Public text: the proving price as a formula in network hash, one threshold sentence, the carried-proof caveat, the dev fee's share, the stranded pool (Horizon economy and security lanes)

From docs/analysis/horizon/economy-and-utility.md (sections 3.1, 4.1 to 4.4, proposals 2, 3, 4, 7) and
docs/analysis/horizon/consensus-security.md (finding 3, proposal 1), both on master.
(a) The litepaper's "proofs at the cost of power" and the customer brief's "priced in dollars per proof" are
conditioned: electricity is close to power, the price a prover must charge is the subsidy it forgoes, published as a
formula with network hash as the input (per shard, card hash over network hash x 0.8 x 31.688 IGN x shard seconds,
plus electricity), never a number; 100 to 300x the published market rate at the devnet's 1.16 GH/s, competitive near
100 GH/s beside the miner, approximate beyond the one card measured. Six litepaper passages and two brief rows. The
text check's P6 sentence moves to the conditioned form. Ledger E20.
(b) One threshold sentence in Governance and Mining: 60 percent of blue blocks over two weeks for a parameter genesis
leaves open, 90 percent for an upgrade (new code), 95 percent with a floor height for a class change (the Mining
section had said a 90 percent signal turns a spare defence on, which is a class change). Ledger G15.
(c) The 20% proving-pool row carries the caveat that consensus does not yet verify the carried proof, so a block
producer could claim shard pay with a false proof today (P21; the 0.3.16 fix). Ledger P24.
(d) The dev fee reads "default-on, switchable, 1 percent of the producer share" in the payment-routes row and the
Ember section; docs/plans/funding.md section 4's ceiling is 1 percent of the producer share, USD 38,520 / 154,080 /
770,400 at the three prices, corrected from 48,000 / 193,000 / 963,000. Ledger E21.
(e) The pool row's note: unclaimed pool credit is today stranded in the escrow, no rule returns it; the fix rolls it
into the next proven segment (0.3.16). Ledger P25.
site/ledger.html regenerated (176 entries); tools/ci/ledger-text-check.mjs carries the five new sentences (53, 0 missing).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/commercial/prover-customer-brief.md

@@ -11,7 +11,7 @@ A proof-of-work chain mined on consumer GPUs, where the same cards prove every I
 | Item | What it is | Status today |
 |---|---|---|
 | Proofs for your chain | Your batches or blocks proven by Igneum's GPU prover network and returned to the address you name | Designed. No shard has been proven on a card yet |
-| Price in dollars | Jobs are priced in dollars per proof. At launch the fee is paid on your own chain, in your currency, to a payout contract keyed by miner address, because Igneum cannot yet see your chain. Settlement in the coin follows when the proof bridge exists | Spec section 5.4 |
+| Price in dollars | Jobs are priced in dollars per proof, at or above the subsidy the prover forgoes while it proves, which is a formula with network hash as the input, never a fixed number: per shard, (card hash ÷ network hash) × 0.8 × 31.688 IGN × shard seconds, plus electricity (under a cent per billion cycles on every card). The price falls as one over network hash: at the devnet's 1.16 GH/s a quote is 100 to 300x the published market rate, and a card proving beside its miner is competitive near 100 GH/s (the Horizon economy lane, `docs/analysis/horizon/economy-and-utility.md` sections 3.1 and 4.1, 6 October 2026; approximate beyond the one card measured; ledger E20). At launch the fee is paid on your own chain, in your currency, to a payout contract keyed by miner address, because Igneum cannot yet see your chain. Settlement in the coin follows when the proof bridge exists | Spec section 5.4 |
 | Delivery rule | A job is claimed with a bond that is slashed on a late or bad proof; a job nobody proves by its deadline expires and refunds in full. At launch your chain's own bond and slashing apply to the miner who claimed the job | Design document, execution layer, sections 5.2 and 6. Bond size and timeout are open (O-5.6) |
 | A versioned interface | Jobs run against the `ProofSystem` trait, version 1 of which is SP1. A later version is a release with its own test-vector set and a three-month overlap, so your integration survives a prover swap | Design document, execution layer, section 5.6 |
 | Verification you can run | A job proof is a single proof your contract verifies on your own chain; Igneum's own segment proofs recursively verify it, so no relayer or committee is in the path | Designed |
@@ -25,7 +25,7 @@ One row per route, so operator income and protocol income never blur. Rows 1 to
 | 1. Emission, per block | IGN, new coins on the published schedule | 80% the block's miner, 20% the proving pool for the provers of that block | None | None. Implemented in consensus on the devnet |
 | 2. Base fee, both gas dimensions | IGN | Nobody | The base fee the chain sets per block | All of it. Implemented on the devnet |
 | 3. Priority fee | IGN | 80% the block's miner and provers; 20% the apps whose code ran, per call frame | The tip the sender sets | The share of any frame in an unregistered contract. Implemented on the devnet |
-| 4. External job, at launch | Your currency, on your chain | The miner who delivered, through a payout contract keyed by miner address | Priced in dollars per proof; your chain's own bond and slashing apply | None; Igneum cannot see the payment. Designed |
+| 4. External job, at launch | Your currency, on your chain | The miner who delivered, through a payout contract keyed by miner address | Priced in dollars per proof, at or above the subsidy the prover forgoes (the formula in network hash in the "Price in dollars" row, never a fixed number); your chain's own bond and slashing apply | None; Igneum cannot see the payment. Designed |
 | 5. External job, after the proof bridge | IGN, on Igneum | 90% the provers who delivered | The job fee | 10%. Designed, phase two |
 | 6. The official client's dev fee | IGN | The project, as operator income, never the protocol | 1 block template in 100 requested with the dev address; off with one flag | None. Implemented, measured on a test network 4 October 2026 |
 

docs/fud-ledger.md

@@ -449,6 +449,24 @@ Sweep (5 October 2026, evening): stated. `site/litepaper.html`, Economics first
 
 ---
 
+### P24. "20 percent of emission to provers" without the caveat that consensus does not verify the proof
+"Your 20 percent pays whoever submits a proof record whose statement matches the node's own execution. The node never checks the SP1 proof behind it. So the block producer, who writes the record, can claim shard pay with a false proof today, in proportion to its hash. Say so next to the 20 percent."
+
+Status: Conceded, stated (6 October 2026, evening; the Horizon security lane `docs/analysis/horizon/consensus-security.md` finding 3 and its proposal 1): `site/litepaper.html`, Economics, the 20% proving-pool row carries the caveat: consensus does not yet verify the carried proof, it checks the record's statement against native execution and its signature, so today a block producer could claim shard pay with a false proof (ledger P21; the in-consensus verifier is the 0.3.16 fix).
+
+Answer: Correct; it is P21's finding read from the payer's side. The fix is the security lane's proposal 1: a record whose aggregated segment proof does not verify against the pinned aggregator key is invalid in consensus; the per-shard v0 record stays payout-only until then and is capped at the exclusive window. Consequence per tier: no honest miner loses anything today, since the pool is paid per valid record and the devnet's producers are the project's; the risk is a dishonest producer at the public testnet, which is why the fix lands in 0.3.16, before it.
+
+Evidence: `docs/analysis/horizon/consensus-security.md` finding 3 and proposal 1, 6 October 2026; spec 07 7.7 item 4 and 7.8 item 8; ledger P21.
+
+### P25. Unclaimed pool credit is stranded in the escrow
+"Spec 5.3 pays the first valid proof included in a block; 7.7 refuses a record older than 600 chain blocks; 7.8 says an unproven segment's aggregator share stays in the escrow. Nothing says what happens to the shard credit nobody claims. It sits there for ever. A ten-day refusal strands millions of IGN."
+
+Status: Conceded, stated (6 October 2026, evening; the Horizon economy lane `docs/analysis/horizon/economy-and-utility.md` section 4.2 and proposal 2): `site/litepaper.html`, Economics, the 20% proving-pool row carries the note: unclaimed pool credit is today stranded in the escrow, no rule returns it; the fix rolls an unproven shard's credit into the next proven segment's pool (0.3.16).
+
+Answer: Correct. The lane's simulation puts a ten-day refusal at 5.5 M IGN stranded (section 4.2: the pool share paid falls to 0.67 with 0.33 stranded during the refusal, 182,387 IGN a day averaged); the devnet already burns the coinbase's 20% output at an unspendable script, so nothing is lost that was ever claimable today. The rule: an unproven shard's credit rolls forward into the next proven segment's pool instead of sitting in the escrow. Consequence per tier: a prover sees a larger pool after a refusal instead of a smaller one; nothing changes for a miner or a pool user.
+
+Evidence: `docs/analysis/horizon/economy-and-utility.md` section 4.2 (the stranded share) and proposal 2, 6 October 2026; spec 5.3, 7.7 item 3, 7.8 item 7.
+
 ## 4. Economics and the coin
 
