Differences

This shows you the differences between two versions of the page.

--- provenance:design:ownership_resolution [2026/09/11 19:22] – Point the Related list at the new residue_pass appendix instead of nonexistent sections of the random_sample one. Authored by Claude karel.kubicek.claude
+++ provenance:design:ownership_resolution [2026/09/11 22:45] (current) – Section L.9: the third sweep and the two 2026-09-05 judgement-call bullets it found still stating 69.9%/93.9% in the present tense; dated rather than refreshed. Authored by Claude karel.kubicek.claude
@@ Line 542: / Line 542: @@
 ^ Route ^ What it is ^ Rows it settled ^
 | ''register-by-number'' | a national company register searched by **company/VAT/register number** rather than by name — the first pass failed on strings like "Admiral", "Collective" and "Globo", which are unsearchable | 4 |
-| ''rdap-history'' | the **registrar's own port-43 WHOIS**, not RDAP. ''rdap.org'' returns a thin registry record with no registrant for ''.com''/''.net''; the registrar's server returns it un-redacted. Also the registration and last-changed **events**, which bound a claim even when the organisation is redacted | 9 |
+| ''rdap-history'' | the **registrar's own port-43 WHOIS**, not RDAP. ''rdap.org'' returns a thin registry record with no registrant for ''.com''/''.net''; the registrar's server returns it un-redacted **when the registrant has not bought privacy protection**, which is a per-registration fact and not a per-registrar one -- ''whois.tucows.com'' returns a real organisation for some domains and ''Contact Privacy Inc. Customer 0168237798'' for ''cdnbasket.net''. Also the registration and last-changed **events**, which bound a claim even when the organisation is redacted | 9 |
 | ''archived-legal'' | a Wayback capture of the domain's **own legal page**, fetched with the ''id_'' suffix so the Archive's banner is not in the bytes | 2 |
 | ''live-source'' | a live document the first pass did not reach — usually because it looked for a page naming the //domain// and this pass looked for the //entity//, or because the page is on a subdomain | 13 |
-The registrar hop is what did most of the work, and it is the cheapest thing
+**These counts are after the hand corrections.** They differ from the
-to add to any future pass: it is one extra socket per domain. It produced
+''owner_tail_merge.py'' output published in the appendix, which ran before them:
+that run reports live-source 12 and rdap-history 10, because the ''i.ua''
+correction moved one row from ''rdap-history'' to ''live-source''. Nothing else
+moved. The largest single route is ''live-source'' -- a live document the first
+pass did not reach, usually because it looked for a page naming the //domain//
+where this pass looked for the //entity//.
+The registrar hop is nonetheless the cheapest thing to add to any future pass:
+it is one extra socket per domain, and it settled rows RDAP alone could not.
+It produced
 ''Applied Technologies Internet SAS'' for ''at-o.net'', ''Conversant, Inc.'' for the
 three ValueClick-style sync domains, ''Acoustic, L.P.'' for ''pages02.net'',
@@ Line 664: / Line 673: @@
 **12 distinct domains of the 175**, down from 40. These are not rows where
 the register was not tried. Each note below is the adjudicator's own account
-of what each of the three routes returned.
+of what each of the three routes returned, **in full and not truncated** -- an
+earlier draft cut this column at 420 characters mid-word, which made "every
+route tried" a claim a reader could not check.
+**Two of the twelve are adjudicator limits rather than evidence limits**, and
+saying so matters because they are the two a person could still close.
+''hqseek.com'' has a live site: it redirects to an adult domain and the
+adjudicator declined to fetch further, so the row is unresolved because a
+model stopped, not because the evidence is gone -- and its note records that
+Tracker Radar's claimed owner matches no name the domain ever surfaced, which
+would be an ''error'' rather than an ''unknown'' if anyone read the pages.
+''stripst.com'' is unresolved because Stripchat's legal pages return HTTP 406
+to a non-browser client, which is a transport failure, not an absence of
+documents. The other ten are genuinely evidence-exhausted.
