Crits can be deflected, it turns out.
Punish expose is now applied as an uptime, not flat 4.5%.