# E08. Target-acquisition code and database aggregates

## Collection implementation

The recovered harvester searches repositories by star range, visits branches and extracts both author and committer email fields, lowercasing and trimming them before filtering. The source record describes up to twenty branches per repository, worker-specific ranges, progress tracking and rate-limit handling. Scheduler and merge components consolidate worker results into two SQLite pools consumed by sender configurations. A saved log describes an April 2026 run; its throughput is a log claim, not an independently measured acquisition rate. [S1]

## Aggregate method

The recorded verification opens the held databases read-only. The safe pool is the main database; the antispam pool is attached as `other`. Both expose an `emails` relation with `email` and `repo` fields. These aggregate queries compare already-stored values without additional lowercasing, canonicalization or person-level identity resolution; ingestion itself lowercases and trims addresses. No row-level contact data is included. The following results were reproduced in the read-only, aggregate-only check recorded on 24 October 2026 in Exhibit E08-5. [S2, S3]

`SELECT count(*) FROM main.emails;` — 79,698.

`SELECT count(*) FROM other.emails;` — 62,667.

`SELECT count(*) FROM main.emails s JOIN other.emails a ON s.email = a.email;` — 0.

`SELECT count(*) FROM (SELECT email FROM main.emails UNION SELECT email FROM other.emails);` — 142,365.

`SELECT count(*) FROM (SELECT repo FROM main.emails UNION SELECT repo FROM other.emails);` — 27,698.

## Interpretation

The pools are disjoint under the tested address comparison, while their repository sets overlap. An earlier total of 20,880 repositories represented only the safe pool and is not the combined result. The combined count measures distinct stored repository values, not verified active repositories. [S1, S2]

The analysis note describes sender configurations referencing both pools with differing intervals, cooldowns and warm-up settings. Those configurations are not retained among the exhibit inputs, so this linkage remains a source-note finding. It does not prove that all stored contacts received a message. The labels safe and antispam are the tool's categories, not independent assessments of recipient risk.

## Limits and handling

The unit of analysis is an address string. Aliases, case variants and multiple addresses per person remain unresolved; 142,365 is not a victim or infection count. The two databases remain withheld because they contain harvested contact information. Their source hashes identify the particular inputs but do not make the totals independently reproducible without authorized access. [S4, S5]