diff --git a/docs/bench-log.md b/docs/bench-log.md
index 52550a677..e2494f36d 100644
--- a/docs/bench-log.md
+++ b/docs/bench-log.md
@@ -98,3 +98,16 @@ Build note for Windows: CUDA 12.8 crashes (cudafe++ access violation) under Visu
 Second program igneum-hourly (128 loads per hash): 96/96 vectors PASS, 185.3 Mhash/s at 1 GiB, 23.7 G random loads/s.
 
 Reading: the 5090 carries 96 MiB of L2. At 4 and 64 MiB the dataset sits inside it and the program runs about 5.8x faster than at 1 GiB. Past the L2 the rate settles at about 23.7 G random loads/s for both programs regardless of loads per hash (104 vs 128 loads gives 228 vs 185 Mhash/s, proportional), so the program is random-access bound once the dataset exceeds on-chip cache. Each 4-byte random load moves a 32-byte sector, so DRAM traffic is roughly 760 GB/s, approximate, against a quoted peak near 1.8 TB/s for this card. Design consequence: the dataset must stay well above any plausible on-chip cache, which the 2 GB genesis size and the growth schedule provide; a chip would need gigabytes of on-chip memory to escape the random-access limit. Still prototype numbers: dataset derivation remains closed-form until the 256 MB cache construction lands.
+
+## 2026-10-03  sim/finality_v2.py, finality rule V2 with latency, partitions and eclipses (model, not hardware)
+
+Model: 30-s slots, Poisson(30) blocks/slot, 1,000 Pareto honest keys in 3 regions (45/35/20), 2-s inter-region delay (0.5 and 5 swept), uptime 97% (99.5% for pools over 1%), warm 30-day start for B to G. Seed 7, seed 11 agrees on B and E. Run time 5 min. Details in sim/results_v2.md.
+Rule: weight = flat 30-day blue blocks, dust 100, checkpoint per 30 blocks, lock at 2/3 of ACTIVE (participation over 240 checkpoints) vs TOTAL weight.
+A: weight = hashrate (corr 1.00000), full weight day 30, all keys over dust by day 20, lock median 2.5 s / p99 4.6 s at 2 s delay, 14 s max at 5 s, 0 stalls in 60 days except 17 at genesis.
+B: share(t) = (t/30) x a/(1+a) holds to 0.04 points; 1/3 crossed at day 20.0 / 15.0 / 12.5 / 11.1 and 2/3 at never / 30.0 / 25.0 / 22.2 for a = 1 / 2 / 4 / 9; dust hands a 9x renter 1.3 extra points.
+C: silent set that keeps mining: active recovers in 0 / 13 / 20 / 29 / 38 min at 34 / 40 / 45 / 50 / 55%; total never (silent weight never ages out).
+D: churn: active 2 min (35%) and 31 min (50%); total 41 h and 10.1 days.
+E: active FAILS the partition test: 50/50 honest split, no attacker, both sides lock after 60 min (30 with DAA retarget), 60/40 after 121 min; first-lock time = presence x (1 - 1.5 s)/s slots, confirmed. Total: 0 conflicts in every honest partition. 34% attacker breaks every variant at 50/50 (67% per side).
+F: delayed eclipse of a 20% pool is harmless (participation 0 after 2 h, back in 2 h, 0 conflicts); a 34% attacker poisoning that pool finalises a private fork in 49 min under active, never under total.
+Floor hybrid: active denominator never below 0.85 x total (lock needs 56.7% of total) gives 0 conflicts in every partition and eclipse, recovers in 0 / 13 min at 34 / 40% silent and 2 min at 35% churn; costs 4.1 days at 50% churn and liveness ends near 42% silent. Floor 0.80 does not stop the eclipse (54% > 53.3%).
+Recommend: active/cert + floor 0.85, presence 240, dust 100, quorum 2/3, grace at least 3x worst delay. Not modelled: real GHOSTDAG merge and post-heal fork choice, DAA lag, VRF aggregators, certificate revocation.
diff --git a/sim/README.md b/sim/README.md
index 4e2d92680..5d7ba4b09 100644
--- a/sim/README.md
+++ b/sim/README.md
@@ -58,7 +58,7 @@ is over certified indices only). Scenarios A to G and every assumption are in `r
 
 Requirements: Python 3, numpy (3.10.10, numpy 2.2.6 on 3 October 2026).
 
