Status: done (core forfeiture wired); remaining fraud scope superseded — see [ADR-0018](../adr/0018-fraud-detection-verification-and-reputation.md) and `.scratch/alpha-hardening/issues/06-fraud-toploc-integration.md` through `10-fraud-penalty-calibration-wiring.md`.

# 34 — Hardened proof-of-work: pending-balance forfeiture penalty

## What to build

Wire the validator's ~5% sampling (issue 07) to the new penalty per ADR-0015. On confirmed output divergence:

1. The node's **entire pending balance is forfeited** to the protocol cut, in the same ledger transaction as the strike (no window where a payout can race the penalty).
2. A **strike** is recorded; the third strike **bans** the wallet — registration rejected, excluded from all routes, and any unpaid pending balance is never paid out.

The probationary period (first N jobs unpaid, default 50) is retained as the anti-sybil re-entry cost, and the node CLI shows remaining probation jobs.

Why this deters cheating: settlement is periodic, so the pending balance itself is the collateral — no upfront stake deposit, zero onboarding friction. At a 5% check rate a cheater is caught once per ~20 fraudulent jobs, so the penalty must exceed ~20× the per-job gain; with daily settlement, pending ≈ a full day's earnings, well above that bar. Document this math in the validator README.

## Acceptance criteria

- [ ] Divergence → pending balance forfeited to `protocol_cut` atomically with the strike
- [ ] 3rd strike bans wallet: registration rejected, excluded from all routes
- [ ] Banned wallet's unpaid pending balance is not paid at next settlement
- [ ] Probation: first N jobs (default 50) accrue no pending balance; node CLI shows remaining
- [ ] Integration test: deliberately-bad node loses pending, accrues strikes, banned within 60 requests
- [ ] Forfeiture events visible in tracker logs and settlement history

## Blocked by

- `07-fraud-detection-slash.md`
- `31-billing-ledger.md`