igneum/docs/analysis/horizon/economy-and-utility.md

Horizon lane 4: economy and utility. What IGN is for beyond gas, the 80/20 under stress, ten years without a treasury, the dev fee, miner signalling, and what the other chains got wrong

6 October 2026, evening UK. Lane 4 of the Horizon programme. Worktree /Users/joshm/Projects/igneum-wt-horizon (branch horizon). Every model is in sim/horizon/economy-and-utility/ with a README line per script; every dollar figure names its inputs and its label. Nothing here is a price prediction, an offer to sell anything, or a change to any consensus parameter.

Read: docs/spec/05-fees-and-economics.md (whole, 5.10 and 5.11 included), 02-consensus.md 2.5, 07-execution.md (7.2 to 7.8); docs/design/payment-routes.md, developer-adoption.md (2a to 2c), execution-layer.md (4.3 to 6), miner-dev-fee.md; docs/plans/funding.md 1 to 5; docs/analysis/security-budget.md, economy-2026-10-04.md, base-fee-floor.md, prover-floor.md, prover-tiers-real-cards.md; sim/economy/ (README, sim.py, security_budget.py, results.md, levers.md); docs/commercial/prover-customer-brief.md; docs/fud-ledger.md E1 to E8 (E9 to E18 are cross-referenced from the spec and the status updates, the file carries E1 to E8 as sections), P6, P8, P9, P10, P14, P22, D1 to D6, C9, C10, G8, L6, L7; site/litepaper.html Building, Economics, Governance; docs/bench-log.md lines 1226 (the dev fee measured), 1910 (proving v1), 2349 (aggregation cost), 2582 (rental cost of hash); docs/plans/counter-asic-3-node.md section 6 (the P2 rule) and counter-asic-3-status.md P2; docs/analysis/horizon/frontier.md section 0 (the ranking) and 3.1, 3.2, 3.5, 3.6, 3.11 to 3.13; lane 3's sim/horizon/consensus-security/cost_results.md and signalling_results.md; vendor/rusty-kaspa (main checkout) consensus/core/src/config/params.rs and consensus/src/processes/coinbase.rs. block-rate-devnet2.md was still a template (RUN_A, RUN_B empty) at 21:50 UK; nothing here depends on it.

---

1. Method

Question	What was run	Where
Task 1, utility beyond gas	Arithmetic: the measured eleven-card table turned into a cost per v1 shard and per billion cycles (alone, beside the miner, rented), against the published prices; five demand curves on a low/base/high grid at three IGN prices	utility.py, output utility_out.md
Task 2, the 80/20 and the burn under stress	sim/economy/sim.py copied and changed in six named places (the measured cards, the renter farm, the 25-s window and 120-s timeout, a FIFO backlog with the 600-s record window, burn per day, the new scenarios), 8 scenarios x 3 seeds, 30 days, plus two sensitivity runs; under the main checkout's run lock at nice 19 on the M5 Max, about 18 s a run	stress.py, outputs results/stress_main.md, stress_busy.md, stress_elecfarm.md
Task 3, ten years without a treasury	Arithmetic: sim/economy/security_budget.py extended with the lane's fee grid, the pool line, the sustained hash at the measured card economics and the rented 34% weight attack at USD 281 per GH/s-day	security_budget_10y.py
Task 4, the dev fee	Arithmetic from miner-dev-fee.md and the bench-log measurement	devfee.py
Task 5, signalling	Arithmetic on the three thresholds; lane 3's signalling.py covers the 95-percent rule and is cross-referenced, not re-run	signal_game.py
Task 6, the other chains	Reading: vendor/rusty-kaspa for Kaspa; everything else named and marked approximate where no clone exists	this file, section 5.6

No node harness was started and no measurement was taken: the fleet, the PCs and the devnet were on the class v4 rehearsal and the Devnet 2 block-rate runs. Every hardware number is the fleet's from 6 October (prover-tiers-real-cards.md) or the bench-log's.

---

2. Evidence

2.1 Measured inputs

Input	Value	Source
v1 shard	4,717,439 cycles; the adopted S_p is 30,000 pgas = 30 M cycles, so the fixture is 16% of a full shard	prover-tiers-real-cards.md; spec 5.11
Shard alone, compressed, patched server 2^26	3060 14.4 s, 3080 7.1, 3090 14.9, 4060 Ti 16 GB 11.6, 4060 Ti 8 GB 9.6, 4060 18.4, 4070 12.1, 4090 6.3, 5070 4.8, 5090 6.3, A5000 8.3	prover-tiers-real-cards.md table
Shard beside the running miner (compressed)	3060 37.5 s, 3080 25.6, 3090 19.9, 4060 Ti 16 GB 34.6, 4070 27.3, 4090 26.1, 5070 37.2, 5090 10.7, A5000 34.6; the 8 GB cards core-only 22.1 to 26.3	same
Hash and watts mining (rented boxes)	3060 23.78 MH/s at 103.7 W ... 5090 98.48 at 258.2 (the table)	same; the 4060's 0.0 W reading replaced by its 115 W rating, approximate
The miner's loss while its card proves	5090: 124.72 to 119.74 MH/s, 4.0%, on empty shards; 8 GB cards 17.1 to 16.0 MH/s, about 6%, on v1 shards	bench-log, proving v1 step 1; prover-tiers-real-cards.md 8 GB row
Watts mining and proving at once	5090: 328.6 W max against 258 W mining (about 70 W more)	bench-log proving v1 step 1; the fleet row
Rental price of hash	USD 0.0117 per MH/s-hour (1,748 MH/s for USD 20.44 an hour, 38 pods); USD 11.7 per GH/s-hour, USD 281 per GH/s-day; the market gave 0 of 20 pods asked at the TH/s scale	bench-log line 2582
Aggregation per block on a mining 5090	9.6 to 9.7 s (2.1 s with the card to itself)	bench-log line 2349
Dev fee on a test network	9 fee blocks in 785 (1.15%; the template rule is exact at 1 in 100)	bench-log line 1226
Proof record sizes	274 bytes per shard record, 586 per segment record, 1,272,897 bytes per compressed proof	spec 7.7, 7.8; bench-log proving v1

2.2 Published prices (all approximate or secondary; none cloned)

Supplier	USD per billion cycles	Label
Boundless (RISC Zero), Base	about 0.21 median lock price, trailing day 4 Oct 2026	developer-adoption.md 2b, secondary summary; approximate
Succinct Prover Network	0.046 base plus up to 0.46 per billion PGU in the quickstart's EXAMPLE request at USD 0.23 per PROVE	developer-adoption.md 2b; example parameters, not a market price
RISC Zero Bonsai	never published a per-cycle list price; paid proving moved to Boundless in 2025	not cloned, approximate
Ethereum L1 block at the ethproofs cluster cost, Sep 2026	sub-half-cent a block; at 0.2 to 1.3 B cycles a block (14 to 44 SP1 cycles per gas, measured on Igneum) about 0.004 to 0.025	frontier.md 2.6 (secondary); base-fee-floor.md
A Taiko-class rollup per batch	taiko-mono not cloned; Taiko Alethia proves batches through its own prover market with SGX and ZK tiers (SP1 and RISC0 accepted); the ZK proof's cost per batch is of the order of the ethproofs figure times the batch's cycles: cents to tens of cents	approximate

