September 30: Hourly Domain Cutover Comparison

20261002-c230-september30-hourly-domain-cutover-comparison.md · 4538 code points

October 2, 2026. Offline projection of the saved raw receipt, not a new census. Existing Java remains unchanged.

Events And Scope

The second five-domain public DNS cutover began at 14:50 MDT on September 30. The 14:00 row is a mixed before/after hour, not a clean post-cutover window. SNI/content preparation and direct-IP probes precede that effect. DNS effect receipt.

Cohorts include apex and all observed subdomains of their five listed families, not just exact apex names. Other hosts stay in the outside-listed column. These partitions are disjoint and reconcile to each hourly total.

Hourly Requests

MDT hour start	All hosts	Original five	Added five	Outside listed	2xx	404	Stored coverage
00:00	164	104	0	60	36	127	Complete
01:00	1,199	46	0	1,153	15	1,080	Incomplete
02:00	658	642	0	16	17	609	Complete
03:00	1,288	703	0	585	38	739	Complete
04:00	1,011	992	0	19	13	852	Complete
05:00	2,905	2,895	0	10	16	1,596	Complete
06:00	1,493	1,480	0	13	3	1,275	Complete
07:00	1,116	905	0	211	1	1,038	Complete
08:00	576	550	0	26	11	493	Complete
09:00	785	758	0	27	51	653	Complete
10:00	1,416	1,412	0	4	104	1,170	Complete
11:00	1,644	1,636	0	8	37	1,393	Complete
12:00	48	29	10	9	19	29	Complete
13:00	516	502	0	14	4	437	Complete
14:00	546	383	78	85	142	399	Complete
15:00	290	251	32	7	49	238	Complete
16:00	40	19	12	9	4	34	Complete
17:00	116	89	16	11	8	105	Complete
18:00	114	89	12	13	9	102	Complete
19:00	1,118	998	9	111	5	960	Complete
20:00	533	512	6	15	16	445	Complete
21:00	1,108	1,055	25	28	45	918	Complete
22:00	330	163	141	26	21	303	Complete
23:00	923	760	148	15	39	812	Complete
Day total	19,937	16,973	489	2,475			One incomplete hour

What Changed

Added-five traffic is zero before noon, then ten requests at noon on apex and pilot hosts, consistent with our pre-DNS probes. This is not proof of early public DNS exposure or organic demand.
The cutover hour contains 78 added-five requests. Subsequent hours retain traffic on those domains and their www/pilot siblings; propagation and probes remain mixed into these counts.
The largest overall hour is 05:00: 2,905 requests, including 2,895 on the original five and none on the added five. It predates their DNS cutover.
The incomplete 01:00 hour retains 1,199 requests, of which 1,153 are outside the listed ten and 46 are original-five requests. That describes retained composition, not where any unrecorded traffic went or how much was lost.
A pronounced fall at noon is visible, but no restart/traffic-change cause is established here. Correlate existing runtime receipts before assigning a cause.

Reuse And Limits

Machine-readable hourly data preserves hour epochs, cohort counts, status counts, coverage, observed added-cohort hosts and the DNS event. It is an experimental offline data artifact, not a new V-tier contract or live endpoint. The 24 disjoint hours sum exactly to the existing daily history projection. 2xx and 404 are selected status columns, not an exhaustive response partition.

Source: saved raw census. The complete file was read through bounded source-Mojo excerpts, parsed as JSON and grouped by existing host/hour coordinates. No network request, new collector, S3 operation or runtime promotion occurred.

This is suitable input for an event-annotated HieroScope/FSheet comparison: children tally into parent counts; do not add overlapping capture snapshots. Do not interpret the counts as people, verified search bots, buyer intent, conversion or a causal effect of the DNS change.

Source text

# September 30: Hourly Domain Cutover Comparison

October 2, 2026. Offline projection of the saved raw receipt, not a new census.
Existing Java remains unchanged.

## Events And Scope

The second five-domain public DNS cutover began at **14:50 MDT** on September
30. The 14:00 row is a mixed before/after hour, not a clean post-cutover window.
SNI/content preparation and direct-IP probes precede that effect.
[DNS effect receipt](/opt/data/phyles/byYear/2026/byVibe/IN/IN/webeon/docs/operations/20260930-c230-wave02-public-dns-cutover-evidence.json).

Cohorts include apex and all observed subdomains of their five listed families,
not just exact apex names. Other hosts stay in the outside-listed column.
These partitions are disjoint and reconcile to each hourly total.