 ### E1. Hard cap plus burn is a security budget cliff
@@ -538,6 +556,24 @@ Answer: Correct. The whole public proving market is three to four orders of magn
 
 Evidence: `docs/analysis/horizon/frontier.md` section 3.11 and the summary (section 7), 6 October 2026; the tracker (ethproofs, "sub-half-cent" fields, September 2026, secondary); the emission schedule (31.688 IGN a block in year 1).
 
+### E20. "Proofs at the cost of power" is the electricity, not the price
+"Your cards' electricity is cheap, fine. The price a prover must charge is the lottery income it gives up while it proves, and that scales as one over the network's hash. At your devnet's 1.16 GH/s every quote is a hundred times the market. 'Marginal cost close to power' and 'priced in dollars per proof' are both unconditioned."
+
+Status: Conceded, stated (6 October 2026, evening; the Horizon economy lane `docs/analysis/horizon/economy-and-utility.md` sections 3.1 and 4.1, proposal 3): `site/litepaper.html`, The problem ("a supplier whose electricity cost is close to power and whose price is the subsidy it forgoes, which falls as the network's hash grows"), Building on Igneum ("Proofs priced by the subsidy forgone", with the price as a formula in network hash: per shard, card hash over network hash x 0.8 x 31.688 IGN x shard seconds, plus electricity; 100 to 300x the published market rate at 1.16 GH/s, competitive near 100 GH/s beside the miner, approximate beyond the one card measured), the payment-routes row 4 ("at or above the subsidy the prover forgoes ... never a fixed number"), For miners, Economics and the questions list. The price is published as a formula, never a number. Supersedes P6's stated sentence ("a supplier whose marginal cost is close to power"), which the text check now carries in the conditioned form.
+
+Answer: Correct. Electricity is under a cent per billion cycles on every card; the price is `h/N` x the subsidy per shard. At 100 GH/s a card proving alone is at 1 to 3x the published market and a card beside its miner at 0.2 to 0.4x, the only row where Igneum undercuts the market, and it rests on the 4% hash loss measured on one card. Consequence per tier: at launch a home miner earns more hashing than proving for outsiders at any card size; a rig the same; the proving market is upside for the fleet as a whole only as network hash grows.
+
+Evidence: `docs/analysis/horizon/economy-and-utility.md` sections 3.1 (the cost model), 4.1 (the table per card and scale) and proposal 3, 6 October 2026; the Boundless median of USD 0.21 per billion cycles (`developer-adoption.md` 2b, approximate).
+
+### E21. The dev fee is 1 percent of the producer share, and the funding plan's ceiling took all rewards
+"Your funding plan says the 1 percent fee could be USD 48,000 to 963,000 a year on year-one rewards of 963 million IGN. The fee template only moves the producer payout. The pool is paid per record. Your ceiling is a quarter too high, and the litepaper never says which share the fee is of."
+
+Status: Conceded, stated (6 October 2026, evening; the Horizon economy lane `docs/analysis/horizon/economy-and-utility.md` section 4.4 and proposal 7): `site/litepaper.html`, the payment-routes row 6 and the Ember section read "default-on, switchable, 1 percent of the producer share"; `docs/plans/funding.md` section 4's ceiling is 1 percent of the producer share, USD 38,520, 154,080 and 770,400 a year at USD 0.005, 0.02 and 0.10 per IGN with every miner on the official client, corrected from 48,000, 193,000 and 963,000.
+
+Answer: Correct. The fee block carries the dev address in the producer output only; the 20% pool output and the per-record escrow are untouched, so the fee's base is 80% of emission. Consequence per tier: a miner on Ember with the fee on gives up 1 in 100 of its own block rewards and nothing of its proving pay; off with one flag, the same on every tier.
+
+Evidence: `docs/analysis/horizon/economy-and-utility.md` section 4.4 (`devfee_out.md`) and proposal 7, 6 October 2026; the fee measured on a test network, 4 October 2026 (bench-log: 9 fee blocks in 785).
+
 ## 5. Governance and the founders
 
 ### G1. No cryptography team
@@ -626,6 +662,15 @@ Evidence: design doc Finality v2, Residual risks bullet 3.
 
 ---
 
+### G15. Three signalling thresholds, four numbers across the documents
+"Spec 5.7 says 90 percent for an upgrade, 5.5 says 60 percent for a parameter, the class-change rule says 95 with a floor, the project rules file says 90 and 60, and the litepaper's Mining section says a 90 percent signal turns a spare defence on, which is a class change your own rule sets at 95. Pick one sentence and put it everywhere."
+
+Status: Conceded, stated (6 October 2026, evening; the Horizon economy lane `docs/analysis/horizon/economy-and-utility.md` proposal 4, lane 3's signalling results): one sentence in `site/litepaper.html`, Governance ("Miners set what genesis leaves open") and Mining ("Miners hold the switch"): miners signal three things at three thresholds, 60 percent of blue blocks over two weeks for a parameter genesis leaves open, 90 percent for an upgrade (new code), and 95 percent with a floor height for a class change. The project rules file carries the same sentence (the coordinator's commit of 6 October 2026). Spec 5.5 (60) and 5.7 (90) agree with it; the 95-with-floor rule is the class v4 cut's P2 rule.
+
+Answer: Correct. The three numbers are three different things: a parameter is a dial inside rules genesis fixed, an upgrade is new code every node must run, a class change moves the hash itself and so takes the highest bar with a floor height as the backstop against a holdout. The lane's game (section 4.3): a 6 percent holdout costs near zero and buys only delay to the floor; a 30 percent pool holds a veto over upgrades at 90 and over class changes until the floor.
+
+Evidence: `docs/analysis/horizon/economy-and-utility.md` section 4.3 and proposal 4, 6 October 2026; spec 5.5, 5.7, 5.8; the class v4 cut's status file (gates P1 and P2).
+
 ## 6. Comparisons
 
