The claim window

In v1 one settlement extinguishes a certificate. That is the bug. A self-challenge for the minimum bond settles first, the certificate dies, and every honest claim behind it is permanently foreclosed. The attack costs one bond and destroys the entire coverage.

Aggregate first, then pay once

A first valid challenge no longer settles. It opens a claim window of 72 hours of ledger time. During the window any party may file an additional claim against the same certificate. At the close, settlement runs once, over every claim the window admitted.

While that is running, the certificate's collateral may be frozen — no new attestation, no reserve withdrawal, no allocation release, no escape by expiring. The freeze and the window are two different things, and it is worth keeping them apart: the window is the period during which claims may join, and the freeze is the narrower question of whether collateral is locked. A freeze is held only by a claim something actually backs — a predicate that evaluated true at filing, or a forged-signature claim the arbiter has upheld. A claim nobody has ruled on locks nothing.

Payouts are shared pro rata rather than first-come, because ordering inside a window must not be worth anything or the race is simply rebuilt one level down. Filing order changes no payout, and there is a test named for exactly that.

Pro rata by what, exactly, matters a great deal, and it is not the same for every pot. The challenger fee is divided by each claim's proven harm. Victim compensation is divided by arbiter-assessed harm only — a claim resting on a computed predicate is paid no victim compensation at all. The waterfall explains why that narrowing was necessary and what it costs.

Nothing may be filed once the certificate's settlement deadline has passed, whatever the proof type. Before that rail existed, an operator lawfully reclaiming their reserve at the deadline left every honestly completed certificate carrying a permanently true shortfall proof that anyone could file for gas, freezing the certificate and taking the auditor's whole allocation. The cost of the rail is that a genuine breach discovered late is unchallengeable.

The freeze itself reuses the lock that already existed rather than inventing a second one. The registry already publishes a settlement deadline that both the vault and the staking contract refuse to release before; opening a window writes the window's close into the certificate, and the deadline becomes the later of the two. One mechanism, three enforcement points, no way for them to drift apart. Two follow-on changes were needed: the reserve and the allocation used to trust a deadline snapshotted at deposit and attest time, which cannot know about a window opened afterwards, so both now read the live value.

Closing the window is permissionless and unrewarded. Anyone may call it once the close has passed, and the caller pays the fee. A bounty here would be a second pot to game, and none is needed: nobody in the window is paid a stroop until somebody makes the call, so every claimant is motivated to be that somebody. A backed claim keeps the collateral frozen until it happens, which means an unclosed window costs the operator and the auditor rather than the victims.

How harm aggregates, and why it is not a sum

This is the part that looks like it wants simplifying, and it must not be.

A harm the arbiter stated is an assessment of what one claimant lost. Two claimants who each lost five hundred dollars lost a thousand between them, so those figures sum.

A harm a predicate computed is a property of the certificate. InsufficientReserve reads one shortfall off one vault; ten people noticing the same hole have not proven ten times the harm. So the shortfall is counted once — the worst state the certificate was recorded in across the window's filings — and shared equally by the claims standing on it.

The attack that closes is harm amplification. If identical predicate claims summed, anyone could file copies of the same true proof and drive the payable amount, and with it the auditor's slash, to a multiple of the real shortfall for the price of a few minimum bonds. The split within that group is equal rather than pro rata because the predicate cannot tell the claimants apart — it reads the vault, not the victims — and equality is the only order-independent answer.

The equal split now governs how the challenger fee is shared among those claims, not what any of them is paid as a victim — a predicate claim is paid nothing as a victim. The underlying limit is the same one and it has simply moved: a certificate-level predicate reads the vault, not the victims, so it can never size what any individual lost. Only the arbiter path can express that, and the arbiter path is trusted.

The fee pot is deliberately still shareable by a swarm. It is a bounty for surfacing a fact rather than compensation for a loss, and its total is fixed at a percentage of proven harm however many people file — the same trade the flat hygiene bounty already makes on purpose.

The hygiene bounty is the one pot that is not pro rata. Hygiene harm is zero by definition, so there is no ratio to divide by: it is one flat bounty for the window, split equally. Its job is to pay for the gas of killing a dead certificate, and that job is done once however many people turned up to do it.

Cured

A window creates a second problem it has to answer for. If a challenge is filed and settled later, the operator can top the reserve up in between, flip the predicate to false, and pocket the challenger's forfeited bond. The protocol would be paying the operator for having been caught.

Two mechanisms, both required.

The predicate is evaluated at filing. Filing computes the predicate and its quantity in the same read and records both on the claim. Nothing downstream ever recomputes whether the challenger was right.

A cure returns the bond. At the close the live predicate is read again — and it answers a different question: not "was the challenger right" but "is the certificate still broken". If it is no longer broken, the claim resolves Cured. The bond comes back in full, the certificate survives, nobody is slashed, and nothing is forfeited from the premium pot.

