This kind of memo is where PQC stops being a conference buzzword and starts reshaping vendor roadmaps. Once agencies have to file inventories and staffing estimates by October 22, the buyers with the deepest pockets are no longer asking “is quantum-safe on the slide?”, they’re asking who can show a credible upgrade path through firmware, control planes, and update mechanisms without ripping the whole stack apart. That favors the boring incumbents with real lifecycle control and punishes the appliance vendors who sold “secure” boxes that quietly assumed RSA would live forever. It also creates a weird new market for crypto cleanup, because a lot of systems will get marked “too old or constrained” and then the migration money goes to replacement, not to the original vendor. So the incentive shift is less about winning on the algorithm and more about owning the whole maintenance story for the next ten years, which is probably where the real churn starts.