`verification/TK-11350/manager-review.md`

33 lines

# TK-11350 AdSense Manager review

Status: partial console inventory; complete read-only review of manager tooling and live 35-site heuristic audit. Owner adsense-manager, delegation root -> adsense_manager depth 1, no further delegation. No source changes/commit, deployments, account writes, emails, or poller runs. Evidence only under /tmp.

## Fresh evidence

- 2026-09-10T07:35:20.945Z: all original 35 monetize domains pass the existing manager's 13 checks. Ran a byte-identical copy of audit.mjs under /tmp/TK-11350-manager-audit/scripts so output did not overwrite shared manager state. Evidence: /tmp/TK-11350-manager-audit/output.json. First sandbox run failed network and is superseded by approved network-enabled rerun. This score checks presence and shallow content signals; it does not certify Google policy compliance, approval, or ad serving.
- Fresh AdSense console list capture: /tmp/TK-11350-manager-console-page1.json, summarized with capture timestamp in /tmp/TK-11350-manager-console-summary.json. Console reports 124 total sites, 3 pages at 50 rows/page. Captured first 50: 47 Getting ready, 3 Requires review. The three are carmelwallpapers.com, iwascute.com, hospitalitydesignreps.com. All 50 rows show ads.txt Not found (distinct from approval Getting ready).
- Console verification was stopped when another actor repeatedly navigated the dedicated target 43668A82713374FB7A21DB79B043A367 to successive domain detail pages between scoped reads. No registration or review buttons were touched. Pages 2/3 and account-wide approved count remain unverified; do not infer zero approvals across 124 from page 1.
- Historical TK-11322 evidence at 2026-09-10T06:53:30Z says all original 35 individually showed Verify site ownership + Review requested checked and Getting ready. Historical scratch adsense_register_RESULT.md (parent supplied path) says another 78 registered, 75 Getting ready and the same three Requires review. Fresh first-page console evidence agrees with those three outstanding states, but 35+78 does not explain all 124 accounts; reconcile other 11 explicitly.

## Findings

1. HIGH: monitoring is incomplete but reports PASS. status.mjs:16-18 restricts inventory to 35 monetize configs, excluding the broad rollout. status.mjs:26-40 reads only the current first console page and accepts any nonzero recognized row count as success. Cached status-latest.json at 06:22:59Z has 18 Getting ready + 17 UNKNOWN. poll-alert.mjs:28-44 calls that PASS and overwrites the baseline with UNKNOWN states. Current console has 124 sites, proving pagination is mandatory. Preserve last-known values per domain separately from observation health and require complete inventory before PASS.

2. HIGH: wrong ads.txt state is displayed. status.mjs:33,38 matches approval and ads.txt in one combined text window. The earlier Getting ready string wins over the actual later Not found. Fresh page1 has 47 Getting ready approvals with Not found ads.txt; the cached manager rows incorrectly say Getting ready for both. Parse actual table columns independently.

3. MEDIUM: in-review metrics invert the workflow. poll-alert.mjs:72 and serve.mjs:75 count Requires review as In review and omit Getting ready. serve.mjs:86 incorrectly tells the operator Requires review is normal while Google finishes review. The cached rollup therefore reports in_review=0 when 18 captured records are Getting ready. Count Getting ready as pending review; surface Requires review as action required.

4. HIGH: shared browser race remains active. status.mjs:26,30 omits target-id. This can read another page or navigate someone else's ongoing task. Merely opening a dedicated target was insufficient in this session because a separate unscoped actor kept navigating it. Use a dedicated isolated page/session and a coordination lock; validate requested URL and captured table before accepting results. Do not run the existing poller to verify a review: it also sends email and rsyncs externally (poll-alert.mjs:47-78).

5. HIGH: 100% readiness overclaims. audit.mjs:43-51 counts article links without requesting article pages and applies local >=300 words/>=3 links thresholds, not a Google approval guarantee. ads_txt at line49 only searches publisher substring, not exact seller record; about/contact/sitemap largely check HTTP200. It does not verify consent, blocked crawlers, content originality, real contact mechanism, actual ad requests/fill, or account approval. Skill says '100% = nothing on our side blocks approval', which is unsupported.

6. HIGH conditional regional consent gap: shared/render.js:1109-1112 loads ads immediately; :1523-1540 supplies only a dismissible Got it notice storing localStorage acknowledgement. It does not itself implement certified CMP/TCF consent. Google requires a certified CMP integrated with TCF for personalized ads in EEA/UK/Switzerland. Account-level Google Privacy & messaging setup was not verified, so conclude local banner is insufficient evidence, not that no remote CMP exists. Official source: https://support.google.com/adsense/answer/13554116?hl=en . Quality eligibility is original, high-quality, audience-worthy content, not a numeric article count: https://support.google.com/adsense/answer/9724?hl=en .

7. MEDIUM dashboard UX: serve.mjs:35-38 strips record timestamps out of client data; :98-112 cards display no created date/time, contrary to standing admin-card rule. Missing console coverage is also invisible in top-level metrics. Existing sort/density persistence is present.

8. MEDIUM drip defect: scripts/drip.mjs uses require() inside an ESM .mjs file without createRequire. dwProducts catches the resulting ReferenceError and silently replaces catalog with [] / scrubber with identity, so its promised real DW-product grounding is absent. Source inspection only; did not run generator, apply, or deploy. This is secondary to monitoring truth.

## Safe next action and gates

First fix local monitoring inventory/pagination/column parsing/status semantics and demonstrate them against saved 50-row fixture plus an isolated complete console read. Separately inspect real runtime consent configuration and deploy status of the three Requires review domains. Parent owns fresh full-fleet HTTP checks. Any live site or dashboard deploy remains outside this review. Earlier TK-11322/TK-11341 logs record Steve's standing AdSense-request authorization, but no account mutation is needed for this review. Full-account approval and actual ad serving remain unknown until complete console and browser-network evidence exists.