 ### C1. vs Monero: GPUs were excluded on purpose

docs/plans/funding.md

@@ -55,7 +55,7 @@ The unfunded half is the half that comes after the chain exists and before and j
 
 ## 4. What the 1% fee could be, and why it is not counted
 
-The fee is 1% of rewards on the official client. Rewards in year one are 963 million IGN (ramp included, `docs/analysis/security-budget.md`). At the low, base and high price inputs of that analysis the fee's ceiling, with every miner on the official client, is USD 48,000, 193,000 and 963,000 a year. Those are inputs, not expectations, and the share of miners on the official client is unknown. Nothing in section 2 is funded against them.
+The fee is 1% of the producer share on the official client, default on and switchable: the fee template moves only the producer payout (80% of emission), and the proving pool is paid per record and carries none of it. Rewards in year one are 963 million IGN (ramp included, `docs/analysis/security-budget.md`), so the producer share is 770 million. At USD 0.005, 0.02 and 0.10 per IGN the fee's ceiling, with every miner on the official client, is USD 38,520, 154,080 and 770,400 a year (corrected 6 October 2026 from 48,000, 193,000 and 963,000, which took 1% of all rewards and overstated the ceiling by a quarter; the Horizon economy lane, `docs/analysis/horizon/economy-and-utility.md` section 4.4). Those are inputs, not expectations, and the share of miners on the official client is unknown. Nothing in section 2 is funded against them.
 
