Backlog Metastability in Windowed Quantum Error Correction Decoding

1. Introduction

A fault-tolerant quantum computation is a race between two processors. The quantum hardware emits syndrome measurements on a fixed cadence, and a classical decoder must convert them into corrections fast enough for the computation to proceed. If decoding falls behind, corrections arrive too late to steer non-Clifford operations, the logical clock stalls, and the backlog compounds. This compounding is the backlog problem [1,2,17]. The condition usually stated for real-time viability is a utilization bound: the mean decode time per syndrome round must be below the round period, $\rho =\mathbb{E}\left[t_{\mathrm{decode}}\right]/T_{\mathrm{round}}<1$. Real-time decoding demonstrations state their stability case in exactly these terms, certifying against the mean per-round latency [17,19].

Our claim is that for an important class of decoding systems the utilization bound is the wrong condition. It is not merely conservative or approximate. It is structurally wrong, in the sense that it cannot distinguish systems that differ by orders of magnitude in reliability. The class is that of windowed decoders with superlinearly event-dependent cost: the decoder periodically takes a batch (window) of accumulated syndrome and pays a decode cost that grows faster than linearly in the number of detection events the window contains. Matching decoders have this shape in practice, and we measure it directly in Section 5.5.

Our contributions:

1.

A basin, not a threshold (Section 2 and Section 5.1). For window-cost exponent $\gamma >1$, the deterministic backlog dynamics have two fixed points. The upper one, $B^{*}$, is an unstable basin boundary that no mean-based analysis can see. At a single mean utilization (${\rho }_0=0.6$) we exhibit four decoders spanning unconditional stability to spontaneous failure.

2.

Noise erodes the boundary (Section 5.1). The stochastic system diverges at perturbations the deterministic map survives. The deterministic reference is drift-matched: its batch costs use the same Poisson moments as the stochastic system’s expectations, so the gap is fluctuation physics rather than a Jensen mean-inflation artifact. The analytic $B^{*}$ is therefore an unsafe provisioning line.

3.

Spontaneous failure at nominal headroom (Section 5.2). At $\gamma =1.5$ and ${\rho }_0=0.6$, escape from the basin is driven by ordinary Poisson fluctuation alone. The measured MTTF is $1,344\pm 289$ rounds, falling to $271\pm 33$ at ${\rho }_0=0.7$. The escape-time coefficient of variation is below one, so the failure is not memoryless, and MTTF alone under-describes it.

4.

Greedy catch-up is the failure mode, and bounded windows are the fix (Section 5.4). With a per-window overhead, the per-round cost $c\left(W\right)$ is minimized at small windows, and the measured stability cliff lands on the closed-form line $c\left(W\right)=T_{\mathrm{round}}$. The intuitive recovery policy, taking everything queued, is the divergent one.

5.

The exponent of a real decoder is anisotropic (Section 5.5). Sparse blossom is near-linear when windows grow in length and approximately quadratic when they grow in density. At matched event count, density-packed windows cost $1.6\times$ length-grown ones, and spatially clustered content, the blob-shaped syndrome footprint that leakage and cosmic-ray events actually produce [28,29], costs $7.6\times$. Bursts deliver density, and clustered density is the worst case we measured. The anisotropy is a property of the matching class rather than of one implementation: a second exact-MWPM decoder reproduces the density exponent ($\gamma =2.20$$[1.95,2.48]$), while BP+OSD is nearly event-independent, with no basin but orders of magnitude more cost per window (Section 5.6).

6.

Dispersion sets the clock, and finite memory obeys the same line (Section 5.3 and Section 5.4). At fixed mean load, MTTF collapses monotonically with the measured dispersion index of the arrival process, independent of how the dispersion is produced, so the Poisson escape times are upper bounds. With a finite queue the bounded-window rule carries over unchanged: cap placement is the same closed-form decision, and the failure mode on the wrong side of it is permanent data loss rather than latency.

Methodologically, all simulations run on a verification-first discrete-event engine (Section 4). Its runs are reproducible from content-addressed identities, its state machines carry runtime-checked invariants, and its paired comparisons are audited at the level of random draws. The underlying circuit model is cross-validated against Stim [3] mechanism for mechanism. The cross-validation caught three defects that internal verification could not (Section 4.2).

2. Model: Windowed Decoding as a State-Dependent Queue

Syndrome rounds arrive deterministically, one per period T. All times are in ticks, with $T=10$ throughout, read as $0.1\mu$s per tick against a $1\mu$s cycle. Round r carries $w_r\sim \mathrm{Poisson}\left(\lambda \right)$ detection events. We use $\lambda =1.6$ as the model’s reference rate; its physical anchoring is order-of-magnitude. Our cross-validated distance-3 memory at $p={10}^{-2}$ (Section 4.2) yields $1.59$ detection events per three-round shot, which is $0.53$ per round, while the distance-13 benchmark circuits of Section 5.5 carry $2.6$ ($p={10}^{-3}$) to $5.2$ ($p=2\times {10}^{-3}$) events per round on their much larger detector set ($\lambda \propto d^2$ at fixed p). Measured hardware brackets the same range: the detection probabilities reported for the Willow surface codes imply roughly $0.6$ to $4.2$ events per round at $d=3$ to 7 [17]. The value $\lambda =1.6$ sits inside that physical range. Because $c_1$ is calibrated to a target utilization at whatever $\lambda$ is chosen (see below), $\lambda$ sets the granularity of fluctuations rather than the mean load, and burst sizes quoted in events should be read against the chosen $\lambda$. A 200-event burst, for example, is 125 round-equivalents at $\lambda =1.6$. The decoder serves the queue in windows: when free, it removes up to W queued rounds (greedy: $W=\infty$) as one batch and occupies itself for

$$t\left(\mathrm{batch}\right)=\max \left(1,⌈c_0+c_1{E}^{\gamma }⌉\right)\mathrm{ticks},$$

(1)

where E is the total number of detection events in the batch. The one-tick floor matches the simulated machine, and the integer boundary matters for the $\gamma =2$ entries of Table 1. Equation (1) is the declared cost model whose exponent Section 5.5 measures on a production decoder. We calibrate $c_1$ so that the steady-state single-round cost matches a target mean utilization: $c_0+c_1\mathbb{E}\left[w^{\gamma }\right]={\rho }_{0}T$.

