# Scanned_20260730-1719
> [!privacy] Privacy-redacted working copy
> Private-person names approved by the vault owner are replaced with `[PERSON REDACTED]`. The private source PDF and pre-redaction backup preserve the original wording. This notice governs over any general statement below describing transcription as exact or unchanged.
## Archival scope and method
This document reconstructs all 76 physical PDF pages of `Scanned_20260730-1719.pdf`, including both covers, sparse and faint pages, crossed-out material, contact lists, network observations, Android and macOS system notes, Unix-lineage research, boot-loader and firmware experiments, and the credential-bearing sticky notes. The PDF is image-only; every page was rendered and inspected visually. Except for explicit privacy redactions, transcriptions preserve visible spelling, capitalization, arrows, and uncertainty as closely as the scan permits. Bracketed text is editorial; quoted text is notebook evidence.
Telephone numbers are replaced with `xxx-xxx-xxxx (see Scanned_20260730-1719.pdf, page N)`. Card numbers, expiration dates, security codes, passwords, recovery material, and comparable secrets are replaced with `[REDACTED CREDENTIAL — see Scanned_20260730-1719.pdf, page N]`. Names, business addresses, public domains, non-secret system identifiers, and visible technical values remain where they have evidentiary value. Research links establish what named technologies or organizations are; they do not prove that every handwritten association is correct.
The notebook’s main active layer is late 2021 through early 2022. Explicit entries include November and December 2021 and January 1, 2022; older dates from 2015, 2016, 2020, and early 2021 appear to have been copied from files, hardware, or earlier records. The 2026 PDF creation date describes scanning, not authorship.
## Knowledge graph navigation
Use [[Index - Notebook Sources|Index - Notebook Sources]] for source identity and scope; [[Index - Master Chronology|Index - Master Chronology]] for dating; and [[Index - People|Index - People]], [[Index - Company and Institution|Index - Company and Institution]], [[Index - Device Inventory|Index - Device Inventory]], and [[Index - Domain and URL Index|Index - Domain and URL Index]] for entity lookup.
The conceptual maps are [[Index - Acronym Dictionary|Index - Acronym Dictionary]], [[Index - Technology and Product Lineage|Index - Technology and Product Lineage]], [[Index - Project and Concept|Index - Project and Concept]], and [[Index - Pattern Ledger|Index - Pattern Ledger]]. Open questions are maintained in [[Index - Unresolved Names and Identifiers|Index - Unresolved Names and Identifiers]].
## Page-by-page reconstruction
## PDF page 1 — Front cover
**Source:** `Scanned_20260730-1719.pdf`, PDF page 1.
**Visible page.** Black pebbled, leather-like cover with a narrow vertical two-tone label near the center. The upper label segment is coral-orange and the lower segment silver-gray. Faint marks on the label are not safely legible.
**Transcription.**
> "[No safely legible text.]"
**Reconstruction.** This is the physical front cover of a compact field notebook. Its format, ruling, closure tab, and later back-cover labels closely match `Scanned_20260730-1706.pdf`.
**Missed Signals and Open Leads.** The colored spine label may once have carried a handwritten volume identifier. Enhancement could be attempted, but the scan does not support a responsible reading.
## PDF page 2 — Hotel network, cloud equities, domains, and device identifiers
**Source:** `Scanned_20260730-1719.pdf`, PDF page 2.
**Visible page.** A dense first working page mixing hotel and network observations, cloud-computing equities, account/domain strings, dates, two telephone numbers, MAC addresses, and cryptocurrency or analytics companies.