 ## 5. Rules
 

site/ledger.html

@@ -4,13 +4,13 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
 <title>Igneum ledger: every criticism, answered</title>
-<meta name="description" content="Every criticism Igneum expects, in the critic's words, with what was done, the status and the date. 171 entries. Nothing deleted, nothing softened.">
+<meta name="description" content="Every criticism Igneum expects, in the critic's words, with what was done, the status and the date. 176 entries. Nothing deleted, nothing softened.">
 <link rel="canonical" href="https://igneum.network/ledger">
 <meta name="theme-color" content="#0C0C0E">
 <meta property="og:type" content="website">
 <meta property="og:site_name" content="Igneum">
 <meta property="og:title" content="Igneum ledger: every criticism, answered">
-<meta property="og:description" content="171 criticisms in the critic's words, with what was done, the status and the date.">
+<meta property="og:description" content="176 criticisms in the critic's words, with what was done, the status and the date.">
 <meta property="og:url" content="https://igneum.network/ledger">
 <meta property="og:image" content="https://igneum.network/og-small.png?v=3">
 <meta property="og:image:width" content="256">
@@ -18,7 +18,7 @@
 <meta property="og:image:alt" content="Igneum. Mined by GPUs. Proven by fire.">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="Igneum ledger: every criticism, answered">
-<meta name="twitter:description" content="171 criticisms in the critic's words, with what was done, the status and the date.">
+<meta name="twitter:description" content="176 criticisms in the critic's words, with what was done, the status and the date.">
 <meta name="twitter:image" content="https://igneum.network/og-small.png?v=3">
 <meta name="twitter:image:alt" content="Igneum. Mined by GPUs. Proven by fire.">
 <link rel="icon" href="/favicon.ico" sizes="48x48">
@@ -134,20 +134,20 @@ details{margin-top:8px;font-size:14px;color:var(--ash)}summary{cursor:pointer;co
 <!-- nav:end -->
 <main id="main" class="wrap">
 <header style="padding-block:clamp(40px,6vw,72px) 8px">
-<div class="eyebrow">Ledger · 171 entries · regenerated from the repository</div>
+<div class="eyebrow">Ledger · 176 entries · regenerated from the repository</div>
 <h1>Every criticism, answered or conceded</h1>
-<p class="intro">This is every criticism the project expects, in the critic's words, with what was done about it and the date. 171 entries since 3 October 2026. Entries are never deleted; a status that changes keeps its history on the line. Where the critic was right the entry says Conceded. Where nothing has been done it says Open and names what settles it. The founder mined through the GPU years. Ethereum's move to proof of stake in September 2022 ended that income and the miners' place in that chain. This is one person building, with AI systems doing the engineering, the coin he wanted to exist for miners: GPU-mined, the miners are the provers, no founder allocation, every cost stated. Help is welcome and a team is wanted: cryptographers, node engineers, miners who will test. This ledger is the application form: pick an open row and write to <a href="mailto:hello@igneum.network">hello@igneum.network</a> with its id.</p>
+<p class="intro">This is every criticism the project expects, in the critic's words, with what was done about it and the date. 176 entries since 3 October 2026. Entries are never deleted; a status that changes keeps its history on the line. Where the critic was right the entry says Conceded. Where nothing has been done it says Open and names what settles it. The founder mined through the GPU years. Ethereum's move to proof of stake in September 2022 ended that income and the miners' place in that chain. This is one person building, with AI systems doing the engineering, the coin he wanted to exist for miners: GPU-mined, the miners are the provers, no founder allocation, every cost stated. Help is welcome and a team is wanted: cryptographers, node engineers, miners who will test. This ledger is the application form: pick an open row and write to <a href="mailto:hello@igneum.network">hello@igneum.network</a> with its id.</p>
 </header>
 <div class="tbl"><table>
 <thead><tr><th>Count</th><th>Status</th><th>Meaning</th></tr></thead>
 <tbody>
 <tr><td class="num">7</td><td><button type="button" class="chip" data-filter="Open">Open</button></td><td>Nothing has settled it yet. The entry names what will</td></tr>
-<tr><td class="num">57</td><td><button type="button" class="chip" data-filter="Conceded">Conceded</button></td><td>The critic is right. &quot;Stated&quot; means the public text says so; &quot;not yet stated&quot; means it does not yet</td></tr>
+<tr><td class="num">62</td><td><button type="button" class="chip" data-filter="Conceded">Conceded</button></td><td>The critic is right. &quot;Stated&quot; means the public text says so; &quot;not yet stated&quot; means it does not yet</td></tr>
 <tr><td class="num">54</td><td><button type="button" class="chip" data-filter="Fixed or built">Fixed or built</button></td><td>A code, spec or text change answers it, with the commit or the page named</td></tr>
 <tr><td class="num">27</td><td><button type="button" class="chip" data-filter="Closed by rule or decided">Closed by rule or decided</button></td><td>A consensus rule or a decision by the owner answers it, dated</td></tr>
 <tr><td class="num">13</td><td><button type="button" class="chip" data-filter="Answered with evidence">Answered with evidence</button></td><td>A measurement or a simulation exists and is named</td></tr>
 <tr><td class="num">13</td><td><button type="button" class="chip" data-filter="Answered by design">Answered by design</button></td><td>A design rule answers it; no measurement is possible yet</td></tr>
-<tr><td class="num">171</td><td><button type="button" class="chip" data-filter="">All</button></td><td>Every entry. The sections: <a href="#m">Mining and chips</a>, <a href="#f">Finality and attacks</a>, <a href="#p">Proving and the zkEVM</a>, <a href="#e">Economics and the coin</a>, <a href="#g">Governance and the founders</a>, <a href="#c">Comparisons</a>, <a href="#l">Legal and regulatory</a>, <a href="#x">Launch and operations</a>, <a href="#d">Builders</a></td></tr>
+<tr><td class="num">176</td><td><button type="button" class="chip" data-filter="">All</button></td><td>Every entry. The sections: <a href="#m">Mining and chips</a>, <a href="#f">Finality and attacks</a>, <a href="#p">Proving and the zkEVM</a>, <a href="#e">Economics and the coin</a>, <a href="#g">Governance and the founders</a>, <a href="#c">Comparisons</a>, <a href="#l">Legal and regulatory</a>, <a href="#x">Launch and operations</a>, <a href="#d">Builders</a></td></tr>
 </tbody></table></div>
 <div class="toolbar"><input type="search" id="q" placeholder="Search the ledger" aria-label="Search the ledger"><span id="shown"></span></div>
 <h2 id="m">Mining and chips</h2>
@@ -387,6 +387,18 @@ details{margin-top:8px;font-size:14px;color:var(--ash)}summary{cursor:pointer;co
 <div class="status"><span class="badge b-conceded">Conceded, stated</span> <span class="did">5 October 2026, night): <code>a repository file</code>, Economics, &quot;Outside customers pay in their own currency on their own chain at launch; settlement in IGN with a 10% burn follows when the proof bridge lets Igneum see the payment&quot;; the route table rows 4 and 5 (E13). Was: Conceded, contradiction to fix.</span></div>
 <details><summary>The answer as first written</summary><p>The litepaper contradicts itself. The design is: at launch external jobs are paid on the customer's chain, in the customer's currency, to a payout contract keyed by miner address, because Igneum cannot yet see Ethereum. The 10% burn in IGN applies when the job market settles on Igneum, which needs the proof bridge. The Economics section must say so.</p></details>
 </article>
+<article class="entry" id="P24" data-bucket="Conceded">
+<div class="head"><span class="id">P24</span><h3>&quot;20 percent of emission to provers&quot; without the caveat that consensus does not verify the proof</h3><span class="date">6 October 2026</span></div>
+<blockquote>Your 20 percent pays whoever submits a proof record whose statement matches the node's own execution. The node never checks the SP1 proof behind it. So the block producer, who writes the record, can claim shard pay with a false proof today, in proportion to its hash. Say so next to the 20 percent.</blockquote>
+<div class="status"><span class="badge b-conceded">Conceded, stated</span> <span class="did">6 October 2026, evening; the Horizon security lane <code>a repository file</code> finding 3 and its proposal 1): <code>a repository file</code>, Economics, the 20% proving-pool row carries the caveat: consensus does not yet verify the carried proof, it checks the record's statement against native execution and its signature, so today a block producer could claim shard pay with a false proof (ledger P21; the in-consensus verifier is the 0.3.16 fix).</span></div>
+<details><summary>The answer as first written</summary><p>Correct; it is P21's finding read from the payer's side. The fix is the security lane's proposal 1: a record whose aggregated segment proof does not verify against the pinned aggregator key is invalid in consensus; the per-shard v0 record stays payout-only until then and is capped at the exclusive window. Consequence per tier: no honest miner loses anything today, since the pool is paid per valid record and the devnet's producers are the project's; the risk is a dishonest producer at the public testnet, which is why the fix lands in 0.3.16, before it.</p></details>
+</article>
+<article class="entry" id="P25" data-bucket="Conceded">
+<div class="head"><span class="id">P25</span><h3>Unclaimed pool credit is stranded in the escrow</h3><span class="date">6 October 2026</span></div>
+<blockquote>Spec 5.3 pays the first valid proof included in a block; 7.7 refuses a record older than 600 chain blocks; 7.8 says an unproven segment's aggregator share stays in the escrow. Nothing says what happens to the shard credit nobody claims. It sits there for ever. A ten-day refusal strands millions of IGN.</blockquote>
+<div class="status"><span class="badge b-conceded">Conceded, stated</span> <span class="did">6 October 2026, evening; the Horizon economy lane <code>a repository file</code> section 4.2 and proposal 2): <code>a repository file</code>, Economics, the 20% proving-pool row carries the note: unclaimed pool credit is today stranded in the escrow, no rule returns it; the fix rolls an unproven shard's credit into the next proven segment's pool (0.3.16).</span></div>
+<details><summary>The answer as first written</summary><p>Correct. The lane's simulation puts a ten-day refusal at 5.5 M IGN stranded (section 4.2: the pool share paid falls to 0.67 with 0.33 stranded during the refusal, 182,387 IGN a day averaged); the devnet already burns the coinbase's 20% output at an unspendable script, so nothing is lost that was ever claimable today. The rule: an unproven shard's credit rolls forward into the next proven segment's pool instead of sitting in the escrow. Consequence per tier: a prover sees a larger pool after a refusal instead of a smaller one; nothing changes for a miner or a pool user.</p></details>
+</article>
 <h2 id="e">Economics and the coin</h2>
 <article class="entry" id="E1" data-bucket="Conceded">
 <div class="head"><span class="id">E1</span><h3>Hard cap plus burn is a security budget cliff</h3><span class="date">3 October 2026</span></div>
@@ -442,6 +454,18 @@ details{margin-top:8px;font-size:14px;color:var(--ash)}summary{cursor:pointer;co
 <div class="status"><span class="badge b-conceded">Conceded, stated</span> <span class="did">6 October 2026, evening; the Horizon lane analysis <code>a repository file</code> section 3.11, <code>frontier_model.py</code> section 7): <code>a repository file</code>, &quot;For miners&quot;, under the three-streams table: all of Ethereum L1's proving is about USD 36 a day at the September 2026 tracker cost (USD 0.005 a block x 7,200 blocks; the tracker figure is a secondary source) against about USD 13,700 a day of Igneum's year-1 emission at USD 0.005 per IGN (31.688 IGN a block x 86,400; the price is an input, not a forecast), so external proving is a small second income at launch and the lottery pays the bills; paid demand would have to grow about 1,000x in dollars for proving to become the main income. Figures the lane labels approximate (all rollup proving spend, USD 8,200 to 27,400 a day; Boundless's trailing day, USD 2) are not on the page.</span></div>
 <details><summary>The answer as first written</summary><p>Correct. The whole public proving market is three to four orders of magnitude under year-1 emission at any price input (the lane's table: Ethereum L1 at the Sep 2026 cost USD 36 a day, at the Dec 2025 cost 288; year-1 emission 13,700 at USD 0.005, 54,800 at 0.02, 273,800 at 0.10). The cost curve falls 3x to 30x a year, so dollars per proof fall as fast as volume rises. The design's own claim stays the defensible one: a second income that keeps cards on after the subsidy fades (spec 5.10.2), never the main one by 2030.</p></details>
 </article>
+<article class="entry" id="E20" data-bucket="Conceded">
+<div class="head"><span class="id">E20</span><h3>&quot;Proofs at the cost of power&quot; is the electricity, not the price</h3><span class="date">6 October 2026</span></div>
+<blockquote>Your cards' electricity is cheap, fine. The price a prover must charge is the lottery income it gives up while it proves, and that scales as one over the network's hash. At your devnet's 1.16 GH/s every quote is a hundred times the market. 'Marginal cost close to power' and 'priced in dollars per proof' are both unconditioned.</blockquote>
+<div class="status"><span class="badge b-conceded">Conceded, stated</span> <span class="did">6 October 2026, evening; the Horizon economy lane <code>a repository file</code> sections 3.1 and 4.1, proposal 3): <code>a repository file</code>, The problem (&quot;a supplier whose electricity cost is close to power and whose price is the subsidy it forgoes, which falls as the network's hash grows&quot;), Building on Igneum (&quot;Proofs priced by the subsidy forgone&quot;, with the price as a formula in network hash: per shard, card hash over network hash x 0.8 x 31.688 IGN x shard seconds, plus electricity; 100 to 300x the published market rate at 1.16 GH/s, competitive near 100 GH/s beside the miner, approximate beyond the one card measured), the payment-routes row 4 (&quot;at or above the subsidy the prover forgoes ... never a fixed number&quot;), For miners, Economics and the questions list. The price is published as a formula, never a number. Supersedes P6's stated sentence (&quot;a supplier whose marginal cost is close to power&quot;), which the text check now carries in the conditioned form.</span></div>
+<details><summary>The answer as first written</summary><p>Correct. Electricity is under a cent per billion cycles on every card; the price is <code>h/N</code> x the subsidy per shard. At 100 GH/s a card proving alone is at 1 to 3x the published market and a card beside its miner at 0.2 to 0.4x, the only row where Igneum undercuts the market, and it rests on the 4% hash loss measured on one card. Consequence per tier: at launch a home miner earns more hashing than proving for outsiders at any card size; a rig the same; the proving market is upside for the fleet as a whole only as network hash grows.</p></details>
+</article>
+<article class="entry" id="E21" data-bucket="Conceded">
+<div class="head"><span class="id">E21</span><h3>The dev fee is 1 percent of the producer share, and the funding plan's ceiling took all rewards</h3><span class="date">6 October 2026</span></div>
+<blockquote>Your funding plan says the 1 percent fee could be USD 48,000 to 963,000 a year on year-one rewards of 963 million IGN. The fee template only moves the producer payout. The pool is paid per record. Your ceiling is a quarter too high, and the litepaper never says which share the fee is of.</blockquote>
+<div class="status"><span class="badge b-conceded">Conceded, stated</span> <span class="did">6 October 2026, evening; the Horizon economy lane <code>a repository file</code> section 4.4 and proposal 7): <code>a repository file</code>, the payment-routes row 6 and the Ember section read &quot;default-on, switchable, 1 percent of the producer share&quot;; <code>a repository file</code> section 4's ceiling is 1 percent of the producer share, USD 38,520, 154,080 and 770,400 a year at USD 0.005, 0.02 and 0.10 per IGN with every miner on the official client, corrected from 48,000, 193,000 and 963,000.</span></div>
+<details><summary>The answer as first written</summary><p>Correct. The fee block carries the dev address in the producer output only; the 20% pool output and the per-record escrow are untouched, so the fee's base is 80% of emission. Consequence per tier: a miner on Ember with the fee on gives up 1 in 100 of its own block rewards and nothing of its proving pay; off with one flag, the same on every tier.</p></details>
+</article>
 <h2 id="g">Governance and the founders</h2>
 <article class="entry" id="G1" data-bucket="Conceded">
 <div class="head"><span class="id">G1</span><h3>No cryptography team</h3><span class="date">5 October 2026</span></div>
@@ -491,6 +515,12 @@ details{margin-top:8px;font-size:14px;color:var(--ash)}summary{cursor:pointer;co
 <div class="status"><span class="badge b-conceded">Conceded, stated in the design doc</span></div>
 <details><summary>The answer as first written</summary><p>True in the same way it is true on Bitcoin, where miner signalling activated SegWit and Taproot. The thresholds are high so that nothing passes without near-consensus. Since 3 October 2026 there is no fund to spend: the 60% threshold applies only to parameters that the genesis rules leave to miners, and 90% to upgrades. The litepaper should name pool concentration as the governance risk rather than imply every miner votes.</p></details>
 </article>
+<article class="entry" id="G15" data-bucket="Conceded">
+<div class="head"><span class="id">G15</span><h3>Three signalling thresholds, four numbers across the documents</h3><span class="date">6 October 2026</span></div>
+<blockquote>Spec 5.7 says 90 percent for an upgrade, 5.5 says 60 percent for a parameter, the class-change rule says 95 with a floor, the project rules file says 90 and 60, and the litepaper's Mining section says a 90 percent signal turns a spare defence on, which is a class change your own rule sets at 95. Pick one sentence and put it everywhere.</blockquote>
+<div class="status"><span class="badge b-conceded">Conceded, stated</span> <span class="did">6 October 2026, evening; the Horizon economy lane <code>a repository file</code> proposal 4, lane 3's signalling results): one sentence in <code>a repository file</code>, Governance (&quot;Miners set what genesis leaves open&quot;) and Mining (&quot;Miners hold the switch&quot;): miners signal three things at three thresholds, 60 percent of blue blocks over two weeks for a parameter genesis leaves open, 90 percent for an upgrade (new code), and 95 percent with a floor height for a class change. The project rules file carries the same sentence (the coordinator's commit of 6 October 2026). Spec 5.5 (60) and 5.7 (90) agree with it; the 95-with-floor rule is the class v4 cut's P2 rule.</span></div>
+<details><summary>The answer as first written</summary><p>Correct. The three numbers are three different things: a parameter is a dial inside rules genesis fixed, an upgrade is new code every node must run, a class change moves the hash itself and so takes the highest bar with a floor height as the backstop against a holdout. The lane's game (section 4.3): a 6 percent holdout costs near zero and buys only delay to the floor; a 30 percent pool holds a veto over upgrades at 90 and over class changes until the floor.</p></details>
+</article>
 <h2 id="c">Comparisons</h2>
 <article class="entry" id="C1" data-bucket="Answered by design">
 <div class="head"><span class="id">C1</span><h3>vs Monero: GPUs were excluded on purpose</h3><span class="date">3 October 2026</span></div>

