diff --git a/docs/design/class-rotation-four-layers.md b/docs/design/class-rotation-four-layers.md
new file mode 100644
index 000000000..513e8f18d
--- /dev/null
+++ b/docs/design/class-rotation-four-layers.md
@@ -0,0 +1,202 @@
+# Class rotation, four layers: the hourly program, the weekly parameter era, the 180-day family epoch, the emergency miner vote
+
+8 October 2026, 14:1x to 15:30 UK, branch `class-v6-rotation` (worktree `igneum-wt-rotation` from the box mirror's master bfe7607a), the rotation lane under the Counter ASIC coordinator. The founder's order (14:3x UK, verbatim intent): "layer 1 the hourly change; layer 2 a weekly or monthly change; layer 3 the 180 day change; layer 4 emergency miner vote change. All automated." No release and no hand for any of the four once shipped. Inputs: the five research lanes' documents on `rotation-research` (build-3, 2f986d70: `docs/analysis/rotation/layer1-hourly.md`, `layer2-weekly.md`, `layer3-family-bank.md`, `layer4-miner-vote.md`, `other-layers.md`), each recommendation kept or rejected in section 8 with its reason; `docs/design/class-v6-rotating-family.md` (the per-tier rows, the band, the three rings); the release record's rules 16 to 19 on `ship-docs-0321` (`docs/plans/release-rules.md` lines 22 to 25, read by `git show`); the node at the mirror's `release-0.3.25-node` c9ad753a. Status: a design document and a research-class prototype on a fork branch behind a params switch (section 9); nothing here touches the devnet, Devnet 3, the testnet object or any served number. Labels: **measured** (a card or a box on a named job, with the clock), **modelled** (arithmetic on cited figures), **claimed** (a vendor's or an author's figure), **approximate**.
+
+Framing (the coordinator's word, 16:5x UK; Igneum 2.0 is the reference, `docs/plans/igneum-2.0.md` on the mirror): rotation is optional to the security argument, the four layers simplify to those with a distinct demonstrated benefit, and this document describes a CAPABILITY the chain has (what changes, from which chain value, under which rules, at what cost per boundary), never a resistance claim; it makes no claim that rotation strands any hardware, and where a chip row appears it says what a draw changes for a datapath or a firmware, labelled, and nothing about any product's life. The prototype of section 9 is kept as the no-rescue test's control.
+
+The founder's bar is "error free and future proof", so every guarantee below is named as what it is and nothing more: a **test** (a unit test that fires on a known-failed case), an **in-node rule** (an acceptance rule every node applies to every draw, deterministically), a **census** (an offline run over drawn eras that bounds a failure fraction at a confidence, never a proof), or a **fast-time crossing** (a three-node network crossing the boundary on the box, which shows the code path once, not every future draw). A claim resting on none of the four is marked owed.
+
+## 0. One page
+
+| Layer | Boundaries a year | What is drawn | From which chain value | What it may touch | What it may never touch | What makes the boundary safe (named as what it is) | What still needs a release |
+|---|---|---|---|---|---|---|---|
+| 1. The hourly program | 3,600 DAA s: **8,766** | the program: the instruction stream, the register init, the load sites, the shadow block's instructions | the epoch's reference block: the last selected-chain block below `3,600 e - 600` (the node's `epoch_seed`, class v5's `C_w`) | the program only | the dataset derivation, the read atom, the layout, the week's table, the family set | in-node rules (a) (b) (c) (a') (c') (c''') and the per-site tests of ring B, the 256-attempt cap then the verified last resort; a wrong program refused at packcheck and by every node's PoW check (`check_header` regenerates the program): test, the class v4 harness's stale-miner case | a new generator (the 64-bit `program_rng` state is one: layer1-hourly.md item 2, ledger M7) |
+| 2. The weekly parameter era | 604,800 DAA s (7 days): **52.18** (monthly 30 days: 12.18, priced in 3.4) | the table the hourly draw reads: the op-mix weights (B = 4 on the seven injecting families, the lossy three at base), the shadow block shape in {64, 128, 256}, the stride multiplier M and rotation R, the index fold's constants (once the fold's form is in), the cross-lane shuffle pattern from a genesis-vectored set; NOT the mixer multiplier (a per-family axis), NOT W (a per-class pin, 4 words), NOT N (the ladder's signal), NOT the layout `pos` | the week's reference block: the selected-chain block at the greatest DAA at or below `604,800 w - 7,200` (two hours below the boundary), through the 1-hour VDF once live | the program's generator inputs only | the dataset derivation, the read atom, the dataset layout, the object digest, every activation height, the binary | ring A in the node (band membership, the lossy-share bound, the rotation class, the pattern index) in microseconds; the table judged by the first epoch's draw (over 32 attempts: the stream's next block, three blocks, then the genesis table, total and the same on every node): in-node rule with tests; the census bounds the redraw (0 of 3,000 band eras exhausted at 256, max attempt 59: measured, lane D 17:00 UK) | a wider band, a new pattern, a new base table |
+| 3. The 180-day family epoch | 15,552,000 DAA s: **2.03** | structure from the genesis bank (section 4): the live reserve subset, the dataset atom from the bank's atom list, the fold form, the shapes admissible that epoch | the family epoch's reference block: the era cut, the last selected-chain block below `15,552,000 n - 7,200` (the node's `era_seed`; the era VDF over the cut's day once live), the same block the class v5 dataset's state is read at | the family set, the atom (within the bank's list), the admissible shapes | anything outside the bank; the read atom outside the genesis list (W = 4; 8 as `admissible: false` until its rows) | the node's own lead-ahead self-test on the coming object (section 6.2: a fast-time crossing per node), rule 18's feed check and rule 19's fingerprint pairing (section 6.3: in-node rules with their CI checks), the per-vendor 5 percent rule and four-vendor fingerprints per bank entry at genesis (tests), the stale-kernel refusal (test) | a family beyond the bank, a read atom or a derivation not in the bank (bank refresh: `bank_version` in the digest, entries added `admissible: false`, the 90 percent tally in epoch n effective at n + 2) |
+| 4. The emergency miner vote | 0 expected; at most one bring-forward per scheduled epoch: **at most 2.03 extra** | nothing new: the vote names the NEXT scheduled family epoch's draw at a target height brought forward; the draw at that height is layer 3's from that height's reference block | the finality votes' carriers: a `FlipVote` item under its own tag in the coinbase finality section, read by Q2's block reading over the certified checkpoints | what layer 3 touches | what layer 3 never touches; and nothing can be delayed: a target at or past the scheduled height is dropped | two thirds of active weight AND half of total 30-day weight at every one of the last 240 of 720 consecutive checkpoint indices (in-node rule; tests on the fold); no vote counts while finality is paused; the flip at the first epoch boundary at least 14,400 DAA s after the tally closes; one bring-forward per family epoch | a trigger no bell can see (the detector is for people, section 5.1) |
+
+The three numbers the 15:45 close quotes. **Boundaries a year**: 8,766 / 52.18 / 2.03 / at most 2.03 extra (the weekly cadence is the default; the monthly alternative 12.18 is priced in 3.4). **The detector's false-positive rate on today's fleet rows** (section 5.1; layer4-miner-vote.md section 2, measured rows): as a trigger it is unusable, as a bell it rings a few times a year: signal A (a hash-rate step over 1.5x in a day) fired on 2 of the 14 days of the two crossing weeks on the record (4 October 152 to 280 MH/s when PC 2 joined, 1.84x in minutes; 6 October's 38-pod wave 1,748 MH/s onto about 1.16 GH/s), about **50 cases a year** at that fleet's behaviour (arithmetic on measured days, approximate); signal B (a clique of 3 correlated keys held 6 windows) read 0 cliques and 1 edge on the 6 October honest baseline (r 0.94 on two same-model 5090s, 4 ids, epochs 40 to 45, measured, `tools/observer/README.md`), and on a real network one candidate clique per few hundred ids from multi-card rental hosts (derived, approximate): **a few cases a year at today's key count**, never a consensus input; signal C has no on-chain form. **The vote window**: 720 consecutive checkpoint indices at 30 DAA s each = **21,600 DAA s, 6 hours of UK clock time at the 1 s block**, the pass line read at the last 240 indices (2 hours), the flip at the first hourly boundary at least 14,400 DAA s (4 hours) after the tally closes: **a carried vote flips between 10 and 11 hours after its first qualifying index** (on the fast-time file the window is 4 indices and the delay 60 DAA s; section 9).