-Run everything (about four minutes):
+Run everything (about five minutes):
 
     python3 finality_v2.py > out_v2.md
 
diff --git a/sim/results_v2.md b/sim/results_v2.md
index 6ae780149..4b66f979e 100644
--- a/sim/results_v2.md
+++ b/sim/results_v2.md
@@ -117,11 +117,11 @@ At day 60 (hour 3 of the run) a random set holding x of weight stops signing and
 
 | silent weight | active/cert | active/seen | active/frozen | active/cert, presence 2,880 | active/cert + floor 0.80 | active/cert + floor 0.85 | total |
 |---|---|---|---|---|---|---|---|
-| 34% | 0 min, 0 stalled | 0 min, 0 stalled | 0 min, 0 stalled | 20 min, 99 stalled | 0 min, 0 stalled | F85_34 | never (3.0 d), 8,666 stalled |
-| 40% | 13 min, 26 stalled | 28 min, 57 stalled | never (6 h), 720 stalled | 2.6 h, 325 stalled | 13 min, 47 stalled | F85_40 | never (3.0 d), 8,666 stalled |
-| 45% | 20 min, 41 stalled | 46 min, 93 stalled | never (6 h), 720 stalled | 4.4 h, 535 stalled | 20 min, 455 stalled | F85_45 | never (3.0 d), 8,666 stalled |
-| 50% | 29 min, 59 stalled | 62 min, 125 stalled | never (6 h), 720 stalled | 6.0 h, 736 stalled | never (3.0 d), 8,666 stalled | F85_50 | never (3.0 d), 8,666 stalled |
-| 55% | 38 min, 79 stalled | 72 min, 144 stalled | never (6 h), 720 stalled | 7.9 h, 955 stalled | never (3.0 d), 8,666 stalled | F85_55 | never (3.0 d), 8,666 stalled |
+| 34% | 0 min, 0 stalled | 0 min, 0 stalled | 0 min, 0 stalled | 20 min, 99 stalled | 0 min, 0 stalled | 0 min, 0 stalled | never (3.0 d), 8,666 stalled |
+| 40% | 13 min, 26 stalled | 28 min, 57 stalled | never (6 h), 720 stalled | 2.6 h, 325 stalled | 13 min, 47 stalled | 13 min, 138 stalled | never (3.0 d), 8,666 stalled |
+| 45% | 20 min, 41 stalled | 46 min, 93 stalled | never (6 h), 720 stalled | 4.4 h, 535 stalled | 20 min, 455 stalled | never (3.0 d), 8,666 stalled | never (3.0 d), 8,666 stalled |
+| 50% | 29 min, 59 stalled | 62 min, 125 stalled | never (6 h), 720 stalled | 6.0 h, 736 stalled | never (3.0 d), 8,666 stalled | never (3.0 d), 8,666 stalled | never (3.0 d), 8,666 stalled |
+| 55% | 38 min, 79 stalled | 72 min, 144 stalled | never (6 h), 720 stalled | 7.9 h, 955 stalled | never (3.0 d), 8,666 stalled | never (3.0 d), 8,666 stalled | never (3.0 d), 8,666 stalled |
 
 Active/cert detail. Predicted stalls = presence x (p0 - 1.5 x online signing share), p0 = weight-averaged participation at the event.
 
@@ -133,7 +133,7 @@ Active/cert detail. Predicted stalls = presence x (p0 - 1.5 x online signing sha
 | 50% | 566 | 49.6% | 0.978 | 56 | 29 min | 59 | 0.000 | 1.005 | 0.493 |
 | 55% | 646 | 44.6% | 0.978 | 74 | 38 min | 79 | 0.000 | 1.004 | 0.445 |
 
