@canonry/canonry 7.87.1 → 7.87.2

package/assets/agent-workspace/skills/aero/references/ai-traffic-tracking.md

@@ -31,7 +31,12 @@ rarely. Report every step separately; never pool them.
 
 Server-side hits are requests and GA4 counts sessions, and each instrument
 misses some visits the other sees, so the two never match exactly. Compare
-their trend, not their totals.
+their trend, not their totals. Server-side arrivals stored before Canonry
+7.87.2 also counted a visitor's later pages, assets and API calls that carried
+the landing page's utm, about one per minute of the visit, so those hours can
+read several times high and cannot be corrected. Never read a trend across
+that upgrade; for earlier hours quote GA4, or AI visitor journeys where they
+exist.
 
 ## Check the instrument before you report a zero
 

package/assets/agent-workspace/skills/canonry/references/ai-traffic-tracking.md

@@ -24,7 +24,12 @@ rarely. Report every step separately; never pool them.
 
 Server-side hits are requests and GA4 counts sessions, and each instrument
 misses some visits the other sees, so the two never match exactly. Compare
-their trend, not their totals.
+their trend, not their totals. Server-side arrivals stored before Canonry
+7.87.2 also counted a visitor's later pages, assets and API calls that carried
+the landing page's utm, about one per minute of the visit, so those hours can
+read several times high and cannot be corrected. Never read a trend across
+that upgrade; for earlier hours quote GA4, or AI visitor journeys where they
+exist.
 
 ## Check the instrument before you report a zero
 

package/assets/agent-workspace/skills/canonry/references/canonry-cli.md

@@ -1104,6 +1104,9 @@ operators, crawled paths, referral products, landing paths, daily history, and
 equal prior-window changes. It does not start a sync or provider work. The
 scope is project-wide for Simple and Advanced portfolios; there is no Property,
 Target, or market attribution. Server sessions and GA sessions remain separate.
+Referral arrivals stored before Canonry 7.87.2 also counted a visitor's later
+same-site requests, so a window or prior window that reaches back before that
+upgrade reads high on that side.
 
 ## Google Analytics 4
 

package/assets/agent-workspace/skills/canonry/references/server-side-traffic.md

@@ -33,10 +33,21 @@ Legitimate peaks can qualify and small automated bursts can escape the rule.
 `--burst-threshold` changes the default 100-hit review trigger; the default has
 not been calibrated against live traffic distributions.
 
-Server counts use short actor windows within ingestion batches, so they are
-not GA sessions or verified people. Normalized paths can combine pages;
-multiple sources can overlap. No Property, Target or market attribution is
-available. These limits apply equally to Simple and Advanced portfolios.
+Server counts are arrivals, not GA sessions or verified people. A request
+whose referer is outside the site (the AI engine's page, or none) is an
+arrival; requests from one visitor (IP and user agent) to the same landing
+page within a minute count once. A later page, asset or API call whose same-site
+referer still carries the engine's utm belongs to that visitor's arrival from
+the same engine for 30 days, in any sync or push, even one that reaches
+Canonry before the landing does. It counts as the arrival only when the
+visitor had none from that engine in those 30 days: a site whose pages a cache
+serves before the logs see them shows nothing else, so a second click from
+the same engine within 30 days is not counted there. Hours stored before Canonry 7.87.2
+counted every later minute of a visit as another arrival and read high;
+hourly rows keep no visitor, so they cannot be corrected. Normalized paths
+can combine pages; multiple sources can overlap. No Property, Target or
+market attribution is available. These limits apply equally to Simple and
+Advanced portfolios.
 