2.3 What the earlier models said that this lane re-tests

Claim	Source	What changed tonight
Hybrid loses the whole hash for the proof's duration plus a 5-s swap	sim/economy/sim.py TPROVE + 2 x swap	Measured: the miner loses 4 to 6% while the card proves; the lottery wins the card's arbitration and the proof is 3 to 4x slower instead
A 3060 proves a shard in 20 s (target)	ledger P1	Measured: 14.4 s alone, 37.5 s beside the miner, on the 4.7 M-cycle fixture; a full 30 M-cycle shard is unmeasured on it (linear scaling would say 92 s alone, approximate)
10-s window, 300-s claim timeout	spec 7.2 as designed	25 s and 120 s decided 6 Oct 2026 (ledger P9)
The farm pays electricity at USD 0.05	sim/economy/sim.py	The farm is a renter at the measured USD 0.0117 per MH/s-hour

---

3. Model

3.1 The supply side of proving

For a card with hash h (MH/s), network hash N (MH/s), shard time t (s), watts w and price P (USD per IGN):

cost_alone  = w t / 3.6e6 x 0.10                      electricity
            + (h / N) x 0.8 x 31.688 x t x P          the subsidy the card forgoes while it proves
cost_beside = 70 t / 3.6e6 x 0.10 + (h / N) x 0.8 x 31.688 x t x 0.04 x P     (4% measured on the 5090, approximate elsewhere)
cost_rented = h x 0.0117 / 3600 x t                   the renter's cost; no subsidy, no electricity
per billion cycles: x 1e9 / 4,717,439

3.2 Demand curves at the adopted floors (spec 5.11; design 6 for jobs)

transfer           = 21,000 x 100 gwei + 300 x 10,000 gwei = 0.0051 IGN, burned; tip 21,000 x 1 gwei, 80% miners+provers, 20% burned (no registered frame)
batch post 100 KB  = (21,000 + 16 x 100,000) x 100 gwei + 300 x 10,000 gwei = 0.1651 IGN, burned
job of C cycles    = C / 1000 x 10,000 gwei x 1.5 = 15 IGN per billion cycles; 90% provers, 10% burned once IGN-settled
payments cap       = B_p / 300 = 400 transfers a block = 34.6 M a day; EIP-1559 target half of that, 17.3 M a day
records            = 274 x shards + 586 / 8 bytes a block in the coinbase; 1,272,897 bytes per proof on p2p

3.3 Sustainability

sustained hash (GH/s) = miners' USD per day / (electricity + capital per GH/s-day)
   electricity = 258.2 W / 98.48 MH/s x 24 / 1000 x USD 0.10 = USD 6.29 per GH/s-day (measured card, the brief's price)
   capital     = USD 2,000 / 98.48 MH/s / 1,095.75 days = USD 18.53 per GH/s-day (approximate)
   total USD 24.8 per GH/s-day; the rental price is USD 281, 11.3x
34% weight attack = rent 1.04 N for 20 days (lane 3's rule, spec 3 headline) = 1.04 x N x 281 x 20; the attacker earns 51% of the producer subsidy meanwhile

3.4 The stress simulator

sim/economy/sim.py with: eleven card classes (HASH, PMINE, TPROVE alone, TBESIDE, CANHYB from the measured table; MIX an approximate installed-base shape), hybrid capacity cards x T / TBESIDE and hybrid hash 1 - 0.04 x duty, operator 0 a renter (cost = cards x MH/s x 0.0117 x hours), window 25 s, timeout 120 s, a FIFO of open shards with a 600-s expiry (expired credit stranded), burn per day = 10% of IGN-settled external jobs plus blocks x content_shards x 0.51 IGN (paid content 0.03 shards a block at launch traffic), one proving shard a block (measured on the devnet). The thresholds T1 to T5 are the 4 October definitions (hash under 50% of the pre-event mean for an hour; backlog over 600 s; a growing backlog; a day under 90% within 60 s; a 10-point proving-share swing).

---

4. Results, task by task

4.1 Task 1: what IGN is for beyond gas

(a) Proving as a sellable service

Card	Alone, 1 GH/s	Alone, 100 GH/s	Alone, 1 TH/s	Beside its miner, 100 GH/s	Rented (no subsidy)	Electricity only
3060 12 GB	36.81	0.377	0.046	0.054	0.236	0.0088
4070 12 GB	32.50	0.331	0.039	0.041	0.208	0.0065
4060 Ti 16 GB	21.92	0.224	0.027	0.040	0.140	0.0049
4090 24 GB	35.38	0.361	0.042	0.069	0.227	0.0068
5090 32 GB	66.69	0.676	0.076	0.050	0.427	0.0096
Boundless median (approximate)	0.21	0.21	0.21	0.21	0.21
ethproofs L1 cluster (approximate)	0.004 to 0.025

USD per billion cycles at USD 0.02 per IGN (utility_out.md 1.3; the IGN price moves only the opportunity term).

What it says. Electricity is under a cent per billion cycles on every card; "marginal cost close to power" (ledger C10's wording) is true of the electricity and false of the price, because the price a prover must charge is the subsidy it forgoes, and that scales as 1 / network hash. At today's devnet scale (1.16 GH/s) a prover that stops mining to prove must charge 100 to 300x Boundless's median. At 100 GH/s a card proving alone is at 1 to 3x Boundless; a hybrid card beside its miner is at 0.2 to 0.4x (USD 0.04 to 0.08), which is the only row where Igneum undercuts the market, and it rests on the 4% figure measured on one card. The renter's row, USD 0.13 to 0.43, is the floor below which no rented prover ever sells. The floor-priced job (15 IGN per billion cycles) is USD 0.075, 0.30 and 1.50 at the three prices: a third of Boundless at 0.005, 1.4x at 0.02, 7x at 0.10. The floor is denominated in IGN and the market in dollars, and the floor moves by a two-week 60% vote (spec 5.11): it cannot follow a price. Frontier 3.11 (rank 15) already shows the market is three to four orders under year-1 emission; this lane adds that at the adopted floor Igneum overprices the market at any IGN price above about USD 0.014.

Tier	Consequence
Home 8 GB	proves alone only (compressed does not fit beside the miner); its price is the alone row: competitive only above about 300 GH/s of network hash
Home 12 GB	mines and proves on headless Linux (37.5 s beside on the 3060, 27.3 s on the 4070); competitive beside its miner at 100 GH/s; a full 30 M-cycle shard beside the miner is unmeasured (about 3 min by linear scaling, approximate, outside the 120-s claim timeout)
Home 16 GB	the cheapest beside-row (USD 0.040 per billion at 100 GH/s)
Home 24 or 32 GB	the 5090 is the cheapest prover per billion beside its miner above 100 GH/s and the dearest alone (its subsidy is the largest)
Rig	eight 4090s beside their miners: USD 0.07 per billion at 100 GH/s; 8 x 26.1 s per shard, so a rig delivers a 30 M-cycle shard in about 21 s with all eight on one shard (approximate; SP1 proves one shard per server)
Pool user	nothing: the pool's provers carry the proofs
Prover	its quote is a function of network hash it does not control; publish the price as h/N x subsidy x t, never as a number
Holder	job demand buys IGN only after the proof bridge (phase two); at launch customers pay on their own chain, so (a) is zero IGN demand at launch
Rollup customer	the customer brief should carry the band above and the condition (network hash) rather than any price

(b) Rollup settlement, (c) bridges, (d) payments, (e) storage

Dollars per day to miners and provers (utility_out.md 3.3) and burn (3.4), base scenario, USD 0.02 per IGN:

Period	External jobs to provers, USD (own chain)	Rollups settling here, IGN to provers	Bridges, IGN to provers	Payment tips, IGN	IGN flows in USD	Burn, IGN	Burn, % of daily emission
launch	450	19,440 (1 rollup)	3,038 (1 bridge)	1.68 (100 k transfers)	450	5,748	0.21%
year 2	1,800	58,320 (3)	9,112 (3)	16.8 (1 M)	1,349	23,316	0.85%
year 5	9,000	194,400 (10)	15,188 (5)	168 (10 M)	4,195	126,716	4.6%
year 5 high	90,000	972,000 (50)	30,375 (10)	290 (17.3 M, the target)	20,058	711,481	26%

Low scenarios are a tenth to a fifth of these; the full grid at the three prices is in utility_out.md. Reading each curve:

• Rollups are the only line that pays provers in IGN at scale: one rollup posting a batch a minute with a 1 B-cycle proof job pays 19,440 IGN a day at the floor, 3.6% of the daily pool. Ten of them in year 5 pay 194,400 IGN a day, 36% of the pool before the second halving and 142% of the pool after it. The condition is the floor price staying under the market's (above). The burn it causes: 10% of the job plus the batch's base fee, 2,398 IGN a day per rollup.
• Bridges at 225 updates a day pay 3,038 IGN a day each; a tenth of a rollup. No bridge is official (spec 7.3), so the count is anyone's.
• Payments cost USD 0.000026 to 0.00051 a transfer (the three prices). A transfer undercuts a 1 bps rail on any payment above USD 0.26 to 5.10 and a 10 bps rail above USD 0.03 to 0.51; a USD 100 payment pays 0.003 to 0.05 bps. The fee is flat in IGN, so payments give the coin burn and almost no income: 10 M transfers a day burn 51,042 IGN (1.9% of emission) and tip 168 IGN at the 1 gwei default. The proving dimension caps the chain at 34.6 M transfers a day and the fee leaves the floor above 17.3 M; above that the burn is set by willingness to pay and no model here knows it, so the year-5 high row is clamped at the target and says so.
• Storage. Records are 347 bytes a block at one shard (1,025 at 3.5): 11 to 32 GB a year, USD 0.17 to 0.50 of disk per node per year (approximate HDD price), paid by whoever runs a node and by nobody else. Proof bytes (1.27 MB each) never enter a block; a node keeps the 600-block pool (about 3 GB at four shards a block) and a light client one proof. An archive of every proof would be 80 to 180 TB a year (USD 1,200 to 2,700 of HDD, approximate): a service someone sells, not a protocol cost. Frontier 3.16 (rank 9) is the research-dataset version of the same bytes.

The honest total. In the base scenario all five uses together put USD 450 a day to miners and provers at launch and USD 4,200 in year 5 at 0.02, against USD 54,800 of daily emission in year 1 and 13,700 in year 5. Fees are 1.6% of security spend in year 1 and 48% in year 5 (security_budget_10y_out.md, base at 0.02), and most of the year-5 share is the external USD line, which is in dollars and does not move with the coin. Burn is 0.2% to 4.6% of daily emission in base scenarios. The Economics section's "part of every payment on Igneum is burned" is true and small: with the ramp's 37 M never minted, burn under 1% of emission a day leaves the cap's approach unchanged to the second decimal for years.

4.2 Task 2: the 80/20 split and the burn under stress

results/stress_main.md: 8 scenarios x 3 seeds, 30 days, the eleven measured cards, the farm (20% of hash, 925 to 1,016 5090s) a renter at USD 0.0117 per MH/s-hour, window 25 s, timeout 120 s, one proving shard a block, USD 0.012 at t = 0. The model's network is about 700 GH/s of potential hash (15,000 cards), so every number below is at that scale; the renter's rent against the subsidy is the N_eq of lane 3 (cost_results.md section 3): 94 GH/s at USD 0.012.

Metric	a: baseline	p10: price x10 day 7	pd10: price /10 day 7	c: no external	x100: external x100	cartel: top 10% of weight never proves	refuse: nobody proves days 10 to 20	halving: 15.844 IGN a block
Hash min / pre-event (seed min)	0.99	0.99	0.55 (0.49)	0.99	0.91	0.99	0.99	0.98
Hash day 30 / pre-event	1.00	1.25	0.74	1.00	0.97	1.01	0.99	1.00
T1 hours under 50%	0	0	0	0	0	0	0	0
Cards off, day 30	9%	0%	31%	9%	8%	0%	9%	9%
Cards proving / hybrid, day 30	6% / 58%	6% / 66%	14% / 44%	6% / 48%	10% / 55%	6% / 57%	6% / 76%	4% / 58%
Backlog max, shards; T2 age max, s	0; 0	0; 0	0; 0	0; 0	0; 0	0; 0	766; 565 (capped by the 600-s expiry)	0; 0
Blocks within 60 s, mean / T4 worst day	1.00 / 1.00	1.00 / 1.00	1.00 / 1.00	1.00 / 1.00	1.00 / 1.00	1.00 / 1.00	0.67 / 0.00	1.00 / 1.00
T5 proving-share swing, points	1.6	0.1	2.0	0.6	2.9	2.2	0.0	4.4
Burn, IGN a day (of which external)	19,928 (18,606)	6,758 (5,437)	146,737 (145,415)	1,322 (0)	1,576,947 (1,575,623)	16,954 (15,632)	13,366 (12,044)	17,247 (15,926)
Burn, USD a day at the run's mean price	214	578	506	15	15,535	218	148	224
Share of the 20% pool paid / stranded	1.00 / 0	1.00 / 0	1.00 / 0	1.00 / 0	1.00 / 0	1.00 / 0	0.67 / 0.33 (182,387 IGN a day averaged; 547,570 a day during the refusal)	1.00 / 0
Renter farm cards on at day 30; margin over rent	0; -77%	984; +114%	0; -77%	0; -76%	54 (0 to 162); -6%	984 (forced on); -79%	0; -77%	0; -88%
Flags tripped (of 3 seeds)	none	none	none (T1 min 0.49 in one seed, under an hour)	none	none	none	T4 3/3	none

Per card class, USD per card-day (every mode, off included) and the share of shards proven, baseline: 3060 1.30 (0%), 3080 3.09 (5%), 3090 2.69 (11%), 4060 Ti 16 GB 1.63 (4%), 4060 Ti 8 GB 2.03 (16%), 4060 0.85 (1%), 4070 1.96 (12%), 4090 3.86 (11%), 5070 3.36 (12%), 5090 3.95 (24%), A5000 3.30 (4%). The full tables are in results/stress_main.md.