site/litepaper.html

@@ -258,7 +258,7 @@ body.all .pager{display:none}
         <p>Rollups, bridges and soon Ethereum itself need zero-knowledge proofs of every batch and every block. Today those proofs come from a few private GPU clusters run by the rollup teams or by a handful of proving companies. The work is a commodity, a proof is correct or it is not, and the cheapest correct proof should win. It does not, because the people with the cheapest GPUs are not in the market.</p>
         <h3>Small proof-of-work chains get attacked</h3>
         <p>When rental markets can hire more hashrate than a chain has for an hour, double-spends against exchanges are cheap. Ethereum Classic, Bitcoin Gold and Vertcoin were all hit this way. Every one of them let hashrate that appeared a minute ago rewrite history.</p>
-        <p>Igneum gives the GPU fleet paid, useful, verifiable work. It gives the proving market a supplier whose marginal cost is close to power. And it makes the right to rewrite history something that must be earned over a month of public mining, not rented for an hour.</p>
+        <p>Igneum gives the GPU fleet paid, useful, verifiable work. It gives the proving market a supplier whose electricity cost is close to power and whose price is the subsidy it forgoes, which falls as the network's hash grows. And it makes the right to rewrite history something that must be earned over a month of public mining, not rented for an hour.</p>
       </section>
 
