diff --git a/docs/analysis/attack-pass-2026-10.md b/docs/analysis/attack-pass-2026-10.md
index 6ff448298..ad49738cb 100644
--- a/docs/analysis/attack-pass-2026-10.md
+++ b/docs/analysis/attack-pass-2026-10.md
@@ -288,7 +288,8 @@ attack-pass) by the coordinator's exception rule; nothing touches GitHub.
 | Family | Class v5 run | Result | Verdict |
 |---|---|---|---|
 | F4 weak-day census | 2^24 chain days from 20,729 under `Shape::for_class(&V5_CLASS)`, box 1, 18:5x to 19:1x UTC | byte-identical to the class v4 census: M2 (DSP-bound) 0 of 2^24 days over 1.1x; M1 (LUT adders) 5,476 days, 3.264e-4, the same bounded tail, worst day 4,819,563 at cost 197 against the median 231; planted weak days fire (mul1all M2 unbounded, mulnaf 1.333x). The day-key draw depends on the mixer shape alone and v5 adds only the state flag, so identity is the expected and the measured result | PASS (v4's reading; AP-F4-1 stays the next-class item) |
-| F8 hot-set gate | 64 seeds at 2^24, chain path, v5 with the dn3 state, box 2 (64 threads), from 18:47 UTC; killed at 11 of 64 at 19:3x UTC on the coordinator's rule (every hand-started run off the boxes; load 601 and 401; the release builds and the v5 suites outrank the families), re-queued through `lease pool` when it lands | the 11 seeds read 0.9915x to 1.144x and 1.50x (p10), the same values as sub-version 3 seed for seed, as the v5 lane predicted (the leaves change the words, not the read addresses) | pending the re-queue |
+| F8 hot-set gate (pre-freeze reading) | 64 seeds at 2^24, chain path, v5 with the dn3 state, box 2: hand-started at 18:47 UTC (11 seeds, killed on the coordinator's rule: every hand-started run off the boxes, loads 601 and 401), re-queued through `lease pool 64` at 19:23 UTC (17 more seeds), released at 19:4x UTC on the Counter ASIC lane's yield so the class v5 (c''') census, the 0.3.24 board's critical path, could take the pool | every seed read equals sub-version 3's seed for seed (0.9915x to 1.144x, p10 1.50x), as the v5 lane predicted: the leaves change the words, not the read addresses | READING, not the gate line |
+| The gate that counts | the Counter ASIC lane's rule (20:4x UK): the frozen class v5 tip (the 0.995 per-site floor on ab6f980b's line moves the draw on seeds whose minimum site reads under it) is the stream the board gates on; F8 at 2^24 over 64 seeds, F9 at 10^5 and F1 at 10^5 run on it through `lease pool` the minute the v5 lane sends the commit, F8 first | pending the frozen commit | pending |
 | F9 exhaustion count | 10^5 chain-shaped seeds on the v5 chain path with the dn3 state, box 1, ten parallel chunks (the chain draw costs about 2.2 s per candidate through (c''), so 10^6 is about fifty hours); killed before its first chunk closed, re-queued through `lease pool` | pending | pending the re-queue |
 | F1 shadow redundancy | 10^5 class v5 programs through the string-seed path, box 1; the known firings fire under v5 (planted 50 of 256: 19.53 percent; the real block 0.000; the must-not-fire 1.157); the census killed before its end, re-queued through `lease pool` | pending | pending the re-queue |