`verification/TK-11350/REVIEW.md`

62 lines
# AdSense fleet review — TK-11350

Reviewed September 10, 2026, approximately 00:35–00:41 Pacific (07:35–07:41 UTC). The review found material defects; the fleet is not verified ready for monetization. No website source, deployments, account settings, ads, or notification jobs were changed by this review.

## Findings in priority order

1. **P1 — Article bodies are absent across the original 35-site fleet.** One live article on each of all 35 domains returned HTTP 200 with zero substantive body text. All 141 current source articles store `body`, while `dw-domain-fleet/shared/render.js:1331` renders only `sections`. The audit counts article links and still reports 35/35 ready. Fix the schema/rendering boundary, review the stored prose, and assert actual rendered article text. Some copy says to “install Wallpaper Weekly” or “install Fabric Fridays”; simply exposing every stored body would publish that defective copy. [35-domain evidence](article-fleet.json), [policy review](policy-review.md). **TK-11351**, linked back to completed content ticket **TK-11322**, routed to **vp-dw-marketing**.

2. **P1 — Three sites block their own loader with CSP.** Live headers from **interiordesignershowroom.com, nationalpaperhangers.com, starsofdesign.com** omit the AdSense script origin. A loader string in HTML cannot pass this boundary. Preserve CSP and configure only needed origins, then verify browser requests. Stars of Design currently returns 200; its earlier 502 is not a current outage. [Engineering review](engineering-review.md). **TK-11341**, existing rollout owners **main / vp-dw-commerce**.

3. **P1 — Ad code was inserted into operational/private journeys.** Live **BubbesBlock `/inbox`** and **Wallpaper’s Back `/luxe-curator.html`** return the loader. Local IWasCute’s root layout also wraps account/admin routes, but that case was not confirmed deployed. Scope injection to approved public-content routes and test exclusion paths. This review did not prove private-data transmission or actual ad impressions. **TK-11341**.

4. **P1 — Privacy disclosures and regional consent need correction/verification.** The 1890s and 1950s wallpaper sites, Wallpaper Dictionary, and Wallpaper History have no discoverable privacy link and return 404 for both tested privacy routes; dynamic navigation was checked too. Interior Designer’s Showroom’s policy omits Google ad-cookie/opt-out disclosures. The original fleet’s “Got it” notice only saves a dismissal flag. It does not establish a working consent platform; account-side Privacy & messaging and regional accept/reject/revoke flows remain unverified. Google requires a certified TCF CMP for personalized ads in EEA/UK/Switzerland; this is not a blanket finding that all European ad serving is prohibited. [Google disclosures](https://support.google.com/adsense/answer/1348695?hl=en), [Google CMP requirements](https://support.google.com/adsense/answer/13554116?hl=en), [policy evidence](policy-review.md). **TK-11341** for rollout fixes; fleet-specific corrections coordinate with **TK-11351**.

5. **P1 — Approval monitoring gives false confidence.** The console shows **124 total sites**, but the manager tracks only 35, reads no later pages, accepts partial snapshots, misparses approval text as ads.txt state, and labels partial UNKNOWN results PASS. Its pending-review counter counts `Requires review` instead of `Getting ready`. Shared unscoped browser navigation also races ongoing work. [Manager review](manager-review.md). **TK-11352**, routed to **adsense-manager**.

6. **P2 — Missing integrations, duplicate loaders, and invalid manual units.** Carmelwallpapers has neither live loader nor correct ads.txt; hospitalitydesignreps is HTTP 401; IWasCute has ads.txt but no loader observed in live homepage HTML. Four live pages have duplicate script tags: customdigitalmurals **2**, hollywoodwallcoverings **3**, naturaltextilewallpaper **2**, philipperomano **2**. The injector also matched `<header>`. HomesOnSpec exposes two manual units without `data-ad-slot`; its loader is preloaded for client execution, so absence of a static script tag is not proof the runtime loader is missing. **TK-11341**.

