I think I can deduce why you are misunderstanding (and it is an expected reason that can probably only be conquered with a very thorough elucidation). It seems you are conflating the concepts of attacks on PoW chains with attacks on, by, or leveraging confirmation nodes. These are orthogonal concepts in my design. For example, confirmation nodes do not gain any power to issue double-spends (all confirmations have an objectivity that can't be violated and that is another design secret and I won't discuss that now but you can look at Dash's Evolution design for a hint).
I think this will indeed be key to understanding this design. This probably doesn't help you at all, but the root of my line of reasoning is that
the attacker can be both confirmation node(s) and regular node(s) and have a majority of both at any time.
True, but that (bolded statement) isn't an attack.

Attack means can blacklist minority PoW and confirmation nodes, double-spend, or DDoS attack (or other form of real harm). I think I already explained why having even 99% of the PoW and confirmation nodes does not enable those attacks. But probably it is only clear to me because there are design details in my head that I haven't written here in public. So when I get it all organized in a white paper, it will be more clear to me what I need to explain in more detail.
Paradigmatic shifts are often non-obvious to others (an analogy to banging into a glass door which is obviously there to the person who banged into before), even though to the person who invented them they seem as obvious as sunshine already.