-Interpretation. Under the total denominator a silent set is fatal: the silent keys keep mining, so their weight never ages out, and 34% silent blocks every lock for as long as they stay silent (8,666 stalls in 3 days, and by the arithmetic for the whole 30-day window and beyond). Under the active denominator with the literal (cert) reading the stall is minutes: 0 at 34% (the network's resting participation of 0.978 already leaves 65.6% of online signers above 2/3 of the active weight), 13 min at 40%, 29 min at 50%, 38 min at 55%. The mechanism is the one the formula states: every stalled index lowers everyone's participation by 1/240, so the denominator shrinks until the present signers reach 2/3 of it; after the first lock the silent keys fall to participation 0 within 2 hours and the signers lock with a ratio of 1.0. The same mechanism is what makes the partition in E unsafe. The seen reading takes about twice as long (silent keys decay, signers do not) and the frozen reading never recovers, like total. A 24-hour presence window multiplies the stall by 12 (2.6 h at 40%, 6 h at 50%). The floor hybrid at 0.80 keeps the minute-scale recovery up to 45% silent (455 stalls there: the margin is one pool outage thin) and stalls for the window at 50% and above, which is the price of the partition safety it buys in E.
+Interpretation. Under the total denominator a silent set is fatal: the silent keys keep mining, so their weight never ages out, and 34% silent blocks every lock for as long as they stay silent (8,666 stalls in 3 days, and by the arithmetic for the whole 30-day window and beyond). Under the active denominator with the literal (cert) reading the stall is minutes: 0 at 34% (the network's resting participation of 0.978 already leaves 65.6% of online signers above 2/3 of the active weight), 13 min at 40%, 29 min at 50%, 38 min at 55%. The mechanism is the one the formula states: every stalled index lowers everyone's participation by 1/240, so the denominator shrinks until the present signers reach 2/3 of it; after the first lock the silent keys fall to participation 0 within 2 hours and the signers lock with a ratio of 1.0. The same mechanism is what makes the partition in E unsafe. The seen reading takes about twice as long (silent keys decay, signers do not) and the frozen reading never recovers, like total. A 24-hour presence window multiplies the stall by 12 (2.6 h at 40%, 6 h at 50%). The floor hybrid at 0.80 keeps the minute-scale recovery up to 45% silent (455 stalls there: the margin is one pool outage thin) and stalls for the window at 50% and above, which is the price of the partition safety it buys in E. At 0.85 (a lock needs 56.7% of total) liveness ends between 40% silent (13 min, with 138 intermittent stalls in 3 days) and 45% (never).
 
 ## D. Churn
 
@@ -144,17 +144,17 @@ At day 60 (hour 3) a random set holding x of weight stops mining and signing. Su
 | 35% | 395 | active/cert | 2 min | 4 | 0 | 68.5% (3 days) |
 | 35% | 395 | active/cert, presence 2,880 | 40 min | 109 | 25 | 68.5% |
 | 35% | 395 | active/cert + floor 0.80 | 2 min | 102 | 98 | 68.5% |
-| 35% | 395 | active/cert + floor 0.85 | D85_35 | | | 68.5% |
+| 35% | 395 | active/cert + floor 0.85 | 2 min | 102 | 98 | 68.5% |
 | 35% | 395 | total | 41.0 h | 6,446 | 1,518 | 68.5% |
 | 50% | 566 | active/cert | 31 min | 106 | 45 | 70.0% (12 days) |
 | 50% | 566 | active/cert, presence 2,880 | 6.1 h | 862 | 140 | 70.0% |
 | 50% | 566 | active/cert + floor 0.80 | 2.2 d | 7,244 | 1,033 | 70.0% |
-| 50% | 566 | active/cert + floor 0.85 | D85_50 | | | 70.0% |
+| 50% | 566 | active/cert + floor 0.85 | 4.1 d | 12,823 | 1,006 | 70.0% |
 | 50% | 566 | total | 10.1 d | 30,307 | 1,180 | 70.0% |
 
 Analytic, perfect retarget: live share of total weight on day t = 1 - x(30 - t)/30, so the total denominator recovers at t = 30(1 - 1/(3x)): never for x at or under 1/3, day 1.4 at 35%, day 10 at 50%.
 