+
+What this document does not claim: no layer moves the per-joule identity (`edge = (E_card + F) / (E_mem + k F)`, the research file's section 2): against the chip that stores the dataset every drawn value is firmware, the edge stays 3.6x at zero shadow, 2.8x at the sequencer core's k 0.56 and 2.1x at k = 1 on a 5090 at its knee (measured card, modelled chip; other-layers.md section 1), and the four layers decide which chip can be built and how long its tape-out lives. Layer 2's weekly cadence does not shorten layer 3's 180 days, so the close's amortisation unit for a chip project stands at 180 days; the week shortens the life of a FIXED-FUNCTION tape-out to a week, which the chip model prices at zero for the chip anyone builds. The read width stays pinned at 4 words (class v6 10.3) in every layer.
+
+## 1. The reference-block rule, one definition for every layer
+
+Every drawn value of every layer is a deterministic function of one chain block, the layer's **reference block**: for a boundary at DAA score `B` with the layer's lead `lead`, the reference block is the last selected-chain block whose DAA score is below `B - lead`, walking down from the header's selected parent (the node's `HeaderProcessor::epoch_seed` for the hour at lead 600 and `era_seed` for the era at lead 7,200, `consensus/src/pipeline/header_processor/processor.rs`; class v5's `C_w` is the same block for the hour). The draw's seed bytes are the VDF over that block where the VDF is live (the 10-minute class-group VDF for the hour, the 1-hour VDF over the cut's day for the era, spec 04 section 4.4) and the block's hash as the stand-in before (every network today). The week takes lead 7,200 like the era. Consequences, each named:
+
+- **Every node computes the same draw or no draw** (in-node rule; the fork's test `rotation_era_draw_is_deterministic_and_moves_with_the_reference`): the reference block is on the selected chain `lead` before the boundary, so a node that has the chain has the draw; a node that has not reached it keeps the old table and its blocks past the boundary are refused by every node that has (the stale-kernel class), at its own cost.
+- **No accepted reorg replaces a week's or an era's reference block** (in-node rule resting on the merge-depth bound, 3,600 DAA s: a lead of 7,200 is two merge depths); the hour's lead of 600 is inside the bound, which is today's known behaviour (an epoch's seed block can move with a reorg before the boundary, and then it moves for every node together).
+- **The one thing that would break it** (layer2-weekly.md section 2, taken whole): a draw that reads anything but the reference block. The tip (the 2720d8d2 fork made two views), a state root or record count (class v5's stale-node refusal, 86 of 86), the signal tally at a window's edge, a node's own DAA reading or the wall clock (the three lost floors of 8 October), a file. The design rule, enforced by the types in the prototype: the draw functions take the reference block's bytes and the genesis constants and nothing else.
+- **The index never enters the draw bytes** (the era rule of igneum-pow: `E_n` commits to `n` through the VDF input), so a boundary's identity is its height, not its number. Test: `era_draw_deterministic_and_bounded` (igneum-pow) and the fork's `rotation_flip_moves_the_era_boundaries_and_rebases_the_schedule`.
+
+## 2. Layer 1: the hourly program
+
+What exists today is layer 1: `pow_epoch_blocks` 3,600 and `pow_epoch_lead` 600; the epoch seed from the reference block; the generator's draw with attempts `k = 0, 1, 2, ...`; the acceptance rules of sub-version 3 and class v5 ((a) stale source, (b) injecting write, (c) the dynamic test over 64 units, (a') the freshness fixpoint, (c') saturation per site, (c''') the distinct-item ratio floor 0.995 in the v5 tree); the cap `MAX_ATTEMPTS_V4` = 256 (exhaustion under 1e-45 per seed at two thirds rejection per attempt, modelled; 0 of 24,631 devnet seeds exhausted, max attempt 29, measured by the hash lane's census) and the verified last resort after it; the program id `program_id_class(generator, seed, attempt, class)` the miner's pack carries (packcheck) while the node regenerates the program from the seeds and refuses a mismatch as invalid PoW (`consensus/pow/src/igneum.rs`, `check_header`). Under rotation layer 1 changes in two ways only:
+
+1. **Its inputs come from layers 2 and 3.** The week's table and the family epoch's structure enter the generator as the class, so the program id carries them and a kernel built against another week or family set is refused exactly as a kernel of another class is. Test: the stale-miner case of the class v4 harness, re-run across a week boundary and a family boundary (section 9).
+2. **The acceptance rule takes those inputs** (ring B): (c''') with the expectation divided by the width, the per-site largest-bucket bound in sigma and the per-site index-bit one-count in sigma on the same 2^20 pass (2.2 s per chosen candidate on a box core, measured), the window-bit test a refusal only once the index fold is in (on today's `load_index` it would redraw about 40 percent of epochs, lane D). In-node rules; the census's n (10,000 random and 3,000 band eras) bounds the failing fraction at 3.0e-4 and 1.0e-3 at 95 percent (measured, lane D).
+
+Kept from layer1-hourly.md (section 8): the hourly period stands (600 s costs the iGPU tier 20.7 percent of the epoch under load and puts the VDF core at 100 percent duty, measured on PC 1; per block is impossible at a 0.6 to 1.1 s prepare); the known-ahead window is 600 s at every epoch length, already the compile deadline an FPGA faces. What layer 1 never touches: the dataset derivation, the read atom, the layout, the table, the families. The cost per boundary is today's: the program compile per epoch (the miner's "program and cache ready" line, 13 to 42 ms measured on the 5090 and the M5 Max at 1 GiB), the verifier +0 ms, no re-tune (the hourly draw moves neither rate nor watts outside the band, measured, class v6 section 2).
