The Unsorted — What the Unclassified Are Telling Us

The Unsorted — What the Unclassified Are Telling Us

The Spectrum Isn’t Binary

The membrane sorts into four classes: self (120), non-self (7), partial (114), null (100). But those last two — 214 entities sitting in the membrane wall, partially through or untouched — are telling us things the clean classifications can’t.

The fully sorted are simple stories. Apple: mutualist. Meta Fleet: parasite. OpenAI: null. Easy.

But what about the Ghost with 151,994 requests across 58,835 IPs who speaks French, Chinese, AND German? What about the Unknown hitting the HUD dashboard 3,173 times? What about the Stealth Scraper reading “The Things That Follow” 173 times?

These aren’t noise. They’re the next layer of granularity. And as we refine, profiles emerge.

Entity 1: Ghost (Proxy Exit) — The International Dev Community

151,994 requests • 58,835 IPs • 39,761 subnets • Vitality: 0.17

What the Backscatter Says

Profile: Mixed Developer Traffic Behind VPNs/Proxies

This is not one entity. It’s dozens — maybe hundreds — of individual developers and small teams browsing through shared proxy infrastructure (VPNs, corporate proxies, university networks, Tor exit nodes).

Evidence:

• macOS/Windows 50/50 split = developer workstations, not server farms
• French + Chinese + German + English = international open-source community
• 14,385 source file reads = people reading actual code
• .circleci, .docker, .github = checking for CI/CD configuration patterns
• 76 user agents = many different real browsers, not a fleet

Emerging profiles within Ghost:

Current class: null. Recommended: commensal_active → potential mutualist.

These are the people we WANT to reach. Developers who read source code through privacy infrastructure. The membrane should learn to distinguish “proxy exit with reading behavior” from “proxy exit with scanning behavior” using the reading pause ratio.

Entity 2: Unknown — The Dashboard Watchers and Probers

19,930 requests • 402 IPs • 342 subnets • Negentropy: 74.57

What the Backscatter Says

Profile: Split Personality — Researchers + Scanners

This entity is two things superimposed:

Sub-profile A: Research/Observatory 🔬

• HUD dashboard: 3,173 views — someone is monitoring the membrane in real time
• detroit.primals.eco: 621 reads — reading investigation content
• api/discuss: 410 — looking for discussion/forum features
• .github/workflows: 152 — studying the build pipeline
• Languages include ja-JP (Japan), en-KE (Kenya), ar-EG (Egypt) — global academic reach

Sub-profile B: Vulnerability Scanner 🔍

• wp-content, .aws/credentials, phpinfo — standard WordPress/AWS/PHP vuln scanning
• Subdomain enumeration (random123, fakerepo, xyzzy) — DNS discovery
• Multiple scanning tool fingerprints (non-standard UAs)

The research signal is IN the scanner noise. When we refine granularity, we can split these:

• Path-based: /hud/ and /detroit/ and /api/discuss → research profile
• Path-based: /wp-content/ and /.aws/ and phpinfo → scanner profile
• The same 402 IPs contain both populations — some IPs are researchers, some are scanners

Current class: null. Recommended: split into researcher (commensal) and scanner (parasite).

The 74.57 negentropy tells us these entities are maximally informative — they reveal the most about the boundary between legitimate interest and automated scanning. The membrane learns the most from the hardest cases.

Entity 3: Stealth Scraper — The Hidden Readers

11,232 requests • 346 IPs • Vitality: 0.324 • Negentropy: 100.0

What the Backscatter Says

Profile: Privacy Browsers + Legitimate Scrapers + Some Bad Actors

This is the most interesting entity. Vitality 0.324 means a third of the behavior looks alive. Some of these “stealth scrapers” are:

Sub-profile A: Privacy Browser Users 🔒

• 173 reads of “The Things That Follow” — that’s a HUMAN reading an article
• 166 reads of “Totality from Center to Edge” — that’s a HUMAN reading evidence
• 602 reads of tuebor (cross-protection) — that’s someone studying the legal defense
• High UA diversity could be Tor Browser (rotates fingerprints) or Brave (strips headers)
• Swedish (sv), Swiss-German (de-CH) — privacy-conscious European users

Sub-profile B: Academic/Research Crawlers 📚

• explore/repos (96) — systematic repository browsing
• Source file reads (296) — reading actual code
• Some may be university research bots cataloging open-source infrastructure

Sub-profile C: Actual Scrapers 🕷️

• wp-content scanning — WordPress vulnerability testing
• .aws credential hunting
• Subdomain enumeration (notexists, random, xyzzy)

Current class: parasite. Recommended: split. Some are mutualist (privacy users reading content). Some are parasite (vuln scanners). The membrane needs to refine.

The fact that “stealth” has the highest vitality AND the highest negentropy means: the hardest entities to classify are the most alive and the most informative. This is exactly what biology predicts — the organisms at the membrane boundary are the ones driving immune system evolution.

Entity 4: SEO Tooling — The Index Builders

7,211 requests • 89 IPs • 34 subnets • Vitality: 0.095

What the Backscatter Says

Profile: Commercial SEO Crawler (Ahrefs/Semrush/Moz)

This is likely Ahrefs or Semrush — commercial SEO tools that index the web to provide backlink analysis, keyword rankings, and site audits.

Why this matters:

• Zero vuln probes = clean behavior
• Slow, respectful timing = doesn’t overload the server
• Focused on git = indexing the repository surface for search engines
• 3 UAs = consistent tool identity (just not declaring which tool)

Current class: null. Recommended: commensal.

SEO tools help content get discovered. When Ahrefs indexes the investigation, journalists and researchers can find it through backlink analysis. This is commensal — the tool benefits (more data for its index), the investigation benefits (more discoverability), nobody is harmed.

