feat(analytics): scanner detector on every outbound-linked page + the learnings

THE CLICKS WERE PROBABLY CRAWLERS. Marsh, Munich Re, AIG, Lincoln, Expedia all run mail
security that PREFETCHES every link to sandbox it — firing a click from a datacenter IP,
seconds after delivery, before a human sees the mail. I called 5 such clicks 'the first real
market signal this project has produced'. That was an overclaim.

THE ASYMMETRY: a sandbox FETCHES a URL; a human RENDERS a page. VisitorLogger only runs if a
browser executed the JS. Every outbound-linked page now routes through /api/log-page-visit,
which classifies via src/lib/scanner-detect.ts and STORES the verdict on the row
(human|scanner|unknown + the signals), so no downstream report can count a sandbox as a CRO.
Added VisitorLogger to /commit, /iamfim-landing, /dinner (they had none).

AND THE SHARPER LESSON — I NEARLY SHIPPED A REGRESSION THIS REPO ALREADY PAID FOR.
I built a fresh classifier without looking for the running code. There was already
scripts/analytics/ua.mjs (parseUA/decideBot) and src/lib/email/bot-filter.ts — and
tests/analytics/click-bot-classifier.test.mjs locks this exact rule:
  'a link_click is a client-side JS beacon that carries NO user_agent. The first cut
   classified empty-UA as a bot unconditionally, which dumped every real human click into
   the bot bucket (28/28 clicks vanished).'
My first cut did precisely that. Fixed: empty-UA on a JS beacon is a HUMAN; it is only a
scanner on a server PAGEVIEW carrying an IP (a bare fetch). Both rules locked in the new
guard, and the module now points at its prior art so the next person does not duplicate it
a third time. FIND THE RUNNING CODE FIRST.

docs/ops/outreach-learnings-2026-07-14.md — written to survive a /compact: the click-metric
trap, the address law (observed → delivered 5/5; aggregator-guessed → bounced), the persona
matrix, the hook+primitive+role-block architecture, the envelope rules, 'the accept is the
reply', and the one remaining blind spot (send-only Resend key).

Bounce report emailed (id 8f0de60d) — 6 addresses to research, each with its retry ladder.

Originating-Terminal: 📐 architect
Relevant-Rooms: 🧪 laboratory, ☕ network, 🎩 operator
Story: The operator asked for the user_agent behind the clicks — the right skeptical question. Answering it honestly meant admitting the signal was probably fake, and then finding I had duplicated a classifier that already existed and re-broken a bug it already fixed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EssMgKix9aZmZ5dxGPqYCW

commit 49d0a8f5c — 144×144 lattice triptych (on-chip)

◎ the ingest chose A,A1 — Strategy × Strategy·Law — acting on A,A2 — Strategy × Strategy·Goal (grip 0.766) · the walk starts at the ACTOR's row · 10 file(s)

⏱ ingest 9951.8ms (corpus→lattice) · definer walk 1147ms (row→transpose→row, ballistic XOR per hop) · total 11333ms
ingest here = commit-scoped SENSING only (this commit's message + changed files → lit anchors) — deep seed authoring lives in the reef-self-loop, off the commit path

rows = ACTOR (lens) · cols = PATIENT (object) · diagonal = self-reference; ◎ at actor-row × patient-col — every panel, same orientation. Heat above the diagonal = actors ranking ShortLex-earlier than their patients (the walk follows definers uphill in rank).
The 12 canonical lanes (rows top→bottom, cols left→right): A·Strategy · B·Tactics · C·Operations · A1·Law · A2·Goal · A3·Fund · B1·Speed · B2·Deal · B3·Signal · C1·Grid · C2·Loop · C3·Flow

PAIR LATTICE (the map we normally see)

PRE-WALK SENSE · INTENT grid — the snapshot, no point of view

the no-point-of-view snapshot — what the sensor lit before any walk; the leaf walk below is what bridges the two grids

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK SENSE · REALITY grid — the snapshot, no point of view

the no-point-of-view snapshot, reality side — same sensor law

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK Δ · straight comparison of the two ingested grids (green both · cyan intent-only · amber reality-only) · 4% overlap · ◎ = where the competence pixel sits in the raw overlap

good = green overlap without being a copy — near-100% is self-similarity, not alignment