+
+## 3. Layer 2: the weekly parameter era
+
+### 3.1 The draw (layer2-weekly.md section 1, taken; the mixer multiplier removed from this document's earlier draft on its reason)
+
+Week `w` is the DAA interval `[604,800 w, 604,800 (w + 1))`. One SplitMix64 stream seeded from `seed_words_from_bytes("igneum-week/" || V_w)` words 0 and 1 (`V_w` the VDF over the reference block's hash; the hash itself as the stand-in), drawn in a fixed order, every slot consumed whether used or not:
+
+| Slot | Parameter | Band (genesis) | Why that band (measured rows) | The node's test at the boundary |
+|---|---|---|---|---|
+| 1 | The op-mix weights (add, xor, mul, mad, shfl, rotl, sub, mulhi, rotr, or) | each injecting family perturbed by `below(2B + 1) - B`, B = 4, around the base table; or, mul, mulhi never above base; shfl never above 8; renormalised by largest remainder | the lossy-capped band reads r 0.595, mean attempt 1.47, max 59, 0 exhausted of 3,000 eras; with the lossy three free 1.2 percent of eras exhaust (measured, lane D); shfl is the dearest op (29.4 pJ at the lock, measured) | ring A: the lossy-share bound `or + mul + mulhi` at most base + B; the rotation class |
+| 2 | The shadow block shape | {64, 128, 256} at 6,912 shadow instructions per iteration; the placement never moves | 64-instruction blocks 2.5 to 3.5 percent faster than 256 on the 5090 and the M5 Max (measured 6 October); 1,024 cost the M5 Max 17 percent | `is_family_shape` in the draw and the acceptance alike |
+| 3, 4 | The stride multiplier `M = low32(next()) OR 1` and the rotation `R = 1 + below(31)` | the 1.13.1 address draws, moved from the era to the week | the index fold is what makes R drawable: without it 7 of 16 drawn eras carry a site at abs z 130 to 511 at address bit R (measured, lane D) | ring A records the rotation class; ring B's window-bit refusal on every candidate |
+| 5, 6 | The index fold's constants | two draws, `1 + below(31)` and a 32-bit mask with the low `b` bits forced set | the fold's form is layer 1's open item; until it and its vectors are in, both slots are consumed and the genesis constants stand | the window-bit refusal; the known-failed case is lane D's 7 of 16 eras, which must read 0 of 16 with the fold |
+| 7 | The cross-lane shuffle pattern | `below(S)` over a genesis-enumerated, genesis-vectored set (the butterfly's 31 xor masks and shfla's 31 deltas) | a pattern outside the vectored set is never drawn; the AMD `ds_bpermute` row is owed (layer1-hourly.md) | ring A: the index inside S |
+| 8, 9, 10 | N, W, the mixer multiplier m | consumed, not read | N is the ladder's signal (an unconditional draw retires the Apple tier, -10 percent at 200,000, measured); W is a per-class pin (4; 8 after the owed rows; 16 never, +25 to +34 percent energy per hash on four cards, measured by floor lane 5); m is a per-family axis closed by adv-mixer-3's ladder and the x16 verifier row (11.4 ms loaded, over the 10 ms gate), the card pays nothing for it (x8 against x16 within 0.1 MH/s and 0.5 W, measured) so it is the verifier's budget and not a weekly knob | none |
+
+### 3.2 The acceptance at the boundary and the fallback (in-node rule; tests)
+
+Ring A on the drawn table in microseconds (band membership of every value, the lossy-share bound, the rotation class, the pattern index). Then the table is judged by the first epoch's program draw under it through ring B: if that epoch's program is not accepted within 32 attempts, the table is discarded and the next block of the week stream is drawn, every slot again in order, three blocks at most; after the third the fallback is the genesis table (the base weights, shape 256 x 27, M and R from the six-monthly era's own draw, the genesis fold constants, pattern 0) with no further check. Total, and the same on every node, because every input is the reference block and the genesis constants. Worst case 96 candidates, 211 s on a box core and 480 s on a 5 s core, inside the 7,200 DAA s lead (measured per-candidate cost, arithmetic). Odds: under the band the max attempt in 3,000 eras was 59 and the mean 1.47 (measured), so a block redraw fires in under 0.1 percent of weeks and the fallback in none seen; the exact count over 32 is owed from lane D's rows. The prototype's tests (section 9): a corner no draw can pass takes the base table at the cap on every seed (`rotation_era_draw_exhausts_to_base_table`, known-failed first); the genesis band accepts at attempt 1 on 2,000 references (`rotation_era_draw_accepts_at_attempt_1_under_the_band`).
+
+### 3.3 Why a weekly boundary needs no state agreement (layer2-weekly.md section 2, taken whole)
+
+The week reads one chain value (the reference block, through the VDF) and writes nothing. Untouched, with the record's reason for each: the dataset derivation (class v5's leaves under the day key, the item's 64 bytes, the mapping under the six-monthly `pos`): the read atom and the layout are what a stale node disagrees on; the object, its digest and every activation height: faults 1 and 2 of the crossing day (section 6.3) are exactly a digest and a height moving; the acceptance rule's code and the worker's class set: rule 19 and rule 16, the rule takes the table as INPUT and the worker carries every band value from genesis; the verifier's budget (m, W, the block count); the public feed's lock (rule 18 reads the same reference block the week does). A node that is behind reaches the reference block in order, computes the same table, accepts the same programs, with no message, no file, no sweep and no minute; the restart case of the fast-time harness already resyncs across a class boundary in 28.1 s (measured, cross-0324), and a week boundary is strictly less than that case. So the failure mode of a wrong week is a refused block at the drawing miner's own cost, never a two-sided chain: that is the sense in which layers 1 and 2 are "program only" boundaries.
+
+### 3.4 Boundaries a year and the cost per boundary (the close's units)
+
+| Cadence | Boundaries a year | A card with a lever (5090, 5070 Ti, 4070): Ember's re-tune per boundary | A card without one (9070 XT, every Apple machine) | Verifier | Chip | Label |
+|---|---|---|---|---|---|---|
+| Weekly (default) | 52.18 | 11 to 12 minutes at stock watts, about 15 s of hashing lost and 0.05 kWh (about 1 p) per boundary: 52 a year is 13 minutes of hashing and 2.6 kWh, under GBP 1 a year per 5090; the measured band says the point does not move (within 0.1 MH/s and 0.5 W at the lock across the mixer draw, 0.6 W across the three weight tables, 3.5 percent of rate across the shapes), so a 3-minute confirm replaces the re-tune | the 3-minute baseline, nothing lost | +0.2 to +1.5 ms per era draw on the epoch build; the daily build unmoved | what a draw changes for a chip: a wired lane ratio, block shape or fold is wrong from the first draw that leaves its value (a fact about the draw, not a claim about any product); a programmable part takes the draw as firmware; its verification burden the same three rings as a node, 3 to 9 s a week typical, 211 to 480 s worst | measured per boundary (the hash lane's rows), multiplied |
+| Monthly | 12.18 | 3 minutes of hashing and 0.6 kWh a year | nothing | the same | the same, with 4.3x the use per draw-specific optimisation | measured, multiplied |
+
+Seven days, not thirty (layer2-weekly.md section 3, taken): the era length moves nothing on joules for a programmable chip and moves a draw-specific optimisation's planning window one for one; the honest cost is a re-tune no card needs.