**Transcription.**
> "at hotel. Uptown Suites
> Linksys found domain: procentric.local
> xxx-xxx-xxxx (see Scanned_20260730-1719.pdf, page 2)
> xxx-xxx-xxxx (see Scanned_20260730-1719.pdf, page 2)"
> "Nov 8 2021
> AMD Lands
> Meta as Cloud $
> Data Partner To Supply"
> "[uncertain: amazon beb.com Amaz@Rivers]
> [uncertain: pandora \"\" xamboor777p]
> wigle.net bryantmcgill [uncertain: WigMigFig]"
> "Dec 30 2021
> AMD Secular Growth
> EPYC Data Center
> [uncertain: EPIC/EPYC ARM Roadshowed Gamification]
> [uncertain: Cloud of trails]
> [uncertain: Super Scalars options — Rex Risc]
> Meta / AWS
> google Peloton"
> "00:e2:51:00:52:9f Anker Global FavorKeys
> be:2e:f7:32:f9:f9 [uncertain: [PERSON REDACTED]]"
> "Crypto.com
> itrustcapital.com
> C3.ai
> Palantir [uncertain parenthetical]"
**Entities and technical context.** [[AMD EPYC|AMD EPYC]] is AMD’s server-processor family and explains the repeated “data center,” “hyperscaler,” and “secular growth” language. [[Meta Platforms|Meta]], [[Amazon Web Services|AWS]], and [[Google Cloud|Google]] are being treated as demand-side cloud infrastructure. [[Wigle.net|WiGLE]] is a crowdsourced wireless-network database, which fits the nearby MAC-address capture. `procentric.local` resembles a multicast-DNS or local DNS suffix and should not be treated as a public domain. [[C3.ai|C3.ai]] and [[Palantir Technologies|Palantir]] frame the page’s enterprise-AI theme, while [[Crypto.com|Crypto.com]] and [[iTrustCapital|iTrustCapital]] introduce digital-asset custody.
**Whole-page reconstruction.** The page is a convergence map: a real hotel-network observation sits beside investment or market notes about the suppliers of cloud-scale computation, then beside the author’s own account and device identifiers. It begins the notebook at the highest abstraction layer—platform capital and hyperscalers—while already grounding that layer in local radio/network evidence.
**Evidentiary status.** Dates, names, addresses, MAC addresses, and company strings are visible. The financial and causal relationships are notebook hypotheses, not verified claims. Several account-like strings remain uncertain because of handwriting.
**Cross-notebook connection.** The device and wireless capture extends the Android/APN and host-identification work on [[Scanned_20260730-1706#PDF page 5 — Mint/T-Mobile APN and MMS configuration|1706 page 5]] and the later Windows interface inventory on [[Scanned_20260730-1706#PDF page 34 — Windows system information and tunnel adapters|1706 page 34]]. Here, however, the local scan is explicitly connected to the cloud-compute market.
**Missed Signals and Open Leads.** Resolve the hotel’s `procentric.local` service role and OUI owners only from a preserved capture, not handwriting alone. Determine whether “AMD Lands” was a headline fragment and whether “Rex Risc” was meant to contrast x86 superscalar design with RISC/Arm.
## PDF page 3 — AMD, hyperscalers, gaming platforms, and enterprise AI
**Source:** `Scanned_20260730-1719.pdf`, PDF page 3.
**Visible page.** A continuation of page 2 with names, an “Infusion Point” note, AMD’s data-center markets, gaming consoles, cloud-scale computing, digital currencies, machine learning, and acquisition rumors.
**Transcription.**
> "[PERSON REDACTED]
> Lisa Sue
> Lisa Sun
> 2020 Infusion Point"
> "Data Center EPYC 2021
> PlayStation AWS Data Center
> XBox, FB ‘META’
> Apple, Running large scale
> companion from home in cloud.
> Digital Currencies"
> "* AMD Best Buy Relationship
> High Performance Computing
> Hyper-Scalars
> Nvidia is buying Arm
> [uncertain: Zylinx] being bought by AMD links?"
> "Found AMD Account in my name ‘Kai’
> * Kai-Fu Lee"
> "Machine Learning
> neural nets
> speech recognition
> enterprise ai -> C3.ai
> Palantir [uncertain spelling]"
**Identity correction.** The exact written form “[PERSON REDACTED]” is identified by the vault owner as [PERSON REDACTED], also known as [PERSON REDACTED], and [PERSON REDACTED]. The faithful transcription above remains unchanged.