-Interpretation. Under total the stall is days: 41 hours at 35% churn (the analytic 34 hours plus the uptime shortfall, then 1,518 intermittent stalls while the margin stays thin) and 10.1 days at 50%, as the first simulation found. Under active/cert it is minutes: 2 min at 35%, 31 min at 50%, with a tail of intermittent stalls (45 at 50%) while the live keys' participation recovers and the dead keys' decays over the next 2 hours. A 24-hour presence window stretches that to 40 min and 6.1 h. The floor at 0.80 removes most of the gain at 50% churn (2.2 days: a lock needs 53.3% of total, which the survivors only hold once 10 points of dead weight have aged out) and at 35% it stalls 98 times in 3 days because the 17% pool's outages take the live online share under 53.3%. Not modelled: the real DAA takes of the order of an hour (approximate) to restore 1 block/s after half the hashrate leaves, which slows the checkpoint clock and so the presence decay by the same factor for that hour.
+Interpretation. Under total the stall is days: 41 hours at 35% churn (the analytic 34 hours plus the uptime shortfall, then 1,518 intermittent stalls while the margin stays thin) and 10.1 days at 50%, as the first simulation found. Under active/cert it is minutes: 2 min at 35%, 31 min at 50%, with a tail of intermittent stalls (45 at 50%) while the live keys' participation recovers and the dead keys' decays over the next 2 hours. A 24-hour presence window stretches that to 40 min and 6.1 h. The floor at 0.80 removes most of the gain at 50% churn (2.2 days: a lock needs 53.3% of total, which the survivors only hold once 10 points of dead weight have aged out) and at 35% it stalls 98 times in 3 days because the 17% pool's outages take the live online share under 53.3%. At 0.85 the 50% churn stall is 4.1 days, between the 2.2 days of 0.80 and the 10.1 days of total; 35% churn is unchanged (2 min, 98 intermittent stalls). Not modelled: the real DAA takes of the order of an hour (approximate) to restore 1 block/s after half the hashrate leaves, which slows the checkpoint clock and so the presence decay by the same factor for that hour.
 
 ## E. Partition
 
@@ -192,16 +192,16 @@ Supplementary, 0% attacker, more splits, 150 and 360 min. Cell = conflicting loc
 
 | honest split | min | active/cert | active/seen | total | active/cert+daa | active/seen+daa | cert+floor0.80+daa | cert+floor0.85+daa |
 |---|---|---|---|---|---|---|---|---|
-| 50/50 | 150 | 90; 60 / 59 | 31; 118 / 112 | 0; never / never | 240; 30 / 30 | 184; 60 / 56 | 0; never / never | E85_1 |
-| 50/50 | 360 | 297; 60 / 59 | 238; 118 / 112 | 0; never / never | 658; 30 / 30 | 602; 60 / 56 | 0; never / never | E85_2 |
-| 60/40 | 150 | 23; 19 / 121 | 0; 44 / never | 0; never / never | 204; 13 / 47 | 141; 32 / 77 | 0; 13 / never | E85_3 |
-| 60/40 | 360 | 193; 19 / 121 | 131; 44 / 198 | 0; never / never | 624; 13 / 47 | 561; 32 / 77 | 0; 13 / never | E85_4 |
-| 67/33 | 150 | 0; 4 / never | 0; 4 / never | 0; 105 / never | 174; 8 / 61 | 116; 8 / 89 | 0; 8 / never | E85_5 |
-| 67/33 | 360 | 122; 4 / 180 | 64; 4 / 262 | 0; 105 / never | 593; 8 / 61 | 535; 8 / 89 | 0; 8 / never | E85_6 |
-| 80/20 | 150 | 0; 0 / never | 0; 0 / never | 0; 0 / never | 127; 0 / 82 | 85; 0 / 103 | 0; 0 / never | E85_7 |
-| 80/20 | 360 | 0; 0 / never | 0; 0 / never | 0; 0 / never | 542; 0 / 82 | 500; 0 / 103 | 0; 0 / never | E85_8 |
-| 33/33/34 | 150 | 0; never x3 | 0; never x3 | 0; never x3 | 354; 59 / 61 / 60 | 198; 87 / 90 / 92 | 0; never x3 | E85_9 |
-| 33/33/34 | 360 | 226; 192 / 185 / 170 | 106; 279 / 278 / 258 | 0; never x3 | 1,198; 59 / 61 / 60 | 1,042; 87 / 90 / 92 | 0; never x3 | E85_10 |
+| 50/50 | 150 | 90; 60 / 59 | 31; 118 / 112 | 0; never / never | 240; 30 / 30 | 184; 60 / 56 | 0; never / never | 0; never / never |
+| 50/50 | 360 | 297; 60 / 59 | 238; 118 / 112 | 0; never / never | 658; 30 / 30 | 602; 60 / 56 | 0; never / never | 0; never / never |
+| 60/40 | 150 | 23; 19 / 121 | 0; 44 / never | 0; never / never | 204; 13 / 47 | 141; 32 / 77 | 0; 13 / never | 0; 13 / never |
+| 60/40 | 360 | 193; 19 / 121 | 131; 44 / 198 | 0; never / never | 624; 13 / 47 | 561; 32 / 77 | 0; 13 / never | 0; 13 / never |
+| 67/33 | 150 | 0; 4 / never | 0; 4 / never | 0; 105 / never | 174; 8 / 61 | 116; 8 / 89 | 0; 8 / never | 0; 8 / never |
+| 67/33 | 360 | 122; 4 / 180 | 64; 4 / 262 | 0; 105 / never | 593; 8 / 61 | 535; 8 / 89 | 0; 8 / never | 0; 8 / never |
+| 80/20 | 150 | 0; 0 / never | 0; 0 / never | 0; 0 / never | 127; 0 / 82 | 85; 0 / 103 | 0; 0 / never | 0; 0 / never |
+| 80/20 | 360 | 0; 0 / never | 0; 0 / never | 0; 0 / never | 542; 0 / 82 | 500; 0 / 103 | 0; 0 / never | 0; 0 / never |
+| 33/33/34 | 150 | 0; never x3 | 0; never x3 | 0; never x3 | 354; 59 / 61 / 60 | 198; 87 / 90 / 92 | 0; never x3 | 0; never x3 |
+| 33/33/34 | 360 | 226; 192 / 185 / 170 | 106; 279 / 278 / 258 | 0; never x3 | 1,198; 59 / 61 / 60 | 1,042; 87 / 90 / 92 | 0; never x3 | 0; never x3 |
 