 ^ Domain ^ In the residue of ^ What each list claims ^ Why it is still unresolved ^
-| ''1rx.io'' | webXray | wx: Blinkx / TR: RhythmOne / DC: Nexxen | register-by-number: no company/VAT number available anywhere for 'Blinkx'/'RhythmOne'/'Nexxen' tied to this specific domain, so nothing to look up. rdap-history: RDAP has no data for the .io TLD via rdap.org; registry WHOIS (whois.nic.io) refers to GoDaddy, and the registrant is fully REDACTED (Domains By Proxy, LLC) with no organisation name, created 2015-05-28. archived-legal: root domain 1rx.io has zero Wayback ca |
+| ''1rx.io'' | webXray | wx: Blinkx / TR: RhythmOne / DC: Nexxen | register-by-number: no company/VAT number available anywhere for 'Blinkx'/'RhythmOne'/'Nexxen' tied to this specific domain, so nothing to look up. rdap-history: RDAP has no data for the .io TLD via rdap.org; registry WHOIS (whois.nic.io) refers to GoDaddy, and the registrant is fully REDACTED (Domains By Proxy, LLC) with no organisation name, created 2015-05-28. archived-legal: root domain 1rx.io has zero Wayback captures ever (checked cdx with and without wildcards); only the ad-serving subdomain a-ams.1rx.io was archived, and only as RTB delivery JS calls, never a privacy/legal page. Also checked SEC EDGAR full-text search for the literal string '1rx.io' (Nexxen/Tremor International is Nasdaq-listed) -- 0 hits. No primary source anywhere names this domain, so it stays unresolved, same as the first pass. |
-| ''agkn.com'' | webXray, Disconnect | wx: Neustar Marketing / TR: TransUnion LLC / DC: TransUnion | Register-by-number: SEC EDGAR full-text search for the exact phrase "agkn.com" across all filings returned 0 hits; "AdAdvisor" appears only in two old NEUSTAR INC (CIK 1265888) filings from before the 2021 TransUnion acquisition, nothing from TransUnion itself. RDAP/WHOIS history: registrant is fully privacy-proxied (Brandsight Privacy Customer, PO Box, Boise ID) with no organization field populated, at either GoDadd |
+| ''agkn.com'' | webXray, Disconnect | wx: Neustar Marketing / TR: TransUnion LLC / DC: TransUnion | Register-by-number: SEC EDGAR full-text search for the exact phrase "agkn.com" across all filings returned 0 hits; "AdAdvisor" appears only in two old NEUSTAR INC (CIK 1265888) filings from before the 2021 TransUnion acquisition, nothing from TransUnion itself. RDAP/WHOIS history: registrant is fully privacy-proxied (Brandsight Privacy Customer, PO Box, Boise ID) with no organization field populated, at either GoDaddy or the registrar's own WHOIS; only the 2005 creation date is usable and it merely predates the whole ownership chain rather than confirming any link in it. Archived legal pages: Wayback shows a 2016 privacy.html and cookie-sync URLs branded "Neustar AdAdvisor" through 2021, but nothing after, and I could not fetch a current TransUnion page (transunion.com/privacy/media-digital-marketing-solutions, transunion.com/privacy/neustar) to bridge that gap -- both returned HTTP 403 (Cloudflare/Akamai bot wall) to curl and to WebFetch alike, so no live source could be confirmed. Leaving unresolved rather than guessing from the secondary-reporting chain. |
-| ''marphezis.com'' | Tracker Radar | TR: Online Media Solutions Ltd. dba Brightcom | register-by-number: no identifier available for 'Online Media Solutions Ltd. dba Brightcom' tied to this domain specifically. rdap-history: RDAP/registry WHOIS registrant is fully REDACTED (GoDaddy/Domains By Proxy pattern), registered 2015-07-14, last changed 2026-07-15 (routine renewal, not evidence of transfer). archived-legal: fetched the only 200-status legal-adjacent capture found -- it is a GoDaddy domain-park |
+| ''marphezis.com'' | Tracker Radar | TR: Online Media Solutions Ltd. dba Brightcom | register-by-number: no identifier available for 'Online Media Solutions Ltd. dba Brightcom' tied to this domain specifically. rdap-history: RDAP/registry WHOIS registrant is fully REDACTED (GoDaddy/Domains By Proxy pattern), registered 2015-07-14, last changed 2026-07-15 (routine renewal, not evidence of transfer). archived-legal: fetched the only 200-status legal-adjacent capture found -- it is a GoDaddy domain-parking iframe (mcc.godaddy.com/park/...) from 2016, i.e. the domain was parked/lapsed, not operated by anyone; no privacy/terms page was ever archived. Also checked brightcom.com's own privacy/legal pages (403/404, no mention possible) and SEC EDGAR full-text search for 'marphezis' (0 hits, though Brightcom is TASE-listed, not SEC, so this is weak). Nothing ties the domain to Brightcom or any other real operator; stays unresolved. |
