Research: watermark delivery flip & leverage ranking (2026-06-14)

Date: 2026-06-14 · Owner: thumbnail-worker · Status: Research memo (point-in-time)

Host identities in this memo use the code-name scheme (H01–H14 flip hosts, H20–H24 cost-control hosts, S01–S04 self-referred institutions, K01 gray-market network). Decodes live in the internal decoder (not published).

TL;DR

• The “we’re not watermarking the buyers” problem from the 06-12 audit (internal repo doc — not published) mostly fixed itself — and overshot. Re-probing production two days later shows the cohort hosts, including H22 (the audit’s flagship “pinned clean for 29 days” example), now serve watermarked bytes on long-aged, uncontaminated edge pins at the probed colo.
• Across 126 probes: 110 wm, 16 clean. A purge/rollout around the 06-12–13 snippet hardening appears to have flipped the per-URL cache lottery, and because the worker watermarks every cohort referrer on a miss, re-pinning resolved toward wm.
• The same flip introduced a reverse leak: no-referrer/direct users now receive wm from edge cache (confirmed on H01, H08, H20, H22) — a violation of the developer-friendly delivery policy in referrer-cohort-and-delivery-policy.
• The binding constraint is therefore no longer delivery. It is the funnel (the now-visible mark still routes nobody to the pricing page) and the reverse leak (over-watermarking ambiguous traffic).
• The cost worry (“invalidating cache is expensive”) is largely moot: the blended per-request rate only applies to blanket page-rule removal. A targeted purge re-pins wm and stays edge-cached (≈$0 ongoing); the snippet redirect path is cheaper than the worker.
• So leverage ranking collapses to one axis — buyer-fit × operator-visibility — because the cheapest hosts to flip are also the best conversion targets, and the expensive ones (H20, H21, H08) are poor conversion targets anyway.

Method

• Cost rates from the snippet/worker cost-reduction plan (internal repo doc — not published): worker $0.504/1M, KV $0.503/1M, 1.13 KV reads/request, blended ≈$1.07/1M skipped-or-added worker requests. These are illustrative per-million unit rates, not bill totals.
• Volumes from the 2026-05-12 cost-candidates pull and per-host top-video-id extract (internal repo docs — not published).
• Cohort membership from apps/thumbnail/lib/referrer-rollout-cohort.ts (266 domains; the worker watermarks all of these on a cache miss).
• Live probes, 2026-06-14: bare-URL GET https://vumbnail.com/{id}.jpg with the candidate host as Referer, reading cf-cache-status, age, and x-thumbnail-variant.

Self-poisoning: only trust aged reads

Only reads with age > 3600s are trusted. Anything younger may be self-poisoned by an earlier probe: the worker normalizes its cache key, and a single probe carrying a cohort referrer pins wm on every miss — so a fresh read can be measuring the probe, not production. Mechanics in watermark-system.

All probes egress a single colo — see Caveats.

Findings

Delivery flipped watermark-dominant

Uncontaminated pins (age > 1h, never touched this session), by host:

Host	wm	clean	Read
H22	4	0	flipped — audit found its top id clean at 29d
H21	7	0	wm
H07	9	0	wm (oldest pin 5.2d)
H04	9	1	wm (oldest pin 3.4d)
H06	4	0	wm
H03	3	0	wm
H20	3	0	wm
H08	2	0	wm
H01	3	4	mixed — still leaking clean
H24	1	1	mixed
H02	1	1	mixed (its hero id is in the snippet HOT set → deterministic wm)
H09 / H05	1 / 1	0	wm
one further cohort host (uncoded)	3	0	wm

Across 126 probes: 110 wm, 16 clean. The set of “hosts we’re not watermarking” is now smaller and colo-dependent, not the broad clean-pinned commercial cohort the 06-12 audit described. The genuinely-still-mixed buyer-fit host at this colo is H01.

The reverse leak is live

Policy violation: direct users are being watermarked

Re-requesting the same URLs with no referrer returned wm from edge cache on one long-aged pinned id each at H01 (age 17.4h), H08, H20, and H22 (age 14h). Direct/no-referrer users — the population the developer-friendly policy explicitly protects — are now being watermarked. Fixing or purging the wm-pinned entries serving ambiguous traffic is the highest-priority correctness issue the flip introduced. Policy: referrer-cohort-and-delivery-policy.

Ranking

Leverage = buyer-fit (commercial, brand-conscious, has budget) × operator-visibility (the mark lands on a page the operator/marketing team actually looks at — not buried in an app/player/LMS) × mark-legibility, divided by cache-invalidation cost. Since the recommended flip mechanisms cost ≈$0 or less (see Cost framing), the denominator drops out and the ranking is buyer-fit × operator-visibility. Targets must also be cheap to keep deterministic: stable catalog ⇒ low snippet HOT churn. Full method: monetization-leverage-method.