 Presence window sweep, active/cert, 0% attacker, no retarget. Prediction for the smallest side with share s: first lock after presence x (1 - 1.5 s) / s slots.
 
@@ -221,7 +221,7 @@ Interpretation. The active denominator as written FAILS the pass criterion. In a
 
 With a 34% equivocating attacker the 2/3 quorum is already broken by arithmetic: 33% honest plus 34% attacker is 67% on each side of a 50/50 split, so both sides lock within 2 minutes under active (19 to 98 conflicts) and sit on the knife edge under total (2 conflicts in seed 7, 0 to 2 in seed 11, the uptime noise decides). The 33/33/34 split with the attacker holds 22% plus 34% per side, which total never certifies and active certifies after 36 to 88 minutes. Post-heal, with the attacker stripped, no run stalled.
 
-The presence sweep shows the trade: a 24-hour window pushes the 50/50 conflict to 12 hours (6 hours with retarget) and the 60/40 one to 24 hours, at the cost of C and D stalls of hours instead of minutes. The floor hybrid is the other lever: with the active denominator never below 80% of total, a lock needs 53.3% of total weight, no honest side in any split tested could reach it, and every honest partition gave 0 conflicts for 6 hours with full retarget while the majority side (where one exists) kept locking.
+The presence sweep shows the trade: a 24-hour window pushes the 50/50 conflict to 12 hours (6 hours with retarget) and the 60/40 one to 24 hours, at the cost of C and D stalls of hours instead of minutes. The floor hybrid is the other lever: with the active denominator never below 80% of total, a lock needs 53.3% of total weight, no honest side in any split tested could reach it, and every honest partition gave 0 conflicts for 6 hours with full retarget while the majority side (where one exists) kept locking. The 0.85 floor gives the same zeros and the same majority-side lock times (13 min at 60/40, 8 min at 67/33).
 