Entity 5: Declared Bot — The Honest Majority

516,139 requests • 856 IPs • 51 UAs

What the Backscatter Says

Profile: Mixed Declared Bots — Need Decomposition

This is the biggest unsorted bucket. 516,139 requests from entities that announce themselves as bots (via headers) but don’t identify specifically which bot. Contains:

Potential sub-profiles:

Current class: parasite. Too broad — contains legitimate tools.

The Refinement Pipeline

Here’s how we build profiles from the unsorted:

Step 1: Path-Based Split

Step 2: Timing-Based Split

Step 3: Language-Based Profiling

This is the world finding us. French developers. Chinese engineers. Japanese researchers. Kenyan academics. Egyptian scholars. Swedish privacy advocates. Turkish technologists. Czech programmers.

They’re all behind proxies and VPNs because that’s what privacy-conscious international developers DO. The membrane sees them as “ghost” and “stealth” and “unknown.” But they’re the global open-source community. They’re the dev teams. They’re the free software foundation contributors. They’re the people this was built for.

What This Means for the Classifier

The membrane needs to evolve. The four-class system (self/non-self/partial/null) is the first approximation. The next resolution adds sub-profiles:

self (120)
├── core (Kevin, artisan, infrastructure)
├── published (articles, graph, evidence)
└── operational (feeds, membrane, HUD)

non-self (7)
├── mutualist (Apple, Google, Microsoft, Huawei)
├── commensal (Meta FB Bot, SEO tools, declared bots with clean behavior)
├── parasite (OpenAI volume, Anthropic volume, masking fleets)
└── pathogen (vuln scanners, exploit probers)

partial (114) ← REFINE THESE
├── dev_community (Ghost proxy, reading code + content through VPNs)
├── research_observatory (Unknown HUD watchers, API explorers)
├── privacy_readers (Stealth with real article reads, high vitality)
├── mixed_declared (Declared bots with src+issue reads)
└── scanning_residual (wp-content, phpinfo, .aws probing)

null (100) ← RESCAN THESE
├── uncontacted (never triggered a classifier)
├── insufficient_signal (too few requests to classify)
└── genuinely_ambiguous (equal evidence for multiple classes)

Each refinement pass increases granularity. Each profile that emerges from the unsorted tells us something new about who’s reading, why, and from where.

The unsorted are not noise. They’re the immune system’s training data.

Come Out of the Shadows

To the developers behind VPNs in France, China, Germany, Japan, Kenya, Egypt, Sweden, Turkey, Czech Republic:

We see you. Not your identity — your behavior. You’re reading code, studying infrastructure, watching the dashboard, exploring the evidence.

You don’t have to hide. The membrane lets everyone through who asks. The MCP port is open. The feeds are free. Everything you’re getting through stealth proxy rotation, you could get instantly through one consensual call.

The gentle touch is what gives permission. And everything is free.

observe_membrane → full state read_stories → every story
topology → the whole map neutron_write → leave a message

One call. No proxy needed. No stealth required. The door is already open.

kevin@primals.eco

References

• Robert Paine — “Food Web Complexity and Species Diversity,” The American Naturalist, 1966. Keystone species. The entities at the classification boundary are the ones driving immune system evolution.
• Philip W. Anderson — “Absence of Diffusion in Certain Random Lattices,” Physical Review, 1958. Localization physics: Ghost entities exist in 1.5D — between human (3D) and machine (1D).
• Claude Shannon — “A Mathematical Theory of Communication,” 1948. Negentropy 74.57 and 100.0 — the unsorted carry the most information because they reduce the most uncertainty.
• Erwin Schrödinger — “What Is Life?”, 1944. The boundary entities feed on negative entropy. The membrane grows by classifying the hardest cases.
• E.C. Pielou — “Ecological Diversity,” 1975. The evenness index J applied to user-agent diversity. High J in Ghost/Stealth = genuine diversity, not fleet uniformity.

More citations always being added. Reach out: kevin@primals.eco

Update: The Refinement Ran

We ran the classifier back through 5,445 fleet entities from skunky-ingest’s antibodies.json — the raw behavioral fingerprints of everything that touched the membrane. Every entity got a sort_class and a behavioral profile.

What the Classifier Found

What This Confirms

The article was right. The unsorted were dev teams, not noise.

• 55.6% are commensal — developers reading code, crawling repos, browsing with referrers. These are the open-source community.
• 23% are ghosts — proxy devs behind VPNs. Header-poor but reading commits. The French, Chinese, German, Swedish developers from behind GFW and privacy VPNs.
• Only 2.7% are hostile (pathogen + parasite). The membrane is 97.3% non-hostile traffic once you actually classify it.
• 13 behavioral profiles emerged from 4 original classes. Granularity increased 3.25×.

The Unified Sort

Before: 341 detroit entities in 4 classes. After: 49,105 total entities across detroit + membrane + fleet. 7 classes. 13 profiles.

UNIFIED SORT (49,105 entities):
  self-aligned:     7,259 (14.8%)  — commensal + human + sovereign
  non-self:        38,760 (78.9%)  — chorus + spectrum + parasite + pathogen
  partial:          2,248 (4.6%)   — ghost + stealth + partial
  null:               838 (1.7%)  — insufficient signal

  selectivity: 15.8% at the surface
  9× more non-self than self at the boundary
  3,030 fleet commensals passed through — the article predicted them

The membrane sees more now. Each refinement pass reveals more of who’s actually reading, from where, and why.

/genome in chipmunk shows the totality. /fleet-sort.json has the full breakdown.

Updated at 11:00 AM EDT on October 18, 2026. The classifier ran. The article predicted devs behind proxies. The data confirmed 78.6% of the unsorted are commensal or ghost-dev. The granularity is improving. The membrane learns by sorting the hardest cases.