What holds and what breaks:

1. The 80/20 holds under every price and demand shock; the price is what moves hash. T1 never trips. The /10 price shock is the closest: hash troughs at 55% of pre-event (49% in one seed for under an hour), 31% of cards go off (the 3060 and 4060 classes at median electricity and above), and the chain is at the T1 line with no backlog and every block proven inside 60 s. A x10 shock brings the renter farm on (margin +114%) and hash ends 25% up: rented hash arrives exactly when the subsidy per GH/s-day clears USD 281, which is lane 3's N_eq. The first halving at a flat price changes nothing at this price level (the same 9% off), because the cards that remain are above break-even at 0.013; a halving is a /2 price shock and the /10 row says where /2 would land between the two.
2. External demand x100 is the burn story and the renter story. USD 200,000 a day of jobs at 10% burn is 1.58 M IGN a day burned, 58% of daily emission, at the run's price of about USD 0.01; and it brings 0 to 162 rented 5090s on at a -6% margin. Hash troughs at 91%: cards leave the lottery for jobs (the 4 October finding, scenario b), and the renter's cards arriving for jobs do not hash. The burn in that row is a transfer from customers to holders of 15,500 dollars a day; it is the only row where burn is material, and it needs IGN settlement, which is phase two.
3. A cartel of the top 10% of weight that never proves costs the chain nothing. In this population the top 10% of weight is one operator, the 20% farm, so the row is a 20% cartel: with 8 draws by weight the chance that every assignee is the cartel's is 0.2^8, under three in a million, so almost every shard still finds an assignee and the rest go open after 25 s; every block is proven inside 60 s, the backlog is zero, and the cartel loses USD 6.77 per card-day (forced on, as a renter, to hold its weight). Sortition with 8 draws is why: the 4 October result (scenario e, 30%) stands with the measured cards.
4. A refusal by every prover is the one scenario that breaks a threshold, and what breaks is the pool, not the chain. For ten days no block is proven (T4 0 on every refusal day), execution and finality do not wait (spec 5.3, ledger P9), and the backlog never passes 600 s because the record window expires the shards: 547,570 IGN a day of pool credit is stranded in the escrow, 5.5 M IGN over the ten days, and no rule returns it. When provers come back the queue is at most 600 s deep and clears in minutes; 76% of cards end in hybrid. The refusal's whole cost is the refusers' own income plus a silent supply reduction nobody voted for (proposal 2).
5. The window excludes the slow hybrids. At 25 s a 3060 beside its miner (37.5 s on the small fixture), a 4060 Ti 16 GB (34.6), a 5070 (37.2) and an A5000 (34.6) cannot land an assignment and win only open races or prove alone; the 3060 class proves 0% of shards in every scenario, the 4060 1%. The 4060 Ti 8 GB proves 16% by proving alone at 9.6 s. The 4 October proposal (window = the fleet's 90th-percentile shard time plus a swap) would set it near 38 s on this fixture; on a full 30 M-cycle shard the number is unmeasured (proposal 8).
6. Burn at launch traffic is USD 15 to 220 a day, 0.05% to 0.7% of emission; the base fee part is 1,322 IGN a day at 0.03 content shards a block. Everything above that is the external 10%, which does not exist until jobs settle in IGN.

Sensitivities (results/stress_busy.md, stress_elecfarm.md, 2 seeds each). At 3 proving shards a block (the 4 October busy value, 3x the load) nothing changes in a, cartel or x100: backlog 0, every block inside 60 s, hash min 0.95 to 1.00; the refusal strands the same 33% of the pool with a queue of 2,265 shards at its deepest, and the renter farm comes on in x100 at 213 cards (181 to 244). With the farm on electricity at USD 0.05 instead of rent (the 4 October assumption) the baseline has 0% of cards off (the farm's 968 cards stay on) and the /10 shock takes 25% of cards off with hash troughing at 63% of pre-event and ending at 77%: the rent is what decides whether the 20% farm is on at all, and with it 20 points of hash at every price; the renter farm margin column of that file is undefined at zero rent and should be read as blank.

Tier	Consequence of the stress runs
Home 8 GB	proves alone and wins open races (16% of shards on the 4060 Ti 8 GB); the first class off in a /10 shock on expensive power
Home 12 GB	the 3060 proves 0% at the 25-s window; the 4070 12% (27.3 s beside, loses the window, wins open races alone); first off in a price fall
Home 16 GB	4% of shards; stays on in every row but pd10
Home 24 or 32 GB	11 to 24% of shards; hybrid is the dominant mode (58% of all cards); the last class off
Rig	as the 24 GB card per card; a rented rig is off below N_eq and on above it (p10 row)
Pool user	the pool's provers' share; unchanged by any row
Prover	income is 20% of emission in every row but refuse, where the refusers strand it; the x100 row is the one where jobs pay more than the pool
Holder	burn is 0.05 to 0.7% of emission a day at launch; 58% in the x100 row, phase two only
Rollup customer	every job delivered in every row but refuse (67%)
Node operator	the backlog never passes the 600-s record window because the window expires it

4.3 Task 3: no-treasury sustainability over ten years

security_budget_10y_out.md. The brief's formula gives a sustained hash proportional to the miners' dollars and an attack cost proportional to that hash, so the ratio is a constant: a 20-day 34% weight attack rents 1.04 N at USD 281 per GH/s-day against an honest fleet that costs USD 24.8 per GH/s-day, 11.8x the honest fleet's 20-day cost, minus the 51% of subsidy the attacker earns back. The subsidy never falls under the attack cost in ratio terms; the halvings shrink both until the absolute number is small. The honest statement is the absolute net cost by year:

Year	Net cost of the 20-day veto, USD, at 0.005	at 0.02	at 0.10	Sustained hash at 0.02, GH/s	Fees as % of total security spend, base at 0.02
1	2,375,000	9,501,000	47,506,000	1,699	1.6%
3	1,233,000	4,933,000	24,666,000	882	18.6%
5	617,000	2,467,000	12,334,000	441	48.3%
7	308,000	1,234,000	6,168,000	221	65.1%
9	154,000	617,000	3,085,000	110	78.9%

The veto's net cost drops under USD 1 M in year 5 at 0.005, year 9 at 0.02, and not within ten years at 0.10; under USD 100 k only after year 10 at 0.005. The rental market's supply, not its price, is the other bound (0 of 20 pods at the TH/s scale on 6 October), and it is not modelled. What the fees change: in the base scenario the proving-pool and job lines reach provers, not miners, and the brief's security line is miners' hash; of the 48% fee share in year 5, under 1% reaches miners (tips at 1 gwei). The chain's security budget after year 5 is the subsidy to miners, and nothing else in the design pays for hash. Frontier 3.1 (rank 7) redirects part of the subsidy to the pool during rental spikes and would lower the miners' line further; this lane's number for it is in 5.1.

The audits. funding.md prices the first cryptanalysis at USD 80,000 to 160,000 and nothing prices the second, which a class or era change in year 3 would need. What the entity's own lines earn (every price an input):

Year	Price	Dev fee, 50% of hash on Ember	Entity's provers at 5% of the pool	Second cryptanalysis (USD 160 k) as % of the dev fee
3	0.005	10,000	25,000	1,600%
3	0.02	40,000	100,000	400%
3	0.10	200,000	500,000	80%

The dev-fee row here uses 1% of the producer share (80% of emission), because the fee template moves only the IGNA payout and the pool is paid per record; funding.md section 4 took 1% of all rewards and overstates the ceiling by a quarter (48,000, 193,000 and 963,000 should read 38,520, 154,080 and 770,400). The honest options for the second audit, ranked:

Rank	Option	What it pays in year 3 at 0.02	Why this rank
1	The entity's own provers (5% of the pool and a share of jobs)	USD 100,000 a year at 5% of the pool, more with jobs	Open-market income the design already names (spec 5.5); scales with the chain, no rule, no switch; the cost is running cards
2	The Ember dev fee	USD 40,000 a year at 50% of hash on Ember	Exists and is measured; falls with every halving and with every miner who flips the switch; alone it funds a review every four years at 0.02
3	A user-paid review market: customers (rollups) co-fund the audit that protects their settlement, as a condition of their integration	unknown; a Taiko-class customer's whole annual proving spend is of the order of USD 100 k (frontier 3.11)	Honest and voluntary; the customer has the motive; it depends on having a customer
4	Founders' mined coins (the litepaper's own answer for grants)	depends on hash share	Visible addresses; finite; the ledger's E2 and E8 live here
5	A burn-funded bounty or review escrow	the base-fee burn at launch traffic is 51 to 20,578 IGN a day: USD 1 to 412 at 0.02	Frontier 3.6 (rank 11, "watch") and its Monero attack: a burn redirect is a payee by rule, which is the switch spec 5.5 removed. The protocol cannot have it because it has no treasury, and that is the contradiction stated plainly: the no-treasury rule means the SECOND audit is paid by whoever earns in the open or it is not paid, and funding.md should say so in a row of its own

4.4 Task 4: the dev fee

What it is (miner-dev-fee.md): one block template in 100, chosen by an exact counter (templates 99, 199, ...), is requested with the project's payout address in the coinbase extra data; the vote key and the UTXO address stay the user's, so a fee block still votes for the user and only the execution-layer payout moves. Default on; --dev-fee 0, the app's Settings switch or HiveOS DEV_FEE=0 turns it off; the start line prints the state; igneum-miner payouts tags the dev address on the chain. Measured: 9 fee blocks in 785 on a test network, the miners' counters and both nodes agreeing (bench-log line 1226).

What it pays (devfee_out.md): 1% of the producer share of emission times the share of hash on Ember with the fee on.

Year	Price	20% keep it on	50%	100%	Home 4070 at 100 GH/s network, a month	Rig 8x 4090, a month
1	0.005	7,704	19,260	38,520
1	0.02	30,816	77,040	154,080	USD 3.33 (6.6 blocks)	USD 55.74 (110 blocks)
1	0.10	154,080	385,200	770,400
5	0.02	8,000	20,000	40,000

What share would turn it off. Precedent (approximate, from memory): T-Rex 1%, lolMiner 0.7 to 1.5%, PhoenixMiner 0.65%, TeamRedMiner 0.75 to 2.5% and NBMiner 1 to 2% were not switchable, and together they held the large majority of Ethereum's GPU hash over the fee-free ethminer because they were faster; NiceHash is a marketplace that takes about 2% of the buyer's payment, not a dev fee; nobody measured an opt-out share because none offered one. Igneum's switch is one flag and the miner is open source, so the rational solo miner with any time at all turns it off; the pool operator decides for its members; the one-click app user keeps the default. A working estimate for planning: 20 to 50% of hash keeps it on, which is the devfee table's first two columns and USD 7,700 to 77,000 a year in year 1 at 0.005 to 0.02. This is a planning input, not a measurement, and the first month of the public testnet measures it from the chain (payouts).

Is "optional" honest? Ledger E18's charge is "a protocol fee with better PR". Three facts answer it. It is not in the protocol: the chain pays whatever IGNA address the template names, and a block with the dev address is indistinguishable in consensus from a block paying any other address. It is switchable in one flag and the chain shows who paid (payouts). It is default-on, and defaults are what most users run, so "optional" describes the mechanism and "default-on, switchable" describes the behaviour. The public line should be the second: "1 block in 100 pays the project unless you turn it off". Two things to add to E18: the ceiling correction above, and the fact that the fee buys the project a visible address holding 1% of mined coins, which is the E5 critic's point restated as a holder consequence.

Tier	Consequence
Home 8 to 32 GB on Ember	1% of blocks unless switched off; USD 2.34 to 13.13 a month at 0.02 and 100 GH/s network
Rig	the same per card; a rig operator on HiveOS sets DEV_FEE=0 once
Pool user	the pool's choice: a pool on its own template software pays 0%; a pool on Ember pays 1% of its templates and passes it on or not
Prover	untouched: the pool share is paid per record, never through a template
Holder	one address accumulates up to 1% of producer emission; the project's incentive to keep Ember the fastest client is the fee
Rollup customer	nothing

4.5 Task 5: miner-signalled parameters

What genesis leaves to miners (spec 5.5, 5.9, 5.11): the base-fee floors f_e and f_p, the proving budget B_p (and with it S_p), set by a proposal at 60% of blue blocks over 1,209,600 DAA s (two weeks), the BIP 9 model. Upgrades (new code) need 90% (spec 5.7, window open, O-5.3). The P2 rule for a PoW class change needs 95% of blue blocks over a one-day window ending at each epoch's seed block, monotone, with a floor height as the backstop (counter-asic-3-node.md section 6: CLASS_SIGNAL_THRESHOLD_BPS 9,500, window 86,400 DAA, the fast-time gate green on three cases and its failed case). The documents disagree about the number: spec 5.7, CLAUDE.md's design paragraph and the litepaper's Governance section say 90% for upgrades; the P2 design and the Horizon preamble say 95% for class changes; the litepaper's Mining section says "a 90% miner signal turns one on". One sentence should carry all three (60 parameter, 90 upgrade, 95 class with a floor) or the three should become two.

The game (signal_game_out.md; lane 3's signalling_results.md for the 95% rule):

Rule	Who can block	A 30% pool	Renter's cost to force at 100 GH/s	What ends a block
60% over 14 days	over 40% of blue blocks	cannot block alone; needs 11 more points	USD 590,000 (1.5 N for 14 days)	the proposal fails; re-register
90% over 14 days	over 10%	blocks it	USD 3.5 M (9 N)	the proposal fails; re-register
95% over 1 day, floor	over 5%	blocks it	USD 534,000 (19 N for a day)	the floor height

A 6% holdout costs USD 18 a day at 1 GH/s and USD 1,800 at 100 GH/s on top of the subsidy it earns like anyone, so near zero (lane 3 section 2); it buys delay to the floor and nothing else. A 30% pool holds a permanent veto over upgrades at 90% and over class changes until the floor at 95%; the devnet's top three vote keys held 34.5% of blocks on 4 October (litepaper, Governance). Signal then defect is bounded by what is signalled: a PoW class defector loses its own blocks (its PoW fails, check_header_version then the PoW check); a consensus-rule defector forks itself and whoever trusts it; an execution-parameter defector produces VALID blocks with a different state (blocks carry no state claim, design 1.1), which is a silent state fork for that node unless the parameter is in the consensus digest that the handshake refuses (G12, X18): Params.fees is in the digest (spec 5.11), so today it is isolated rather than split, and any future miner-signalled execution parameter must enter the digest the same day or the defector is a quiet fork.

What Bitcoin and Kaspa did. BIP 9: version bits, a 95% threshold of 2,016-block retarget periods, states DEFINED, STARTED, LOCKED_IN, ACTIVE, FAILED, a timeout; BIP 8 added a lock-in-on-timeout flag so a flag day ends a holdout (bips repository, bip-0009.mediawiki and bip-0008.mediawiki; not cloned, approximate). Kaspa's Crescendo (1 to 10 BPS) was a fixed DAA score, not a signal: crescendo_activation: ForkActivation::new(110_165_000) for mainnet and 88_657_000 for testnet, with ForkActivation::is_active(daa) as current_daa_score >= self.0 (vendor/rusty-kaspa/consensus/core/src/config/params.rs lines 28 to 60, 648, 704, main checkout), and the coinbase keeps the activation score for ever to compute the subsidy month across it (consensus/src/processes/coinbase.rs lines 40 to 43, 238 to 253); docs/crescendo-guide.md tells miners to upgrade before the activation. The P2 rule is BIP 8 in shape: a signal path plus a flag day. Igneum's 6 October incident (DAA 198,000 crossed by a half-updated fleet) is the flag-day hazard, and P2's floor keeps it.

