Six distinct attack surfaces. One whitepaper. Circle published its Post-Quantum Security Roadmap for @Arc today and the scope of it is the part worth sitting with. Wallet signatures, smart contracts, private EVM state, validator authentication, encrypted transport, account recovery. Each has a different migration path and a different dependency chain. The whitepaper doesn't treat this as a single upgrade event. It maps a phased roadmap because not every layer can move at the same time. Quantum-secure signatures ship in beta at mainnet launch. Private EVM state follows shortly after. Validator hardening and PQ-safe TLS come later as vendor support matures. That sequencing is honest about what's actually possible versus what sounds good in a security announcement. The framing that matters here is "harvest now, decrypt later." Attackers don't need quantum computers today. They collect encrypted onchain data now and sit on it. Stablecoins, tokenized RWAs, and long-lived financial contracts are exactly the assets with exposure windows that stretch years into the future. Building the Internet Financial System on cryptographic assumptions that have a known expiration date without a documented migration path is the kind of risk that doesn't show up until it's too late to fix cleanly. What I'm watching is account recovery. That's the last item on the phased roadmap and probably the hardest operational problem. Migrating long-lived wallets and custody systems without breaking access for institutional users is where post-quantum transitions historically stall. The architecture here looks credible. The execution is still ahead of us.