## Hourly Requests

| MDT hour start | All hosts | Original five | Added five | Outside listed | 2xx | 404 | Stored coverage |
| --- | ---: | ---: | ---: | ---: | ---: | ---: | --- |
| 00:00 | 164 | 104 | 0 | 60 | 36 | 127 | Complete |
| 01:00 | 1,199 | 46 | 0 | 1,153 | 15 | 1,080 | Incomplete |
| 02:00 | 658 | 642 | 0 | 16 | 17 | 609 | Complete |
| 03:00 | 1,288 | 703 | 0 | 585 | 38 | 739 | Complete |
| 04:00 | 1,011 | 992 | 0 | 19 | 13 | 852 | Complete |
| 05:00 | 2,905 | 2,895 | 0 | 10 | 16 | 1,596 | Complete |
| 06:00 | 1,493 | 1,480 | 0 | 13 | 3 | 1,275 | Complete |
| 07:00 | 1,116 | 905 | 0 | 211 | 1 | 1,038 | Complete |
| 08:00 | 576 | 550 | 0 | 26 | 11 | 493 | Complete |
| 09:00 | 785 | 758 | 0 | 27 | 51 | 653 | Complete |
| 10:00 | 1,416 | 1,412 | 0 | 4 | 104 | 1,170 | Complete |
| 11:00 | 1,644 | 1,636 | 0 | 8 | 37 | 1,393 | Complete |
| 12:00 | 48 | 29 | 10 | 9 | 19 | 29 | Complete |
| 13:00 | 516 | 502 | 0 | 14 | 4 | 437 | Complete |
| 14:00 | 546 | 383 | 78 | 85 | 142 | 399 | Complete |
| 15:00 | 290 | 251 | 32 | 7 | 49 | 238 | Complete |
| 16:00 | 40 | 19 | 12 | 9 | 4 | 34 | Complete |
| 17:00 | 116 | 89 | 16 | 11 | 8 | 105 | Complete |
| 18:00 | 114 | 89 | 12 | 13 | 9 | 102 | Complete |
| 19:00 | 1,118 | 998 | 9 | 111 | 5 | 960 | Complete |
| 20:00 | 533 | 512 | 6 | 15 | 16 | 445 | Complete |
| 21:00 | 1,108 | 1,055 | 25 | 28 | 45 | 918 | Complete |
| 22:00 | 330 | 163 | 141 | 26 | 21 | 303 | Complete |
| 23:00 | 923 | 760 | 148 | 15 | 39 | 812 | Complete |
| **Day total** | **19,937** | **16,973** | **489** | **2,475** | | | **One incomplete hour** |

## What Changed

- Added-five traffic is zero before noon, then ten requests at noon on apex and
  pilot hosts, consistent with our pre-DNS probes. This is not proof of early
  public DNS exposure or organic demand.
- The cutover hour contains 78 added-five requests. Subsequent hours retain
  traffic on those domains and their www/pilot siblings; propagation and probes
  remain mixed into these counts.
- The largest overall hour is 05:00: 2,905 requests, including 2,895 on the
  original five and none on the added five. It predates their DNS cutover.
- The incomplete 01:00 hour retains 1,199 requests, of which 1,153 are outside
  the listed ten and 46 are original-five requests. That describes retained
  composition, not where any unrecorded traffic went or how much was lost.
- A pronounced fall at noon is visible, but no restart/traffic-change cause is
  established here. Correlate existing runtime receipts before assigning a cause.

## Reuse And Limits

[Machine-readable hourly data](/opt/data/phyles/byYear/2026/byVibe/IN/IN/webeon/docs/operations/20261002-c230-september30-hourly-domain-cutover-comparison.json) preserves hour epochs, cohort counts,
status counts, coverage, observed added-cohort hosts and the DNS event. It is an
experimental offline data artifact, not a new V-tier contract or live endpoint.
The 24 disjoint hours sum exactly to the existing daily history projection.
2xx and 404 are selected status columns, not an exhaustive response partition.

Source: [saved raw census](/opt/data/phyles/byYear/2026/byVibe/IN/IN/webeon/runtime/telemetry/nav-c230-captures/2026-10-02T10-27-29.255Z-b947e748-732c-40e6-a486-1f8a780e80cc/catchup-0-arrivals.json).
The complete file was read through bounded source-Mojo excerpts, parsed as
JSON and grouped by existing host/hour coordinates. No network request, new
collector, S3 operation or runtime promotion occurred.

This is suitable input for an event-annotated HieroScope/FSheet comparison:
children tally into parent counts; do not add overlapping capture snapshots.
Do not interpret the counts as people, verified search bots, buyer intent,
conversion or a causal effect of the DNS change.