arXiv:2606.08886v2 Announce Type: replace-cross Abstract: Many censorship circumvention systems keep moving their servers to new cloud addresses, so that whatever the censor discovers soon goes stale. But clients often reach these servers through a name the censor can see and block, such as a hostname or a front domain, and moving a server to a new address does not give it a new name. Existing models treat each proxy as a single unit and leave open when such a system keeps working. We model addresses and names as two coupled layers and ask which one limits availability. Enough servers, rotated fast enough relative to how quickly the censor finds them one at a time, keep some address reachable, and we compute how fast is fast enough. Past that point, faster rotation buys almost nothing, and the names become the limit. If the censor burns names, blocking them for good, $\beta$ times as fast as the system mints new ones, clients can connect less than a $1/\beta$ share of the time, however fast the servers move. For an illustrative system with eight servers and room for eight names, sessions lasting five mean mint intervals stay connected with probability at least 0.95 only while $\beta \leq 0.66$, the system's sustainability frontier, which a censor that times its blocks can cut about tenfold. Public data show that China and Iran block platform names one tenant at a time or a whole suffix at once, that Russia orders such blocks, and that even Snowflake clients need names to obtain proxies. Our solver, simulator and data pipelines are openly available. Once rotation is fast enough, the race that matters is between minting and burning names, not between rotation and discovery.