2.0.0.1. The deterministic map.

Under greedy windowing, a backlog of B rounds is served as one batch carrying $E\sim \mathrm{Poisson}\left(B\lambda \right)$ events, and $t/T$ new rounds arrive during the service. The deterministic (mean-drift) reference evolves the backlog by the drift-matched map

$$B^{\prime }=f\left(B\right)={\displaystyle \frac{c_0+c_1\mathbb{E}\left[E^{\gamma }\right]}{T}},E\sim \mathrm{Poisson}\left(B\lambda \right).$$

(2)

Using the Poisson moment rather than the naive ${\left(B\lambda \right)}^{\gamma }$ keeps the reference system at the same mean drift as the stochastic one. With $w\equiv \lambda$ the reference would run at a lower effective utilization by Jensen’s inequality, and part of any stochastic-versus-deterministic gap would then be a calibration mismatch rather than fluctuation physics. The correction is a few percent in the boundary region: the integer fixed points of Table 1 move by at most one round relative to the naive map, but the deterministic critical bursts of Figure 2 move by up to 20%.

For $\gamma =1$, f is affine with a single, globally attracting fixed point whenever ${\rho }_0<1$. This affine case is the textbook condition, and the queueing-literate reader will recognize it as valid precisely for state-independent service, which is the assumption that superlinear event-dependent cost violates. For $\gamma >1$, f is convex and has two fixed points: a stable operating point $B_{\mathrm{lo}}$ and an unstable boundary $B^{*}$. Any excursion beyond $B^{*}$, whether a burst or an unlucky run of fluctuations, diverges permanently, in a system whose mean utilization may be far below one. Table 1 shows how shallow the basin becomes as $\gamma$ grows.

Figure 1. (a) The drift-matched backlog map, Equation (2), at ${\rho }_0=0.6$. For $\gamma =1$ the single fixed point is globally attracting. For $\gamma >1$ the map is convex, and the open circles mark the unstable boundary $B^{*}$, from which the backlog flows away in both directions (arrows); the callout marks the $\gamma =1.5$ boundary, $B^{*}=6$. (b) Basin depth $B^{*}$ versus mean utilization. At the same ${\rho }_0$ the basin spans two orders of magnitude across exponents that identical mean-throughput measurements cannot distinguish.

Figure 1. (a) The drift-matched backlog map, Equation (2), at ${\rho }_0=0.6$. For $\gamma =1$ the single fixed point is globally attracting. For $\gamma >1$ the map is convex, and the open circles mark the unstable boundary $B^{*}$, from which the backlog flows away in both directions (arrows); the callout marks the $\gamma =1.5$ boundary, $B^{*}=6$. (b) Basin depth $B^{*}$ versus mean utilization. At the same ${\rho }_0$ the basin spans two orders of magnitude across exponents that identical mean-throughput measurements cannot distinguish.

Figure 2. Measured $P\left(\mathrm{divergence}\right)$ versus burst size at ${\rho }_0=0.6$ ($n=40$ per point; Wilson 95% intervals), with each exponent’s deterministic critical burst as a dashed vertical line (bisection on the drift-matched noise-free dynamics). Every stochastic transition sits at or left of its deterministic line. Fluctuations carry the system over the boundary at perturbations the mean-field analysis survives, and $\gamma =1.5$ requires no perturbation at all.

Figure 2. Measured $P\left(\mathrm{divergence}\right)$ versus burst size at ${\rho }_0=0.6$ ($n=40$ per point; Wilson 95% intervals), with each exponent’s deterministic critical burst as a dashed vertical line (bisection on the drift-matched noise-free dynamics). Every stochastic transition sits at or left of its deterministic line. Fluctuations carry the system over the boundary at perturbations the mean-field analysis survives, and $\gamma =1.5$ requires no perturbation at all.

3. Related Work

Windowed decoding is as old as the surface code itself. Overlapping-window decoding appears already in Dennis et al. [8], and the modern real-time literature develops it into sliding-window and parallel-window architectures: Skoric et al.’s parallel window decoding [9], Tan et al.’s scalable window scheme [10], and Bombín et al.’s modular decoding [11]. Alongside these sit hardware decoders engineered for bounded latency, including LILLIPUT [12], Helios [13], and Barber et al.’s real-time collision-clustering decoder on FPGA [14]. The most complete demonstration to date is the real-time decoder of the Willow below-threshold experiment: streaming sparse blossom over ten-cycle processing blocks, with threads assigned to spacetime regions and fused asynchronously, holding a mean latency of $63\mu$s over ${10}^6$ cycles at $d=5$ against a $1.1\mu$s cycle [17]. Caune et al. integrate a sub-microsecond FPGA decoder directly into the control loop and report the backlog problem avoided, certified by mean per-round latency [19]. On the qLDPC side, Relay-BP targets real-time belief-propagation decoding of bivariate-bicycle codes [20], now demonstrated on FPGAs [21]; an iteration-bounded BP decoder caps its cost at an accuracy price, the same exchange Section 5.4 quantifies for windows. All of these architectures bound their windows by construction, historically motivated by latency and locality. Adaptive-window designs grow the window when decoder confidence drops [22]; expansion triggered by dense content is state-dependent service cost by construction, and without a bound equivalent to $c\left(W\right)<T$ it reinstates the convex coupling of Section 2 at the moment expansion is most expensive. System-level analyses of the real-time stack identify round time and tail latency, rather than mean throughput, as the binding constraints [25].