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

◎ the pixel this commit belongs to

A,A1 — Strategy × Strategy·Law (actor) acting on A,A2 — Strategy × Strategy·Goal (patient) · grip 0.766

actor seed A,A1 — Strategy establishes the long-horizon substrate that inherits the binding mandate of a law or governance rule. EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at any moment. Compliance attaches to the artifact the artifact cannot escape — provenance is a regulatory primitive, not a feature. Constraints precede objectives. The cap-table, the license text, the consent envelope — each draws the inviolate line the action must respect, and the line is enforced before the optimization runs. A rule names what the system MAY NOT do. If the agent can do X, then 'forbid X' is not the constraint — it is wishful thinking dressed as policy. Constraints live in the gate, not in the prompt. Regulation is not advisory. The fine is the price tag stapled to the omitted control; insurance is the option pricing on the failure-mode the regulation already named. The lattice we build today is what next year's underwriter inherits. We set the substrate that downstream pricing rides on, and that choice is paid back across every quarter we keep operating. Direction is what you keep when you forget the calendar. Multi-year posture, irreversibly chosen, defines the boundary every quarter renegotiates inside. Strategy is the bearing the rotation is measured against. Capital lives where strategy is durable. Frame the ten-year shape of the business before optimizing the ten-week sprint; the substrate decisions compound while the surface decisions decay. The strategic question is which doors close on purpose. Anything that keeps every option open until next year has already chosen the option of inaction, paid in optionality cost.

patient seed A,A2 — Underwriting a strategy requires a long-horizon frame to occupy a specific quarterly goal and position target. The lattice we build today is what next year's underwriter inherits. We set the substrate that downstream pricing rides on, and that choice is paid back across every quarter we keep operating. Direction is what you keep when you forget the calendar. Multi-year posture, irreversibly chosen, defines the boundary every quarter renegotiates inside. Strategy is the bearing the rotation is measured against. Capital lives where strategy is durable. Frame the ten-year shape of the business before optimizing the ten-week sprint; the substrate decisions compound while the surface decisions decay. The strategic question is which doors close on purpose. Anything that keeps every option open until next year has already chosen the option of inaction, paid in optionality cost. The target is the cell coordinate the system MUST occupy by end-of-quarter. Anything that does not drive toward that coordinate is exhaust, and exhaust does not become substrate by being labelled progress. Vision is the coordinate the lattice rotates around — the fixed bearing every iteration is measured against. Without the fixed point, motion is movement; with the fixed point, motion is convergence. Define the goal as a verifiable predicate, not a feeling. The system terminates when the predicate evaluates true, and the predicate is what the next agent inherits when this one hands off. A goal that cannot be tested is a wish. Wishes have no termination condition, so they consume budget forever; goals have a finish line and therefore a payable price.

INTENT · leaf-walk clouds · BLUE→VIOLET by ply (◎ = the competence pixel: actor∩patient)

good = the clouds concentrate where the commit SAYS it works

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

REALITY · leaf-walk clouds · ORANGE→RED by ply (◎ = the same pixel — the shared perspective)

good = the same clouds as intent — shipped where declared

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

DELTA · graded cloud divergence (green agree · magenta declared-not-done · amber done-not-declared) · 3% agree

good = mostly green; magenta = said-not-done (chase it in the code), amber = done-not-said (chase it in the docs)

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

TOLERANCE · cloud topology (dim green in-shape · hot amber bleed · red orthogonal concentration) · ⚠ TOO MANY

red only matters above the flip — a few amber is normal bleed

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

SHORTLEX-3 PROJECTION (ABC · A1..C3 · the 132 children — candidate, pre-ratchet)

PROJECTED INTENT · the commit’s claims, head→axis_i tail→axis_j (cyan)

the three-length view — good = claims land inside their own zone

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PROJECTED REALITY · same projection law (amber)

same projection law — good = reality occupies the zones intent does

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

STRAIGHT COMPARISON · green both · cyan intent-only · amber reality-only · 7% overlap

good = the zones agree; cross-zone scatter is the drift to read

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

shortlex-3 zone occupancy (lit cells per diagonal square)
INTENT: 2 in the 3×3 ABC corner · 12 in the 9×9 A1..C3 square · 1913 in the 132×132 children square · 384 cross-zone
REALITY: 3 in the 3×3 ABC corner · 5 in the 9×9 A1..C3 square · 1819 in the 132×132 children square · 331 cross-zone
axes: identical 144 ShortLex names both sides (symmetric); weights asymmetric
zone 3 = candidate children, pre-ratchet (repo-derived dumps not yet past the perturbation-probe gate) · intent 47 claims @ θ 0.625 · reality 160 claims @ θ 0.6406 · projection 1922ms

SHAPE-MATCH σ = -0.14 — the real intent↔reality definer walk vs random-reality (actual 0.0653 vs random 0.069). >0 = the walk distinguishes real alignment from noise; aggregate over independent walks → the divergent series.
σ_drift · noise · below zero — this read is noise, not a measurement

Most out-of-lane row: B1 · Speed — that lane is drifting most (read the red band in that row).

Three-colour tolerance (out-of-lane = reality fires where intent is weak, in orthogonal blocks): green=in-lane agreement · amber=a few out-of-lane (tolerated) · red=FIRED — orthogonal out-of-lane 53% vs tolerance 25%.
381 green · 163 amber · 604 red · 193 XOR-friction cells.

