[dedup] remove 4 redundant example duplicates; record the rest as open findings

Probe: 16 example pairs where one filename is a strict prefix of another. My
first read called ~13 of them duplicates. That was wrong, and the check that
caught it is the one worth keeping: before deleting anything, ask what each file
is the sole anchor for.

DELETED — 4, cleanly redundant (declare nothing the canonical does not, nothing
anchors them): 2023-04-sentiment-balancer-read-only-reentrancy,
2024-07-li-finance-diamond-facet-exploit, 2024-07-wazirx-230m-exchange-exploit,
2022-02-wormhole-bridge. 659 -> 655.

Three were test_fixtures.positive in a spec — build_specs validates that
fixtures resolve to real examples, so deleting first would have failed the
build. Fixtures repointed to the canonical example, each of which already
carries the required Technique (T9.010, T9.008, T10.007 respectively).

The wormhole file also claimed T10.001 (Validator/Signer Key Compromise) while
its own text reads "primary classification is the signature-verification
bypass" — that is T10.002, which the canonical file correctly carries. No
Guardian key was compromised; the signature was forged through a verification
flaw. A wrong tag, not extra coverage.

NOT DELETED — 7 are technique-lens companions, each the SOLE anchor for
Techniques the canonical lacks: harmony-horizon-economic-incentive-gap holds
T10.007, ankr-abnbc holds T14.003/T14.004, ledger-connect-kit-library holds
T11.006/T4.001, and so on. Deleting them would have silently broken coverage.
One incident legitimately illustrating several Techniques is a defensible
pattern; the open question is that it is currently implicit — Harmony has three
files and nothing marks them as views of one event.

NOT DELETED — 3 pairs are legitimate and not duplication at all:
inverse-finance (two real incidents that April), wintermute vs
wintermute-profanity-cohort ($160M Wintermute vs the ~$3.3M cohort of other
Profanity victims), bybit vs bybit-thorchain-laundering.

Recorded in TAXONOMY-AUDIT as a dated addendum, with two findings that need
adjudication rather than mechanics:

- Companions contradict each other on ATTRIBUTION STRENGTH. Harmony is
  inferred-strong in one file and confirmed in two others; Ankr is confirmed
  with a named individual in one and pseudonymous in another. Same incident,
  same evidence, different label — so the distribution published in STATS.md as
  an integrity metric inherits the error.
- Two pairs contradict on the VULNERABILITY CLASS itself. ParaSpace is
  reentrancy (T9.005) in one file and cross-contract reinitialization (T9.009)
  in the other. Curve/Vyper is T9.005 in one and read-only reentrancy (T9.010)
  in the other — and may not even be the same incident, since the second names
  Market.xyz. Both need source research; neither touched.

npm run check clean. check_tags exits 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: iZonex

BACKLOG.md

@@ -2,7 +2,7 @@
 
 _Generated by `tools/build_backlog.py` on 2026-07-17. Regenerated on every `npm run site:data`._
 
-_Scope: 659 worked examples, 148 Techniques, 19 Threat Actors._
+_Scope: 655 worked examples, 148 Techniques, 19 Threat Actors._
 
 This file is a prioritized contributor backlog. **P0** items close hard structural gaps (empty Tactics, placeholder actor cards). **P1** items lift per-Tactic coverage below the documented minimum. **P2** items anchor candidate sub-Techniques from `TAXONOMY-GAPS.md`.
 

SPECS.md

@@ -253,4 +253,4 @@ Maturity legend:
 
 ---
 
-Updated automatically when `tools/build_specs_index.py` runs as part of `npm run site:data`. Last regenerated from corpus state at `2026-07-17T11:50:56+00:00`.
+Updated automatically when `tools/build_specs_index.py` runs as part of `npm run site:data`. Last regenerated from corpus state at `2026-07-17T12:29:57+00:00`.