-| ''cdnbasket.net'' | Tracker Radar, Disconnect | TR: Bounce Exchange / DC: cdnbasket.net | All three routes came back empty. Register-by-number: no identifying company/VAT number found anywhere for this domain or for Bounce Exchange/Wunderkind. RDAP/WHOIS history: registrant is privacy-proxied today (Contact Privacy Inc., Tucows), last changed 2026-08-15, with no un-redacted historical record available. Archived legal pages: the Wayback CDX index has zero captures of cdnbasket.net at any URL, ever. bouncee |
+| ''cdnbasket.net'' | Tracker Radar, Disconnect | TR: Bounce Exchange / DC: cdnbasket.net | All three routes came back empty. Register-by-number: no identifying company/VAT number found anywhere for this domain or for Bounce Exchange/Wunderkind. RDAP/WHOIS history: registrant is privacy-proxied today (Contact Privacy Inc., Tucows), last changed 2026-08-15, with no un-redacted historical record available. Archived legal pages: the Wayback CDX index has zero captures of cdnbasket.net at any URL, ever. bounceexchange.com does 302 to wunderkind.co, and Wunderkind's own privacy policy (fetched, quoted above) confirms 'Wunderkind Corporation' as a real live entity, but nothing there or in its cookie policy names cdnbasket.net, so the tie to Bounce Exchange/Wunderkind stays an unconfirmed lead, not a resolution. |
-| ''mapixl.com'' | Disconnect | DC: MarketingArchitects | All three routes tried and none produced an identifier for the actual operator, let alone one naming 'MarketingArchitects'. register-by-number: no imprint/legal page exists anywhere to pull a company number from. rdap-history: re-queried whois.godaddy.com by socket myself this session -- registrant is 'Domains By Proxy, LLC', an explicit privacy proxy, which the brief excludes as a domain-register source; DNS is Clou |
+| ''mapixl.com'' | Disconnect | DC: MarketingArchitects | All three routes tried and none produced an identifier for the actual operator, let alone one naming 'MarketingArchitects'. register-by-number: no imprint/legal page exists anywhere to pull a company number from. rdap-history: re-queried whois.godaddy.com by socket myself this session -- registrant is 'Domains By Proxy, LLC', an explicit privacy proxy, which the brief excludes as a domain-register source; DNS is Cloudflare-fronted (104.21.x/172.67.x, no MX, TXT is an opaque verification hash) with no organizational signal. archived-legal: Wayback CDX for mapixl.com shows only redirect/revisit captures back to 2019; the one distinct body I could fetch (20230420115444id_) turned out to be a Microsoft Azure AD sign-in page, unrelated to any ad-tech company and not a legal page. Live fetch returns a Cloudflare JS-challenge page (HTTP 403, title 'Attention Required! %%|%% Cloudflare'). No route ties this domain to MarketingArchitects or to any other named entity; left unresolved as instructed. |
-| ''htplayground.com'' | Disconnect | DC: htplayground.com | register-by-number: Disconnect's own entry is just the domain string, so there is no candidate company name to get an identifier for. rdap-history: rdap.org has no RDAP service for this registrar; registry WHOIS is thin, and the registrar-side WHOIS (whois.registrar.amazon) shows a proxy registrant ('c/o whoisproxy.com', 604 Cameron Street, Alexandria VA -- a known privacy-proxy mail-drop address), no real organisati |
+| ''htplayground.com'' | Disconnect | DC: htplayground.com | register-by-number: Disconnect's own entry is just the domain string, so there is no candidate company name to get an identifier for. rdap-history: rdap.org has no RDAP service for this registrar; registry WHOIS is thin, and the registrar-side WHOIS (whois.registrar.amazon) shows a proxy registrant ('c/o whoisproxy.com', 604 Cameron Street, Alexandria VA -- a known privacy-proxy mail-drop address), no real organisation. archived-legal: the domain has real Wayback history, but it is a personal phpBB forum from 2007-2008 ('H.T Playground', self-described as a hangout for Vietnamese Catholic youth-group members, TNTT/Huynh Truong) -- not a company, and a CDX search across the whole path space found zero privacy/legal/terms/about captures at any point in the domain's history. Domain is currently fully dead (no TLS handshake, no HTTP response). No route produced a real company; unresolved, same as the first pass. |