Our single-server greedy queue is the base case whose pathology explains, in dynamical-systems terms, why bounding the window is not merely convenient but stabilizing: greedy catch-up is the divergent policy (Section 5.4), and a bounded window with $c\left(W\right)<T$ removes the unstable fixed point entirely. The backlog problem itself is stated in Terhal’s review [1] and quantified by Smith et al. [2] at the utilization level. Our contribution is the structure below the utilization level.

The classical control side of the field is moving in a direction that makes this structure more binding, not less. HRL Laboratories has demonstrated a digitally controlled silicon quantum processing unit whose control electronics, including the syndrome-extraction sequencing for a distance-5 repetition code, run on a custom cryogenic CMOS controller inside the cryostat, with no real-time input from room-temperature equipment [16]. Decoding in that demonstration was a simple parity check evaluated offline. Section 6 returns to what the basin picture implies for decoders that must live within a cryogenic power budget.

On the queueing side, bistability and metastable congestion collapse in systems whose service degrades with state are classical subjects. Slotted ALOHA exhibits bistability [26], and loss networks exhibit metastability [27]; both show the two-fixed-point structure of Equation (2), and that community will recognize the convex one-dimensional map on sight. The new content here is the QEC instantiation: the identification of the decoder’s event-dependent cost as the state coupling, the measured anisotropy of that cost in a production decoder, and the resulting provisioning requirement. The excursion spectrum that drives escapes has direct physical referents. Cosmic-ray events produce catastrophic, spatially clustered error bursts in superconducting arrays [28], and leakage accumulates into correlated syndrome content [29]. On gap-engineered devices the measured spectrum has shifted but not vanished: the Willow repetition-code experiments observe correlated bursts about once per hour, localized to roughly 30 qubits, with detection probabilities elevated three- to six-fold and decaying over about $400\mu$s [17]. The residue has a measured mechanism: ionizing radiation transiently raises the quasiparticle density and produces correlated phase-error bursts lasting about a millisecond, which survive gap engineering [23]. All of these deliver exactly the dense, clustered windows that Section 5.5 measures as the most expensive per event. Correlated noise enters the decoding literature as an accuracy problem, because decoders built on independent-error models mismatch the true error distribution. The measurements of Section 5.5 give it a second consequence: clustered syndrome is also the most expensive content per event, so one physical footprint degrades accuracy and stability together.

4. Methods

4.1. Verification-First Simulation

All experiments run on polysim, a discrete-event simulation engine built around four disciplines that this study exercises end to end. First, every run is reproducible from a content-addressed identity (world hash, scenario hash, seed, replication index) and reproduces its journal digest byte for byte. Second, the simulated components are state machines with declared invariants checked on every transition; the decoder queue, for instance, carries machine-checked rules that its published backlog equals its actual queue and that a dropped round is a journaled refusal, never an omission. Third, paired comparisons run under common random numbers with a mechanical audit that the paired scenarios drew identical streams (every comparison below passed). Fourth, statistics that cannot be computed are refusals with named causes, never silently absent numbers. Across all runs reported in this paper the invariant monitors evaluated 21 declared rules per replication with zero violations.

Perturbations (bursts) are scheduled, not drawn, so the background noise realization is byte-identical across every scenario of a sweep. The exponent and calibration sweeps consume no random draws at all.

4.2. Cross-validation of the Circuit Model against Stim

The event rate $\lambda$ and the burst semantics are grounded in a concrete code: a distance-3 rotated surface-code memory (9 data + 8 ancilla qubits, 3 rounds, ideal final readout) simulated by exact Pauli-frame propagation, with a generated layout, machine-checked schedules, and an exhaustive circuit-fault-distance proof used as a gate on all sampling experiments. The proof reproduces the known schedule-dependent fault-distance results, hook error witness included [5,6].

The model is cross-validated against Stim [3] at three levels. Structural: the single-fault symptom sets (which detectors fire, and whether the logical observable flips) of our mechanism table and Stim’s detector error model are identical, with 199 distinct symptoms for the good schedule and 213 for the bad one, and with per-symptom probabilities agreeing to 1.9%, the $O\left(p\right)$ cross terms between channel composition and linear addition. Distance: Stim’s undetectable-logical-error search returns minimum weights 3 and 2, matching our proofs. Statistical: ${10}^6$ Stim shots decoded by our own lookup decoder give logical error rates 0.0283 / 0.0649 and detection fractions 0.0662 / 0.0657, each inside our engine’s own intervals ($0.0269\pm 0.0022$, $0.0656\pm 0.0034$, $0.0668/0.0665\pm 0.0026$).

The cross-validation caught three defects that internal verification (invariants, known-answer tests, reproducibility) could not have caught, and we consider this the methodological finding of the exercise: a physically non-deterministic detector definition invisible to a Pauli-frame simulator by construction, a silent gap in a fault table labeled “proved,” and a probe denominator off by exactly $24/20$ (Appendix A details all three). Internal verification bounds self-consistency; only an external referee bounds truth.

5. Results

5.1. Stability Is a Basin

Table 2 is the central result. Every cell has the same mean utilization (${\rho }_0=0.6$), the same arrival process, and the same scheduled burst profile (40 rounds, beginning at round 400 of 4,000). Only the cost exponent and the burst magnitude vary. Divergence is classified as more than 100 rounds of outstanding work at the horizon. Recovered runs end near zero, diverged runs end in the hundreds to thousands, and the indicator is itself a probe whose ensemble mean carries a confidence interval.