STATS.md

@@ -1,11 +1,11 @@
 # OAK — Stats Snapshot
 
-_Auto-generated by `tools/build_stats.py` at 2026-07-17 11:50 UTC._
+_Auto-generated by `tools/build_stats.py` at 2026-07-17 12:29 UTC._
 
 ## Catalogue
 
 - **17** Tactics · **148** Techniques · **19** Threat Actors · **47** Mitigations · **41** Software · **12** Data Sources
-- **659** Worked Examples · **1555** bibtex entries
+- **655** Worked Examples · **1555** bibtex entries
 
 ## Examples by Tactic
 
@@ -19,9 +19,9 @@ _Auto-generated by `tools/build_stats.py` at 2026-07-17 11:50 UTC._
 | T6 (Defense Evasion) | 55 |
 | T7 (Laundering) | 169 |
 | T8 (Operator Continuity / Attribution Signals) | 90 |
-| T9 (Smart-Contract Exploit) | 209 |
-| T10 (Bridge / Cross-Chain) | 56 |
-| T11 (Custody / Signing) | 152 |
+| T9 (Smart-Contract Exploit) | 207 |
+| T10 (Bridge / Cross-Chain) | 55 |
+| T11 (Custody / Signing) | 151 |
 | T12 (NFT-Specific) | 23 |
 | T13 (Account Abstraction) | 20 |
 | T14 (Validator / Staking) | 39 |
@@ -42,9 +42,9 @@ _Auto-generated by `tools/build_stats.py` at 2026-07-17 11:50 UTC._
 | 2019 | 10 |
 | 2020 | 30 |
 | 2021 | 45 |
-| 2022 | 97 |
-| 2023 | 106 |
-| 2024 | 153 |
+| 2022 | 96 |
+| 2023 | 105 |
+| 2024 | 151 |
 | 2025 | 77 |
 | 2026 | 74 |
 
@@ -81,10 +81,10 @@ _Auto-generated by `tools/build_stats.py` at 2026-07-17 11:50 UTC._
 
 | Strength | Count |
 | --- | ---: |
-| pseudonymous | 312 (47.3%) |
-| unattributed | 155 (23.5%) |
-| confirmed | 125 (19.0%) |
-| inferred-strong | 64 (9.7%) |
+| pseudonymous | 312 (47.6%) |
+| unattributed | 151 (23.1%) |
+| confirmed | 125 (19.1%) |
+| inferred-strong | 64 (9.8%) |
 | inferred-weak | 3 (0.5%) |
 
 ## Threat Actors

TAXONOMY-AUDIT.md

@@ -8,6 +8,58 @@ After two Tactic introductions (T15, T16) and ~20 sub-Technique promotions acros
 