-| ''contentabc.com'' | Tracker Radar | TR: Aylo / DC: ContentABC | Register-by-number: no imprint, VAT, or company number for either candidate ('Aylo'/Ethical Capital Partners or a literal 'ContentABC') is attached to this domain anywhere I could find, so there is no number to look up. RDAP/WHOIS history: registrant is fully proxied via 'Whois Privacy (enumDNS dba)' in Luxembourg through EuroDNS S.A.; no organization ever disclosed; creation date 2009 does not narrow the candidates. |
+| ''contentabc.com'' | Tracker Radar | TR: Aylo / DC: ContentABC | Register-by-number: no imprint, VAT, or company number for either candidate ('Aylo'/Ethical Capital Partners or a literal 'ContentABC') is attached to this domain anywhere I could find, so there is no number to look up. RDAP/WHOIS history: registrant is fully proxied via 'Whois Privacy (enumDNS dba)' in Luxembourg through EuroDNS S.A.; no organization ever disclosed; creation date 2009 does not narrow the candidates. Archived legal pages: the mechanical probe's Wayback CDX shows zero captures for legal pages, root, or the URL inventory. contentabc.com itself does not resolve from this sandbox (HTTP 000), and a web search for "contentabc.com" together with Aylo/MindGeek returned no corroborating primary source. Disconnect's 'ContentABC' is just the domain label capitalised with no independent evidence behind it. |
-| ''stat-track.com'' | Disconnect | DC: StackTrack | All three routes were tried. Register-by-number: Disconnect's 'StackTrack' is not a findable real company, and a GitHub-issue claim of Moosend ownership could not be verified -- Moosend's own privacy, cookie and terms pages (all fetched) never mention stat-track.com. RDAP/WHOIS history: rdap.verisign.com (queried live, quoted above) returns only a registrar (MarkMonitor) entity with no registrant object at all -- ful |
+| ''stat-track.com'' | Disconnect | DC: StackTrack | All three routes were tried. Register-by-number: Disconnect's 'StackTrack' is not a findable real company, and a GitHub-issue claim of Moosend ownership could not be verified -- Moosend's own privacy, cookie and terms pages (all fetched) never mention stat-track.com. RDAP/WHOIS history: rdap.verisign.com (queried live, quoted above) returns only a registrar (MarkMonitor) entity with no registrant object at all -- full redaction, domain re-registered 2016-02-02. Archived legal pages: Wayback's CDX index only has captures from 2002-2011 of a self-hosted Prosper202 affiliate-tracking install, which entirely predates the 2016 re-registration and cannot speak to who holds the name now; nothing has been captured since. |
-| ''mmstat.com'' | webXray | wx: Alimama / TR: Alibaba Group / DC: AlibabaGroup | Register-by-number: tried China's official ICP/beian registry at beian.miit.gov.cn directly -- it returned HTTP 521 behind a JS/cookie challenge I could not solve with curl. A third-party ICP lookup aggregator (icplishi.com; not an accepted source, same category as a WHOIS aggregator) suggests the beian filer is an 'Alibaba (China) ... Co., Ltd.' entity, but this is an unverified lead, not admissible evidence, so it  |
+| ''mmstat.com'' | webXray | wx: Alimama / TR: Alibaba Group / DC: AlibabaGroup | Register-by-number: tried China's official ICP/beian registry at beian.miit.gov.cn directly -- it returned HTTP 521 behind a JS/cookie challenge I could not solve with curl. A third-party ICP lookup aggregator (icplishi.com; not an accepted source, same category as a WHOIS aggregator) suggests the beian filer is an 'Alibaba (China) ... Co., Ltd.' entity, but this is an unverified lead, not admissible evidence, so it is not used as a verdict basis. RDAP/WHOIS history: 'Alibaba Cloud Computing (Beijing) Co., Ltd.' in the WHOIS record is the REGISTRAR (whois.verisign-grs.com and grs-whois.hichina.com both confirm this), not a Registrant Organization -- no registrant org line is present at all, only province 'zhe jiang' and country CN. Archived legal pages: Wayback shows only sparse root captures from 2004-2016 (mostly 404 after 2016) and zero legal-page captures. Also tried mmstat.com live (HTTP 000, no connection) and Alibaba Group's/Alibaba.com's own live privacy pages (rule.alibaba.com/rule/detail/2034.htm, alibabagroup.com/en-US/privacy-policy) via curl -- neither mentions mmstat.com. |
-| ''collective-media.net'' | webXray | wx: Collective / TR: Collective, Inc. / DC: Collective | Tried all three routes. Register-by-number: SEC EDGAR full-text search for '"Collective, Inc." advertising' returns 424 hits but none for the ad-network Collective, Inc. (it was VC-backed/private, never an SEC filer) -- no identifier to look up. RDAP/WHOIS history: re-queried whois.godaddy.com this session; Registrant Organization is 'Domains By Proxy, LLC', a proxy, not acceptable per the domain-register rule. Archi |