First, mean-based provisioning cannot distinguish these four systems. At identical ${\rho }_0$ their behavior spans unconditional stability ($\gamma =1$ absorbs a burst of $500\times$ the per-round load and recovers fully) to failure without provocation. Second, the stochastic boundary sits below the deterministic one, and because the deterministic reference is drift-matched, the gap is genuinely fluctuation-activated rather than a mean-calibration artifact. The drift-matched critical bursts (bisection on the dynamics of Equation (2); dashed lines in Figure 2) are 254, 55, and 36 events for $\gamma =1.15$, $1.25$, and $1.5$. Against these, $\gamma =1.25$ diverges in 43% of runs at a burst of 50, below its deterministic critical burst of 55, and $\gamma =1.15$ diverges in 8% of runs at 200, which is $0.8\times$ its deterministic critical burst. Provisioning against the analytic $B^{*}$ therefore still fails stochastically. Third, the sharpest cell is $\gamma =1.5$ at zero burst: 100% divergence in a system whose deterministic map survives bursts up to 36 events. This failure is noise-activated escape from a metastable basin, and we quantify it next.

5.2. Spontaneous Escape Is Fluctuation-Driven and Sub-Exponential

The failure rate is acutely sensitive to utilization, with a five- to forty-fold MTTF collapse per $+0.1$ of ${\rho }_0$. The measured $0.6\to 0.7$ step is $1344/271\approx 5\times$; the censored $0.5\to 0.6$ step is at least $9\times$ and, under any reasonable extrapolation of the censored row, plausibly around $40\times$. The basin depth itself barely moves across the same range (Table 1), so the sensitivity lies in the escape rate, not the barrier position, as in thermal escape over a fixed barrier [7]. The total escape time’s coefficient of variation is consistently below one: escape is not memoryless. A provisioning methodology that quotes MTTF alone therefore under-describes the failure process, because the distribution’s shape matters.

Decomposing each escape path at the analytic boundary shows where the determinism lives. For each replication we record the first crossing of $B^{*}$ and the time from that crossing to the 100-round threshold. The waiting time to first crossing is memoryless in both ensembles ($\mathrm{CV}=1.05$ at ${\rho }_0=0.6$, $0.96$ at $0.7$; $n=60$), consistent with noise-activated escape. The breakout leg behaves differently at the two utilizations. At ${\rho }_0=0.7$ it is markedly narrower than exponential ($219\pm 122$ (sd) rounds, $\mathrm{CV}=0.56$), which is the wait-then-ramp picture. At ${\rho }_0=0.6$, where $B^{*}$ is only 6 rounds, the first crossing is a weak committor: the backlog brushes the shallow boundary and re-enters many times before a decisive excursion, so the first-crossing decomposition stays memoryless ($\mathrm{CV}=1.09$) even though the total escape time is sub-exponential ($\mathrm{CV}=0.83$). For basins this shallow, no single backlog level cleanly separates waiting from breakout. The sub-exponential total is the signature that does not depend on that choice.

Figure 3. Escape-time survival curves at $\gamma =1.5$, no perturbation ($n=60$ each; the ${\rho }_0=0.5$ curve is right-censored at the horizon). Dashed: exponential references with the matching means. The measured curves are convex relative to memoryless decay, with few early escapes and then a faster-than-exponential fall. This shape is the CV $<1$ signature of a waiting time followed by a near-deterministic breakout.

Figure 3. Escape-time survival curves at $\gamma =1.5$, no perturbation ($n=60$ each; the ${\rho }_0=0.5$ curve is right-censored at the horizon). Dashed: exponential references with the matching means. The measured curves are convex relative to memoryless decay, with few early escapes and then a faster-than-exponential fall. This shape is the CV $<1$ signature of a waiting time followed by a near-deterministic breakout.

5.3. Dispersion Sets the Clock

The escape times above assume Poisson arrivals, dispersion index $D=1$. Measured devices are overdispersed: detection-event rates show unexplained spikes [16] and burst phenomenology at every timescale [28,29]. To measure what dispersion alone does to the clock, we modulate the arrival rate with a scheduled square wave, $\lambda$ alternating between ${\lambda }_0(1\pm a)$ with half-period $\Pi$ rounds and a per-replication phase offset, and recalibrate $c_1$ against the modulated stationary moment, $c_0+c_1·{\mathrm{mean}}_{\varphi }\mathbb{E}\left[\mathrm{Poisson}{\left({\lambda }_{\varphi }\right)}^{\gamma }\right]={\rho }_{0}T$, so the mean load is held fixed and the experiment varies dispersion without varying drift (the same Jensen discipline as Equation (2)). The achieved dispersion is measured per arm, as the variance-over-mean of event counts in 100-round windows, rather than derived. The $a=0$ baselines are common-random-number re-runs of Table 3 and reproduce it exactly.

Three findings follow (Table 4, Figure 4). First, MTTF collapses monotonically with measured dispersion at fixed mean load: fourfold by $D\approx 2.8$ at ${\rho }_0=0.6$, sevenfold by $D\approx 17$. The effect is largest where the headroom is largest: a twelve percent dispersion excess ($D=1.12$) already lifts the ${\rho }_0=0.5$ escape probability from 20% to 67%, and by $D\approx 2.8$ the previously censored ensemble escapes every time, at least fourfold below its censored median. Second, dispersion is the right axis: the $\Pi =20$ and $\Pi =80$ series fall on a single MTTF-versus-D curve, so the modulation period matters only through the dispersion it produces. Third, the escape-time CV stays below one throughout but falls with dispersion, to about $0.35$ at high D. Strongly modulated arrivals therefore make failure more deterministic rather than more memoryless: the system dies on the first sufficiently adverse high-rate phase, and the wait for one is narrow. For provisioning, the Poisson row of Table 3 is the best case at its mean load, and the correction for a device’s measured D is a multiplicative MTTF collapse read off Figure 4.