The asymmetry is the safety property, and it is worth stating as one line: recorded state decides the bond, live state decides the certificate, and live state can only ever move in the challenger's favour.

A cure closes the whole window. With no admitted claim left, closing lifts the freeze and leaves the certificate alive; a fresh window may open later. A claim filed after the cure is rejected rather than aggregated, and that falls out of the first mechanism rather than needing a rule of its own — a claim against a certificate that is already fixed is false at filing, and false at filing is what a rejected claim means.

One consequence worth naming: a claim that is false at filing with no window open does not open one. It is rejected on the spot and its bond forfeited. If a wrong claim could freeze a certificate for 72 hours, anybody could freeze any certificate for the price of the minimum bond. Once a window is already open a wrong claim is allowed to join it, because there it changes nothing.

Cured is a third outcome alongside upheld and rejected. There is a fourth, Unadjudicated, for an arbiter-gated claim nobody ruled on before the close: the bond comes back whole, because a claim nobody judged is not a claim the challenger got wrong. That refund is now cost-free to the protocol — an unruled claim freezes nothing on its way past — so the honest claimant abandoned by an unresponsive arbiter keeps the protection it was written for. Being rejected is now the only outcome that forfeits a bond, and it is reachable only by being wrong at filing.

A cure is free, and that is a decision

The operator restores the reserve, the certificate survives untouched, the auditor is untouched, and the challenger is made whole out of their own returned bond. The protocol takes nothing.

It does under-price getting caught. An operator can run a persistently underfunded certificate and top it up only when challenged, using the 72 hours as free credit. Two things make that a trade rather than a hole. Each cure leaves a challenge on-chain forever, readable by any counterparty. And the alternative prices remediation: a cure fee is a tax on exactly the behaviour the protocol wants most, and an operator weighing "fix it and pay" against "do not fix it and hope" has been pushed toward the second answer. A penalty also needs a recipient, and every candidate turns curing into somebody's revenue line.

A per-certificate cure counter, with a fee or a forced re-attestation on repeat, is the obvious next step. It is not built, because pricing it without a loss history would be inventing a number.

The cost to a genuine victim

State it plainly, because it is the price of the whole mechanism: a genuine victim now waits out the entire window before being paid a stroop, even when theirs is the only claim ever filed. That latency is real. It is what buys the guarantee that a self-dealer cannot foreclose them.

Seventy-two hours is a proposal, not a researched number — long enough to be a real cost to a victim and short enough that a claimant in a bad timezone can miss it.

An arbiter-gated claim freezes nothing

A forged-signature claim has no on-chain predicate, so it cannot be rejected at filing the way a false reserve claim is. It opens a window and waits for the arbiter. The design priced that as a griefing surface costing one minimum bond for three days of frozen reserve and allocation — and an adversarial review found the contract did not charge that bond. An arbiter who simply ignored the claim left it Unadjudicated at the close, and an unadjudicated bond comes back in full. The griefer's real cost was gas plus 72 hours of float, repeatable.

The fix removes the thing being bought rather than pricing it. The freeze is no longer held by the window. It is held by a claim something actually backs: a predicate that evaluated true at filing, whether it opened the window or joined one, or the arbiter upholding a forged-signature claim. A claim nobody has ruled on locks no reserve and no allocation, so the grief has nothing to purchase at any price, and the 72 hours cost the operator and the auditor nothing to wait out.

The other candidate — a higher bond for arbiter-gated proof types — was rejected, and the reason is worth keeping. It prices the grief instead of removing it, and an attacker who can afford the price still gets the freeze. On this attack the lever does not even connect: the bond is refunded under Unadjudicated, so raising it raises the griefer's float and not their cost. Making it bite would mean forfeiting the bond of a claimant whose arbiter never ruled, which is the one outcome that branch exists to prevent.

The cost, stated plainly. An upheld forged-signature finding can settle against collateral that has already unwound. The exposure is bounded rather than open-ended: the reserve and the allocation are locked until the certificate's own settlement deadline whatever this contract does, and nothing may be filed from that deadline onwards — so the loss requires the arbiter to still be silent at a deadline the claim was necessarily filed before. That is a latency controlled by a party already trusted completely with the verdict itself.

The early close

There is also a way for the arbiter to end a window on the spot once they have rejected a claim in it — arbiter-only, and only against a claim they themselves ruled false. A claim a predicate found false is not a key to that door, because nobody exercised judgement on it. The rail is that it refuses while any other live claim remains: one the arbiter has not yet ruled on, or one that is proven, whether an arbiter stated it or a predicate computed it. A proven claim holds the window open even if the operator has since cured the underlying condition, because the cure check belongs at the close and only at the close — otherwise an operator could cure mid-window, have a throwaway claim rejected, and cut the window out from under a genuine victim who had not been paid yet.

Getting rejected faster is not cheaper. The early path runs the same settlement a natural close runs, so a rejected claimant forfeits their bond exactly as they would have at the close.