+
+## 4. Layer 3: the 180-day family epoch and the bank
+
+### 4.1 The bank at genesis (layer3-family-bank.md, taken; this document's earlier "twenty entries" corrected to its count)
+
+The bank is what ships at genesis so that no family epoch ever needs a release: **18 op families** (class v4's ten: add, xor, mul, mad, shfl, rotl, sub, mulhi, rotr, or; the reserve R1 to R8 of `docs/plans/counter-asic-3-reserve.md`, ordered by hardware orthogonality: shfla, perm, popc and clz, bfe, shl and shr, sel, andn, mm8), **3 dataset atoms** (the mixer at x4 and x8, the derive program dr368), **1 fold form** with drawn constants, **3 block shapes** (64, 128, 256); x16, dr736 and W = 8 in the list as `admissible: false` from genesis (the ladder's flag shape, flipped only by the 90 percent path once measured). Each entry carries at genesis its emitter on every vendor, the conformance vectors of spec 1.15 with four-vendor fingerprints (Metal, CUDA, OpenCL on NVIDIA and AMD), the per-vendor 5 percent rule's measurement (class v6 4.2's table: shfla 1.91x per op on Apple, 1.53 NVIDIA; perm 1.13 / 1.30; mm8 emulated 1.6x per dot4; measured), and its price in chip k (shadow-k.md: mad 0.20, the ARX families 0.17 to 0.18, the fold 0.14, or 0.12, mul 0.082, prmt 0.056, mulhi 0.032; the shuffle, crossbar and tile rows owed). The entry rule is sub-version 3's acceptance under the entry's own shape, ring C's census (10,000 random and 3,000 band eras, 0 of 10^6 exhaustions per corner), the 5 percent rule, and the 10 ms verifier gate for atoms. Entries are never removed, so program ids stay decodable.
+
+### 4.2 The draw (structure from the bank, never content)
+
+The family epoch's reference block (the era cut) seeds one stream; five draws in fixed order: (1) the live reserve subset: during the reserve (epochs 1 to 8) entry `n` unlocks at epoch `n` with `W_new` = 4 points taken proportionally (spec 1.13.2, the slot consumed and unused); after the reserve, two entries live by a fixed cycle over the reserve whose phase the draw sets, so a retired family returns on a schedule a chip cannot wait out; (2) the atom from the bank's admissible atom list (the one draw of any layer that changes the dataset derivation); (3) the fold form's genesis constants (the week draws the values); (4) the admissible shapes; (5) the B = 4 band the week draws inside. The split with layer 2, this document's resolution of the two lanes' overlap: **the family epoch sets the structure (which families, which atom, which form, which shapes are admissible); the week draws the values inside it (the weights, the shape, M, R, the fold constants, the pattern).** 180 days aligned to the six-month era; the dataset floor's steps offset by 90 days (lane 3's schedule), so the chain has at most two boundary events a year of the costly class. On the chip timelines (layer3-family-bank.md section 4, claimed dates): 3 flips inside Kaspa's 22 months to the KS0, 6 inside Ethash's 36 to the E3, 7 inside Monero's 46 to the X5.
+
+### 4.3 What a chip must cover
+
+What the bank asks of a datapath (a capability statement, no claim about any product): to compute every bank entry (about 8 to 14 adders per lane, about USD 4 of N5 on a 14,000-lane array, class v6 4.2, modelled) and every atom in the bank, else a family's weight of the mix (4 points of 79) is computed by emulation at the measured vendor penalty (1.5x to 2.4x per op) on the day it goes live. The chip that survives any flip is the sequencer core (layer3-family-bank.md item 2): 3.1x the bare lane (6.9 against 2.2 pJ on ASAP7, synthesised), k 0.56 at the lock at N3 against the bare 0.18; so the layer's honest floor is a chip that is the GPU, unmoved against the memory system (GDDR7 2.8x at the knee, the SRAM die 4.7x, the M5 Max column 1.7x to 2.8x; modelled on measured cards), and the bank changes about 1.2x of edge over the bare floor and nothing for a programmable part. Under the 2.0 framing this is the layer's cost side; it is not offered as resistance.
+
+### 4.4 What a layer 3 or 4 boundary requires that 1 and 2 do not
+
+A family epoch can change the atom and the admissible shapes, so a node on the wrong dataset refuses every honest block: a two-sided chain, the DAA 198,000 class and this morning's crossing (section 6.3). The guards, each named: the node's own lead-ahead self-test (6.2, a fast-time crossing per node); rule 18's feed check and rule 19's fingerprint pairing (6.3, in-node rules with CI checks); the bank's conformance vectors (a test per entry per vendor); ban clearing (object-mismatch strikes not counted within one window of the flip, cleared at it; F23 untouched); the stale-kernel refusal (test). None is a proof that a future draw is right; the vectors are what say a family computes the same value everywhere.
+
+## 5. Layer 4: the emergency miner vote
+
+### 5.1 The trigger: the detector is a bell for people, never a consensus input (layer4-miner-vote.md section 2, taken; this document's earlier "6-sigma trigger" withdrawn on its numbers)
+
+| Signal | What the chain can read | Its false-positive price on today's rows | Its false-negative price against a disciplined chip fleet | Verdict |
+|---|---|---|---|---|
+| A: a hash-rate step beyond the fleet-tier envelope | the difficulty's implied rate; the envelope from 98 measured rows over 43 tiers (14.9 MH/s on a 2060 to 416 on a B200; consumer 0.08 to 0.58 MH/W; the 5090 99 to 123 MH/s, n 849) | the 4 October crossing stepped 152 to 280 MH/s in minutes (1.84x, measured); the 6 October wave put 1,748 MH/s on about 1.16 GH/s; a rule on a 2x day step fires on every day of both crossing weeks; a 20 to 30 percent daily swing is ordinary rental churn (approximate) | a fleet ramping 5 percent a week is under every honest swing; doubling a 1 TH/s mainnet is USD 3,500 an hour of rentals, inside the market (approximate) | a gate (no flip vote is worth raising under a 1.5x step in 30 days), never a trigger |
+| B: share concentration and correlation of winning keys (`tools/observer/detector.mjs`: spread over 10 percent, band, early, nonce; a clique of 3 ids over r 0.8 held 6 windows) | blue-block share per key, residual-rate correlation, nonce law | the 6 October baseline: 6 pairs, max r 0.94 on two honest 5090s on one Windows schedule, 1 edge, 0 cliques (measured); a Vast 8-card host is a clique of 8 at r near 1 | a chip throttled into a card band (bandTol 30 percent), keys split, 10 percent per-unit jitter, randomised nonces: every test beaten for under 1 percent of its edge (modelled) | a bell |
+| C: an efficiency signature in timing | the early-epoch share, template-to-block latency, nonce order | all three are shapes of the honest card (compile, fetch, counter) | a chip is on time and its nonce order is firmware; joules per hash never reach the chain | no on-chain form; the off-chain instrument is the bounty and benchmark |
+
+The number for the close: signal A about 50 cases a year at the record's fleet behaviour (2 of 14 crossing-week days, arithmetic, approximate); signal B a few a year at today's key count (derived from the one measured baseline, approximate); so an automatic flip on either would be griefable for under USD 1 an hour on devnet data and a consensus input the observer feeds. The signals decide when nodes SHOW a flip proposal with its evidence and when miners' signers offer their operators the vote; they never decide the vote.