       <section id="glance">
@@ -343,7 +343,7 @@ body.all .pager{display:none}
             <tr><td>Continuously</td><td>The dataset grows on a schedule fixed at genesis, slowly enough that consumer cards keep up for years. A chip is built with fixed memory, so it is on a countdown from the day it ships. Ethereum's growing dataset ran Bitmain's E3 out of memory in 2020 this way, approximate, with nobody doing anything</td><td>No</td></tr>
           </tbody>
         </table></div>
-        <p>Three ideas carry the chip resistance. <strong>The hash rewrites itself.</strong> A new program every hour, drawn from the chain. Its memory pattern changes with it. The rules change on a schedule fixed at launch. No release, no vote. These are automatic schedule changes: they defeat a chip wired for one datapath and they need no human fork. Against a chip that stores the dataset every drawn parameter is firmware, and what meets that chip is the latency-shadow work (class v4) and the price per joule (the Horizon lane analysis, 6 October 2026, section 5.4; ledger M32). <strong>It waits on memory, not maths.</strong> Every hash is a chain of random reads into a table too big for a chip to carry. The wait is the same physics for everyone. <strong>Miners hold the switch.</strong> Spare defences are written into the rules, switched off. A 90% miner signal turns one on. No fork.</p>
+        <p>Three ideas carry the chip resistance. <strong>The hash rewrites itself.</strong> A new program every hour, drawn from the chain. Its memory pattern changes with it. The rules change on a schedule fixed at launch. No release, no vote. These are automatic schedule changes: they defeat a chip wired for one datapath and they need no human fork. Against a chip that stores the dataset every drawn parameter is firmware, and what meets that chip is the latency-shadow work (class v4) and the price per joule (the Horizon lane analysis, 6 October 2026, section 5.4; ledger M32). <strong>It waits on memory, not maths.</strong> Every hash is a chain of random reads into a table too big for a chip to carry. The wait is the same physics for everyone. <strong>Miners hold the switch.</strong> Spare defences are written into the rules, switched off. A miner signal turns one on, at the class-change threshold: miners signal three things at three thresholds, 60 percent of blue blocks over two weeks for a parameter genesis leaves open, 90 percent for an upgrade (new code), and 95 percent with a floor height for a class change. No fork.</p>
         <p>No hash has stayed free of chips forever. Igneum does not claim to. It states the gain its own model finds, the response takes a week, and both are measured. The model is public: <a href="/bench#counter-asic-2-0-the-numbers">the numbers</a>; the claim is tested by paid independent cryptanalysis and the public benchmark. Monero has run on RandomX since 2019 with no chip publicly shipped, approximate; that is precedent, not proof.</p>
         <p>One thing takes a person, here and on every chain that exists: writing new code. A chain cannot safely write its own generator, and it cannot safely tell a chip from a wave of honest new cards by hashrate alone. If the design above ever failed, anyone could publish a new generator and miners would switch it on by signalling, as Monero's community can fork. Igneum is built to make that day unlikely, and does not depend on avoiding it.</p>
       </section>
@@ -405,7 +405,7 @@ body.all .pager{display:none}
         <h3>Why build here</h3>
         <p>Not for speed. Fast EVM chains filled with copied Ethereum contracts and emptied when incentives stopped. Three things no L2 can offer. Keep your Ethereum deployment.</p>
         <ol>
-          <li><strong>Proofs at the cost of power.</strong> A contract requests a proof of any computation and the miners produce it. Their cards already run and are paid by emission, so a job only has to beat a few seconds of lottery income. Verification is folded into the chain's own proof; you ship no verifier. The price is a base fee that rises with the backlog, published at the phase 4 job market.</li>
+          <li><strong>Proofs priced by the subsidy forgone.</strong> A contract requests a proof of any computation and the miners produce it. Their cards already run and are paid by emission, so a job has to beat the lottery income the card forgoes while it proves. That is the price a prover must charge, as a formula with network hash as the input: per shard, (card hash ÷ network hash) × 0.8 × 31.688 IGN × shard seconds, plus electricity, which is under a cent per billion cycles on every card. It falls as one over network hash: at the devnet's 1.16 GH/s a quote is 100 to 300x the published market rate; a card proving beside its miner is competitive near 100 GH/s (the Horizon economy lane, 6 October 2026, sections 3.1 and 4.1, approximate beyond the one card measured; ledger E20). Verification is folded into the chain's own proof; you ship no verifier. The job's base fee rises with the backlog, published at the phase 4 job market.</li>
           <li><strong>Users who were not paid to arrive.</strong> Every miner is a funded wallet. Pools, payout contracts, hardware finance and hashrate forwards have customers before any consumer app does. Block rewards can pay straight to a contract.</li>
           <li><strong>A share of fees, with the number stated.</strong> 20% of every priority fee goes to the contracts whose code ran, per call frame, to the payee registered at deployment. Libraries are paid at their code address. Factories pass their registration to what they deploy. At launch fee levels this is a property, not an income: a million 100,000-gas calls a day at a 1 gwei tip pays about 7,300 IGN a year, with 1 gwei taken as a billionth of an IGN (the base unit is Open). It grows with traffic and nothing else.</li>
         </ol>
@@ -448,7 +448,7 @@ body.all .pager{display:none}
           <thead><tr><th>Share</th><th>Goes to</th><th>Why</th></tr></thead>
           <tbody>
             <tr><td class="num">80%</td><td>The miner who wins the block</td><td>Pays the hashrate that secures the chain</td></tr>
-            <tr><td class="num">20%</td><td>The proving pool: shard provers and aggregators</td><td>For a standing prover population that does not have to hash. On the devnet today the coinbase's 20% output goes to an unspendable script tagged <code>igneum-proving-pool-v0</code> and is burned there. Provers are paid from a separate escrow in the execution state, credited by rule with the same 20% of each blue block's subsidy and released per shard against valid proof records (Implemented, proving v0, since 5 October 2026). Open: the single coinbase payout that replaces the burn, and whether it reclaims the share burned so far</td></tr>
+            <tr><td class="num">20%</td><td>The proving pool: shard provers and aggregators</td><td>For a standing prover population that does not have to hash. On the devnet today the coinbase's 20% output goes to an unspendable script tagged <code>igneum-proving-pool-v0</code> and is burned there. Provers are paid from a separate escrow in the execution state, credited by rule with the same 20% of each blue block's subsidy and released per shard against valid proof records (Implemented, proving v0, since 5 October 2026). Caveat: consensus does not yet verify the carried proof, it checks the record's statement against native execution and its signature, so today a block producer could claim shard pay with a false proof (ledger P21; the in-consensus verifier is the 0.3.16 fix). Note: unclaimed pool credit is today stranded in the escrow, no rule returns it; the fix rolls an unproven shard's credit into the next proven segment's pool (0.3.16). Open: the single coinbase payout that replaces the burn, and whether it reclaims the share burned so far</td></tr>
             <tr><td class="num">0%</td><td>Treasury, foundation, team or stake</td><td>There is no coin-holder class in consensus and no tax on emission</td></tr>
           </tbody>
         </table></div>
@@ -462,9 +462,9 @@ body.all .pager{display:none}
             <tr><td>1. Emission, per block</td><td>IGN, new coins on the schedule above</td><td>80% the block's miner, 20% the proving pool for the provers of that block</td><td>None</td><td>None. Implemented in consensus: the 80/20 coinbase on the devnet</td></tr>
             <tr><td>2. Base fee, both gas dimensions</td><td>IGN</td><td>Nobody</td><td>The base fee the chain sets per block</td><td>All of it. Implemented on the devnet</td></tr>
             <tr><td>3. Priority fee</td><td>IGN</td><td>80% the block's miner and provers; 20% the apps whose code ran, per call frame</td><td>The tip the sender sets</td><td>The share of any frame in an unregistered contract. Implemented on the devnet</td></tr>
-            <tr><td>4. External job, at launch</td><td>The customer's currency, on the customer's chain</td><td>The miner who delivered, through a payout contract keyed by miner address</td><td>Priced in dollars per proof; the customer chain's own bond and slashing apply</td><td>None; Igneum cannot see the payment. Designed</td></tr>
+            <tr><td>4. External job, at launch</td><td>The customer's currency, on the customer's chain</td><td>The miner who delivered, through a payout contract keyed by miner address</td><td>Priced in the customer's money per proof, at or above the subsidy the prover forgoes (a formula in network hash, under Building on Igneum, never a fixed number); the customer chain's own bond and slashing apply</td><td>None; Igneum cannot see the payment. Designed</td></tr>
             <tr><td>5. External job, after the proof bridge</td><td>IGN, on Igneum</td><td>90% the provers who delivered</td><td>The job fee</td><td>10%. Designed, phase two</td></tr>
-            <tr><td>6. The official client's dev fee</td><td>IGN</td><td>The project, as operator income, never the protocol</td><td>1 block template in 100 requested with the dev address; off with one flag</td><td>None. Implemented, measured on a test network 4 October 2026</td></tr>
+            <tr><td>6. The official client's dev fee</td><td>IGN</td><td>The project, as operator income, never the protocol</td><td>default-on, switchable, 1 percent of the producer share: 1 block template in 100 requested with the dev address; off with one flag</td><td>None. Implemented, measured on a test network 4 October 2026</td></tr>
           </tbody>
         </table></div>
         <p class="src"><b>Sources:</b> specification sections 2.5 and 5.1 to 5.4; the engineering log for the devnet receipts and the dev-fee count.</p>
@@ -495,7 +495,7 @@ body.all .pager{display:none}
           </tbody>
         </table></div>
         <p>The size of that third stream today, in numbers: all of Ethereum L1's proving is about USD 36 a day at the September 2026 tracker cost (USD 0.005 a block, 7,200 blocks a day; the tracker figure is a secondary source), against about USD 13,700 a day of Igneum's year-1 emission at USD 0.005 per IGN (31.688 IGN a block, 86,400 blocks a day; the price is an input, not a forecast). So external proving is a small second income at launch and the lottery pays the bills; for proving to become the main income the paid demand would have to grow about 1,000x in dollars (the Horizon lane analysis, 6 October 2026, section 3.11; ledger E19).</p>
-        <p>The honest bear-market case rests on cost. A miner's card is already running and the power is often domestic, so Igneum miners' marginal cost in the proving market is close to power, which is an edge over data-centre provers and nothing more. Which of the two in-chain streams pays more per GPU-second depends on the size of the fleet: on the devnet of 4 October 2026, three machines at 275 million hashes a second, a second of hashing paid about 4.9x a second of proving the pool share; at 10,000 cards the same arithmetic favours proving by about 930x. That is arithmetic on measured devnet rates, approximate, not a market measurement.</p>
+        <p>The honest bear-market case rests on cost. A miner's card is already running and the power is often domestic, so Igneum miners' electricity cost in the proving market is close to power. The price they must charge is another matter: the price a prover must charge is the subsidy it forgoes while it proves, which falls as one over network hash, so the edge over data-centre provers appears only once the network's hash is large (near 100 GH/s for a card proving beside its miner) and is nothing more. Which of the two in-chain streams pays more per GPU-second depends on the size of the fleet: on the devnet of 4 October 2026, three machines at 275 million hashes a second, a second of hashing paid about 4.9x a second of proving the pool share; at 10,000 cards the same arithmetic favours proving by about 930x. That is arithmetic on measured devnet rates, approximate, not a market measurement.</p>
         <h3>Hardware</h3>
         <p>The dataset starts at 2 GB and grows (the proposed schedule, fixed at the testnet genesis: 2 GB, doubling at years 4, 12 and 28, the average of half a gigabyte a year), so a 4 GB card mines for about four years and an 8 GB card for about twelve, approximate. Every NVIDIA card from 8 GB proves; 12 GB and up mine and prove; 24 GB on the stock server (eleven rented cards, RTX 3060 to RTX 5090, 6 October 2026). NVIDIA and AMD both work, because the mining program is generated for the architecture both share and the proof system is hash-based. Apple's chips are GPUs with unified memory, so Macs mine too, at about a fifth of a flagship card: Measured, 26.7 against 123 million hashes a second, an Apple M5 Max beside an RTX 5090 on the live devnet, 4 October 2026. A Mac is a poor miner per dollar. There is no CPU mining lane, on purpose, because CPU mining is what botnets farm. Nodes, wallets and exchanges need no GPU at all.</p>
         <h3>What a miner's hour looks like</h3>
@@ -541,7 +541,7 @@ body.all .pager{display:none}
         </table></div>
         <p class="src"><b>Measured:</b> engineering log, "miner performance: variant racing" (lever 1), "first hourly program swap on the live devnet" and "miner fault guards and the app watchdog" (lever 5), 4 October 2026; the 0.3.6 release plan, the miner-latency gate (lever 4), 5 October 2026; the efficiency-sweep plan, the RTX 5090 log of 4 October 2026 (lever 3). Levers 2 and 3 are shipped code with no fleet measurement yet.</p>
         <h3>The software's fee, not the protocol's</h3>
-        <p>The protocol is fee-free: no dev fund, no fee to any team, foundation or fund. Ember takes a 1% software dev fee, the norm for GPU miners. One block template in 100 is requested with the dev address instead of yours, by a counter, never a random draw, so it is exactly 1 in 100 and anyone can check it from the source or from the chain. A fee block still carries your vote key, so it still adds to your finality weight. Ember prints the fee and the address when it starts, shows it in Settings next to a switch, and <code>--dev-fee 0</code> turns it off, as does <code>DEV_FEE=0</code> in a HiveOS flight sheet. Any other client is welcome.</p>
+        <p>The protocol is fee-free: no dev fund, no fee to any team, foundation or fund. Ember takes a 1% software dev fee, the norm for GPU miners: default-on, switchable, 1 percent of the producer share (the 80% of emission that pays the block's miner; the proving pool is paid per record and carries none of it). One block template in 100 is requested with the dev address instead of yours, by a counter, never a random draw, so it is exactly 1 in 100 and anyone can check it from the source or from the chain. A fee block still carries your vote key, so it still adds to your finality weight. Ember prints the fee and the address when it starts, shows it in Settings next to a switch, and <code>--dev-fee 0</code> turns it off, as does <code>DEV_FEE=0</code> in a HiveOS flight sheet. Any other client is welcome.</p>
         <p class="src"><b>Measured:</b> engineering log, "the software dev fee measured on a test network", 4 October 2026: 9 fee blocks in 785 from two fee-paying miners, 0 from the control at <code>--dev-fee 0</code>, the chain and the miners' counters equal.</p>
         <h3>What Ember does not claim</h3>
         <ul>
@@ -578,7 +578,7 @@ body.all .pager{display:none}
         <p>Igneum is governed by the hashrate that powers it. Pools carry their hashers' votes, so pool concentration is the governance risk, and it is public: on the devnet the top three vote keys held 34.5% of 8,090 blocks on 4 October 2026, measured.</p>
         <ul>
           <li><strong>Nothing needs a scheduled upgrade.</strong> The mining program, the dataset and the finality rules run themselves for ever. If the community ever ships an improvement, a better proof system or a block-rate step, it is published with test vectors at least three months ahead and activates only when 90% of blocks signal readiness. Developers can write code. Only miners can turn it on.</li>
-          <li><strong>Miners set what genesis leaves open.</strong> A parameter that the genesis rules leave to miners is set by signalling: a proposal passes or fails on 60% of hashrate over two weeks. There is no fund to vote on and no fee to any team, foundation or fund.</li>
+          <li><strong>Miners set what genesis leaves open.</strong> Miners signal three things at three thresholds: 60 percent of blue blocks over two weeks for a parameter genesis leaves open, 90 percent for an upgrade (new code), and 95 percent with a floor height for a class change. There is no fund to vote on and no fee to any team, foundation or fund.</li>
           <li><strong>Pools can be bypassed on transaction choice.</strong> Igneum ships Stratum v2 job declaration from day one, so a miner chooses its own transactions when its pool supports it. Pools can decline, and vote keys stay with the pool. Designed: the pool protocol is specification section 9, not yet run by any pool.</li>
           <li><strong>There are no admin keys in consensus.</strong> Nothing in consensus can be paused, upgraded or reversed by any key. There is no foundation allocation to vote with and no stake to buy. The genesis apps are contracts, and each publishes its own upgrade and key policy before launch; the bridge's is the one to read. Designed, open item O-5.4. On the devnet the activation heights and one execution-state restart (6 October 2026) reach every node through the signed update manifest, so on the devnet the release key acts as the operator; the sentence above holds for mainnet consensus only once that path is closed, and the public testnet terms will say which parameters still travel that way.</li>
           <li><strong>The chain runs without its founders.</strong> Blocks, proofs and finality need no one. A second independent node client is the first priority after launch, and anyone can build it.</li>
@@ -642,7 +642,7 @@ body.all .pager{display:none}
         <h3>Where is the miner?</h3>
         <p>On the devnet now. Igneum Ember runs on Windows, macOS and Linux, a HiveOS package exists, and the devnet's coins have no value. The public benchmark with a leaderboard by card model is January 2027. Pools and the public testnet are August 2027. All of it before any coin exists. Nothing is asked of a miner before they can run something. The <a href="#ember">Ember section</a> says what is shipped and what is still owed.</p>
         <h3>Will my card still pay in a bear market?</h3>
-        <p>Block reward and in-chain proving move with the price. Proving for other chains is priced in the customer's money, and it is a small market today. What Igneum can promise is that its miners' marginal cost in that market is close to power, because the card is already running on domestic power. That is an edge over data-centre provers and nothing more.</p>
+        <p>Block reward and in-chain proving move with the price. Proving for other chains is priced in the customer's money, and it is a small market today. What Igneum can promise is that its miners' electricity cost in that market is close to power, because the card is already running on domestic power; the price they must charge is the subsidy they forgo, which falls as one over network hash. That is an edge over data-centre provers at scale and nothing more.</p>
       </section>
 
