diff --git a/docs/analysis/attack-pass-2026-10.md b/docs/analysis/attack-pass-2026-10.md
index f08825ec0..b471df3a3 100644
--- a/docs/analysis/attack-pass-2026-10.md
+++ b/docs/analysis/attack-pass-2026-10.md
@@ -29,7 +29,7 @@ against the log before quoting it to the project lead.
 | F6 | Verifier worst case over 10^5 programs + O-1.14 laptop run | worst program under 10 ms cold on the half-core proxy and the laptop | O-1.14 CLOSED on an i7-9700K (v4 6.006 ms avg, 6.334 cold max; dr736 10.04 fails as it must). Box search: 100,000 programs drawn and ranked, 50,000 timed cold on the one-core proxy (min / median / p99 / max 4.610 / 4.948 / 5.606 / 6.194 ms, `attack-f6/48484`); half-core re-times of the worst (batches B and C) queued, starved of the exclusive hold by back-to-back shared holders (F2's runner now stopped to free it); carried at the genesis ratio the worst would read 10.3 ms, at the additive cost 9.66 ms, so batch C decides | INCOMPLETE (batch C decides; re-armed) |
 | F7 | Era-draw bias harness + 2^20 era-seed census | no re-roll inside the publish window; no era class with gain over 1.1x over 2^-20 | (b) census PASS at 2^24 seeds: no class over 1.1x, stride bijective on all draws, R, pos and M uniform (chi-square 38.5 on 30 dof), op-weight corners 1.0x, planted cases fire; (c) 64-bit day-key seeding PASS as the spec intends, 0 collisions in 2^17; (a) re-roll harness INCOMPLETE by the plan's allowance: the node's era seed is a plain chain block hash (`seed_below`), the cut is grindable with one block of hash at no delay (1 of 6 epochs) and immune past one block interval (0 of 6), and the 1-hour VDF of spec 4.4 is not in the node; the era-VDF lane builds it with `reroll.mjs` as its gate. Record `docs/analysis/attack-pass/f7-era.md`; the harness's three devnet-980 nodes stopped by pid at 12:1x UK | PASS (b, c); INCOMPLETE (a) pending the era VDF, a freeze precondition |
 | F8 | Uniformity censuses (line-index 2^28, distinct lines, cross-hash histogram) | uniform within the window model of spec 1.13.1, layer 8; the excess beyond it within 6 sigma over 64 seeds; no hot set under 1% of items beyond the model | line index PASS at 2^28 (max +5.61 sigma, control +5.61). Phase E, 64 seeds at 2^18 nonces: 31 of 64 over 1.2x of the window model (median 1.17x, p90 2.70x, max 13.09x), 23 with a hot item, the lossy-source class across the stream. AP-F8-1 resolved to a mechanism: the window null gives 1.39x at the top 0.1% (not 4.05x); the rest is a lossy LOAD SOURCE (an `or` writer feeding site 15's load; the all-ones source is item 0xca5b92, 7 of 7 next-hottest predicted), a fault class in the acceptance rule's blind spot carried by 96.6% of v4 programs; hot-set bound at most 1.067x under rule (c); no v4 change, v5 generator item with phase E as its gate; phase E (64 seeds) pending | FINDING (mechanism ours; fix ships in 0.3.20 (the feature node) on `ca3-v4-amend`, re-gate by this lane's 64-seed census) |
-| F9 | Acceptance edges (39) + header grinding on an RTX 5090 | zero passing programs with a hot set under 1%; grinding gain under 1% of rate | (c) grinding on the 5090 pod: +0.004% of rate at K = 2^14 (141.62 vs 141.61 MH/s, sd 0.003, 5 rounds) at 11.7 hashes of search per hash, ceiling +43%: PASS; (a) edges on generator 4 running in parts (21,007 agreeing so far); (b) hot-set search over 10^6 seeds running in parts (about half done) | (c) PASS; (a), (b) RUNNING on the box |
+| F9 | Acceptance edges (39) + header grinding on an RTX 5090 | zero passing programs with a hot set under 1%; grinding gain under 1% of rate | (a) edges on generator 4 over 10^5 seeds: 34 disagreements in 105,064 candidates (29 const_bit, 4 bias, 1 lane_const), every one a one-bit or sampling-noise property moving the choice to an attempt both stand-ins accept, nothing in the attacker's favour: PASS; (b) hot-set search over 10^6 seeds: 11,696 passing programs (1.17%) concentrate 1% or more of reads on a hot set, worst 17.3%: FINDING, the same or-saturation load-source class as AP-F8-1 found by a second harness (F9-1 merged into AP-F8-1), re-gated on the amended stream; (c) grinding on the 5090: +0.004% at K = 2^14, ceiling +43%: PASS. Record `docs/analysis/attack-pass/f9-grind.md` | (a) PASS; (b) FINDING = AP-F8-1 class, re-gate running; (c) PASS |
 | F10 | Ladder signal monotonicity harness | no step without 90% over 7 windows in either direction | known-fail fails, known pass passes; new cases on the exact-share driver: 89% up holds (no step), 89 then 90% down with restarts steps only at 90% after the 7-window cool-down, the floor holds under 100% down (never below rung 0); decision per seed block memoised, identical after a restart, never differs between nodes; 19 of 19 checks per case. Two items to main, not findings: a stale commit string in the ladder lane's igneumd, and proof-synced nodes deciding rung 0 until the witness lands (a precondition line for spec 01). Record `docs/analysis/attack-pass/f10-ladder.md` | PASS |
 
 ## The rows
@@ -353,7 +353,12 @@ phase D ran, gate: the top 0.1 percent of items within 1.2x of the window model
 window draws, one number per seed; reported to the hash lane, main and the Counter ASIC lane. The amended stream has
 no lossy-sourced load by construction, so a seed over 1.2x there is a finding against the model's own tail, not the
 fault, and the record says which.
