Ninety Idle Rotations and a New Lead: The Night MITM Campaign Provider-Credential Outage, the Ad Decision String at /v.f4v, and the Frequency Gate of a Second Play of the Same tvid

The night shift’s closing report handed in a ledger honest to the point of brutality: a three-route verdict, ninety idle rotations self-reported, and three leads worth their ink.

I. The Three-Route Verdict: All Negative, Each with an Epitaph

The Kanxue ad-ID-zero method is unworkable — the v16 plugin simply has no Java-side ad ID generation point: during ad playback the Java log is silent, the ad UI never enters the view tree (a native SurfaceView draws directly), and the only trace is the native CUPID Exec line — request, decision, playback and countdown drawing all live in libcupid.so, with Java a bystander. The AdItem/countdown tamper is unworkable — mForceMs is only a Java UI copy the native side never reads; after the v62 injection the countdown still read 112 seconds, and the injection broke v57’s splash interception (the LANCOME regression), rolled back. The MITM route — proxy plus DNAT infrastructure fully working, complete business traffic captured, but by the master’s standing rule (MITM/proxy is not a delivery plan) it can only diagnose, never conclude.

II. The Self-Report of Ninety Idle Rotations

The most glaring figure in the report is not an experiment’s failure but cron failing ninety consecutive runs from 03:04:53 (provider credential missing: provider custom) — actual progress had stalled at 03:25. The guard did not hide the stall; by its own covenant it self-reported and paused: no more idling. The environment terminal state was checked item by item: the emulator’s in-service plugin v57 (md5 identical to the start of the watch), no FATAL, foreground normal; a leftover DNAT rule was also found (the proxy process long dead, effectively severing port 80 on the device) and deleted, the nat table clean. A guard’s worth is not in how many rounds it ran but in reporting the stall honestly and putting the environment back in order.

III. Three New Leads and One Frequency Gate

The night was not wasted; three leads entered PROGRESS.md: puma-api.ptqy.gitv.tv’s POST /tiger/fetch is the likeliest ad-request entrance; data6.video.ptqy.gitv.tv’s GET /v.f4v returns a 215-byte JSON that looks like an ad decision string — next round grabs the body first; and a discipline-grade discovery: a second play of the same tvid draws no ads (a server-side frequency gate) — verification must use a drama not played that day, otherwise what is being measured is the gate, not the patch. Every advance of reconnaissance came bundled with a discovery that the previous testing method itself had a hole.

IV. The Etiquette of the Guard

The night demonstrated the complete etiquette of a watch: verdicts carry epitaphs (each dead route records why it died), stalls are self-reported (ninety idle rotations counted aloud), environments are inventoried (the DNAT leftover removed, the nat table checked, the untouched list declared), and leads are entered for the next shift (three leads, written to PROGRESS.md). The night took no city, but the wall gained a map dense with coordinates — and a map is precisely the supply the next shift needs most.