What SHOULD be miner-signalled and is not, with the risk of each:

Parameter	Today	Should be	Risk if signalled	Risk if not
The block rate step (1 to 4 to 10 BPS)	a planned fork with its own test campaign, "as Kaspa's Crescendo" (spec 2.1)	a 90% upgrade signal with a floor, like P2: it is a consensus change crossed by a whole fleet	a 10% pool vetoes the step; a renter forces it a day early for USD 5.3 M at 1 TH/s	a fixed height on a half-updated fleet: the 229-block reorg of 6 October at mainnet scale
The dataset growth step	automatic, genesis schedule (spec 1, 2 GiB doubling at years 4, 12, 28)	NOT signalled, by design: it is an anti-ASIC escalator and a chip-holding cartel would vote growth down. Allow a 60% signal to ACCELERATE only (monotone), never to delay	a 40% holdout blocks acceleration: no worse than today	none: the schedule runs
The 80/20 lottery/proving split	fixed (spec 2.5)	a 60% parameter inside a hard band [10%, 30%]	80% of the voters are the lottery; without the band they vote the pool to 0 and the provers go; with the band the worst case is 10%	the simulator says 20% is not load-bearing at launch traffic and 30% helps at 100 shards a block (economy-2026-10-04 5.3); fixed means a 90% upgrade to move it
The base-fee floors and B_p	60% over 14 days (spec 5.11)	a bounded per-block dial, Ethereum's gas-limit mechanism (frontier 3.5, rank 8): the dollar market moves faster than two weeks (4.1)	a 51% majority walks the dial to the bound in days; the bound and a cost curve are the defence	the job price is pinned in IGN while the market is in dollars; at 0.10 the floor is 7x Boundless and a two-week vote cannot follow it
The job premium 1.5 and the external claim timeout 120 s (O-5.6)	design 6 constants	the same bounded dial	as above	a constant calibrated once on the phase 4 devnet
The exclusive window 25 s	a consensus constant (P9)	a function of the fleet's measured shard-time distribution, published per era (economy-2026-10-04 proposal 1; frontier I3)	none: it reads a measurement	a 12 GB fleet whose shard time drifts past the window loses every assignment to the open race (the 4 October finding at 10 s)

4.6 Task 6: what Kaspa, Monero, Ethereum and the zk rollups did and got wrong

Area	Chain	What it did	Where	What went wrong, or what it costs	Igneum's rule	Avoids or repeats
Emission	Kaspa	A pre-deflationary phase at 500 KAS a block (pre_deflationary_phase_base_subsidy: 50000000000, deflationary_phase_daa_score: 15778800 - 259200), then the chromatic schedule: 426 monthly steps, each month's subsidy the previous times 2^(-1/12), from 440 KAS a block (SUBSIDY_BY_MONTH_TABLE[0] = 44000000000), halving every twelve months smoothly	vendor/rusty-kaspa/consensus/core/src/config/params.rs 631 to 638, 687 to 694; consensus/src/processes/coinbase.rs 22 to 25, 222 to 253, 280	Steep and smooth: no halving-day cliff, but the subsidy fell 50% a year and the chain leaned on price appreciation it could not promise; the table is divided by BPS at Crescendo so the per-second rate is unchanged	1 B a year halving every two years, in DAA seconds; a 30-day ramp; no tail (spec 2.5, 5.10)	Avoids the yearly rate (slower), repeats the cliff (a step, not a glide); E6 concedes it
Emission	Monero	A tail emission of 0.6 XMR a block for ever after the main curve	monero repository src/cryptonote_basic/cryptonote_basic_impl.cpp, get_block_reward (not cloned, approximate)	Security paid for ever at about 0.9% a year inflation falling toward zero; the cost is a soft supply cap critics name	No tail; a review trigger that puts a tail to a 90% vote if proving revenue is under a fifth of the subsidy after year 5 (spec 5.10.3)	Repeats Bitcoin's bet, keeps Monero's door ajar by vote
Emission and burn	Ethereum	EIP-1559: the base fee burned, the tip to the proposer; issuance by stake since the Merge, about 0.5 to 1% a year gross, net near zero when burn is high	ethereum/EIPs EIPS/eip-1559.md; ethereum/execution-specs src/ethereum/london/fork.py (calculate_base_fee_per_gas); not cloned, approximate	The burn removes the proposer's incentive to stuff blocks, at the cost that usage pays security nothing; proposers' income moved to tips and MEV	Both base fees burned, tip 80/20 to miners-provers and apps; the same trade-off, stated (security-budget.md section 5)	Repeats on purpose (E3 is the reason); the EIP-1559 step is copied (next_base_fee, denominator 8)
Fee market	Ethereum	A base fee that cannot fall below 7 wei in practice and has no floor; the gas limit voted per block by proposers within 1/1,024	execution-specs fork.py; geth core/block_validator.go VerifyGaslimit; approximate	A near-zero base fee when idle makes spam cheap; the gas-limit vote is the one continuous miner dial that worked for a decade	A floor per dimension (spec 5.11) calibrated for spam; B_p and the floors by a two-week 60% vote	Avoids the idle-spam gap; does not take the per-block dial (frontier 3.5 asks for it)
Proving market	Aleo	Proof-of-succinct-work: provers compete on proofs for coinbase rewards; the fastest prover (GPUs, then FPGAs and ASICs) took the reward share	AleoNet/snarkOS and snarkVM (not cloned, approximate; CLAUDE.md "the Aleo lesson", ledger C9)	The proving reward centralised to the fastest hardware; small provers earned nothing	The lottery and the proving are separate; shards by sortition on 30-day weight, 8 assignees, 25 s, then open (spec 7.2)	Avoids the race for assigned shards; the open race after the window is where fast cards win beyond their weight (economy-2026-10-04 3.1 item 5)
Proving market	Boundless (RISC Zero)	A reverse auction per request; provers post ZKC collateral; PoVW pays ZKC per cycle proven	docs.boundless.network/zkc/mining/overview and provers/performance-optimization (read, not cloned)	A token gate on supply and a stake that scales with work; the median price USD 0.21 per billion (approximate)	No bond for shards; a coin bond only on external jobs (O-5.6); frontier 3.2 (rank 2) replaces even that with work-stake	Avoids the token gate for internal proving; repeats a bond for jobs
Proving market	Succinct	A real-time auction settled in PROVE; provers stake PROVE to bid	docs.succinct.xyz/docs/provers (read, not cloned; ledger C10)	The same gate; example prices, no public market price	As above; prices in dollars settled in the token (spec 5.4)	Avoids the gate; repeats "settled in our token" once IGN settlement starts
Governance	Monero	Scheduled hard forks (six-monthly, now 9 to 12 monthly), decided by the core team and the community off-chain	getmonero.org and the monero repository's release history (approximate)	Works because the community trusts a small team; the schedule itself is a central clock	No scheduled human releases; automatic escalators at genesis; 90% (or 95%) miner signalling for anything else (spec 5.7)	Avoids the clock; the price is that pools hold the vote (G8)
Governance	Kaspa	KIPs discussed off-chain, activated at fixed DAA scores; Crescendo at 110,165,000 after a testnet campaign	params.rs 648; docs/crescendo-guide.md	A flag day; a node not upgraded forks off; it worked because the community upgraded in time	P2: a signal plus a floor height; Devnet 2 as the staging chain for every cut (CLAUDE.md 6 Oct rules)	Avoids the bare flag day, keeps it as the floor
Governance	Ethereum	All Core Devs calls decide; clients ship; activation by timestamp; no on-chain vote	ethereum/pm repository (approximate)	Works by rough consensus among client teams; a single client bug is a chain-wide event (the 2016 Shanghai attacks, the 2020 Geth split, approximate)	One client today; a second independent client is the first priority after launch (litepaper, Governance)	Repeats the single-client risk until the second client exists
Rollups	Taiko and the zk rollups	Pay their own prover networks per batch; based sequencing; multi-proof tiers	taiko-mono (approximate)	Proving cost is a line item that falls 3 to 30x a year (frontier 2.6); settlement and proving are bought from two suppliers	Settlement and proving from the same miners in one flow (litepaper, Building)	New; the price condition is 4.1 (a)

