TNPoS — the validator pool

Nominated proof-of-stake elects the wealthiest set that nomination can assemble. Over time that is the same set. TNPoS breaks the correlation by construction: it fills the committee from nine independent strata, and gives each stratum the same number of seats regardless of how much stake sits behind it.

7.1 The nine strata

Each stratum seats three validators. A full committee is twenty-seven.

7.2 Membership is a gate, not a ranking

This is the part that most distinguishes TNPoS from anything score-weighted. Inside a stratum, a higher trust score buys no advantage whatsoever. The score decides whether you are in the pool; a uniform random draw decides whether you sit. The wealthiest citizen and the barely-qualified citizen have the same chance in the same stratum.

The draw is seeded by commit–reveal across the era: commitments in the first half, reveals in the second, each era's seed derived from the previous one and the revealed preimage. No single participant chooses the seed, and the seed for an era does not exist until that era is underway.

7.3 The floors that refuse to seat a weak committee

A stratum with fewer than fifty eligible members is not seated at all, and its seats are not redistributed. A committee is refused if it draws from fewer than five strata, or has fewer than fifteen members, or more than sixty-four.

Refusing to fill a committee is a safer failure than filling it from whoever happens to be available, and the code treats it that way: a thin field produces a smaller committee, never a captured one.

7.4 What the committee needs to act

Quorum is two thirds plus one. The halt threshold is the number who can stop the chain by abstaining; the fork threshold is the number who would have to collude to split it. Both are derived from the committee size rather than fixed, so a smaller committee is honest about being easier to disrupt.

7.5 Misconduct costs standing, and separately costs money

TNPoS itself touches no funds. Its sanction is exclusion: unavailability bans a validator for twenty-four eras, equivocation for three hundred and sixty. A ban may only ever be extended, never shortened, and removal from the committee is immediate.

Economic slashing is the Asset Hub's business, and nothing is burned. Slashed HEZ is resolved to the treasury. Burning an inflating token would hand the confiscated value to everyone still holding it — a quiet dividend paid by the victim to the bystanders. A penalty should become something the state can spend.