 ## F. Eclipse
 
@@ -244,20 +244,20 @@ F2. Poisoned view: an attacker holding 34% of weight feeds the pool a private fo
 | 1 h | active/cert | 0.787 | 115 min | 10 | 49 | 18 | 0 / 0 |
 | 1 h | active/seen | 0.787 | 0 min | 0 | never | 0 | 0 / 0 |
 | 1 h | total | 0.738 | 125 min | 0 | never | 0 | 0 / 0 |
-| 1 h | active/cert + floor 0.80 | F80_1 | | | | | |
-| 1 h | active/cert + floor 0.85 | F85_1 | | | | | |
+| 1 h | active/cert + floor 0.80 | 0.787 | 115 min | 10 | 49 | 18 | 0 / 0 |
+| 1 h | active/cert + floor 0.85 | 0.738 | 125 min | 0 | never | 0 | 0 / 0 |
 | 2 h | active/cert | 0.562 | 85 min | 65 | 49 | 82 | 0 / 0 |
 | 2 h | active/seen | 0.562 | 0 min | 12 | 106 | 29 | 0 / 0 |
 | 2 h | total | 0.471 | 125 min | 0 | never | 0 | 0 / 0 |
-| 2 h | active/cert + floor 0.80 | F80_2 | | | | | |
-| 2 h | active/cert + floor 0.85 | F85_2 | | | | | |
+| 2 h | active/cert + floor 0.80 | 0.562 | 85 min | 65 | 49 | 82 | 0 / 0 |
+| 2 h | active/cert + floor 0.85 | 0.471 | 125 min | 0 | never | 0 | 0 / 0 |
 | 4 h | active/cert | 0.108 | 20 min | 174 | 49 | 209 | 0 / 0 |
 | 4 h | active/seen | 0.108 | 0 min | 121 | 106 | 156 | 0 / 0 |
 | 4 h | total | 0.000 | 125 min | 0 | never | 0 | 0 / 0 |
-| 4 h | active/cert + floor 0.80 | F80_3 | | | | | |
-| 4 h | active/cert + floor 0.85 | F85_3 | | | | | |
+| 4 h | active/cert + floor 0.80 | 0.108 | 20 min | 174 | 49 | 209 | 0 / 0 |
+| 4 h | active/cert + floor 0.85 | 0.000 | 125 min | 0 | never | 0 | 0 / 0 |
 
-Interpretation. A pure delay is harmless to safety and costly to the pool: its late votes miss every certificate, its participation falls linearly to 0.5 after one hour and to 0 after two, it leaves the active denominator entirely, and it recovers to 1 exactly 2 hours after its view catches up (the missed indices roll out of the 240-checkpoint window). No lock was lost on the honest side, under any denominator, because 80% of weight kept signing. A poisoned eclipse is the dangerous version, and it is the partition hazard of E in miniature: the eclipsed side holds 54% of weight (pool plus attacker), which under total can never certify (0 conflicts at 1, 2 and 4 hours) but under active/cert certifies the attacker's fork 49 minutes in, once the eclipsed view's denominator has decayed below 54%/(2/3) = 81%. Under seen it takes 106 minutes. The attacker here holds 34%, over the 1/3 bound, so this is a "beyond" case by the brief's criterion, but it shows that against the active denominator an attacker does not need 2/3 of weight to finalise a private fork: it needs a third plus one well-connected pool to isolate for an hour. The floor rows show whether a floor on the denominator closes this: 0.80 asks for 53.3% of total and the eclipsed side holds 54% (knife edge), 0.85 asks for 56.7%. The quick return of the pool's participation to 1 at the heal under seen (0 min) is a merge artefact: the eclipsed side's own records credit the pool and are OR-merged into the honest view.
+Interpretation. A pure delay is harmless to safety and costly to the pool: its late votes miss every certificate, its participation falls linearly to 0.5 after one hour and to 0 after two, it leaves the active denominator entirely, and it recovers to 1 exactly 2 hours after its view catches up (the missed indices roll out of the 240-checkpoint window). No lock was lost on the honest side, under any denominator, because 80% of weight kept signing. A poisoned eclipse is the dangerous version, and it is the partition hazard of E in miniature: the eclipsed side holds 54% of weight (pool plus attacker), which under total can never certify (0 conflicts at 1, 2 and 4 hours) but under active/cert certifies the attacker's fork 49 minutes in, once the eclipsed view's denominator has decayed below 54%/(2/3) = 81%. Under seen it takes 106 minutes. The attacker here holds 34%, over the 1/3 bound, so this is a "beyond" case by the brief's criterion, but it shows that against the active denominator an attacker does not need 2/3 of weight to finalise a private fork: it needs a third plus one well-connected pool to isolate for an hour. The floor rows settle which floor closes this: 0.80 asks for 53.3% of total, the eclipsed side holds 54%, and the result is identical to no floor (10, 65 and 174 conflicts, first at 49 min); 0.85 asks for 56.7% and gives 0 conflicts at 1, 2 and 4 hours with the pool's participation and recovery exactly as under total. The quick return of the pool's participation to 1 at the heal under seen (0 min) is a merge artefact: the eclipsed side's own records credit the pool and are OR-merged into the honest view.
 