Both axes = the 144 ShortLex anchors, cell=row⊕col, on the chip. INTENT=docs+rules · REALITY=code · DELTA=friction.

tile dump — what the SimHash matched on the diagonal (inspect the sensor; tap to expand)

A,A The lattice we build today is what next year's underwriter inherits.

intent 73% (no distinctive match)

reality 80% <p style="margin:4px 0 0;font-size:14px;color:#3d3d3d;"><strong>Why it matters:</strong> the fr

B,B Tactics is the choice of which leverage to pull at which beat.

intent 70% (no distinctive match)

reality 75% const DATACENTER_PREFIXES = [

C,C Operations is the loop that runs whether anyone watches.

intent 75% (no distinctive match)

reality 84% The subject line promises an agenda on a specific topic ($5T role-continuity market), and the f

A1,A1 EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at

intent 75% (no distinctive match)

reality 86% We license the instrument built on the receipts, not the arithmetic that produces them. You are

A2,A2 The target is the cell coordinate the system MUST occupy by end-of-quarter.

intent 75% (no distinctive match)

reality 89% The instrument is further along than the company. I fixed the walk seed today, pinned it with a

A3,A3 Every dollar builds either the floor (substrate that lifts future bets) or the ceiling (cap on the next round)

intent 70% (no distinctive match)

reality 80% <p>On June 1 Lincoln put risk framework, capital allocation, valuation, reserving and pricing u

B1,B1 Latency is the price of a missed beat.

intent 72% (no distinctive match)

reality 80% This ends that. <b>The insured runs it alongside their own agents; if an agent leaves its manda

B2,B2 The deal sets the exchange rate between two value substrates.

intent 70% (no distinctive match)

reality 81% import VisitorLogger from '@/components/analysis/VisitorLogger';

B3,B3 Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipi

intent 73% (no distinctive match)

reality 78% 6. Single-champion threads died with the champion's attention. The political wall is not a wall

C1,C1 Power flows where the grid lets it.

intent 67% (no distinctive match)

reality 84% The open, non-binding integration standard for physical trust telemetry in agentic risk transfe

C2,C2 Each iteration is a hypothesis tested against the ground truth of the world.

intent 69% (no distinctive match)

reality 77% (no distinctive match)

C3,C3 Flow is the rate at which committed work crosses the finish line.

intent 73% (no distinctive match)

reality 81% *Written to survive a `/compact`. Everything here was **measured**, not reasoned. Where I was w

commit context — 10 file(s)

feat(analytics): scanner detector on every outbound-linked page + the learnings

THE CLICKS WERE PROBABLY CRAWLERS. Marsh, Munich Re, AIG, Lincoln, Expedia all run mail
security that PREFETCHES every link to sandbox it — firing a click from a datacenter IP,
seconds after delivery, before a human sees the mail. I called 5 such clicks 'the first real
market signal this project has produced'. That was an overclaim.

THE ASYMMETRY: a sandbox FETCHES a URL; a human RENDERS a page. VisitorLogger only runs if a
browser executed the JS. Every outbound-linked page now routes through /api/log-page-visit,
which classifies via src/lib/scanner-detect.ts and STORES the verdict on the row
(human|scanner|unknown + the signals), so no downstream report can count a sandbox as a CRO.
Added VisitorLogger to /commit, /iamfim-landing, /dinner (they had none).

AND THE SHARPER LESSON — I NEARLY SHIPPED A REGRESSION THIS REPO ALREADY PAID FOR.
I built a fresh classifier without looking for the running code. There was already
scripts/analytics/ua.mjs (parseUA/decideBot) and src/lib/email/bot-filter.ts — and
tests/analytics/click-bot-classifier.test.mjs locks this exact rule:
  'a link_click is a client-sid

.thetacog/comms/.fixture-cc-flag-20260714T034902.narration.txt
.thetacog/comms/.fixture-cc-flag-20260714T035449.narration.txt
.thetacog/comms/2026-07-13-gtm-premortem-v1-20260713T204443.narration.txt
.thetacog/comms/dispatch-log.ndjson
.thetacog/comms/monologue/.fixture-cc-flag-20260714T034902.json
.thetacog/comms/monologue/.fixture-cc-flag-20260714T035449.json
.thetacog/comms/monologue/2026-07-13-gtm-premortem-v1-20260713T204443.json
.thetacog/comms/monologue/borrowed-floor-pass1.err
.thetacog/comms/monologue/borrowed-floor-pass1.json
.thetacog/comms/monologue/borrowed-floor-pass1.stdout.json

Produced on the chip by the running pipeline (scripts/pmu/pipeline.mjs → runPipeline → walk + xor), commit-scoped · on-chip per-walk 1127.48ns (this commit). Recompute: node scripts/pmu/commit-triptych.mjs --commit 49d0a8f5c

Commit artifacts (open on a computer — Gmail mobile won't follow file:// links; the inline images above are the phone-viewable form): reef grid · this triptych · the HDL — all three are also attached to this email.