**Entities and technical context.** [PERSON REDACTED] resolves to the canonical [PERSON REDACTED] identity following the owner’s correction. [[Index - People#Lisa Su|Lisa Su]] is AMD’s chair and CEO; “Lisa Sun” appears to be a phonetic or spelling variant written immediately below. AMD announced its plan to acquire [[Xilinx|Xilinx]] in October 2020 and completed the transaction on February 14, 2022, combining CPUs, GPUs, FPGAs, and adaptive SoCs ([AMD completion announcement](https://www.amd.com/en/newsroom/press-releases/2022-2-14-amd-completes-acquisition-of-xilinx.html)). The note “Nvidia is buying Arm” accurately captures a proposed transaction as of December 2021, but NVIDIA and SoftBank terminated it on February 7, 2022 ([NVIDIA announcement](https://nvidianews.nvidia.com/news/nvidia-and-softbank-group-announce-termination-of-nvidias-acquisition-of-arm-limited)). [[Index - People#Kai-Fu Lee|Kai-Fu Lee]] is an AI researcher and investor; the adjacent “Kai” account clue may be mnemonic association rather than identity.
**Whole-page reconstruction.** This page is an investment-and-platform thesis in outline form. AMD is seen as the common compute supplier behind consoles, data centers, cloud services, and AI workloads. The acquisition notes reveal attention to architectural consolidation: x86 CPUs, programmable logic, GPUs, and Arm were being reorganized by large vendors.
**Evidentiary status.** Company and product names are visible; the notebook’s proposed linkages to Best Buy, Apple, specific accounts, or named people are not independently demonstrated. The NVIDIA/Arm entry is historically time-bounded and later became false when the deal was terminated.
**Cross-notebook connection.** [[Scanned_20260730-1706#PDF page 2 — Domains, Ubuntu workstation, and hardware profile|1706 page 2]] documents one Intel/Ubuntu workstation. This page moves outward to the industrial supply chain that furnishes such machines and inward toward AI as a workload.
**Missed Signals and Open Leads.** Identify “2020 Infusion Point” and clarify why the [PERSON REDACTED] name cluster appears beside the AMD/AI thesis. Test whether “companion from home in cloud” referred to remote work, cloud gaming, or an AI assistant.
## PDF page 4 — Hotel LAN scan and gateway services
**Source:** `Scanned_20260730-1719.pdf`, PDF page 4.
**Visible page.** A handwritten LAN inventory for `wlan0`: local address, gateway/vendor, gateway MAC, TCP service ports, a Pixel handset, and public DNS resolvers.
**Transcription.**
> "wlan0
> 172.20.1.44
> nomadix, inc. 172.20.1.1
> 00:50:e8:00:ba:3f"
> "80 HTTP
> 53 DNS
> 1883 MQTT
> 5000 UPnP
> 8000 HTTP Alt
> ~~8080 HTTP BRProxy~~
> 62078 iPhone-Sync
> TCP"
> "172.20.1.44 (Pixel 4a 336e)
> 60:b7:6e:34:34:50
> 9.9.9.9 / 0.0.0.0
> 1.1.1.1"
**Entities and technical context.** [[Nomadix|Nomadix]] makes hospitality-network gateways, which is consistent with the hotel context. Port 1883 is conventionally associated with [[MQTT|MQTT]], port 5000 is sometimes used by UPnP-related services, and 62078 is associated with Apple device synchronization. [[Quad9|Quad9]] uses `9.9.9.9`; [[Cloudflare DNS|Cloudflare DNS]] uses `1.1.1.1`. A port label records a scanner’s service guess, not proof of the application actually listening.
**Whole-page reconstruction.** This is a practical reconnaissance sheet for a captive hospitality LAN. The author identified the gateway and local handset, then recorded exposed service signatures and alternate resolvers. It is diagnostic rather than conclusively adversarial: the same observations support troubleshooting, privacy checks, or device discovery.
**Evidentiary status.** Addresses and labels are visible. Vendor and protocol attribution likely came from a scanner/OUI database. No packet capture or banner evidence is preserved, so services remain probable rather than proven.