Tier 1 — Convert (high buyer-fit, plausibly operator-visible, cheap to flip)

#	Host	Volume	Why	Delivery now (probed colo)
1	H01	low	Brand-conscious consumer commerce; stable product-video catalog	mixed (still leaking clean) — best live target
2	H02	low-mid	Commerce; single dominant hero video already in the HOT set — nearly deterministic already	mixed
3	H03	low	Commerce with staff who browse the catalog pages the embeds live on; catalog rotates	wm
4	H04	low	Commerce; confirmed operator-visible (embeds referenced in landing-page static HTML); stable catalog	wm
5	H05	low	Design-goods commerce; brand-conscious; stable catalog	wm
6	H06	low	Public company; marketing-site embeds; stable	wm
7	H07	low	Commerce; stable YouTube-style ids; already wm-pinned	wm
8	H08	high (largest flip host)	Global brand, high budget — but high volume + likely product-page embeds; verify operator-visibility before spending the purge	wm
9	H09	mid	Commerce, seasonal catalog; both subdomains are separate cohort entries	wm
10	H10–H14	tail (near-free each)	Good buyer-fit, tiny volume — verify operator-visibility	varies

Tier 2 — Do NOT chase for conversion; cost control only

Host	Why not a conversion target	Action
H20	High volume; audit confirmed embeds live in the player/app — the operator never sees the mark; ids rotate (expensive to keep in the snippet HOT set)	Snippet-redirect to cut worker/KV spend
H21	High volume; back-office surface, operator-invisible; heavy malformed-path (/.jpg) traffic	Snippet-redirect / invalid-path short-circuit
H23, H24, and a creator-tipping platform (uncoded)	App/creator embeds — the mark shows to end-users, not the buyer	Cost control only
S01–S04, H22, K01	Viewers ≠ buyers (the audit’s audience-mismatch thesis: institutions, nonprofits, gray-market networks)	Snippet-redirect (cost); already mostly wm

Cost framing (corrected)

Three mechanisms for changing which variant a URL serves, three cost signs:

Mechanism	Effect	Cost
Targeted purge of clean-pinned URLs	next request re-pins wm, stays edge-cached for the 31-day page-rule TTL	one-time miss only ≈ $0 ongoing
Snippet redirect (add host to WM_DOMAINS + current HOT ids in apps/snippet/watermark-router.snippet.js)	307 → prebuilt R2 wm.jpg, runs before cache, skips the worker	negative — saves ≈$1.07/1M blended
Blanket page-rule removal	every request hits the worker every time	≈$1.07/1M ongoing at full program volume — the only expensive path; do not

Any naive “worst case” per-host dollar figure is volume × the blended rate under blanket removal — an anchor, not a plan. The recommended mechanisms cost ≈$0 or save money, so cost does not gate the conversion targets. Details: cost-safe-cache-purging.

Recommendation

1. Re-confirm per-host delivery before any purge — the lottery is colo-local. H01 is the only Tier-1 host still visibly leaking clean at the probed colo; most others already serve wm, so the action there is funnel + legibility, not delivery.
2. Make Tier 1 deterministic via the snippet (add to WM_DOMAINS + current HOT ids), not via page-rule changes. Cheaper than the status quo and removes the lottery. Rollout mechanics: staged-rollouts.
3. Fix the reverse leak first or in parallel — the flip’s policy violation outranks its conversion upside. Scope or purge the no-referrer-pinned entries.
4. Wire the funnel — every watermark now visible is wasted until the mark points at /pricing and /pricing is crawlable. This gates conversion for all tiers and outranks adding more watermarked hosts.
5. Verify operator-visibility for Tier 1 by rendering each host’s key pages in a real JS browser and confirming where the thumbnail lands (homepage/PDP/blog = good; player/app = demote).

Caveats

• Single vantage. All probes egress one colo. Pin state is per-colo × URL × month; global coverage is a patchwork. The wm-dominance finding is directional, not a census.
• Warm-URL bias. Trusted (age > 1h) reads over-sample high-traffic URLs, which are likelier to have been pinned by a cohort referrer. The long tail may hold more clean than this sample implies.
• Stale volumes. Volumes are the 2026-05-12 pull; two hosts from the March cohort fell below the May threshold — re-pull before acting on them.

Sources

• Watermark monetization audit, 2026-06-12 (internal repo doc — not published)
• apps/thumbnail/lib/referrer-rollout-cohort.ts, apps/snippet/watermark-router.snippet.js, apps/thumbnail/lib/customers.json
• Snippet/worker cost-reduction plan and 2026-05-12 volume artifacts (internal repo docs — not published)
• The 2022 31-day edge-TTL *.jpg* page rule and cache baseline (internal repo artifacts — not published); mechanics in watermark-system
• Live production probes, 2026-06-14 (this memo)