So the 49 - 99% attacker could nominate ALL the confirmation nodes in his private chain, but attacker can't convince the rest of the network that his chain is valid, due to my rule that attacker must include all the nominations from propagated block announcements (which attacker didn't refute within the 6 second window...because as I explained, the attacker can't refute because the rule requires him to restart his computation of next block after each block announcement).
He doesn't need to convince the rest of the network. The problem is insidious; the attacker presents a majority of fully compliant, well behaved nodes with which the rest of the network becomes acquainted and then sits and waits until he needs to pull of his attack, at which point the minority of the network will go along with his presented truth because they will already be nominating his 'sleeper' nodes.
Unless I have misunderstood the entire design, which is very possible