**Cross-notebook connection.** The page fills the gap between the mobile provisioning on [[Scanned_20260730-1706#PDF page 5 — Mint/T-Mobile APN and MMS configuration|1706 page 5]] and the protocol-analysis pages [[Scanned_20260730-1706#PDF page 25 — Application Layer Gateway concept|1706 pages 25–30]]: it shows the live access network being enumerated.
**Missed Signals and Open Leads.** Preserve scanner timestamps, probe type, and service banners in future captures. `0.0.0.0` may be a failed resolver, route placeholder, or copied interface value.
## PDF page 5 — Android network scanner and nearby access points
**Source:** `Scanned_20260730-1719.pdf`, PDF page 5.
**Visible page.** Android app/service text and a list of visible or hidden wireless infrastructure with manufacturers, MAC addresses, and Wi-Fi-generation notes.
**Transcription.**
> "Intent Filter Verification Service
> restricted 3.41 GB"
> "Ruckus
> Samsara Networks, Inc
> fc:fb:21:05:cf:2a
> [uncertain: 802.11y / 802.11u]"
> "TP-Link
> 60:a4:b7:98:31:52"
> "Hidden
> 22:ef:bd:44:ca:64
> 5G 802.11n"
> "[uncertain: IWDNL / Liteon Technologies Corporation]"
**Entities and technical context.** [[Android App Links|Android App Links]] verification checks whether an app is authorized to handle URLs for a claimed web domain; Android’s documentation describes verified links as a trust relationship between a site and app ([Android App Links verification](https://developer.android.com/training/app-links/verify-applinks)). [[Ruckus Networks|Ruckus]], [[Samsara|Samsara]], [[TP-Link|TP-Link]], and [[Lite-On Technology|Lite-On]] are network or hardware vendors. “5G” almost certainly means the 5 GHz Wi-Fi band, not cellular 5G.
**Whole-page reconstruction.** This appears to combine an Android storage/service screen with wireless scanning. The author is trying to distinguish software-level link handling from the physical access points around the device—two different layers of “where a connection goes.”
**Evidentiary status.** The scanner labels and MAC addresses are visible. Because OUIs can belong to component manufacturers and MAC randomization is common, they do not conclusively identify the operator of each network.
**Cross-notebook connection.** The page continues the device-identity inventory seen on [[Scanned_20260730-1706#PDF page 31 — Linux/Android fragment|1706 page 31]] and anticipates this notebook’s recurring interest in mapping logical names back to hardware.
**Missed Signals and Open Leads.** Resolve whether the handwritten standard is 802.11u, which would fit hotspot roaming, rather than 802.11y. Record SSID, BSSID, channel, security mode, and collection time together.
## PDF page 6 — T-Mobile LTE cell identity and Wi-Fi Direct names
**Source:** `Scanned_20260730-1719.pdf`, PDF page 6.
**Visible page.** Cellular-network fields followed by a dated list of Wi-Fi Direct or nearby SSIDs.
**Transcription.**
> "operators
> 310 260 PLMN T-Mobile-US
> channel band 1900 EARFCN 31955
> Identity CI 16525423
> [uncertain: eNB: CID: 64553:11 (1)]
> TAC 31955 PCI; 199"
> "Nov 23 9:51 AM
> [uncertain: cz.mroczis.net monster]
> WiFi Direct
> DIRECT-soko-FUY-6CFB26
> CCT-SCR-RESTRICTED
> mobileservice
> PizzaToday
> TP-Link-3132"
**Entities and technical context.** [[Public Land Mobile Network|PLMN]] identifiers combine country and network codes; `310 260` identifies T-Mobile US. [[E-UTRA Absolute Radio Frequency Channel Number|EARFCN]], [[Tracking Area Code|TAC]], [[Physical Cell ID|PCI]], and cell/eNodeB identifiers are LTE radio-access fields. The copied placement of `31955` beside both EARFCN and TAC may reflect a transcription error rather than a genuine equality. [[Wi-Fi Direct|Wi-Fi Direct]] creates peer-to-peer groups whose generated SSIDs often begin `DIRECT-`.