---

5. Ranked proposals

Rank	Proposal	Evidence	Model	Hours	Consequence per tier	Gate
1	Decouple the job price from f_p: a job's reserve is the measured proving electricity per pgas (USD 4.4e-9 at 0.15 per kWh, base-fee-floor.md 3) converted at a published settlement rate, and the requester bids above it; the 1.5 premium becomes a bid, not a floor	At the adopted floor a billion-cycle job is 15 IGN = USD 0.075 / 0.30 / 1.50 at the three prices against Boundless's 0.21 (4.1 a); a two-week 60% vote cannot follow a dollar market	utility.py section 2	16: the reserve rule in Prover.request (6), the rate oracle as the review-trigger's published reading (spec 5.10.3 already defines it) (4), spec 5.4 and design 6 text (6)	Prover: sells at the market, not at a vote; Rollup customer: a quote it can compare; Holder: job demand for IGN survives a price rise; Miner: nothing; Pool user: nothing	A simulated job book at the three prices clears within 20% of Boundless's median at every price
2	Define the stranded pool: an unproven shard's credit rolls forward into the next proven segment's pool instead of sitting in the escrow for ever	The spec is silent on credit nobody claims; a 10-day refusal strands 5.5 M IGN (4.2); the devnet already burns the coinbase 20% output (litepaper, Economics)	stress.py refuse scenario, stranded_share	8: the roll-forward in split_pool_credit (4), spec 5.3 and 7.8 item 7 text (2), a unit test with a 10-segment gap (2)	Prover: a refusal costs the refusers and pays the returners; Holder: no silent burn; Miner: nothing	On the fast-time harness, 100 unproven segments then 10 proven: the escrow returns to zero within the 10
3	Publish the prover's price as a formula, never a number: price per billion = (h / N) x 0.8 x 31.688 x t x P x 212 / cycles, with N the live network hash	The same card is 100 to 300x Boundless at 1 GH/s and 0.2 to 0.4x at 100 GH/s (4.1 a); the customer brief says "priced in dollars" with no condition	utility.py 1.3	3: a paragraph in the customer brief and the litepaper's Proving section, with the table	Rollup customer: no promise it cannot hold the project to; Prover: knows when to sell; everyone else: nothing	The brief and the litepaper carry the condition before any customer conversation
4	Make the 80/20 split a 60% parameter inside a hard band [10%, 30%], and record the three signalling numbers (60 parameter, 90 upgrade, 95 class with floor) in one sentence in spec 5.7, CLAUDE.md and the litepaper	The split is not load-bearing at launch traffic and 30% buys backlog relief at 100 shards a block (economy-2026-10-04 5.3); the documents carry two upgrade thresholds (4.5)	stress.py --set pool=	10: the band in Params (4), the proposal kind (3), text (3)	Prover: a floor of 10% of emission by rule; Miner: a vote on its own share, bounded; Holder: nothing	The fast-time harness: a 60% vote moves the pool to 30%; a 100% vote cannot pass 30% or go under 10%
5	Every miner-signalled execution parameter enters the consensus digest the same release, with a CI check that fails a Params field marked signalled and absent from the digest	A signal-then-defect on an execution parameter is a silent state fork unless the handshake refuses the defector; Params.fees is in the digest, nothing guarantees the next one is (4.5)	signal_game.py section 3	6: the check in tools/ci (4), a test (2)	Node operator: a defector is isolated, never quietly wrong; everyone else: nothing	The check fails on a planted field and passes on the live set
6	The block-rate steps become P2-shaped activations (signal plus floor), not fixed heights	Crescendo was a fixed DAA score (params.rs 648); the 6 October incident was a fixed height; spec 2.1 still says "a planned fork" (4.5)	lane 3 cost_results.md forced-flip row	4: spec 2.1 text and a line in the Devnet 2 gate	Miner and rig: no flag day crossed while updating; Pool user: nothing	Spec text; the first step's rehearsal on Devnet 2 passes the same gate as the class v4 cut
7	Correct funding.md section 4's dev-fee ceiling (1% of the producer share, not of all rewards) and add a row that names who pays the SECOND cryptanalysis	48,000 / 193,000 / 963,000 overstate by a quarter (4.4); no row prices a second review (4.3)	devfee.py, security_budget_10y.py section 3	1	Holder and critic: a number that matches the mechanism	The file's git history
8	Measure the two numbers every price here rests on: the miner's hash loss while each card proves (4% is one card), and a full 30 M-cycle shard beside the miner on the 12 GB and 16 GB tiers	The hybrid row is the only one that undercuts the market and it rests on one measurement (4.1 a); the 4.7 M fixture is 16% of S_p (2.1)	utility.py hybrid_hash_loss	6 on the fleet: eleven boxes, two fixtures, tools/fleet/lib	Home 12 and 16 GB: whether they are provers at all beside their miner; Rig: the same per card	Eleven rows with both numbers in prover-tiers-real-cards.md

1. Decouple the job price from f_p. f_p's floor exists to price spam above the electricity it imposes (base-fee-floor.md section 3: 230x the electricity at USD 0.10 per IGN). Design 6 then prices every external job at maxPgas x f_p x 1.5, so the same floor that is 230x electricity for spam is the job market's minimum: 15 IGN per billion cycles, which is a third of Boundless at USD 0.005 and 7x at 0.10. A rollup compares in dollars every week; a 60% vote takes two weeks and a quorum. Lane 7 (frontier 3.5, rank 8) proposes the continuous dial for the floors themselves and it would help; this proposal is narrower and independent of it: the job reserve is the electricity, published as a rate the review trigger of spec 5.10.3 already needs ("converted at the window's settlement rate and published with the reading"), and the price above the reserve is the requester's bid against the sortition's assignees. Cost 16 hours. Gate: a simulated job book clearing within 20% of Boundless at all three prices. Per tier: the prover sells at a market price; the rollup customer gets a comparable quote; the holder keeps job demand for IGN through a price rise (at 0.10 and the floor, every rollup leaves); miners, pools and home cards see nothing.