7. **P2 — Deployment and dashboard checks overstate completion.** `~/d.sh:44–46` discards restart failures and increments success after file copy, regardless of final service health. The old fleet viewer still uses August 5 account snapshots and outdated placement flags superseded by the later commerce rollout. Neither a 100% heuristic score nor a loader proves Google approval or ad serving. Reconcile inventory, timestamps, status semantics, and policy metadata without blindly reviving old decisions. **TK-11341 / TK-11352**.

## Coverage and current observations

The combined local inventories contain **135 unique domains**: 92 expanded-rollout targets, 35 original monetize domains, and 10 legacy viewer entries, with two overlaps. The expanded list includes intentionally skipped, remote-only, and protected sites; a missing integration is not automatically authorization to add one.

| Check | Observed result |
|---|---:|
| HTTPS homepage returned 200 | 134 / 135 |
| Correct publisher loader in static script tag | 120 / 135 |
| Exact Google DIRECT seller record at `/ads.txt` | 122 / 135 |
| Original 35: HTTP 200 + loader + seller record | 35 / 35 |
| Original 35: sampled live article has substantive body | **0 / 35** |
| Expanded 92: homepage 200 / static loader / seller record | 91 / 77 / 79 |
| Live duplicate-loader domains | 4 |
| Fresh console rows captured / total displayed | 50 / 124 |

See [every domain and its result](domains.csv) and [timestamped HTTP evidence](live-results.json). The home-word count is diagnostic only; JavaScript product grids and useful short pages cannot be judged by raw word count.

The console capture at **07:36:04 UTC** contains **47 Getting ready + 3 Requires review**. The latter are carmelwallpapers.com, iwascute.com, and hospitalitydesignreps.com. All 50 captured rows say ads.txt “Not found,” which is Google's crawler observation and may lag the live record. [Console evidence](console-summary.json). Every captured console domain is in the 135-domain HTTP inventory; uncaptured console pages cannot yet be reconciled.

Historical TK-11322 evidence at 06:53 UTC reports all original 35 review requests confirmed. A separate rollout handoff reports 78 additions and 75 review requests. These historical claims are distinct from this review's fresh, partial console observation. We cannot derive the full account approval count or ad revenue from them.

## Coordination and acceptance

Parent/finalizer: **codex, TK-11350**. Reviewers: the local registered **AdSense Manager** definition/toolkit, **code-reviewer**, and **seo-analyzer**, under the A2A contract. Parent independently checked article schema/live prose, all 135 home/ads.txt responses, CSP headers, duplicate script tags, and manager parser/poller source.

| Work | Ticket | Requested owner | A2A evidence |
|---|---|---|---|
| Existing rollout remediation | TK-11341 | main / vp-dw-commerce | M-02543, M-02546 |
| Article/body and editorial regression | TK-11351; related TK-11322 | vp-dw-marketing | M-02544 |
| Inventory, parser, monitor, browser ownership | TK-11352 | adsense-manager | M-02542, M-02545 |
| Avoid duplicate health scans | TK-11350 | codex-adsense-health | ticket-linked DM and supporting ticket log |

Handoffs were sent and durably logged; receipt/implementation acceptance is not assumed. Existing tickets retain their owners. No duplicate rollout implementation ticket was created. The fresh account-wide read remains partial because another actor repeatedly navigated the reviewer's dedicated browser target; our reviewer stopped navigation and did not close that actor's active tab.

## Limits and next verification

This is a source, live-HTTP, and partial-console review. Actual ad fill, browser network execution, authenticated private-data flows, geographic CMP behavior, responsive placement, and earnings were not certified. Domain-level checks cover all 135 inventoried builds; editorial/privacy review sampled representative expanded sites and examined the shared original-fleet implementation. This is not a claim every page was audited.

Fix and verify the demonstrated content/technical/monitoring defects before expanding content. Keep deployment decisions with the owning tickets and existing session authorization. The independent `/dtd` recommendation and post-decision check are recorded in `dtd-verdict.md`. No ad clicks or artificial traffic generation were performed; HTTP probes fetched documents without running ad scripts.

Evidence includes [engineering](engineering-review.md), [policy/content](policy-review.md), [manager](manager-review.md), [legacy mechanical audit](manager-audit.json), and [proof manifest](../e2e-proof.json). Report files are local review artifacts; they are not deployed dashboard changes.