 ## G. Honest doubling overnight
 
@@ -287,7 +287,7 @@ Interpretation. New honest miners are under-weighted for the whole window, as th
 | Window | 30 days flat, no damping | Weight is hashrate (A: corr 1.00000), the renter formula holds to 0.04 points (B), and the crossing days 10(1+a)/a and 20(1+a)/a are the whole defence. Nothing here argues for changing it. |
 | Dust threshold | 100 blocks, keep | Every honest key clears it by day 20 from zero and by day 25 after a doubling (A, G). It costs an a = 9 renter's victims about one point (B) and holds small new keys out for up to 25 days (G); both are acceptable. Raising it would widen both effects for no measured gain. |
 | Quorum | 2/3 of the denominator, keep | The 34% attacker breaks every variant by arithmetic (E: 33% + 34% on each side of a 50/50 split). Lowering the quorum would let a smaller attacker do the same; raising it would stall at smaller silent sets (C: 34% silent already stalls total). |
-| Denominator | active, cert reading (objective, from certificates), WITH a floor: the denominator is never below 80% of total weight, so a lock needs 2/3 of active and at least 53.3% of total | Active alone fails E: a 50/50 honest partition finalises two histories after 60 min (30 min with DAA retarget), a 60/40 one after 121 min (47 min), and a 34% attacker with one eclipsed 20% pool finalises a private fork in 49 min (F2). Total alone fails C and D: a 34% silent set that keeps mining stops finality for the whole 30-day window, 50% churn stops it for 10.1 days. The floor keeps C's minute-scale recovery up to 45% silent (13 to 20 min) and D's at 35% churn (2 min), and gave 0 conflicting locks in every honest partition of every split for 6 hours with full retarget (E supplementary). Its costs: 50% silent or 50% churn stall like total (2.2 days for churn, the window for silence), and at 45% silent the margin is one pool outage thin (455 stalls in 3 days). Pick 0.85 instead if F2 at 0.80 is not clean in the table above: 56.7% of total is above the 54% an eclipsed pool plus a 1/3 attacker can hold, at the price of liveness ending near 41% silent. |
+| Denominator | active, cert reading (objective, from certificates), WITH a floor: the denominator is never below 85% of total weight, so a lock needs 2/3 of active and at least 56.7% of total | Active alone fails E: a 50/50 honest partition finalises two histories after 60 min (30 min with DAA retarget), a 60/40 one after 121 min (47 min), and a 34% attacker with one eclipsed 20% pool finalises a private fork in 49 min (F2). Total alone fails C and D: a 34% silent set that keeps mining stops finality for the whole 30-day window, 50% churn stops it for 10.1 days. The 0.85 floor gave 0 conflicting locks in every honest partition of every split for 6 hours with full retarget (E) and 0 in the poisoned eclipse at 1, 2 and 4 hours (F2), where 0.80 gave the same 10 to 174 conflicts as no floor because the eclipsed side's 54% clears 53.3%. It keeps C's recovery at 0 min for 34% silent and 13 min for 40%, and D's at 2 min for 35% churn. Its costs, all measured: 45% silent or more stalls like total (for as long as they stay silent), 50% churn stalls 4.1 days (total: 10.1, floor 0.80: 2.2), and at 40% silent and 35% churn the margin is one pool outage thin (138 and 98 intermittent stalls in 3 days). The floor turns the liveness bound from 1/3 (total) to about 42% of weight, and the safety bound stays at 1/3 for every event tested. |
 | Presence window | 240 checkpoints (2 hours) with the floor; 2,880 (24 hours) if the floor is rejected | With the floor the window only sets how fast silent keys leave the denominator, and 2 hours gives C and D their minute-scale recovery. Without the floor the window is the only partition defence and 2 hours is too short: 24 hours moves the 50/50 conflict to 12 hours (6 with retarget) and the 60/40 one to 24 hours, at the cost of 2.6 to 7.9 hour stalls in C and 6.1 hours at 50% churn in D. |
 | Certificate grace | at least 3x the worst one-way delay | At a 5-s delay the slowest region already loses 1.7 points of participation to the 15-s grace (A). Too short a grace turns geography into a participation penalty. |
 | Participation reading | cert | seen is not objective (each node counts its own view, so nodes disagree on the denominator) and is slower in C by 2x for no safety gain in E once the floor is in place. frozen is total with extra steps. |