       <section id="builders-ask">
@@ -683,7 +683,7 @@ body.all .pager{display:none}
         <ul>
           <li><strong>A proof in seconds.</strong> Not at launch. Proving a full block today needs a cluster of 100 to 200 consumer GPUs, approximate, so Igneum launches with proofs within about a minute and tightens as hardware improves. Users still see their transaction land in one second.</li>
           <li><strong>A chip is impossible.</strong> No. A chip wired for one program is a bad bet, because the program moves before it ships. A programmable chip is not stopped by the moving target: everything it needs is public at genesis and every drawn parameter is firmware to it (an address permute, a rotator, an immediate table), so the defence against it is the latency-shadow work (class v4) and the price per joule, not the schedule (the Horizon lane analysis, 6 October 2026, section 5.4; ledger M32). The published model (5 October 2026) prices the strongest chip we can name, one with the whole cache on-die computing dataset items on the fly, at 0.92x the hash rate of an RTX 5090 per unit of silicon with a 3x fixed-function allowance, approximate. The same model, drawn out to the chip that stores the dataset (6 October 2026): The strongest recompute chip we can price, holding the whole 256 MiB cache on-die, reaches under 1x per chip against an RTX 5090. A memory-controller chip that stores the whole dataset reaches 1.2x per chip and, in our model, 5x to 9x per joule; the Ethash chips of this class reached 2.1x to 4.8x. The lever against it, program work in the latency shadow, is measured and in its gates: it brings the chip to about 2x. Sources: the chip model analysis (6 October 2026); the Ethash rows of the ASIC history (Linzhi Phoenix 2020, Jasminer X4 2021, Antminer E9 2022); Counter ASIC 3.0 item 8 (100,000 ops per hash: the chip's per-joule edge over the RTX 5090 falls from 5.6x to 2.1x on GDDR7 at a chip core equal to the GPU's, the 5090 at 0.2% less rate, gates G1 to G6 in progress). No hash has stayed free of chips forever; Igneum does not claim to. Monero's seven years without a public chip are precedent, not proof, and a small prize: they say nothing about the price of a chip with the 256 MB cache on its die, and that price is a cost model, not a measurement.</li>
-          <li><strong>A guaranteed income floor.</strong> No. External proving is a small market today. Igneum's miners' marginal cost in it is close to power, which is an edge and nothing more.</li>
+          <li><strong>A guaranteed income floor.</strong> No. External proving is a small market today. Igneum's miners' electricity cost in it is close to power, but the price they must charge is the subsidy they forgo, which falls as one over network hash: an edge at scale and nothing more.</li>
           <li><strong>A memory-hard prototype on every vendor.</strong> Not yet. The 256 MB cache closed the shortcut on Apple silicon (computing items runs 4.8x slower than loading them, measured 3 October 2026). The same ratio on NVIDIA and on a discrete AMD card is Open.</li>
           <li><strong>Finality in the first month.</strong> No. No checkpoint locks until the 30-day window has 30 days of history. The first month of mainnet is proof of work with a 12-hour depth, and the text above says so wherever a day count appears.</li>
           <li><strong>A cryptography team.</strong> Not yet. One founder working with AI systems wrote the design and the code; external reviewers are named and paid before gate 3, and every security claim here is a design claim until then.</li>