 **Author:** maintainer audit, not agent-generated. Judgment calls flagged explicitly.
 
+---
+
+# Addendum — 2026-07-17: same-incident multi-file duplication
+
+Surfaced while fact-checking the corpus against external sources for a downstream project. Not part of the 2026-05 audit above, which closed at 93 sub-Techniques.
+
+**The probe.** 16 example pairs exist where one filename is a strict prefix of another (`2024-07-wazirx` / `2024-07-wazirx-230m-exchange-exploit`). Three are legitimate and are *not* duplication: `2022-04-inverse-finance` vs `-twap` (Inverse genuinely had two incidents that April), `2022-09-wintermute` vs `-profanity-cohort` (the $160M Wintermute loss vs the ~$3.3M cohort of *other* Profanity victims), and `2025-02-bybit` vs `-thorchain-laundering` (incident vs laundering leg).
+
+**Resolved: 4 files deleted.** Cleanly redundant — nothing declared that the canonical file did not, nothing anchoring them. `2023-04-sentiment-balancer-read-only-reentrancy`, `2024-07-li-finance-diamond-facet-exploit`, `2024-07-wazirx-230m-exchange-exploit`, `2022-02-wormhole-bridge`. Three were `test_fixtures.positive` in a spec and were repointed to the canonical example first, each of which already carries the required Technique. The wormhole file additionally claimed **T10.001** (Validator / Signer Key Compromise) while its own text says "primary classification is the signature-verification bypass" — which is T10.002, what the canonical file correctly carries. No Guardian key was ever compromised; the signature was forged through a verification flaw. The tag was wrong, not additional.
+
+## Finding A — seven files are technique-lens companions, not duplicates
+
+The following are same-incident-different-Technique files, and each is the **sole anchor** for Techniques the canonical file does not carry. Deleting them would silently break coverage:
+
+| File | Sole anchor for |
+|---|---|
+| `2022-06-harmony-horizon-economic-incentive-gap` | T10.005, **T10.007** |
+| `2022-06-harmony-horizon-bridge` | T10.005 |
+| `2022-12-ankr-abnbc-liquid-staking-exploit` | **T14.003, T14.004** |
+| `2023-07-multichain-mpc-bridge-verification-model-collapse` | T10.005, T10.007 |
+| `2023-12-ledger-connect-kit-library-supply-chain-compromise` | **T11.006, T4.001** |
+| `2024-01-socket-bungee-bridge` | T4.001, T9.005 |
+| `2024-06-loopring-smart-wallet` | **T11.008, T5.005** |
+
+This is a defensible pattern — one incident legitimately illustrates several Techniques, and a focused per-Technique anchor is more useful than a single sprawling file. **The open question is whether it should be explicit.** Today it is implicit, and it has two costs: the example count treats one incident as three (Harmony has *three* files), and nothing marks these files as views of a shared event.
+
+**Proposal:** an optional `**Same incident as:**` header field, mirroring the existing `**Adjacent Techniques:**` convention, plus a rule in CONTRIBUTING that a per-Technique companion must declare its sibling. Alternatively a `views:` grouping in `oak.json`. Either makes the pattern legible to a consumer counting incidents rather than files.
+
+## Finding B — companions contradict each other on attribution strength
+
+Load-bearing, because the attribution-strength distribution is published in `STATS.md` as an integrity metric:
+
+| Incident | File A | File B |
+|---|---|---|
+| Harmony Horizon | `-horizon` **inferred-strong** | `-horizon-bridge` / `-economic-incentive-gap` **confirmed** |
+| Ankr | `-ankr` **confirmed**, names an individual | `-abnbc-liquid-staking` **pseudonymous** |
+| Multichain | `-multichain` pseudonymous | `-mpc-bridge-…` unattributed |
+| Socket / Bungee, Loopring, Ledger Connect Kit | pseudonymous | varies |
+
+Same incident, same evidence, different strength label. At least one side of each pair is wrong, and the aggregate distribution inherits the error. Requires per-incident adjudication against the sources — not resolvable mechanically.
+
+## Finding C — two pairs disagree on the vulnerability class itself
+
+Worse than a duplicate; these are substantive contradictions and neither was resolved here:
+
+- **ParaSpace (2023-03).** `2023-03-paraspace` classifies the bug as **T9.005 reentrancy** and never uses the word "reinitialization". `2023-03-paraspace-reinitialization-blocksec-whitehat` classifies it as **T9.009 Cross-Contract Reinitialization**. Same date, same $0-loss BlockSec whitehat rescue, same ~$5M at risk. One is wrong about what the vulnerability was.
+- **Curve / Vyper (2023-07).** `2023-07-curve-vyper` carries **T9.005** with the Vyper-compiler-emitted-guard twist and never mentions read-only reentrancy. `2023-07-curve-vyper-market-xyz-read-only-reentrancy` carries **T9.010**. This may not even be the same incident — the filename names Market.xyz — in which case it is misfiled under a `curve-vyper` prefix rather than duplicated.
+
+Both need source research before either file is touched.
+
+---
+
 ## Top-line findings
 
 1. **T9.003 (Governance Attack) overlaps T16.x family** — biggest classification mistake. Should migrate.