5.4. Greedy Catch-Up Is the Failure Mode

With a realistic per-window overhead ($c_0=5$ of the 10-tick budget), the per-round cost of a width-W window, $c\left(W\right)=\left(c_0+c_1\mathbb{E}\left[E^{\gamma }\right]\right)/W$ with $E\sim \mathrm{Poisson}\left(W\lambda \right)$, is minimized at small W. Overhead dominates tiny windows, and the superlinear term dominates large ones. This section operates at $c_0=5$ and $c_1=1.17$, a drift-matched single-round steady cost of 7.9 ticks ($\rho \approx 0.79$). This is deliberately hotter than the ${\rho }_0=0.6$ used elsewhere, in order to place the window sweep across the stability line. For bounded W the map is asymptotically affine in B with slope below one whenever $c\left(W\right)<T$, so bounding the window removes the upper fixed point entirely. There is no basin boundary to fall over, and stability is global. Greedy windowing is what restores the convexity and, with it, the basin.

The condition $c\left(W\right)<T$ is necessary for stability but is not a performance guarantee. As $c\left(W\right)\to T$ the drain rate $T-c\left(W\right)$ vanishes and the recovery time after a burst diverges even on the stable side. Table 5 shows both regimes. Windows of 2–8 rounds absorb a 200-event burst with single-digit mean backlogs. The window $W=16$ sits almost exactly on the line ($c\left(W\right)=9.9$ against $T=10$): it is stable in the strict sense, with no upper fixed point, but its post-burst drain is about 0.1 tick per round, and the “90%” entry is the more-than-100-outstanding-at-horizon classifier firing on a slow transient. A re-run at a $20,000$-round horizon ($n=30$) confirms the distinction. The $W=16$ backlog peaks near 353 rounds and is draining by the horizon (ensemble mean 209, final 176), with 60% of replications still above the 100-round line; this behavior is slow recovery. The window $W=32$, with $c\left(W\right)=13.7>T$, grows without bound (final backlog near 5,400 and rising); this growth is instability. The two regimes call for different remedies: more margin in the first case, a different window in the second. The greedy policy, taking everything queued, which is the intuitive recovery move, diverges always, with a mean backlog three orders of magnitude above the bounded optimum.

The quantity $c\left(W\right)$ is a throughput criterion, and the optimum it selects ignores accuracy. Short windows harm matching accuracy at window boundaries, which is why practical designs use overlapping or fused windows of order the code distance, and why real-time operation carries a measured accuracy cost ($\Lambda =2.0$ in real time versus $2.18$ offline in the Willow experiment [17]). It therefore selects among accuracy-admissible windows; it does not license windows below the accuracy floor.

5.4.0.2. Finite memory.

The queue above is unbounded, so escape manifests as latency. A decoder co-located with control hardware has a hard queue bound, and the failure mode becomes data loss: a round arriving at a full queue is dropped (drop-newest here, as a journaled refusal, never an omission). The design question is where the cap C may sit, and the answer is the same closed-form line. Under greedy service a cap is an implicit window bound: with C on the stable side of $c(·)=T$, every excursion is a bounded loss episode followed by full recovery, and the loss under the standard burst is essentially the burst overshoot above the cap. With C in the unstable range, the queue pins at the cap and sheds rounds indefinitely, a saturated, permanently lossy state, and more memory makes greedy strictly worse: at $C=128$ the greedy policy sheds $42\times$ the rounds it does at $C=8$ (Table 6). A bounded window is immune by construction: $W=4$ never saturates at any cap, and its loss vanishes once the cap clears the excursion peak (4.5 rounds dropped at $C=128$ under the burst, zero without it). A second regime appears under hotter load. In the escape configuration of Section 5.2, where even $c\left(8\right)=11.9>T$, a cap of 8 is too small to pin for 1,000 consecutive rounds, and the queue runs instead as a lossy governor, shedding a steady ≈2% of rounds forever, converting instability into chronic data loss rather than latency. For the hardware question of how much memory the decoder queue needs, the rule is: enough for the excursion spectrum’s overshoot above the operating point, and never a cap whose implicit window lands on the unstable side of $c(·)=T$.

5.5. The Measured Exponent of a Production Decoder Is Anisotropic

The cost model (1) was declared; this section measures it. PyMatching 2 (sparse blossom [4]) decodes Stim-generated rotated-surface-code windows ($d=13$). Decode time for individual shots, stratified by detection-event count and timed as a minimum over repeated calls, is regressed against events, with $\gamma$ fitted by grid search (closed-form least squares in $(c_0,c_1)$ at each candidate $\gamma$, SSE on linear time) and reported with a 5%-SSE band. Because a three-parameter power law trades $c_0$ against $\gamma$ at the low-E end, we re-fit with $c_0$ pinned to an $E\to 0$ extrapolation as a robustness check. The exponents move from 1.14 to 1.16 (window) and from 2.31 to 2.05 (density), so the anisotropy is not a fit degeneracy.

The exponent depends on how the events arrive:

• Window axis (the window grows in rounds at fixed density, which is ordinary catch-up): $\gamma \approx 1.1$–$1.2$, bands $[1.01,1.35]$ across passes, $R^2\approx 0.97$. Near-linear.
• Density axis (fixed 40-round window, syndrome packed denser by raising p): $\gamma \approx 2$, bands spanning $[1.7,2.5]$ across passes, $R^2\approx 0.95$. Approximately quadratic.
• Cluster axis (fixed window, fixed background $p={10}^{-3}$, with the k detectors nearest a random space-time center flipped, the syndrome footprint of a localized burst [28]): a global power-law fit is poorly conditioned here, because decode time at fixed E varies severalfold with blob location (boundary versus bulk), so we report the matched-event form below.
• Matched-event check (robust to the thermal drift that moves the absolute fits; all three axes measured adjacently in one process): at 600–900 events, density-packed windows cost $\mathbf{1}.\mathbf{6}\times$ length-grown ones (1.52× in an earlier pass), and clustered windows cost $\mathbf{7}.\mathbf{6}\times$ length-grown ones, which is $4.8\times$ the uniformly densified windows at the same event count.

