# v1.9.87 - C2 corpus-mining batch 1

Track C, C2 (full-corpus fingerprint mining). First catalog-growth batch
sourced from a full-corpus gap-mining run rather than vendor-doc reading
(C1). Aggregate-only: the corpus, per-domain results, and the candidate
list stay in the gitignored `validation/corpus-private/` and
`validation/runs-private/` paths. Only counts, vendor names (detection
classes), and vetted patterns are recorded here. No real-company apex or
per-domain finding is committed.

## The run

- Corpus: 5,241 domains (the gitignored consolidated corpus).
- Mode: deterministic pipeline, concurrency 5, CT off (the nine Bayesian
  nodes are DNS / identity-fed, so a no-CT pass mines the gaps fully; CT
  feeds only the separate cert surfaces and is exercised in the C3
  calibration run instead).
- Health: 5,241 / 5,241 resolved, 3 input-error records (0.1%), well
  inside the concurrency-5 error budget. Zero JSON-parse failures.
- Gap mining: `find_gaps` surfaced 1,335 unclassified CNAME-terminus
  buckets; `triage_candidates` (min-count 3, intra-org drop on) reduced
  that to 30 triage-ready candidates.

## Triage outcome (30 candidates)

### Merged (5 vendors, 7 new `cname_target` patterns + 2 GovCloud regions)

All verified against public vendor documentation before merge. Committed
examples use the fictional brands; descriptions follow the humble-tone
rubric in `CONTRIBUTING.md`.

| Vendor | Slug | Pattern(s) | Category |
|---|---|---|---|
| Reblaze (Link11) | `reblaze` | `reblaze.com` | Cloud (WAAP front) |
| Indusface AppTrana | `indusface` | `indusguard.com`, `induscdn.com` | Cloud (WAAP front) |
| SharpSpring | `sharpspring` | `marketingautomation.services` | Marketing |
| HugeDomains (parked) | `hugedomains` | `hugedomains.com` | Infrastructure |
| AWS GovCloud ELB | `aws-nlb` (extended) | `elb.us-gov-east-1.amazonaws.com`, `elb.us-gov-west-1.amazonaws.com` | Cloud |

The two GovCloud regions extend the existing `aws-nlb` per-region ELB set
(commercial regions only until now); `us-gov-east-1` was observed in the
corpus and `us-gov-west-1` is seeded from the AWS GovCloud docs to close
the partition. The two WAAP fronts (Reblaze, Indusface) map to the Cloud
panel category and the multi-cloud rollup alongside their peer `imperva`.

Catalog: 829 to 833 entries.

### Excluded as not generalizable (about half the candidates)

The highest-frequency unclassified termini were org-internal
infrastructure, not third-party services: GSLB and load-balancer
hostnames published under an organization's own secondary domain
(seen across universities, health systems, banks, and large platform
operators), plus first-party hyperscaler properties where one of a
vendor's own brands CNAMEs into that same vendor's backbone. These are
correctly absent from the catalog: a `cname_target` rule must mark a
third-party service that distinct orgs point at, not a single org's own
internal plumbing. The `triage_candidates` intra-org filter caught most
of these; the first-party-hyperscaler cases were excluded by hand.

### Deferred pending verification (next batch)

Real third-party vendors, held back only until the canonical pattern is
confirmed or the false-positive risk is resolved:

- Claranet (`clara.net`): a short vendor domain with substring-match
  false-positive risk; confirm the canonical cross-region customer
  pattern before merge.
- Marketo landing pages: the observed terminus was Marketo's own
  first-party host, while the documented customer target is a different
  domain; needs a corpus-observed customer instance.
- Gamania CloudForce, BAMKO, SiteDetour, Turbify, ejoco: niche or
  single-org-in-corpus vendors; verify identity and generalizability.
- Edgio / `zetacdn.net`: the operator (formerly Limelight) wound down in
  2024; low value for a defunct CDN.

## Reading the merge rate

A 30-to-5 merge is expected for a mature catalog, not a coverage failure:
most surviving high-count gaps are org-internal GSLB endpoints that by
design never become fingerprints. The residual third-party gap is small
and concentrated in the deferred set above. The next C2 pass lowers the
min-count threshold and verifies the deferred vendors to push the
third-party residual lower still.
