The 89% the headline rate doesn't show.

verdict

distribution

count

%

93,666

1.46%

650,902

10.12%

1,962,203

30.51%

1,751,669

27.24%

1,601,139

24.90%

132,026

2.05%

239,310

3.72%

Exhibit B · the apex cell · z = 29σ above population baseline

Tension: H185 had inferred that publishers declaring IAB v1.1 OWNERDOMAIN / INVENTORYPARTNERDOMAIN would resolve cleaner. H186 refuted that — the cascade outcome correlates with SSP-count regime (bimodal), not with directive adoption. H187's per-cell resolution then surfaces this HuffPost-Yahoo case as direct counter-evidence: the publisher is a wholly-owned subsidiary of the SSP, the ownership relation is unambiguous, no directive is needed to declare it — and the cascade still fails. The break isn't in publishers neglecting to declare ownership. It's in the registries not reflecting the ownership relations the operators themselves already know.

Exhibit C · H188 · the second generator class

H189 update: when H188 first identified the BuySellAds Class-B pattern, it looked operator-specific. H189 cross-tabbed the apex tier (592 cells with n_direct ≥ 100 and impersonation rate ≥ 95%) against the 17,952 publishers who declare MANAGERDOMAIN, and found Class B (narrow) is 49.7% of the apex tier. bloxdigital.com (BLOX Digital, Lee Enterprises subsidiary NYSE:LEE) is 286 of 294 Class B-narrow cells. Three sampled BLOX customer ads.txt files (thegazette.com / fox21online.com / wdel.com) have byte-identical bloxdigital line blocks (Jaccard = 1.0000, 236 lines each); 195 lines appear across all 5 sampled BLOX customers.

H190 broader Class B: if the publisher declares any MANAGERDOMAIN (not just one matching the cell SSP), Class B rises to 63.5% of apex (376/592). Freestar 330 cells, all targeting bloxdigital.com — Freestar propagates the BLOX template into the BLOX-network publishers it co-manages. The remaining 36.5% Class A residual is the registry-mapping problem (HuffPost-Yahoo + yieldlove + stroeer + tail).

Registry reciprocity gap: per IAB v1.1, when publisher P declares MANAGERDOMAIN=M, M's sellers.json should list P as a seller. Of the 8 BSA-victim publishers, 5 declare MANAGERDOMAIN=buysellads.com while BuySellAds' sellers.json does not list them. The directive doesn't validate the template's content — and the manager's registry doesn't reciprocate the declaration.

Exhibit D · H190 · the bimodal split among managers

CafeMedia + Mediavine = 3,327 publishers · 0 apex cells at every threshold · ~60–70% cleanly disclosed. These are the counter-evidence that the IAB v1.1 spec scales. The cascade headline (30.51% phantom, 88% non-validating DIRECT) is the average; the hygienic-vs-template-paste manager split shows the population is not uniformly broken. H193 finding: 83 of 85 managers template-paste at some scale — apex visibility just depends on template size. The 2 hygienic managers prove the practice is possible. The other 83 prove it's not common. The break is not in the protocol; it's in operator practice.

H194 mechanism correction: the hygienic mechanism is not "IPD per partner" as earlier exhibits implied. Wayback traces show CafeMedia adopted OWNERDOMAIN+MANAGERDOMAIN in 2022–2024; Mediavine experimented with INVENTORYPARTNERDOMAIN from 2023-09 to 2024-06 then abandoned it. Neither uses IPD today. The actual mechanism: upstream SSPs (triplelift contributes 31K disclosed cells to the CafeMedia cohort, sharethrough 6K, indexexchange 4K, …) register seller_ids with reg_domain pointing at the manager (raptive.com/cafemedia.com) or the publisher domain, AND the publisher's MANAGERDOMAIN/OWNERDOMAIN directive matches. Two-side reciprocity at the upstream registry level. CafeMedia's own SSP entry contributes only 447 of 100,502 (0.4%) disclosed credentials in its cohort.

H195 primary-source confirmation: fetched triplelift.com/sellers.json (DUNS 063519038, 7,872 sellers). 23 entries explicitly named "CMI Marketing, Inc. d/b/a Raptive" with domain=cafemedia.com. Single seller_id 4800 is cited by 1,843 of 1,856 publishers (99.3% reciprocity). Each of the 8 sampled CMI sids reaches ≥ 90% of CafeMedia's managed-publisher cohort.