tools/ci/ledger-text-check.mjs

@@ -33,7 +33,12 @@ const REQUIRED = {
     ['F10', 'Pools carry their hashers’ votes, so vote concentration equals pool concentration, and it is public', 'Pools carry their hashers\' votes, so vote concentration equals pool concentration, and it is public'],
     ['P3', 'the wrapping cost is a phase two measurement'],
     ['P4', 'The consensus proof that makes the checkpoint self-verifying is phase two'],
-    ['P6', 'a supplier whose marginal cost is close to power'],
+    ['P6', 'a supplier whose electricity cost is close to power and whose price is the subsidy it forgoes'],
+    ['E20', 'the price a prover must charge is the subsidy it forgoes while it proves, which falls as one over network hash'],
+    ['E21', 'default-on, switchable, 1 percent of the producer share'],
+    ['G15', '60 percent of blue blocks over two weeks for a parameter genesis leaves open, 90 percent for an upgrade (new code), and 95 percent with a floor height for a class change'],
+    ['P24', 'a block producer could claim shard pay with a false proof'],
+    ['P25', 'unclaimed pool credit is today stranded in the escrow'],
     ['P7', 'Writing new code, including an emergency fix to the proof system, is the one thing that takes a person'],
     ['P10', 'settlement in IGN with a 10% burn follows'],
     ['P14', 'pays about 7,300 IGN a year'],