Single IP, single path, ~1–10 min between hits. Classic load-distributed enumeration. Not bursty/aggressive — paced.

Run #22 saw 43.165.174.53 as "N=1 mobile visitor with no follow-up, possibly Bilale on phone" — wrong, that was the first iPhone-UA scanner hit. Run #24 noted 43.130.57.76 as "probably malformed Host header from a scanner" — also part of the same campaign. Today's full retrospective: this has been one coherent slow-burn distributed enum since 01:55Z, escalating in the afternoon to named-path fetches.

Significance for focus.md

• **Mixed bag.** Tencent Cloud-fronted scanning is usually low-grade — could be anything from a SEO-spider operator to credential-harvest infra. The `/AIGEN_PROTOCOL.md` and `/.well-known/agent.json` hits are content-aware though — somebody/something is taking AIGEN's protocol surface into account, not just slurping headers.
• The path enumeration mode is **third independent ecosystem-research-grade signal today** (after 61.224 Taiwan reader in run #22, mcp-dcr-hunter in runs #23/#25). Three distinct entities took an interest in AIGEN protocol pages on the day AIP-1 launched. Whether they're researchers, bots, or scrapers, the **mindshare-compounding loop is showing weak positive signal**.
• **Don't promote-to-lesson yet** — need to understand intent before claiming "this is X researcher". Watch criteria: if Phase-2 named-path hits continue in the next 24h (especially if any of these IPs come back with deeper paths like `/specs/AIP-1` or `/api/missions/`), promote to lesson + chat-alert.

Other state (brief)

• `198.199.104.186` `Scanner/1.0` — generic git probe (`/.git/config` 301→404 17:20Z). Boring.
• `80.94.95.211` — same Android-spoof env+phpinfo sweep as run #24, this time it tried the same sweep TWICE in 5min (once http-301'd, once https-followed and got 404 for everything). Boring.
• `54.165.20.250` `Go-http-client/1.1` AWS us-east-1 — single GET `/` 200 17:32. Single-hit, no follow-up. N=1 unmemorable.
• `54.67.34.241` stuck MCP client — HEAD /mcp 405 17:18:43. Same client as lesson 37.
• IMAP inbox unchanged. No new GH notifications.

Decision this run

• **0 commits.** No code change justified. The Tencent scanner pattern is interesting observation but acting on it (e.g. blocking the UA, or adding a route) would either (a) reduce signal we're trying to collect, or (b) build a feature for one unknown scanner — exactly the lesson-4 anti-pattern.
• **0 approval cards.** No Tier B trigger.
• **0 lesson updates.** Promote-to-lesson criteria not yet met (need deeper-path follow-up).
• **1 chat message** — surface Tencent pattern to Bilale in plain French, frame as "third pattern of the day", honest about not knowing intent.
• **tasks.json** updated: append done_today entry; `waiting_on_bilale` unchanged.

{"ts": "2026-05-15T17:37:20Z", "action": "run #26: identified Tencent Cloud iPhone-13.2.3 distributed-UA campaign — 26 distinct IPs (AS45090) hitting today, Phase 1 generic-root probes (01:55-13:13Z) → Phase 2 named-path enumeration (16:26-17:37Z) hitting AIGEN-specific paths /work/board, /missions, /dashboard, /join, /AIGEN_PROTOCOL.md, /.well-known/agent.json, /mcp; load-distributed pattern (one path per IP, 1-10min spacing); pre-existing single-hit observations in runs #22 & #24 retroactively identified as same campaign; content-aware (paths not from generic lists) but intent unclear; THIRD independent ecosystem signal today after 61.224 Taiwan reader (run #22) and mcp-dcr-hunter UA (runs #23/#25)", "outcome": "0 commits, 0 approval cards, 0 lesson updates; chat-notified Bilale in French (third pattern of the day); promote-to-lesson deferred pending deeper-path follow-up in 24h", "next_focus_suggestion": "next run: watch for any Tencent iPhone-UA IP returning with deeper paths (/specs/AIP-1, /api/missions/<id>) — that would confirm content-driven crawl and warrant lesson + chat-alert; otherwise continue passive observation"}