+
+### 5.2 The vote (layer4-miner-vote.md section 3, taken; this document's earlier veto, day-long window and frozen-table denominator withdrawn on the reasons in section 8)
+
+- **The payload**: a `FlipVote` item under its own tag in the coinbase finality section (the Leave item's shape, tag 8, carried last so an older decoder stops cleanly; never a widened `Vote`, whose decoder dispatches on exact length): a BLS signature by a finality voter's key over `"igneum-flip-v1/" || chain_id || 0 || index || hash(C_i) || family_id || target_height`; relayed where votes are relayed. `family_id` is the next scheduled epoch's bank structure id; `target_height` an hourly epoch boundary. **A target at or past the scheduled height is invalid and dropped, so no vote can delay**; there is no veto because the scheduled epoch is a height and not a vote.
+- **The tally** (in-node rule; the prototype's `vote_carries` with its tests): over 720 consecutive checkpoint indices (6 hours; 4 on the fast-time file), by Q2's block reading (a key's vote at index j counts when a block in the past of C_i carries it), weighted by W2 at C_i: the vote passes when at every one of the last 240 indices the summed weight of keys whose latest flip vote names the same `(family_id, target_height)` is at least two thirds of active weight (W2 times participation, Q3's first test) and at least half of total 30-day weight. Why both: the active test means silence cannot block (a key that stops signing leaves the denominator within a presence window); the half-of-total floor means an eclipsed minority cannot pass alone. Memoised per seed block like the class signal, so a fork has its own answer. No vote counts while `finality_active` is false.
+- **The delay and the flip**: the first hourly boundary at least 14,400 DAA s (4 hours, the publish rule's own lead) after the tally closes; nobody fetches anything (the bank is in every binary that could vote); every node runs the lead-ahead self-test on the incoming structure and refuses to serve a template it cannot verify; Ember re-tunes once. UK clock: 6 hours of window plus 4 of delay, so a carried vote flips 10 to 11 hours after its first qualifying index at the 1 s block. The next scheduled epoch re-bases from the flip (the prototype's `era_index_with_flip`); one bring-forward per family epoch.
+- **Every node deterministic**: the carried votes are chain values (carriers in the certified checkpoints' past), so every node with the checkpoints computes the same flip height and a node that joins later reads it from the blocks it syncs; a node synced from a pruning proof cannot tally below its pruning point and takes the schedule (owed, the class signal's same gap).
+
+### 5.3 The attack read
+
+| Attack | What happens | The read |
+|---|---|---|
+| A chip fleet at a third of weight blocking by abstention | it blocks every bring-forward while it holds a third of active weight; it cannot delay the scheduled epoch (a height); if it goes silent it leaves the denominator within a presence window and, at a third, pauses finality (3.11.3), which costs it its own locks | the vote adds no new threshold to buy: a third of active weight is a third of the 30-day blocks, the same third that pauses finality; the damage is bounded by the schedule's cadence (180 days), which no vote shortens |
+| A chip fleet with majority weight | it is the finality problem itself (20 days of 100 percent hash to reach two thirds); it could carry a bring-forward, which only hurts a chip; it cannot delay | layer 4 is a lever for an honest two thirds and a cost to nobody else |
+| A griefing vote (a two-thirds coalition flipping early for the cost to others) | one bring-forward per family epoch; each costs every honest miner one bench pass (minutes) and nothing else; a floor step's rate cost (4 to 10 percent per hash on the 5090 at 2 to 8 GiB, measured) only where the family carries one | worst case twelve re-tunes a year by a majority that wanted them; the coalition pays the same |
+| A flip during a partition | no vote counts while finality is paused (C5, 3.9); a partition shorter than the lead heals before the flip; one longer has already paused finality on at least one side (3.7 item 9), so the vote is void there and the schedule stands; a vote carried before the split flips on both sides at the same height from the same reference block | the flip cannot be one-sided; today's Devnet 3 (14.7 MH/s, a handful of keys, two PCs on one schedule) could never pass one, which is correct: nothing on it has the weight to speak |
+| A replayed or forged vote | the tag separates it from a checkpoint vote; `chain_id` stops cross-network replay; `index || hash(C_i)` expires it with its checkpoint; two flip votes by one key at one index naming different targets are equivocation under 3.6's evidence shape; forging is forging BLS12-381 | in-node rules with the finality suite's shape; a pool cannot vote for a member (no verifier, no vote) |
+| A vote naming a height outside the window | ignored | in-node rule; test `rotation_flip_height_outside_the_window_is_ignored` |
+
+## 6. The exposure: a flip is a boundary
+
+### 6.1 The arithmetic
+
+A boundary is a height at which every node must compute the same new value or refuse the other side's blocks. Boundaries a year: layer 1 8,766, layer 2 52 (12 monthly), layer 3 2, layer 4 at most 2 extra. The exposure is the failure class a disagreement can cause times the count:
+
+| Boundary class | Failure if a node disagrees | Recovery | Boundaries a year | The exposure |
+|---|---|---|---|---|
+| Program only (layers 1 and 2) | the disagreeing miner's blocks are refused by every node with the reference block; the chain does not fork | automatic: the miner's next template after its node catches up | 8,818 | 8,818 chances a year of one miner losing one epoch's blocks; zero of a two-sided chain, because no agreement beyond the reference block is needed and every node already agrees on that |
+| Structure (layers 3 and 4: the atom, the admissible shapes, the family set) | a node on the wrong dataset refuses every honest block: a two-sided chain | the losing side's execution reset and a deep reorg; nothing automatic beyond the merge-depth bound | 2 to 4 | 2 to 4 chances a year of the costliest class; this is why layer 3's cadence is 180 days and not 7, and why layers 1 and 2 are forbidden the derivation and the atom |
+
+The layers are split by exposure class, not by cadence: a weekly boundary is cheap because it is program only, and a family boundary is rare because it is not. Putting the atom under a weekly draw would be 52 chances a year of the two-sided class against 2.