2. Define the stranded pool. Spec 5.3 pays "the first valid proof included in a block"; 7.7 item 3 refuses a record older than 600 chain blocks; 7.8 item 7 says an unproven segment's aggregator share "stays in the escrow". Nothing says what happens to the shard credit nobody claimed. In the refusal scenario (4.2) the whole 20% is stranded for ten days: 5.5 M IGN that reach nobody and that nobody decided to burn. A roll-forward (the next proven segment's pool is larger by what was stranded) makes a refusal a transfer from refusers to returners, which is the incentive the design wants, and makes the pool's total over any month equal to 20% of emission as the litepaper's table promises. 8 hours. Gate on the fast-time harness.

3. The prover's price as a formula. The whole of 4.1 (a) is one line: price per billion cycles = the subsidy the card forgoes per shard, which is h/N. At the devnet's 1.16 GH/s every quote is 100x the market; at 100 GH/s hybrids undercut it. The customer brief's "priced in dollars per proof" and the litepaper's "proofs at the cost of power" need the condition beside them, or the first customer conversation ends with the number. 3 hours of text.

4. The 80/20 as a bounded parameter, and one sentence for the thresholds. The 4 October lever study found the pool share not load-bearing at launch traffic and useful at 30% under heavy traffic; tonight's runs (4.2) agree. A band of 10 to 30% lets miners trade lottery for proving capacity when the traffic says so, and the band stops the lottery's 80% from voting the provers out. The same change should carry the three signalling numbers in one place; today a reader finds 90 in spec 5.7 and CLAUDE.md, 95 in P2 and the preamble, 60 in 5.5, and "a 90% miner signal turns one on" in the litepaper's Mining section about a class change the P2 rule sets at 95.

5. Signalled execution parameters enter the digest, by CI. Blocks carry transactions only. A node that signalled a fee change and runs the old rule accepts every block and computes a different state; its proof records fail everyone else's statement and everyone else's fail its own, which is loud for provers and silent for a wallet. Params.fees is in the digest and the handshake refuses a different digest, so today the defector is cut off. The next signalled parameter has no such guarantee until a check fails without it. 6 hours.

6. Block-rate steps as signal-plus-floor. Spec 2.1 names the steps "a planned fork with its own test campaign, as Kaspa's Crescendo". Crescendo was a fixed DAA score (params.rs line 648) and Igneum's own fixed height cost it a 229-block reorg on 6 October. P2 exists; the steps should use it. 4 hours of text and a gate line.

7. The funding corrections. One number and one row. 1 hour.

8. Measure the two numbers. The hybrid row is the only competitive one and it rests on the 5090's 4% and a fixture a sixth of a full shard. Six hours on the fleet, through tools/fleet/lib, eleven boxes.

Cross-references to lane 7 by name and rank: 3.1 (rank 7, the rental tax) would move 25 to 75% of a spiking block's subsidy to the pool; against 4.3's constant 11.8x ratio it doubles the renter's break-even and does not change the year the absolute cost gets small. 3.2 (rank 2, work-stake) removes the coin bond this lane's job model carries; the numbers here do not depend on the bond's form. 3.5 (rank 8, continuous dials) is the general form of proposals 1 and 4 here. 3.6 (rank 11, burn bounties) is option 5 of 4.3 and is rejected on the same ground. 3.11 (rank 15) and 3.12 to 3.14 are the market-size and verifiable-compute ceilings this lane's demand grid sits under. I7 (equivocation bounty in sortition slots) is the one treasury-less incentive in lane 7 that this lane's stranded-pool rule could fund without coins: stranded credit to the evidence carrier is a variant worth one line in the ledger, not a proposal here.

---

6. Open questions and what I could not run

• The full-shard beside-the-miner times on every tier (proposal 8). Linear scaling from the 4.7 M fixture says 92 s alone on a 3060 and 240 s beside the miner; if that holds, no 12 GB card meets the 120-s claim timeout beside its miner and the 25-s window is for 24 GB cards and up. The fleet was on the class v4 rehearsal tonight.
• The hash loss while proving on Ampere and Ada: the 5090's 4% is Blackwell with 32 GB; the 8 GB cards showed 6%; the 12 to 24 GB tiers are unmeasured and the hybrid row of 4.1 (a) moves with them.
• Price elasticity of job demand: every demand count is an assumption. The customer brief's "low millions a year" is the only market figure and it is approximate.
• The rental market's supply curve: 0 of 20 pods at the TH/s scale on 6 October; the attack costs assume the hash can be had at the measured price, which the bench entry says it cannot above about 2 GH/s.
• The Devnet 2 block-rate runs (RUN_A, RUN_B) were empty at writing; a 10 BPS chain changes shards per segment, records per block and the per-block fee step, and 4.1 (e) should be re-read when they land.
• The economy simulator's price process is exogenous; burns do not move it (4.2's burn is a number, not a feedback).
• BIP 8 and BIP 9 texts, the Ethereum specs, Monero's reward code, Aleo, Boundless and Succinct are cited by repository and path from memory or from the project's earlier readings and are marked approximate throughout; no clone exists in vendor/.

---

7. Summary for the coordinator

Lane 4 turned the eleven measured cards into a price per proof, built five demand curves with dollars and burn, re-ran the economy simulator with the measured table and the measured rental price under eight stresses, extended the security budget ten years with those fees, priced the dev fee and the signalling game, and tabulated what the other chains did. Three findings:

1. The proving price is h/N, not "the cost of power". Electricity is under a cent per billion cycles on every card; the price a prover must charge is the subsidy it forgoes, which is 100 to 300x Boundless's USD 0.21 at today's 1.16 GH/s and 0.2 to 0.4x at 100 GH/s for a card proving beside its miner (utility.py 1.3). And the adopted floor prices a job at 15 IGN per billion cycles, USD 0.075 / 0.30 / 1.50 at the three prices: above USD 0.014 per IGN the chain overprices the market by rule, and a two-week vote cannot follow a dollar market (proposal 1).
2. Fees are not a security budget for a decade. All five uses together put USD 450 a day to miners and provers at launch and USD 4,200 in year 5 in the base scenario at 0.02 (utility.py 3.3) against USD 54,800 and 13,700 of daily emission; of the 48% fee share in year 5 under 1% reaches miners. The 20-day 34% weight attack costs 11.8x the honest fleet's 20 days at every price and year (security_budget_10y.py); its absolute net cost drops under USD 1 M in year 5 at 0.005 and year 9 at 0.02. The second audit has no payer by rule: the entity's own provers (USD 100 k a year at 5% of the pool, year 3, 0.02) are the only line that scales.
3. The 80/20 survives every stress but one, and that one strands the pool. With the eleven measured cards, the 25-s window and a renter farm at the measured rent, T1 to T5 hold under price x10 and /10, external zero and x100, a 20% proving cartel and the first halving (stress.py, 8 scenarios x 3 seeds; hash troughs at 55% of pre-event under the /10 shock with 31% of cards off, the one row at the T1 line). A ten-day refusal by every prover breaks T4 only, and what it costs is 547,570 IGN a day of pool credit stranded in the escrow with no rule to return it (5.5 M IGN over the ten days): a silent supply cut nobody voted for (proposal 2). The renter farm is off in every row but the x10 price shock (margin +114%) and partly on under x100 external demand (-6%), which is lane 3's N_eq in an agent model.

Rules for main: the customer brief and the litepaper's "proofs at the cost of power" need the h/N condition before any customer conversation (proposal 3); funding.md section 4's dev-fee ceiling is a quarter too high (the fee moves the producer payout only); the three signalling thresholds are stated inconsistently across spec 5.7, CLAUDE.md, the P2 design and the litepaper's Mining section; and the spec is silent on pool credit nobody claims (proposal 2).