A July 2026 question on Quantum Computing StackExchange, citing David Mermin's Quantum Computer Science, surfaces a detail that most Shor's algorithm explanations gloss over: the continued fractions step that recovers the order r from a quantum measurement outcome y depends on a uniqueness condition from Hardy and Wright's An Introduction to the Theory of Numbers. Without that condition, the algorithm can converge to the wrong rational and fail to factor the target integer — even when the quantum hardware performed perfectly.
For CTOs and technical VCs evaluating quantum computing roadmaps, the implication is concrete: every credible factoring demonstration depends on classical post-processing that is rarely published in full. The companies that handle this step transparently will own the credibility advantage when RSA-2048 factoring becomes feasible.
What the Continued Fractions Step Actually Does
Shor's algorithm has two phases. The quantum phase uses period-finding to produce a measurement outcome y that, with probability greater than 40%, lies within 1/2 of an integer multiple of 2^n/r, where n is the number of measurement qubits and r is the order of a randomly chosen element modulo N. The classical phase then recovers r from y.
The recovery uses the continued fraction expansion of y/2^n. If |y/2^n − j/r| ≤ 1/(2N²), and since r < N, this implies |y/2^n − j/r| ≤ 1/(2r²). The Hardy–Wright theorem then guarantees that j/r is the unique rational with denominator at most r within distance 1/(2r²) of y/2^n. Uniqueness is what makes the continued fraction algorithm return the correct order — and not some other rational that happens to be close.
Without uniqueness, the algorithm could converge to a fraction j/r' where r' is a multiple or divisor of the true order, producing a useless result. The 1/(2N²) bound in Mermin's presentation is precisely what ensures the bound is tight enough to satisfy the 1/(2r²) requirement. This is the silent gatekeeper that most quantum factoring demonstrations skip over in their press releases.
Why This Matters for Quantum Factoring Claims
Every public demonstration of Shor's algorithm — from IBM's 2001 factoring of 15 on a 7-qubit NMR device to more recent trapped-ion and superconducting claims targeting larger integers — depends on this classical step working correctly. The quantum hardware gets the headlines; the continued fractions post-processing is what determines whether the demonstration is valid.
For CTOs evaluating quantum vendors, the implication is direct: any factoring claim should be reproducible with the classical post-processing made explicit. Vendors that publish only the quantum circuit and the final factors — without showing the intermediate measurement outcomes and the continued fraction convergents — leave room for the result to be a lucky guess rather than a validated algorithm run.
This is not a hypothetical concern. The cryptographic community has historically been quick to flag factoring demonstrations that don't disclose their measurement statistics. A single ambiguous continued fraction convergent can invalidate a "first to factor N" claim, and the burden of proof falls on the vendor.
Competitive Implications
This affects the credibility gap between hardware roadmaps. IBM's 2025 announcement of a 127-qubit Heron processor and its longer-term path to fault-tolerant quantum computing via the 1386-qubit Condor and the 2029 Kookaburra system all assume that Shor's post-processing will scale. IonQ, Quantinuum, and PsiQuantum face the same constraint: their logical-qubit roadmaps are bounded above by the classical difficulty of recovering r from noisy measurements, not just by quantum hardware fidelity.
The companies most exposed are those that have published factoring demonstrations without releasing the full measurement statistics. A vendor that claims to factor a 64-bit integer but cannot show the convergents that produced the order has not, in any rigorous sense, demonstrated Shor's algorithm — only that some classical search found a factor. This is a low bar to clear: the convergents are a few lines of output from any standard continued fraction library.
For investors, this creates a diligence opportunity. The classical post-processing is computationally cheap and well-understood; verifying a vendor's claim requires only a laptop and the published measurement outcomes. Quantum VCs who ask for the convergents will separate credible demonstrations from marketing. The same diligence applies to quantum advantage claims in optimization and simulation, where the classical baseline is often the harder part of the comparison.
Adjacent markets benefit from this scrutiny. Quantum software vendors — Classiq, QC Ware, Zapata — that build classical post-processing into their stacks have an underappreciated moat. As factoring demonstrations scale, the classical wrapper becomes a larger share of the engineering effort, and vendors that own that wrapper capture more value.
The Bigger Picture: 2026 Quantum-Cryptography Landscape
The continued fractions step is one of several classical bottlenecks that determine when RSA-2048 becomes practically breakable. NIST finalized its post-quantum cryptography standards — ML-KEM, ML-DSA, and SLH-DSA — in August 2024, with federal migration timelines extending through the 2030s. The implicit assumption is that cryptographically relevant quantum computers will arrive in the 2030–2035 window, but that window is set by hardware milestones, not by the classical post-processing, which is well-understood and runs in milliseconds on a laptop.
Recent comparable milestones calibrate the pace. Google's December 2024 announcement of the Willow chip — 105 qubits with error rates below 10⁻³ — moved the field closer to the surface-code threshold needed for fault-tolerant operation. Quantinuum's H2 system, announced in 2024, claims 32 trapped-ion qubits with all-to-all connectivity and measured two-qubit gate fidelities above 99.7%. PsiQuantum's 2025 funding round of $940 million, led by BlackRock, signaled continued institutional conviction that photonic quantum computing will scale to millions of qubits.
What the StackExchange question reveals is that the classical side of Shor's algorithm is more pedagogically neglected than it should be — and that neglect creates a credibility risk for vendors who skip over it in their technical disclosures. As quantum hardware approaches the threshold for factoring larger integers, the classical post-processing will move from a textbook footnote to a board-level diligence question.
The signal here is that the uniqueness condition in the continued fractions step is the silent gatekeeper of every Shor's algorithm demonstration. Quantum hardware roadmaps get the press; the classical post-processing determines whether the press release is real.
In short: Shor's algorithm's continued fractions step requires a uniqueness condition that most quantum factoring demonstrations treat as automatic — and getting it right is what separates credible RSA-breaking claims from marketing.