+| ''collective-media.net'' | webXray | wx: Collective / TR: Collective, Inc. / DC: Collective | Tried all three routes. Register-by-number: SEC EDGAR full-text search for '"Collective, Inc." advertising' returns 424 hits but none for the ad-network Collective, Inc. (it was VC-backed/private, never an SEC filer) -- no identifier to look up. RDAP/WHOIS history: re-queried whois.godaddy.com this session; Registrant Organization is 'Domains By Proxy, LLC', a proxy, not acceptable per the domain-register rule. Archived legal pages: the CDX inventory has no privacy/terms/about capture; the one 'root page' capture that returns 200 is contaminated with Internet Archive's own Petabox/search-portal HTML rather than the actual site (an IA artifact), so it establishes nothing. webXray/TR/Disconnect's 'Collective' claim (matching the once-real ad network Collective, Inc.) could not be confirmed or refuted for who holds the domain today; stays unresolved. |
-| ''hqseek.com'' | Tracker Radar | TR: Michal Vodrazka | All three routes tried. register-by-number: no imprint or identifiable number anywhere; the domain redirects to an adult site (hqporn.pics) which per content policy I did not fetch further. rdap-history: RDAP has no JSON endpoint for this domain; the two-hop WHOIS in the probe shows only registrar DNC Holdings/DirectNIC and registrant 'Jewella Privacy LLC' (a privacy service), no unredacted organization. archived-leg |
+| ''hqseek.com'' | Tracker Radar | TR: Michal Vodrazka | All three routes tried. register-by-number: no imprint or identifiable number anywhere; the domain redirects to an adult site (hqporn.pics) which per content policy I did not fetch further. rdap-history: RDAP has no JSON endpoint for this domain; the two-hop WHOIS in the probe shows only registrar DNC Holdings/DirectNIC and registrant 'Jewella Privacy LLC' (a privacy service), no unredacted organization. archived-legal: fetched the earliest available capture with content (2004-04-04, an adult-directory page even then) and its meta tags read 'copyright: Miguel Bain' / 'author: Miguel Bain' -- a real named individual, but a DIFFERENT name from Tracker Radar's claimed 'Michal Vodrazka', and there is a 20+ year gap with a privacy-proxied registrant in between, so this cannot be bridged to a verdict about today. Flagging the tension: TR's specific personal-name claim does not match the only name this domain's own pages have ever surfaced. |
-| ''stripst.com'' | Disconnect | DC: Stripchat | Register-by-number: no imprint or company number is available anywhere for stripst.com, and nothing on the domain or Stripchat's reachable pages names an operating legal entity, so there is no number to look up. RDAP/WHOIS history: registrant is fully proxied ('Withheld For Privacy LLC', Delaware) via NameCheap; the mechanical probe's RDAP lookup also failed; TLS is a domain-validated Google Trust Services cert with  |
+| ''stripst.com'' | Disconnect | DC: Stripchat | Register-by-number: no imprint or company number is available anywhere for stripst.com, and nothing on the domain or Stripchat's reachable pages names an operating legal entity, so there is no number to look up. RDAP/WHOIS history: registrant is fully proxied ('Withheld For Privacy LLC', Delaware) via NameCheap; the mechanical probe's RDAP lookup also failed; TLS is a domain-validated Google Trust Services cert with no O= field, so no organization there either. Archived legal pages: the mechanical probe confirms zero Wayback captures of stripst.com itself (root, legal, and inventory all empty). I additionally tried Stripchat's own live /privacy, /terms and /legal pages hoping to find a parent-site mention of stripst.com, but all three returned HTTP 406 (bot-blocked) to curl; stripst.com itself, cdn.stripst.com, and www.stripst.com all return HTTP 000 (no connection) from this sandbox. Disconnect's 'Stripchat' claim is plausible (third-party scan data and CT-log subdomain names like cdn.stripst.com are consistent with Stripchat infrastructure) but remains unverified against a primary source. |
 Two obstacles are worth naming for anyone attempting this again:
@@ Line 694: / Line 716: @@
   * **Three sub-agents could not re-issue a port-43 query themselves** (this sandbox's ''curl'' has no ''whois://'' support and ''bash'' has no ''/dev/tcp'') and relied on the probe's already-fetched WHOIS text, disclosing it per row. Every such citation was independently re-fetched by ''owner_verify_sources.py'' afterwards, which is what closes that gap.