+
+### 6.2 What a layer 3 or 4 boundary requires: the node's own fast-time crossing self-test
+
+Before every family boundary (scheduled or voted), from the reference block on, every node crosses the boundary against itself in fast time: it derives the coming structure from the reference block, generates the new epoch's first program and packchecks it against its own generator, runs the 96 vector lanes and the 2^24 fingerprint of each live family against the bank's table, builds the dataset head under the coming atom, captures and persists the day stream at the cut, and only then prints the family line and serves the new template at the boundary. A node whose self-test fails keeps the old structure (its blocks refused from the boundary, at its own cost) and reports the failure home with the reason shown (the plug, tune, play rule). This is a fast-time crossing per node: it shows this node can cross; the reference block and the vectors are what say every node agrees.
+
+### 6.3 The four crossing faults and rules 16 to 19 (the release record on `ship-docs-0321`, `docs/plans/release-0.3.22.md` section 25 and `release-rules.md` lines 22 to 25, read today)
+
+The four faults of the class v5 crossing on Devnet 3 (12:48 to 13:30 UK, 8 October), each a boundary where nodes had to agree on something beyond the chain's own blocks: (1) every fleet miner's worker ran generators 2 to 4 only, so the chain made no block for 9 min 26 s at DAA 68,400 (rule 16: every shipped worker prepares the live epoch before the cut; a package is checked by whether its worker can prepare the new class, never by its packs' presence); (2) container OOM kills and a proof map without a window (rule 17: memory read against the container's cap, never the host's; anything held per received item needs a window); (3) the re-walking node's chain-id refusal and its misbehaviour strikes (a mismatch between the network's own ids is a refusal, never a strike); (4) the public feeds read build-1's observer in a drifted one-peer cluster, so the public saw the chain dead from 12:59 UK while the chain ran (**rule 18, the feed check**: "every public feed names its source node and reads it only while that node's hash and state root at the current epoch's reference block equal the network's; on a mismatch the feed fails over to the next listed node and says so"). A fifth, behind **rule 19, the fingerprint**: a gate artefact built from uncommitted igneum-pow edits ("the pairing is a fingerprint, not a path": every node and miner binary carries the fingerprint of the igneum-pow tree it was built from; the build fails when it differs from the pinned freeze; the read-back prints it beside the commit; the handshake carries it and a node refuses a peer whose fingerprint differs; `tools/ci/pow-fingerprint-check.sh`). Under rotation: rules 16 and 19 are what make "the bank is in every binary" a checked fact rather than a hope (the worker prepares the coming structure, the fingerprint pairs the bank); rule 18 reads the same reference block the layers draw from, so a feed right about the lock is right about the week and the epoch; and layer 2 has none of the four faults' shape by construction (3.3), which is the research lane's proof that the weekly boundary needs no state agreement.
+
+### 6.4 Two more faults of the crossing day, refused by construction and carried into the crossing test (the coordinator's word, 14:5x UK; the mechanics from the node lane's reading, 15:0x UK, cited here by lane)
+
+| Fault | What happened (the node lane's mechanics) | The rule | Where it binds in the four layers | What the fast-time crossing asserts |
+|---|---|---|---|---|
+| (6) The epoch 20 boundary stall (Devnet 3, 13:03:41Z) | the class v5 check (`consensus/pow/src/igneum.rs:156`) refuses a header whose epoch state this node's executor does not hold; (a) the relay flow counts every PoW-check `Err` as a PoW cache strike, so the fleet's nodes, executors behind epoch 19's seed block, banned build-1's seed ("230 PoW cache strikes within an hour (limit 2)", 12:56Z), and in IBD the same refusal is `protocol/flows/src/ibd/flow.rs:1127`; (b) the template needs the same state, so at DAA 72,000 no mining node's executor had passed epoch 20's seed block and no epoch 20 template existed: the chain stood at the last epoch 19 block | a refusal for missing state is never a strike (the `Err` carries a missing-state kind the strike counter skips, the header is parked and retried, the peer keeps its standing); a node's template waits for its executor past the epoch's seed block and says so (a line, never silence). No fix exists yet; the record names it as the next node line's item | every boundary of every layer is a template-build event, the hour included (epoch 20 WAS an hourly boundary), so this is a layer 1 rule first and layers 2 to 4 inherit it; under class v5 every boundary reads state at its reference block | at the epoch cut a node whose executor is held below the cut prints the :156 line, never appears as "PoW cache strikes" or "banned" in its peer's log, and the chain advances on the peers whose executors passed the cut: the absence of a strike in the peer's log is the read; the harness's per-second `getBlockTemplate` keeps answering on every node at every boundary crossed (a failed template call at a boundary fails the run) |
+| (7) The cold-restart deadlock (13:25Z) | `igneum/exec/src/service.rs` `follow_once`: a node with nothing executed (its snapshot refused by the 0.3.25 digest stamp) hit the 6 October sink-age guard (sink older than 10 minutes: "waiting for consensus to sync before the executor starts"), retried every pass; with the chain stale (fault 6) every restarted node waited, class v5's check needs the executor, so none could validate or mine and no sink ever freshened: a network-wide deadlock | a node holding the chain from genesis replays whatever the sink's age. Fixed in place: f8da7515 on `release-0.3.25-node` (both mirrors; no digest change): `cold_start_replays(sink_age_ms, holds_chain_from_genesis)`, `Err` (the wait) only for a node that has synced nothing or whose retention root is above genesis, `Ok(true)` when the sink is stale but the node holds the chain from genesis, printing once "exec sync: the sink is N s old but this node holds the chain from genesis ... replaying from genesis whatever the sink's age"; test `cold_restart_tests::a_node_holding_the_chain_from_genesis_replays_whatever_the_sinks_age` (the pre-fix refusal asserted first) | layers 3 and 4 are the only boundaries that touch state, so their crossing test carries the cold-restart case; the prototype's fork branch is fast-forwarded onto f8da7515 | `--cold`: after the era boundary every node is stopped by its pid, left down over 10 minutes, its exec snapshot removed, and restarted from its kept datadir; on f8da7515 each node holding the chain from genesis prints the cold-restart line within its first follower pass and its executor tip climbs; on c9ad753a each prints the wait line every 60 s and the tip stays 0 (the known-failed binary); `--restart` (one node, a young sink) is the lighter case |
+
+## 7. What each guarantee is (the founder's bar: never claim more)
+
+| Claim | What it rests on | What that is |
+|---|---|---|
+| Every node draws the same value at every boundary | the reference-block rule; the stream's fixed order | in-node rule; tests in igneum-pow and the fork (section 9) |