The mechanism is consistent with the algorithm’s structure. In blossom-type matching, growing the window in length adds graph volume while defect interactions stay local, whereas packing defects closer multiplies alternating-tree and blossom interactions per defect. That is a plausible route to near-quadratic scaling, and clustering then concentrates the interactions in one region. In Figure 5, the density series’ larger intercept (about 80 $\mu$s versus about 20 $\mu$s at small E) reflects the fixed 40-round graph paying its size at low occupancy, while the window series builds small graphs at small E. At matched E the two sweeps also differ in graph size (a 160-round sparse window versus a 40-round dense one), so the $1.6\times$ ratio folds together density and graph-size effects. The cluster series, which holds both the graph and the background fixed, isolates content structure, and it is the cleanest evidence that burst-shaped syndrome is intrinsically expensive.

Mapping the measured exponents through Equation (2) gives Table 7, where $\gamma =1.09$ and $1.23$ are the two independent passes’ point estimates and $1.35$ is the upper edge of the pooled 5%-SSE band. Steady-state catch-up sits in a deep basin, thousands of rounds at $\gamma =1.09$. But within the window-axis confidence band alone, $B^{*}$ at ${\rho }_0=0.6$ ranges from effectively infinite to 11 rounds: real-time provisioning requires pinning the cost exponent to about $\pm 0.1$, a requirement we have not seen stated anywhere in the literature. Burst content, on the density axis, faces a basin of 2–4 rounds for ${\rho }_0$ between 0.5 and 0.8. A sparse-blossom-class decoder provisioned on its steady-state throughput curve therefore meets bursts on a cost curve two exponent classes worse, and the cluster measurement says even that is the optimistic reading.

On this machine, single-core per-round decode time corresponds to $\rho \approx 2.0$ ($d=13$, $p={10}^{-3}$) up to $\rho \approx 4.8$ ($d=21$) against a $1\mu$s cycle. One core cannot hold real time at all, which is why real systems window and parallelize, and why the windowing policy is the operative lever. This does not contradict the published sparse-blossom throughput of roughly $1\mu$s per round at $d=17$ and $p={10}^{-3}$ [4]. That figure is batched C++ throughput, while ours is per-call invocation through the Python boundary, whose constant lands in $c_0$ and whose per-shot dispatch forgoes batching. Per-call is the operationally relevant mode for real-time windowing: a window must be decoded when its deadline arrives, not when a batch fills.

5.6. The Anisotropy Is a Property of the Matching Class

Everything above measures one decoder. To test whether the anisotropy is a property of PyMatching or of its class, we ran the same three axes over three more decoders (Table 8): fusion-blossom, a second exact-MWPM implementation whose own empirical claim is near-linear scaling; the ldpc package’s union-find decoder; and BP+OSD as an intended superlinear control. Accuracy differences across decoders are out of scope, since this measures cost shape only.

Three conclusions follow. First, the anisotropy generalizes across the matching class. Fusion-blossom reproduces the density exponent with the tightest density band in this paper (${\gamma }_{\mathrm{density}}=2.20$$[1.95,2.48]$, $R^2=0.97$), though its anisotropy expresses differently: a higher window exponent (1.49) and no matched-E density premium, but a clustered premium of $2.06\times$. The density-to-window exponent gap, which is the quantity the basin analysis depends on, survives the implementation change. This pass also re-reproduces PyMatching’s own numbers within the earlier bands, a third consistency check on Section 5.5’s fits. Second, the software union-find decoder is not credibly fit by a power law at all, but its matched-E ratios are decisive: dense content costs $60\times$ and clustered content $29\times$ its own length-grown windows, at absolute times (0.1–6.8 s per window) nowhere near real time. We scope this to the measured implementation (matrix-inversion union-find in software); it says nothing about hardware collision-clustering decoders [14], which would need the same three-axis measurement on their own silicon. Third, the intended positive control refuted its prediction, and the refutation completes the taxonomy. BP+OSD’s cost is set by the graph and not by the events: the window exponent is 0.97 (pure graph growth), and denser windows are cheaper per event ($0.28\times$ at matched E). For BP-class decoders the utilization condition $\rho <1$ is therefore approximately valid, because there is no event-dependent feedback to build a basin, but that validity is bought at a per-window cost of $800\times$ PyMatching’s and $33\times$ fusion-blossom’s at matched event count (≈640 ms for a 160-round window here). The taxonomy is then: matching-class decoders are cheap on average and metastable under bursts, and BP-class decoders are stable by construction and unaffordable per window. The basin is the price of event-adaptive decoding, and a provisioning methodology must know which side of that trade its decoder sits on.

6. Discussion

For windowed decoders with superlinearly event-dependent cost, report the basin, not the utilization. A provisioning claim should state (i) the measured cost exponent on both axes with a confidence band; (ii) the implied $B^{*}$ at the operating utilization; (iii) the expected excursion spectrum, that is, burst sizes and rates from the device’s leakage and radiation environment, for which measured magnitudes exist [17,23,28,29]; and (iv) the window bound W placing $c\left(W\right)$ safely below the round period, with margin, since the recovery time diverges as $c\left(W\right)\to T$ even on the stable side. Items (i) and (iv) are a measurement and a design choice, item (ii) is closed-form, and item (iii) is the one input this paper takes from outside. The newest decoder implementations already report worst-case rather than mean latency [24], the reporting posture that items (i) through (iv) systematize. Parallel-window architectures [9,10,11] satisfy (iv) by construction; this paper supplies the dynamical-systems reason that the construction is load-bearing. Code class moves the exponent as well: noise-biased cat-qubit architectures suppress bit-flips passively and reduce active correction to a repetition code [18], whose quasi-one-dimensional matching graph should sit near $\gamma =1$ on all three axes, placing that architecture, pending measurement at its operating density, in the unconditionally stable row of Table 1. The basin is a property of the code and decoder pair, not of quantum error correction as such.