   * **''cratecamera.com'' and ''sa-as.com'' rest on an uncorroborated registrant organisation** and nothing further could be found for either: Admiral publishes no allowlist of its own domains, and no Foundry page names ''sa-as.com''. They are in the sensitivity run for that reason.
+==== L.9 Reviewers, and what each one was worth ====
+All four told explicitly that the author's context may not be exhaustive, all
+handed the page text, the scripts, their unedited output and these notes. The
+three focused passes ran in parallel against a bundle cut at 19:21; the generic
+pass ran afterwards against the pages as the first three had left them.
+=== Findings accepted ===
+^ Pass ^ Finding ^ What was done ^
+| figures vs script | ''added 14 rows to webXray, 15 to Tracker Radar'' — the recovered counts are **7 / 9 / 12**. 14 and 15 match no quantity in the data | **Accepted, and it is the author's own fabrication.** Corrected. |
+| figures vs script | the same sentence mixes conventions: ''9 of Disconnect's 12 were current … against 41 of its previous 42''. 41/42 is current+granularity; against a current-only numerator the comparable figure is **39 of 42** | Accepted; rewritten to name the convention. |
+| figures vs script / citations / generic | both guards assert a correct figure is **present** and neither asserts a superseded one is **absent**, so the headline box could carry the old rates with both exiting 0 | **Accepted and closed with code.** ''check_tail_figures.py'' gained section G; three mutations that reintroduce a superseded rate were added to the harness. |
+| figures vs script | the ''whois://'' retry runs on a short response but returns on the first raised **exception**, contradicting its own comment | Accepted; fixed, and the failure path exercised by hand. |
+| citations | ''adj_rows_tail_final.json'''s ''i.ua'' row still carried the adjudicator's superseded "error" reasoning beside a ''current'' verdict | Accepted; note rewritten, superseded text kept, marked as superseded. |
+| citations | ''offshoregeology.com'''s note flags a WHOIS line the adjudicator could not re-fetch; this sandbox can | Accepted; gap closed in the note, and the reviewer reproduced it independently. |
+| external currency | **Disconnect's ''entities.json'' has not changed since 2026-08-07**; the 2026-09-05 commit the page cites touched ''services.json'' | **Accepted, verified independently before acting**: ''commits?path=entities.json'' → ''ab6ff5a3a8'', 2026-08-07; repo HEAD ''4b592c288a'', 2026-09-05; the three raw files are byte-identical (412,191 bytes, same MD5). Both places on the content page corrected, with the query in a footnote. |
+| external currency | the RDAP-vs-registrar claim is stated as a general rule; it holds only where the registrant has not bought privacy, and that is per-registration, not per-registrar | **Accepted, reproduced**: ''whois.tucows.com'' returns ''Contact Privacy Inc. Customer 0168237798'' for ''cdnbasket.net'' while returning real organisations for others. §L.2 qualified, and the generator too. |
+=== The generic pass, which had no checklist and found the most ===
+It ran after the three focused ones, against the pages as they had left them,
+and it returned 15 findings. **Fourteen were accepted.** Two of them changed
+what the page claims, and both were things all three focused passes and the
+author's own site-wide sweep had read past.
+| # | Finding | What was done |
+| 1 | **The overturned headline is a fact about one metric and the page never said which.** All three pairwise tests were published on ''current'' only. On ''current+granularity'' — which the page itself says is right when the unit is "which company" — both Disconnect comparisons clear Bonferroni, before *and* after, so the second pass overturns nothing there. Worse: ''report_tail_pass.py'' tested ''current+granularity'' in section B and ''current''-only in E2, each the choice that made its own claim mildest, and disclosed neither | **Accepted; the most consequential finding of the sitting.** Reproduced independently before acting: 52/54 vs 44/56 → *p* = 0.008, 52/54 vs 43/56 → *p* = 0.004; before, 0.010 and 0.004. Sections B and E2 now print **both** metrics and say why; the Fisher table on the page carries both; the recommendation and the short answer name the metric each claim belongs to |
+| 2 | **"All four errors were found by the second pass" is false.** ''elfsight.com'' was Tracker Radar's one ''error'' before it | Accepted. Three are new. Corrected on the content page and on ''provenance:programming:crawler:webxray'' |
+| 3 | The short answer's "no longer clears" implies Disconnect-vs-Tracker-Radar was once significant. It never was — 0.025 before, against a threshold of 0.0167 | Accepted; rewritten to say it never cleared it |