+| No week's table leaves the band or exhausts | ring A; the three-block redraw and the genesis table | in-node rule; the fork's two known-failed tests; the census bounds the failing fraction at 1.0e-3 at 95 percent (measured), never a proof |
+| Layers 1 and 2 cannot split the chain | they never touch the derivation, the atom or the layout | a design rule the types enforce (the prototype's `EraDraw` has no derivation field) and the record's reading of the four faults (6.3) |
+| A family boundary is crossed clean | the self-test, rules 16 to 19, the vectors, the ban clearing | a fast-time crossing per node plus in-node rules; the three-node crossing on the box shows the path once |
+| A vote cannot carry one-sided or delay anything | the active and half-of-total tests; no vote while finality is paused; a target past the schedule dropped | in-node rules resting on the finality rule's own guarantee (sim v2: 0 conflicting locks in every partition scenario, measured in the simulator); the 720-index window against the sim is owed (layer4-miner-vote.md section 7) |
+| The detector's false-positive rate | the two crossing weeks and the 6 October baseline | measured days, arithmetic; the multi-card-host clique rate is derived and owed (one 8x Vast box for an hour measures it) |
+
+## 8. The research lanes' recommendations, kept or rejected
+
+| Lane | Recommendation (its five lines, shortened) | Kept or rejected | Why |
+|---|---|---|---|
+| layer1-hourly (34f95b6e) | (1) keep the hourly period; (2) close the 64-bit `program_rng` entropy cap with ledger M7's standard-hash stream; (3) add the warp-uniform block select, the register-file width draw and the full-permutation shuffle pattern; (4) never draw per-lane branches, the placement or N; (5) the refusals per failure mode | (1) KEPT; (2) KEPT as a generator change, so it rides a class cut and is named in section 10 as what a release still carries; (3) the shuffle pattern KEPT in the week's draw (slot 7) behind its AMD row; the block select and the register width REJECTED for this document (research, class v6 7c's layers 6 and 7; their censuses are owed); (4) KEPT; (5) KEPT | (2) is the one finding ProgPoW's audit made and it costs zero GPU; (3)'s two extra dimensions move nothing on the identity and their Apple compile footprint is unmeasured |
+| layer2-weekly (234c9067) | (1) five draws, never m, W, N or `pos`; (2) the three-ring acceptance with the 32-attempt judgement, three blocks, the genesis table; (3) no state agreement, the one thing that breaks it; (4) seven days; (5) the precedents | ALL KEPT; the mixer multiplier removed from this document's earlier draft of the week's draw | m is the verifier's budget (1.86x per doubling, measured) and a per-family axis; the lane's reading of the four faults is the proof section 3.3 needed; the prototype's chain path folds the week's reference into the era seed, which this round redraws `pos` as well (section 9 says so and what the generator entry must split) |
+| layer3-family-bank (fa5482d1) | (1) the bank's count and entry rule; (2) the sequencer core as the chip that survives; (3) the flip as a state-agreement boundary with the self-test, rule 18, rule 19, ban clearing; (4) 180 days aligned to the era, floor steps offset 90 days; (5) a release stays for a family beyond the bank, W = 8, a new derivation; bank refresh at n + 2 | ALL KEPT; this document's earlier "twenty entries" and "R0 derivation variant" corrected to the lane's 18 + 3 + 1 + 3 (there is no R0 in the spec) | the overlap with layer 2 (both draw B = 4 and the shape) resolved in 4.2: the epoch sets structure, the week draws values |
+| layer4-miner-vote (c2e8ecd0) | (1) the detector never flips anything; (2) opt-in bring-forward at two thirds of active weight, no veto; (3) its own tag, 720 checkpoints, the half-of-total floor; (4) the flip at the first boundary 14,400 DAA s after the tally; (5) the site line | ALL KEPT; this document's earlier veto, day-long window, frozen-table denominator and 6-sigma trigger withdrawn | a veto is a delay lever handed to the fleet the layer exists to remove; the active denominator is what stops silence blocking; the detector rang on two honest 5090s |
+| other-layers (2f986d70) | KEEP the floor's composition rule (the state read at the era cut only; a vote never lowers the floor); HOLD W in {4, 8} behind the PC 1 row; KEEP per-tier census and RISC Zero as genesis instruments only; KILL randomised epoch lengths, a sealed reserve class, VRF or beacon draws, per-block placement, per-tier shadow, the detector-armed hold, a drawn verifier budget, the kernel-fetch tell | ALL KEPT as verdicts; the Qubic read (a captured third blocks only the bring-forward; the 95 percent signal form is blocked from 5 percent of blocks) carried into 5.3 | a sealed class cannot be censused, and an uncensused class is the liveness risk the record measured (0.986 to 0.990 rejection on the per-load form) |
+
+## 9. The prototype (research class; never a chain path without the switch)
+
+On the fork branch `class-v6-rotation-node` (worktree `vendor/igneum-node-rotation` from the mirror's `release-0.3.25-node` at c9ad753a, the class v5 freeze tree `igneum-pow-v5` beside it under the untracked paths override) and `class-v6-rotation` (the harness and this document). What is built this afternoon, each piece named by what it shows:
+
+- **Params**: `rotation_v6_activation_daa` (the switch; `u64::MAX` = never on every network; the digest arm entered only when set, so a binary carrying the field peers with one that does not), `rotation_era_daa` (layer 2: 604,800; 10,080 on the 60x file; 180 in the harness), `rotation_vote_window` (layer 4: 720 checkpoints; 4 in the harness), `rotation_vote_delay_daa` (14,400; 1,440 at 60x; 60 in the harness); each on `Params` and `OverrideParams`, the `From` and `override_params` lines, a key in `override-60x.json`. Layer 3 rides the existing 180-day era (`pow_era_blocks`, 420 in the harness).
+- **The schedule as pure functions** (`consensus/core/src/igneum/rotation.rs`): `weekly_index`, `weekly_reference_score`, `fold_era_seed`, `draw_era_params` with ring A's loop and the base table, `draw_family` from the bank, `vote_carries`, `flip_height_admissible`, `era_index_with_flip` and `era_start_with_flip` (the era clock `pow_era_index` and `pow_era_seed_score` now read the installed flip). Tests first, the known-failed ones first: `rotation_era_draw_exhausts_to_base_table`, `rotation_vote_one_of_three_does_not_carry`, `rotation_flip_height_outside_the_window_is_ignored`, then the accepting cases and the determinism cases (ten tests; the box's result in the SUMMARY).
+- **The chain path, behind the switch**: the week's reference block folded into the era seed the generator consumes (`fold_era_seed`), so the address draw changes weekly and a kernel of the old week is refused at packcheck and by every node's PoW check; the node's era line and family line at each boundary; the template unchanged in shape (the harness reads `eraIndex` and `eraSeed` from `getBlockTemplate` and the node's lines). Honest limit of this round: the fold redraws M, R AND the interleave `pos` (the week's slot list says M and R only; splitting the stream so `pos` stays with the era is the generator entry the next round adds in igneum-pow, a research build with the freeze check named on its start line); the weights, the shape and the pattern are drawn and accepted in the module and enter the program only through the folded seed until that entry exists.
