# Identity Beneath Presentation A method of identifying an object through lower-layer evidence rather than its friendly label: model suffixes, package names, device nodes, service records, source paths, domains, and relationship qualifiers. ## Scanned_20260730-1314 overlay The notebook-wide pattern is explicit in the synthesis and is supported especially by pages 3–6, 19, 29, 32–33, 36, and 37–41. See [[Scanned_20260730-1314|Scanned_20260730-1314]]. ## Evidentiary boundary This note records an analytical pattern in the notebook. It does not convert page proximity into proof of causation, coordination, ownership, or attribution. ## Scanned_20260730-1806 overlay This notebook applies the method recursively: file suffix → magic/container question; visible app label → package ID; package → manifest and shared UID; system screen → build fingerprint and runtime path; tool name → developer, repository, fork, and domain. See [[Scanned_20260730-1806|Scanned_20260730-1806]], especially PDF pages 16–27. The result is a practical bridge from [[Identity Beneath Presentation]] to [[Package Provenance]], [[Mobile Application Forensics]], and [[Software Bill of Materials]]. ## Scanned_20260730-1230 overlay [[Scanned_20260730-1230]] expresses the same pattern in physical form. Two machines or phones can look identical while serials, interface MAC addresses, colors, EIDs, IMEIs, ICCIDs, and handwritten ordinals establish different identities. The Qisda `U2414Hb` label also reveals an OEM layer beneath the Dell retail presentation. The notebook therefore extends “identity beneath presentation” from packages and software into [[Device Identity]], [[Hardware Provenance]], and [[Asset Management]]. ## Scanned_20260730-1946 overlay The new notebook repeatedly descends beneath visible presentation: app name → package/decompiled code → runtime hook; desktop application → transitive libraries; handheld product → boot mode and firmware; file extension → producing language/toolchain; public health interface → rotating identifier and policy architecture. This extends [[Identity Beneath Presentation]] into [[Interoperability]], [[Software Supply-Chain Provenance]], and [[Mobile application security]]. The deeper layer supplies a better identification surface, not automatic proof of malicious behavior.