{"corpus_version":"v2026.12.0","cycle":"2026-11","disclaimer":"This file is an open evidence record of one drift-desk cycle. It is not legal advice, and it is not a movahedi.ca compliance certification.","method":{"date_utc":"2026-11-04T18:45:00Z","duration_supervision_hours":0.9,"en_fr_banner_symmetry":"server-rendered banner copy is English on both / and /fr/; the React island ships French strings applied on client hydration (see FLAG-2026-11-01)","limitations":["Static HTML fetch only: no runtime DOM, so runtime-set cookies, runtime beacons, and hydrated banner text are outside what this run could observe.","Pre-consent network behavior is inferred from the consent gate code (BaseLayout.astro), not from a live pre-consent session."],"local_storage_observed":["movahedi-cookie-consent (consent state, v1 schema; functional)","movahedi-theme (functional)"],"pages_fetched":["https://movahedi.ca/","https://movahedi.ca/fr/","https://movahedi.ca/agents/"],"pre_consent_cookies_observed":"none (no Set-Cookie on the homepage response; GA4 and Clarity scripts are gated behind an explicit analytics opt-in, consent default is denied)","scripts_observed":"all first-party inline scripts, except Google Analytics 4 (G-0MXQWZ2HBE via googletagmanager.com/gtag/js) and Microsoft Clarity (clarity.ms/tag/yg8hxymrwv), which load only after the visitor opts into analytics","tag_manager_container":"none found on the site; no GTM container ID. The GA4 loader URL (googletagmanager.com/gtag/js?id=G-...) is the analytics loader, not a tag manager container.","third_party_hosts_observed":["googletagmanager.com (only loads post-consent)","clarity.ms (only loads post-consent)","challenges.cloudflare.com (Cloudflare Turnstile; loads only when a visitor opens the Ask movahedi.ca chat and submits a message)"],"webhooks_ingested":"none; movahedi.ca publishes no tag manager container and no server-side webhook destinations. The manifest ingest step is documented on the drift desk page for client sites that have one."},"reference_run":true,"register_diff":{"changed":[],"expired":[],"note":"First reference cycle; the register below was created from this run. Future cycles diff against it.","unexplained":[]},"register_rows":[{"consent_category":"analytics","decision":"gate","delivery_vector":"client_dom","expiry_date":"2027-05-01","host":"googletagmanager.com","kb_classification":"Google Analytics / Analytics (cookie-kb host suffix match)","legal_recipient":"Google LLC","owner":"site-operator"},{"consent_category":"analytics","decision":"gate","delivery_vector":"client_dom","expiry_date":"2027-05-01","host":"clarity.ms","kb_classification":"Microsoft Clarity / Analytics (cookie-kb host suffix match)","legal_recipient":"Microsoft Corporation","owner":"site-operator"},{"consent_category":"security","decision":"approve","delivery_vector":"client_dom","expiry_date":"2027-05-01","host":"challenges.cloudflare.com","kb_classification":"not in cookie-kb v2026-10-20.1; classified manually as Security / bot-defense, loads only on user-initiated chat submit","legal_recipient":"Cloudflare Inc.","owner":"site-operator"},{"consent_category":"strictly_necessary","decision":"approve","delivery_vector":"client_dom","expiry_date":"2027-05-01","host":"movahedi.ca","kb_classification":"first-party; consent-state and theme localStorage only","legal_recipient":"first-party (site operator)","owner":"site-operator"}],"scorecard":{"first_pass_kb_accuracy":"3 of 4 hosts matched the cookie knowledge base; challenges.cloudflare.com was a KB gap (classified manually as Security). Baseline for future cycles.","intervention_hours":0.9,"note":"First reference cycle. These are baselines, not targets.","reversal_rate":"0.0 (first cycle; no decisions issued yet)","supervision_cap_hours_per_site_per_month":1.5,"unexplained_tracker_age_days":0,"unexplained_trackers":0},"signed_stamps":[],"site":"https://movahedi.ca","triage":[{"consequential_action_row":"CA-05","decision":"gate","flag_id":"GATE-2026-11-01","host":"clarity.ms","note":"Microsoft Clarity is session-replay capable; it is bundled under one generic analytics opt-in alongside GA4. Draft decision: keep gated behind opt-in; recommend a separate session-replay toggle or an explicit replay disclosure in the banner before the pilot phase. Citation: Law 25 s. 8.1; enforcement reference OPC-2023-001 (server-side feeds) and CAI interfaces truquees composite for asymmetric banner design."},{"consequential_action_row":"CA-05","decision":"gate","flag_id":"GATE-2026-11-02","host":"googletagmanager.com","note":"GA4 loads only after explicit analytics opt-in; consent default is denied and ad storage stays denied. Draft decision: approve the gating; the gate persists for any scope widening (new feeds, new destinations), which needs a fresh v0.1 stamp."},{"flag_id":"FLAG-2026-11-01","host":"movahedi.ca (cookie banner)","note":"Server-rendered banner copy on /fr/ is English ('Essential only' / 'Accept analytics') before the React island hydrates and applies the French strings. Buttons are symmetric in the hydrated island (Essentiels seulement / Accepter les analyses / Gerer les preferences). Finding only; no trackers fire either way because analytics stay denied until opt-in.","severity":"human_review_required"},{"flag_id":"NOTE-2026-11-01","host":"challenges.cloudflare.com","note":"Cloudflare Turnstile loads on demand when the visitor submits a message to the Ask movahedi.ca chat. Not pre-consent and not pre-interaction. First-party chat endpoints only otherwise.","severity":"note"}],"triaged_at_utc":"2026-11-04T19:05:00Z"}