+| 4 | Disconnect's only ''error'', ''km0trk.com'', is a **scoring decision on a bare-label entry** presented as the same kind of failure as a law-firm attribution — and the rule that separates it from ''i.ua'', scored the other way, is nowhere on the page. The remaining Disconnect residue is enriched for that class, which bears on the worst-case bound | Accepted in both halves. The rule is now stated (is the label a brand the operator's own documents use for the property?), with the admission that a reasonable person would score it the other way. The residue enrichment is verified from the §L.7 table — **3 of Disconnect's 6 remaining rows**: ''cdnbasket.net'' and ''htplayground.com'' are the bare domain string, ''stat-track.com'''s "StackTrack" is not a findable company — and said on the page next to the bound |
+| 5 | **The published sensitivity run covers 2 of the 11 rows that rest on the new bar**, and the ''i.ua'' alternative reading that the published correction log promises "the sensitivity run reports" was never computed | **Accepted.** E3 now has three runs: the original 2-row one, the **same-bar** run that drops all 11 (webXray 69.2%, Tracker Radar 72.1%, Disconnect 89.0% — the result does not depend on the widened bar), and the ''i.ua'' alternative (Disconnect 88.6%). All three are on the page and all three are asserted by the figure guard |
+| 6 | "Indistinguishable for the other two" is exactly the interpretation §L.8 says the p-values cannot bear | Accepted; the summary now says nothing here establishes that the tail was worse for any list, and names the metric dependence |
+| 7 | The residue is described as evidence-exhausted; two rows are **adjudicator limits**, not evidence limits, and every "why it is still unresolved" cell was **cut at 420 characters mid-word**, so "every route tried" was not checkable | Accepted in both halves. ''hqseek.com'' (adjudicator declined a live adult redirect on content policy, and its note records a possible ''error'' nobody ran down) and ''stripst.com'' (HTTP 406 to every non-browser fetch) are now named as limits of this pass. The truncation is removed from the generator, so §L.7 carries the notes in full |
+| 8 | The new section never says **who adjudicated the second pass** | Accepted. §I of this page records dropping that disclosure as the worst finding of the previous sitting, so this is a repeat. The content page now says: Sonnet sub-agents, one rater per domain, no inter-rater agreement measured for this pass |
+| 9 | **The largest single movement of the pass is absent from the content page**: Tracker Radar encounter-weighted 68.6% → 74.3%, almost all of it one row (''spot.im'', prevalence 0.011) — the column the page calls "the number a paper's attribution error depends on" | Accepted; a row added to the before/after table and a sentence to the prose |
+| 10 | "29 of the 525 verdicts were changed" predates this sitting's own ''i.ua'' rescore | Accepted; 30 now, split by date |
+| 11 | Stale limit bullet on ''provenance:programming:crawler:webxray'': "n is 42–49 per list … 69.9 vs 73.7" | Accepted. Now 54–56 and 69.2 vs 73.9, with the Fisher *p*. **The sweep could not see it because neither figure carries a ''%''** — recorded in the bullet itself |
+| 12 | §L.2's "the registrar hop did most of the work" disagrees with the ''owner_tail_merge.py'' output published two sections below (9/13 against 10/12) | Accepted; the difference is the ''i.ua'' correction moving one row's route, and §L.2 now says its counts are post-correction and the appendix output is not |
+| 13 | Two published scripts print different 95% intervals for the same estimate, under a claim of "imported, not reimplemented" | Accepted. The intervals are **removed** from ''report_tail_pass.py'''s output rather than reconciled: its bootstrap draws from a shared generator, so an identically seeded re-run legitimately differs. The estimator's own output remains the only source for intervals, and the script now says so |
+| 14 | Three prose misstatements: "changed the answers more than it changed the rows" (28 of 40 rows changed); "narrower rather than tighter" (synonyms); "the highest and by the widest margin" (unclear) | **Two accepted, one rejected.** The first is rewritten to the actual quantity (23% of draws → 7.8%); the second is rewritten. The third is left: in a bullet that has just given both rates, "highest and by the widest margin" reads plainly, and rewording it costs more than it buys |
+| 15 | ''report_tail_pass.py'''s docstring shows a pre-corrections input file, so copying it reproduces a Disconnect with two ''error''s | Accepted; docstring fixed to the file the published run used |
+**What this pass cost and what it bought.** It was the only one of the four to
+question the *choice of metric* rather than the arithmetic within one, and that
+question changed the page's headline claim from "the second pass overturned
+Disconnect's lead" to "it overturned a legal-entity-level lead over a list this
+page calls historical, and cost it nothing at the company level". The three
+focused passes checked every number against the script and found the script's
+own metric switch invisible, because each number was right for the metric its
+section used. **A checklist cannot find a framing defect**; this is the
+strongest evidence so far that the generic slot earns its place.