-Status: FINDING-OPEN: mechanism found and ours; FIXED-AND-PASSED on the 64-seed verdict against `ca3-v4-amend`.
+Second harness (F9 sub-row b, 10^6 seeds, 12:5x UK): the same class from the other side, the per-site address trace:
+11,696 of 1,000,000 passing programs concentrate 1 percent or more of their reads on a hot set (worst 17.3 percent,
+seed 842871, an `or`-written load source all-ones in 36 percent of evaluations), so F9-1 merges into AP-F8-1 and
+F9's harness is the second re-gate of the amendment, run on the amended stream beside F8's 64-seed census.
+Status: FINDING-OPEN: mechanism found and ours; FIXED-AND-PASSED on the 64-seed verdict against the amended stream
+(igneum-pow 8c728ca3, sub-version 1, paired with release-0.3.20-node 8097d600) with F9's hot-set census agreeing.
 
 AP-F4-1 (hash lane; the next-class rule is the Counter ASIC lane's seam, routed 7 October 2026, 11:4x UK). A bound
 on the day-key draw, not a weak class: on the M1 metric (every multiply in LUT adders, adders per mixer application
diff --git a/docs/analysis/attack-pass/f9-grind.md b/docs/analysis/attack-pass/f9-grind.md
index f103215b3..5f6e3608e 100644
--- a/docs/analysis/attack-pass/f9-grind.md
+++ b/docs/analysis/attack-pass/f9-grind.md
@@ -225,3 +225,45 @@ Per-warp header grinding at K = 2^14 draws per warp against the honest kernel, 5
 ceiling (the five init-determined loads fully coalesced, `forced1` extended) is +43 percent. Gate: the grinding gain
 under 1 percent of rate at any search cost. Sub-row (c): PASS. Pod time about 1 h 50 min from 09:02 UK; destroyed on
 the lane's done line.
+
+## Full censuses (box 1 parts 0 to 7 and 0 to 6; box 2 parts `edges-b2`, `hotset-b2` after the lane's move to
+build-2 at 12:2x UK; `summarise.py` over all parts, 12:5x UK)
+
+### (a) The edges on generator 4, 10^5 seeds
+
+| Quantity | 100,000 seeds |
+|---|---|
+| Candidates evaluated | 105,064 |
+| Verdicts agreeing | 105,030 |
+| Disagreements | 34 (0.032 percent of candidates; the 3 October census had 39 in 100,000 on its generator) |
+| By kind | `const_bit` 29 (closed form accepts 17, memory-hard accepts 12); `bias` 4 (3 and 1); `lane_const` 1 (memory-hard accepts) |
+| Seeds whose chosen attempt differs | 34, every one moving to the next attempt, which both stand-ins accept; exhausted 0 on either |
+| Rejected, closed form / memory-hard | 5,046 / 5,048 (static 4,201; then const_bit 424 / 428, saturated 275 / 275, distinct 112 / 112) |
+| Accepted margins, closed form | saturated at most 148 of 164, bias at most 121 of 136, distinct sum at least 247,335 (bound 245,760) |
+| Accepted margins, memory-hard | saturated at most 157, bias at most 126, distinct at least 247,571 |
+
+The 20,000-seed reading holds at 10^5: the stand-ins disagree on a one-bit property (a final register bit pinned in
+2,047 of 2,048 hashes against 2,048) and on four programs' output bias within sampling noise, never on saturation
+or the distinct count, and never in the attacker's favour. Gate: the 39 edge disagreements reproduced and bounded.
+Sub-row (a): PASS.
+
+### (b) The hot-set search, 10^6 seeds
+
+| Quantity | 1,000,000 seeds |
+|---|---|
+| Programs with any hot bucket (strict) | 75,400 (7.5 percent) |
+| Programs flagged at the gate reading (hot share at least 1 percent of reads, or 7 constant address bits) | 11,696 (1.17 percent) |
+| Worst hot share | 17.3 percent of the program's reads (seed 842871) |
+| Hot-share bands (block init) | 0: 932,106; under 0.1 percent: 11,721; under 0.5: 3,645; under 1: 41,581; 1 percent and over: 10,947 |
+| Sites with 7 or more constant address bits | 0 (max 6) |
+| Fewest distinct addresses at a site in 2,048 evaluations | 43 |
+| Most evaluations reading one address at a site | 1,838 of 2,048 |
+| Mean hot share over programs | 0.063 percent |
+
+Gate: zero passing programs with a hot set under 1 percent of items. FAIL on the class v4 stream by the letter:
+11,696 passing programs concentrate 1 percent or more of their reads on a hot set. The mechanism is F9-1 above,
+the or-saturated load source, which is the same fault class the F8 row found from the cross-hash histogram
+(AP-F8-1: a load whose source's last writer is lossy); the two harnesses found it independently, one from the
+program's address trace per site, one from the item histogram across hashes. F9-1 therefore merges into AP-F8-1,
+and the fix is the amendment shipping in 0.3.20 (a load's source drawn only from registers whose last writer injects
+or is a rotate). Sub-row (b): FINDING (AP-F8-1 class); re-gated on the amended stream with this harness below.