H196 generalization: probed 5 more upstream SSPs to test if the mechanism generalizes. All 5 reciprocate for both managers:

upstream SSP	CM sids	MV sids	attribution name (sample)
triplelift.com	23	—	"CMI Marketing, Inc. d/b/a Raptive"
themediagrid.com	1	4	"CMI Marketing d/b/a Raptive" / "MediaVine"
sharethrough.com	11	2	"CMI Marketing Inc dba Raptive CoinDesk"
indexexchange.com	8	5	"CMI Marketing, Inc. d/b/a Raptive" / "Mediavine, Inc."
openx.com	10	5	"CMI Media Group dba CMI Marketing, Inc. d.b.a Raptive dba CMI Media LLC"
media.net	2	3	"CMI Marketing, Inc. d/b/a Raptive" / "Mediavine, Inc"

55+ CafeMedia + 19+ Mediavine named-entity sids across 6 upstream SSPs. sharethrough goes further with per-property differentiation: each top managed property (CoinDesk, Daily Hive, …) gets its own CMI-attributed sid. openx has the longest legal-entity chain ("CMI Media Group dba CMI Marketing, Inc. d.b.a Raptive dba CMI Media LLC").

H197 refutation (negative control): the H195/H196 framing was incomplete. Probing 8 template-paste managers found ALL of them have substantial named-entity reciprocity too — Freestar has 922 named sids across 147 SSPs, MORE than CafeMedia's 266. The differentiator is not reciprocity per se. The actual mechanism is the fraction of cohort DIRECT credentials whose seller_id reg_domain equals the manager domain: CafeMedia 67.86%, Mediavine 62.55%, vs Freestar 15.94%, TheMoneytizer 6.06%, BLOX 5.34%. Two-factor decomposition: (a) template size — CafeMedia/Mediavine publishers carry ~69-84 DIRECT/pub; Freestar 301, BLOX 593, TheMoneytizer 745 — and (b) manager-attributed-sid usage ratio: hygienic templates predominantly cite the manager's named sids; template-paste templates dilute them with hundreds of other-publisher-attributed sids.

H198 victim distribution: if hygienic templates cite manager-attributed sids, what do template-paste templates cite? Enumerated the 109,254 victim mentions in 592 apex cells: 1,558 distinct reg_domains, long-tailed (top 200 = 64.5% of mentions; no concentrated cabal of "stolen identities"). Partitioned: 73.6% of distinct victims (1,146 of 1,558) never publish their own ads.txt. They can't reciprocate even if they wanted to. The cascade flags impersonation correctly, but the structural mechanism is untraceable attribution — upstream SSPs' sellers.json files attribute seller_ids to many small domains that don't participate in the spec, and template-paste managers route customer ads.txt through those untraceable attributions.

Final fix recommendation (three actors, two-side fix):

1. Upstream SSPs: stop attributing seller_ids to domains that have never published ads.txt — mark them confidential instead. ~62% of apex "impersonation" comes from these untraceable attributions.
2. Template-paste managers: reduce template size to what each publisher actually monetizes; keep the template dominated by manager-attributed sids (CafeMedia + Mediavine prove this scales).
3. IAB v1.1 cascade: consider a verdict subclass unverifiable_attribution for reg_domain that doesn't itself publish ads.txt — distinguishing structural attribution gaps from genuine impersonation.

Exhibit E · H191 · refined taxonomy

Template paste = ~96% of apex cascade tier. Under H191's refined taxonomy, ~576 of 592 apex cells (B-narrow + B-broad + A-template) share the template-paste mechanism. The remaining ~16 are genuine ownership-mapping issues (HuffPost-Yahoo class). The A/B partition the cascade computes is real — but the difference is "did the publisher declare MANAGERDOMAIN" rather than "what generated the impersonation." The fix recommendation collapses to one: either managers stop pasting non-customer seller_ids, or publishers declare MANAGERDOMAIN per spec (which would surface the operator-side practice for IPD-per-partner remediation).