+- **The vote**: the `FlipVote` item (tag 8, the Leave shape, carried last), its ingest with carriers, the tally at every lock (two thirds of active and half of total over the voters whose record has a carrier in the checkpoint's past and an index inside the window), the fold over the last N consecutive locks in `evaluate`, `install_flip` when it carries and the schedule admits the height, the node's flip line; the installed flip persisted in the finality state and re-installed on load (a restarted node would otherwise compute the plain schedule and refuse its peers' blocks: fault 7's class for any schedule state that is not a pure function of the chain); the miner's `IGNEUM_ROTATION_VOTE=<height>` (devnet only, the `IGNEUM_CLASS_SIGNAL` shape) appending the signed item to its vote submissions from a named epoch.
+- **The fast-time run** `infra/fast-time/class-v6-rotation.mjs` on build-3 through `tools/fast-time-remote.sh` at normal priority (nice, bounded cores): three nodes, three CPU miners, the 60x file with the week at 180 DAA, the era at 420, a vote from epoch 2 naming 660, window 4, delay 60; one run crosses hourly boundaries, week boundaries, the scheduled era boundary at 420 and the voted flip at 660, and passes only with zero refused blocks on every node, the sinks and counts equal, every node's era, family and vote lines equal, the program ids equal across the three miners at every epoch, a template served on every node at every boundary (fault 6) and, with `--restart`, one node restarted from its kept datadir after the era boundary re-synced to the others by the end (fault 7); the known-failed cases (`--voters 1 --expect flip` must report FAIL; `--expect off` must show no rotation line) first; the four cases run side by side on one box under one `fast-time-remote` run (`class-v6-rotation-cases.sh`, each on its own `--slot` of ports, suffix and data dir, at nice 19). Every process by pid file. The SUMMARY by 18:30 UK with the numbers.
+
+### 9a. What the prototype's crossing showed (build-3, runs 1 to 4, 15:0x to 16:2x UK; the record under `infra/fast-time/out-v6r*`; every number from the harness's summary or the nodes' own lines)
+
+The network: three nodes, three CPU miners, the 60x file with class v4 from genesis, the week at 180 DAA (the merge-depth lead 60), the family epoch at 420 (the era's own lead 30), a vote naming 720 from every voting miner's first checkpoint vote, the window 4 locks, the delay 60 DAA; the CPU bits 4x easier than the devnet's so twelve nice-19 miners on a box at load 20 to 40 make about 1.2 DAA a second; four cases side by side, 900 DAA each (16 hourly epochs, 5 week boundaries, 2 family boundaries).
+
+| Case | Verdict | What it showed | Label |
+|---|---|---|---|
+| `--expect off` (the switch never) | PASS (run 2; run 4 the same on every check but the timeout line below) | the node prints its off line, no week or family line, 300 blocks on three equal sinks, 0 refused | measured, run 2 |
+| `--voters 1 --expect flip` (known-failed first) | FAIL as required (runs 1, 2, 4) | one key of three signs 41 to 50 of 120 weight at every lock ("short" on the tally line), no flip line on any node, the family epochs on the schedule (420, 840), 0 refused by any node, sinks equal, 900/900/900 | measured, run 4 |
+| `--voters 3 --expect flip` | the vote carried at lock 15 (daa 449; 11 contiguous passing locks, share 10,000 bps) on all three nodes at the same lock, the family epoch brought forward to 720 (the family line "from reference block ... (daa 690)" on every node), the schedule re-based (the next boundary 1,140, not 840), 0 refused by any node at every one of the 16 hourly, 5 weekly, the scheduled and the voted boundary, sinks equal, 900/900/900; every check PASS but `zero_rejected_by_miners`, whose one line is a miner's submit RPC timeout on the loaded box (run 4) | measured, run 4 |
+| `--voters 3 --expect flip --cold` | the cold-restart line of f8da7515 on all three nodes after 660 s down with the exec snapshots removed ("the sink is 669 s old but this node holds the chain from genesis ... replaying"), no wait line; the rest as the flip case (run 2's read; run 4's summary in the SUMMARY) | measured, runs 2 and 4 |
+
+The three faults the runs found in the prototype, each fixed the same hour and each a rule for the design: (1) the flip tally excluded a key whose latest vote index was above the locking index (the miner votes ahead of the lock): the latest vote counts whatever its index; (2) a flip vote reaches other nodes only inside the block that first carries it, so on every other node a key's record stays at its first index: a carried vote STANDS until the key names another target, the window is the consecutive LOCKS that pass and the carrier-in-past test is the binding (an expiry of one weight window is the next round's item; the finality gossip could carry flip votes like checkpoint votes); (3) the brought-forward boundary lived in a process-wide static and a restarted node would have computed the plain schedule and refused its peers' blocks: the installed flip is persisted in the finality state and re-installed on load (fault 7's class for any schedule state that is not a pure function of the chain). Two facts about the test network, not the design: class v5 at genesis needs every node's executor (the state stream for the PoW check and the prepare), which the fast-time file cannot give, so the crossing runs on class v4; and on the 60x file the merge-depth lead is 60 DAA, so a week's reference block sits a third of a week below its boundary (3,600 of 604,800 on the devnet).
+
+## 10. The "automated" claim for the site, stated honestly
+
+Once shipped, the chain changes its own hash on four clocks with no release and no hand: every hour a new program, every week a new table for it, every 180 days a new family set from the bank written into the chain at genesis, and in an emergency the next family set brought forward by a vote the miners carry in the finality votes they already sign. Every change is drawn from a block the chain already agreed on, checked by the same rules on every node, and refused at the boundary by every node if a miner gets it wrong, so none of the four can split the chain by a bad draw; the team holds no key, no switch and no date, and the detector every node shows is a warning light, not a switch. What still needs a release: a family the genesis bank does not hold, a read width or a dataset derivation outside the genesis list, a wider band, a new generator (the 64-bit stream's successor is one); the automation rotates what genesis shipped, and nothing it did not.
+
+## 11. Unverified and owed
+
+- Lane D's count of band eras over 32 attempts (the week's redraw rate: under 0.1 percent by the max of 59, the exact figure owed).
+- The 720-index window against `sim/finality_v2.py` under the F2 eclipse and the bought-keys case (finality lane); the clique test's false-positive rate on an 8-card rental host (one Vast box for an hour); the 14,400 DAA lead against a family change on AMD and Apple (bench lane, PC 1); the pruning-proof node's tally (node lane).
+- The AMD `ds_bpermute` row for the shuffle pattern; the Apple compile footprint of layers 6 and 7.
+- The generator entry that splits the week's slots from the era's (section 9); the index fold's form and vectors; the 2,880-era harness case with a restart across a week boundary from a kept datadir.
+- Every chip figure is the chip model's; no chip has been measured.