+=== Findings recorded as already-fixed (stale bundle) ===
+Three of the four passes independently reported that the content page's
+''%%<WRAP important>%%'' "short answer" box still carried **94.4% / 73.7% / 93.9%**.
+It did when their bundle was cut at 19:21. A site-wide sweep
+(''scripts/sweep_moved_figures.py'') had found and fixed it at 19:28, along with
+three more the first patch missed. **The finding was right and the bundle was
+stale** — the same trap this wiki has recorded before. Two of the four passes
+also named the ''%%<WRAP todo>%%'' that still asked for the thing this sitting did;
+that one was **not** yet fixed and has been.
+=== A second sweep, after the generic pass's fixes were published ===
+''sweep_moved_figures.py'' was re-run over a **fresh export of all 182 pages**
+taken after publishing, with five pairs added for figures that carry no ''%'' —
+the class the generic pass showed the sweep was blind to (''42–49''→''54–56'',
+''69.9 vs 73.7''→''69.2 vs 73.9'', ''29 of the 525''→''30 of the 525'',
+''All four were found'', ''9 of 13''→''10 of 12'').
+**69 suspect lines, 68 legitimate and one real.** The content page's
+methodology bullet still said **"29 of the 525 verdicts were changed"**: the
+page carried that figure **twice**, round four fixed the copy in the section it
+was editing, and ''check_tail_figures.py'' could not see the other because it
+asserts a figure is *present* and a correct copy was. The other 68 are
+before/after columns, the published mutation harnesses' own output, the
+-09-05 estimator run this family deliberately preserves as the "before",
+and one coincidental match on an unrelated rater-agreement figure.
+Closed with code rather than with an edit: the guard now derives the total from
+''owner_tail_corrections-output.txt'''s own ''actions: ... rescore=N'' line plus the
+first sitting's 29, asserts both that the right value is present and that the
+superseded one is absent, and the mutation harness reverts **one** copy to prove
+it bites. Control: run against the pre-fix export, it fails on exactly that
+line.
+**This is the same shape as the defect three reviewers found earlier in the
+sitting** — a presence check blessing a page with one stale copy — and it
+recurred inside the fix for it. The harness header now states the limit plainly
+and points at the sweep as the tool that covers it.
+=== A third sweep, and the last two stale figures ===
+Re-run once more over a fresh export after publishing the guard fix. **68 hits,
+all legitimate except two**, both on ''provenance:programming:crawler:webxray''
+and both in the //judgement calls// section written by the 2026-09-05 sitting:
+  * "webXray at 69.9% domain-level and 93.9% encounter-weighted" — stated in the present tense about figures that are now 69.2% and 93.8%;
+  * "93.9% encounter-weighted is a flattering number … and Disconnect is better on the measured axis anyway" — the second clause is now **metric-dependent**, which is the finding the generic pass produced two sections above.
+Both were **dated rather than refreshed**: a record of a judgement made on a
+particular day should keep the figures it was made on. Each now carries the
+-09-11 value beside the 2026-09-05 one, and the "better on the measured
+axis" claim names both metrics and both p-values.
+The remaining 66 were read and are all one of: a //before// column, a
+struck-through open question quoting its own superseded text, a reviewer-log
+entry quoting the old page, the published mutation harnesses' own output, a
+''-'' line in the committed unified diff, the 2026-09-05 estimator run that
+''provenance:programming:crawler:webxray:random_sample'' exists to preserve, and
+one coincidental match of an unrelated inter-rater figure (76.5%).
+**Three sweeps were needed and each found something the one before did not**,
+because each round of edits moved figures the previous pair list did not name.
+The pair list is now 28 entries and is committed at ''out/moved_figures.json'';
+the next sitting should extend it rather than rebuild it.
+=== Nothing found in ===
+Fisher's exact (independently reimplemented: 0.031 / 0.083 / 0.831, matching);
+the eligibility rule (read against the estimator's, equivalent, and asserted at
+runtime); the worst-case convention; the raw-count arithmetic; the source-kind
+split (9 / 2 / 17, recomputed from the rows); the reproducibility of every
+committed output; citekeys (22, all resolving once against a freshly fetched
+bibliography, none added); **all 28 recovered citations re-fetched and verified
+verbatim by a second party**; the three ''error'' verdicts, each re-derived from a
+primary source; the ''i.ua'' override, judged substantively right by an
+independent read of the surrounding agreement text.
 ===== J. scripts/report_ownership_resolution.mjs, in full =====