 The observed server/GA quotient, rounded to 2 decimals, uses
 dimension-deduplicated GA sessions, but complete matching coverage and the GA
@@ -61,7 +72,8 @@ Four tables store the shared output from every adapter:
 | `ai_user_fetch_likely_fake_hourly` | One row per `(project, source, hour, bot, first trust reason)` — requests that claimed a user-triggered agent but were judged likely fake |
 | `agent_scanner_clients` | One row per `(project, source, client)` — the latest run of scanner probes from one IP (stored as a keyed hash), kept two days so a burst split across batches is still recognized |
 | `journey_visitor_aliases` | One row per `(project, alias key)` — a visitor key found to be another visitor seen from a new IP (same AI-tagged page, same browser, within 5 seconds); requests under the alias key are kept under that visitor. Both are keyed hashes, never an IP |
-| `ai_referral_events_hourly` | One row per `(project, source, hour, product, source_domain, evidence_type, landing_path, status)` — click-through arrivals rolled up by hour |
+| `ai_referral_events_hourly` | One row per `(project, source, hour, product, source_domain, evidence_type, landing_path, status)` — click-through arrivals rolled up by hour; a visitor's later same-site requests are not arrivals |
+| `ai_referral_visitors` | One row per `(project, source, visitor)`: each visitor's latest AI arrival (the visitor is a keyed hash of IP and user agent, never the address), kept 44 days so a later request of the same visit in a later batch is not counted again |
 | `raw_event_samples` | Bounded forensic samples for spot checks. Source writes plus a startup/daily global sweep enforce 30-day retention; Cloudflare also uses a per-source, per-hour cap |
 
 Each `traffic_sources` row is one server-log integration for a project.

package/dist/{backfill-PNHBAV5N.js → backfill-6AYHWEQX.js}

@@ -10,8 +10,8 @@ import {
   backfillSnapshotAttributionCommand,
   backfillTrafficClassificationCommand,
   replayQueryAuditLog
-} from "./chunk-CR54BCUP.js";
-import "./chunk-RHOIR5QY.js";
+} from "./chunk-IE4D47JE.js";
+import "./chunk-BVJA3TV2.js";
 import "./chunk-2FJB3CSS.js";
 import "./chunk-HGMYEDAQ.js";
 import "./chunk-JAYUWQAV.js";
@@ -19,10 +19,10 @@ import "./chunk-IBGZ6D6R.js";
 import {
   backfillProjectAnswerMentions,
   backfillProjectAnswerMentionsInChunks
-} from "./chunk-W7DHXSXN.js";
-import "./chunk-VDYXB6SV.js";
+} from "./chunk-AI75KS7G.js";
+import "./chunk-POMLL2OZ.js";
 import "./chunk-GBWCEOZR.js";
-import "./chunk-O26FQ7RI.js";
+import "./chunk-AYYZ4HKJ.js";
 import "./chunk-F643WELJ.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{bootstrap-AZYQXBHN.js → bootstrap-27NOBWTP.js}

@@ -44,7 +44,7 @@ import {
   createClient,
   dashboardSessions,
   migrate
-} from "./chunk-O26FQ7RI.js";
+} from "./chunk-AYYZ4HKJ.js";
 import {
   ProviderNames,
   ProviderReloadErrorReasons

package/dist/{chunk-J7ITGXCS.js → chunk-3FHBPJ5R.js}

@@ -28,7 +28,7 @@ async function buildSetupState() {
   }
   if (dbPath && fs.existsSync(dbPath)) {
     try {
-      const { createClient, projects, queries: queriesTable } = await import("./src-SJYGA7NH.js");
+      const { createClient, projects, queries: queriesTable } = await import("./src-JQYZ2TP6.js");
       const db = createClient(dbPath);
       project_count = db.select({ id: projects.id }).from(projects).all().length;
       const firstQuery = db.select({ id: queriesTable.id }).from(queriesTable).limit(1).all();
@@ -47,7 +47,7 @@ function queueServeHandoff() {
 async function runPendingServeHandoff(format) {
   if (!pendingServeHandoff) return;
   pendingServeHandoff = false;
-  const { serveCommand } = await import("./serve-ZQXMTDE7.js");
+  const { serveCommand } = await import("./serve-LLIUILD2.js");
   await serveCommand(format);
 }