The Willow below-threshold experiment is the existence proof that the mitigation regime is practical [17]. Its real-time decoder never executes greedy catch-up: syndrome is processed in bounded blocks and fused asynchronously, a working instance of the bounded-window rule, and it holds its mean latency constant over a million cycles at $d=5$. The same data shows the tail our analysis predicts: infrequent latency spikes above $1$ms, roughly nine hundred cycles of outstanding work, absorbed and drained on the stable side. The spontaneous failures of Section 5.2 are a property of the greedy policy class, not a prediction about deployed systems that already bound their windows. The open question is margin, not existence. Syndrome volume grows quadratically with distance and decoder latency grows with code size, as that experiment’s own outlook notes, and the basin accounting above is the instrument for deciding how much margin the next factor of $d^2$ requires. A burst of the magnitude and duration measured above carries roughly $1,500$ to $2,500$ excess detection events, so real excursions do not probe the edge of any basin in Table 2; they overrun it outright. Surviving them is therefore entirely a question of the drain rate $T-c\left(W\right)$ against a once-per-hour recurrence, which is Section 5.4’s regime.

HRL Laboratories has reported a digitally controlled silicon quantum processing unit: a 54-dot array configured as up to 18 exchange-only spin qubits, operated entirely by a custom cryogenic CMOS controller inside the cryostat, executing a distance-5 repetition code over hundreds of autonomous syndrome-extraction rounds with sub-microsecond operations [16]. That demonstration solves, at the chip level, exactly the half of the real-time problem this paper takes as given: syndrome generation and control at rate, with all control signals generated inside the cryostat. Readout in that system is still digitized at room temperature, and decoding was a simple parity check evaluated offline; real-time decoding at error-correction speed remains open on that platform. Wherever the future decoder lands, the constraint is the same. On the room-temperature side it inherits the latency of the link that carries the syndrome out of the refrigerator. Inside the cryostat it inherits a hard power and area budget (the reported controller draws $3.5$W at $4$K), and a cryogenic decoder cannot buy its way out of a backlog excursion with burst compute, because the compute ceiling is fixed at design time. In that regime the windowing policy is not one lever among several; it is the lever. The provisioning discipline above then becomes a design input, since nothing can be added after the cryostat closes. The demonstration also shows that sub-microsecond operation is no longer specific to superconducting hardware, so the round period in our model should be read as a platform parameter rather than a superconducting constant.

Two features cut against intuition. Greedy catch-up, the natural recovery behavior and the default of any decoder that simply processes what has accumulated, is exactly the policy that converts a transient overload into a permanent one. And the deterministic basin boundary, though closed-form and correct as far as it goes, is not a safe engineering line: fluctuations carry the system over it from below, at rates our escape-time measurements quantify.

What this model deliberately omits marks the next experiment. The feedback studied here is computational: backlog leads to costlier windows. The physical feedback, in which a stalled logical clock idles qubits and raises the syndrome density the decoder then faces, compounds along the measured density axis, which is the quadratic one. The HRL experiment measures this ramp directly: without leakage-reduction units the detector event fraction grows steadily with syndrome round, and only their inclusion holds it stationary [16]. In our terms, leakage mitigation is what keeps $\lambda$ constant; its absence hands the decoder a rising $\lambda \left(r\right)$ under which the operating point and the basin boundary drift toward each other and annihilate.

We measured this open-loop half of the coupled feedback directly, with a scheduled ramp $\lambda \left(r\right)={\lambda }_0(1+\beta r)$ at fixed service calibration (Figure 6). Two closed-form clocks bound the deterministic death: $r_{\mathrm{drift}}$, where the single-round drift reverses, and $r_{\mathrm{ext}}$, the saddle-node round where the map loses its fixed points. The deterministic system dies a fixed ≈143 rounds after $r_{\mathrm{drift}}$ across the decade of $\beta$ in which both clocks are defined, which is the intrinsic superlinear runaway time and a constant of the decoder rather than of the ramp. The dynamic saddle-node ${\beta }^{-2/3}$ ghost scaling never engages, because the classification threshold sits two orders of magnitude above the ∼1-round tangency backlog. The stochastic system does not wait for either clock: it dies 303 rounds early at $\beta ={10}^{-3}$, 6,100 rounds early at $\beta ={10}^{-4}$, and at $\beta \le 3\times {10}^{-5}$, where no extinction exists inside the horizon at all, every replication still fails, which is the moving-boundary form of the unsafe analytic boundary. The control arms carry the sharpest result: a constant rate equal to the ramp’s time-average kills the system sooner at every slope, by factors from $2\times$ to $17\times$, because the ramp spends its early life benign while the constant arm runs hot from round zero. Neither the time-averaged utilization nor stationarity alone predicts the failure epoch. The load trajectory does, and provisioning against a drifting rate must integrate it. The remaining closed-loop half, in which the stalled clock itself raises $\lambda$, requires connecting the queue back into the circuit-level noise model, which our simulation framework supports but this paper does not yet exercise.

