing exposed public key—the defensible, structurally unambiguous figure—rising to 5–7M BTC (25–35%) once key-reuse is included, the range's width set by the P2SH/P2WSH script-hash upper bound. This decomposes exactly along the taxonomy's structural-versus-operational axis and quantifies Taproot's hidden-key regression (a directional shift on the exposure axis, minor by value); current resource estimates and a CRQC timeline; and a per-chain migration survey. A recurring result: account and governance architectures migrate most easily while immutable/UTXO chains are hardest—the property prized as a security virtue is the migration handicap. No unconditional security exists; all verdicts are contingent on unproven conjectures and the assumption that BQP is the physical ceiling of computation.