7. Limitations

The cost curve (1) is a declared model. The primary calibration (Section 5.5) measures one decoder (PyMatching 2.4.0), on one machine (a laptop-class x86 core), for one code family, with the Python call boundary contributing a constant to $c_0$. The class comparison (Section 5.6) adds three software implementations under the same conditions, of which the union-find entry should not be read as representative of hardware union-find decoders, and all four exclude decoding accuracy from scope. The density-axis exponent moves by roughly $\pm 0.3$ with thermal state, and the matched-event ratio is the stable form of that claim. The cluster measurement flips detectors in a space-time ball, the syndrome footprint of a localized burst, rather than simulating a microscopic burst mechanism; it isolates what blob-shaped syndrome costs the matcher, not how a specific physical event produces it. The cost model applies to decoders whose batch grows with backlog: per-call windowed invocation, catch-up after stalls, and adaptive-window designs. Streaming architectures that hard-cap the decode problem on a constant-size graph buffer [17] have already applied the mitigation of Section 5.4; for them the state dependence moves into queueing delay rather than service cost, and they inherit the slow-recovery regime rather than the basin. The model’s event rate $\lambda =1.6$ is an order-of-magnitude anchor between the measured distance-3 rate (0.53/round) and the benchmarked distance-13 rates (2.6–5.2/round), and it is treated as backlog-independent. The arrival process is Poisson with independent rounds except where Section 5.3 deliberately modulates it. Measured devices show correlated fluctuations, including unexplained spikes in detection-event rates on a silicon platform [16] and catastrophic correlated bursts on superconducting ones [28], and Section 5.3 turns the resulting caveat into a measurement: the Poisson MTTFs of Table 3 are upper bounds, and a dispersion index near 3, well inside reported device behavior, costs fourfold at ${\rho }_0=0.6$. The square-wave modulation is one dispersion mechanism among many, and a device’s measured D enters through Figure 4 only to the extent that MTTF depends on D alone, which we verified across two modulation periods but not across mechanisms. The finite-buffer study fixes drop-newest semantics; a drop-oldest queue loses different rounds with different logical-error consequences, and the logical cost of a dropped round is outside the queue model’s scope, since we count rounds and not logical errors. The ramp study holds $c_1$ fixed while $\lambda$ rises, so the decoder is not re-provisioned mid-drift. Divergence is classified against a declared threshold (100 outstanding rounds) at a declared horizon. This classifier flags slow recovery as well as true instability, and Section 5.4 disambiguates the two by horizon-doubling where it matters. The escape-time probe shares the same threshold by construction. The ${\rho }_0=0.5$ escape row is right-censored at the simulation horizon. The distance-3 circuit model, not the queue, is what the Stim cross-validation covers; the queue model’s external referent is the decoder benchmark. Sampling grids use $n=40$–60 replications per cell. Sequential stopping was not applied to the basin grids, and the sharp 0/100 cells are limited by that n accordingly.

8. Conclusions

For windowed decoders whose cost grows superlinearly in syndrome content, real-time stability is a basin, not a threshold. The utilization bound $\rho <1$ cannot separate systems that differ by orders of magnitude in reliability: at a single mean utilization we exhibit decoders spanning unconditional stability to spontaneous failure, show that fluctuations carry the system over a drift-matched boundary the mean-field analysis survives, and measure the failure clock at $1.3$ms of wall time with forty percent nominal headroom. The exponent that controls all of this is a measurable property of a real decoder, and it is anisotropic: bursts meet sparse blossom on a cost curve two exponent classes worse than steady-state catch-up, and clustered burst content is more expensive still. The design consequence is to bound the window, place $c\left(W\right)$ below the round period with margin, and report the basin alongside the utilization.

Four further measurements place the framework against conditions a device actually presents. Arrival dispersion at fixed mean load collapses the escape clock monotonically with the measured dispersion index, sevenfold by $D\approx 17$, so the Poisson escape times are upper bounds and a device’s measured D enters provisioning directly. A drifting arrival rate kills the system before either closed-form clock, and a constant rate at the ramp’s time-average kills it sooner still, so the load trajectory rather than its mean sets the failure epoch. The anisotropy survives a change of implementation and separates the decoder classes: matching-class decoders are cheap on average and metastable under bursts, while BP-class decoders are stable by construction and unaffordable per window. Finite decode memory converts escape from a latency failure into a data-loss rate, and under greedy service more memory is strictly worse.

Three directions remain open. The exponent taxonomy should widen further still: union-find and clustering decoders on hardware, and the quasi-one-dimensional repetition strips of noise-biased architectures [18] at their operating densities, plausibly occupy the stable row of Table 1 and should be measured there. Neural decoders belong in the same taxonomy and sit at its stable end by construction: a network with fixed input dimension and constant-time inference does bounded work per window, which is the $\gamma =1$ row [15]. Hybrid designs qualify that placement, since a pre-decoder that routes hard instances to a matching fallback [24] inherits the matching exponent on precisely the dense windows that trigger the fallback, and its effective exponent follows the fallback path rather than the fast one. Dispersion enters here too, since the square-wave modulation of Section 5.3 is one mechanism among many and a device’s own excursion spectrum may not reduce to a single index. And the loop this paper left open, a stalled logical clock raising the syndrome density the decoder then faces, closes through the circuit-level noise model along the quadratic axis. The direction of the hardware gives these measurements their urgency: as classical control moves into the cryostat and compute ceilings become design constants, the basin stops being an operational tuning concern and becomes an input to the machine’s blueprint.

(a) Physically non-deterministic detectors.

A boundary-plaquette mirroring in the layout generator produced a collision-free, invariant-clean circuit whose detectors compare measurements that are not deterministic in the absence of errors. A Pauli-frame simulator is constitutively unable to see this failure class: it tracks deviations from a reference execution it never checks, so a detector that is broken in the reference looks exactly like a working detector with a relabeled baseline. Stim’s structural comparison (which detectors fire for which fault) exposed it immediately.

(b) A silent gap in a table labeled “proved.”

The fault enumeration used one schedule variant’s gate slots when enumerating both variants, leaving mechanisms of the second schedule unenumerated. The gap was invisible to internal consistency checks because the enumeration is itself the reference the checks run against. The cross-validation’s symptom-set equality (199 and 213 distinct symptoms) failed until the enumeration was made schedule-dependent.

(c) A denominator off by exactly 24/20.

A detection-fraction probe divided events over the machine’s 20 detector components rather than the 24 syndrome bits of the readout convention. The defect was found because Stim’s detection fraction refused to match ours by a suspiciously clean ratio. Ratios of small integers in a discrepancy are a fingerprint of denominator disagreement, not physics.