**Whole-page reconstruction.** The author is correlating cellular infrastructure with nearby peer-to-peer and conventional Wi-Fi names at a specific moment. Together with pages 4–5, this forms a three-page radio and access-network survey: gateway, Wi-Fi environment, then cellular cell.
**Evidentiary status.** The numeric fields are visible but their labels may have been copied from an app screen imperfectly. SSIDs identify advertised networks, not necessarily people or organizations.
**Cross-notebook connection.** Whereas [[Scanned_20260730-1706#PDF page 5 — Mint/T-Mobile APN and MMS configuration|1706 page 5]] records the configuration needed to join T-Mobile’s packet network, this page records the network identity observed after joining.
**Missed Signals and Open Leads.** Reconstruct the cell only with a contemporaneous tower database and timestamp. Avoid treating playful SSIDs such as “PizzaToday” as verified owner names.
## PDF page 7 — Android identity fragments and real-estate investor mapping
**Source:** `Scanned_20260730-1719.pdf`, PDF page 7.
**Visible page.** A small Android/package fragment at upper left and, below a January 1, 2022 Bloomberg note, a real-estate and investment network.
**Transcription.**
> "
[email protected]
> [uncertain: org.ligi.axt]
> Apt Aug / Sept / Oct 2021
> [uncertain: AXT.at(ctx)]"
> "Jan 01, 2022, Bloomberg
> A-ROD Corp Alex Rodriguez
> ‘Lynx’
> [uncertain: SIP / SLIP / slack]
> partner Newport Property Mgmt
> 5K units from Florida to Texas
> ‘Grand Station’ in Miami
> ‘Erin Knight’ — mgmt company"
> "Barry Sternlicht
> Black(Rock|Stone)
> Warren Buffett"
> "Marc Lore
> Jet.com"
**Entities and technical context.** `
[email protected]` resembles the public identity of Android developer [[Index - People#Ligi|ligi]], and `org.ligi...` resembles a Java/Android package namespace. [[Index - People#Alex Rodriguez|Alex Rodriguez]], [[Index - People#Barry Sternlicht|Barry Sternlicht]], [[BlackRock|BlackRock]], [[Blackstone|Blackstone]], [[Index - People#Warren Buffett|Warren Buffett]], and [[Index - People#Marc Lore|Marc Lore]] form a business/investment comparison set. The parenthetical “Rock|Stone” shows that the author had not yet resolved which similarly named investment company applied.
**Whole-page reconstruction.** The page shifts from code identity to ownership identity. A Bloomberg segment or search session appears to have prompted a graph of operators, property managers, unit counts, projects, and better-known comparison investors. The exact relationship between the Android fragment and the real-estate notes is not visible.
**Evidentiary status.** The broadcast date and names are visible. The notebook’s “partner,” project, and unit-count assertions are unverified in this reconstruction and should not be read as a due-diligence conclusion.
**Cross-notebook connection.** This resembles the entity-association lists elsewhere in the archive, but here the author visibly preserves ambiguity (“Black(Rock|Stone)”) instead of silently choosing.
**Missed Signals and Open Leads.** Identify the Bloomberg segment aired January 1, 2022. Resolve “Lynx,” “Grand Station,” and “Erin Knight” from that source before creating canonical entity links.
## PDF page 8 — Android shell, remote access, and resource names
**Source:** `Scanned_20260730-1719.pdf`, PDF page 8.
**Visible page.** A list of Android utilities followed by package/resource fragments and Java/ICU terms.
**Transcription.**
> "Power Menu Pro
> Nextcloud
> droid VNC - NG
> [uncertain: AJShA / AJSHA Android Java Shell App]
> Google Sunfish"
> "ctx —
> [uncertain: org.ligi.ajsha.R.drawable.ic_launcher]
> ic_launcher
> ICE
> icu.jar
> [uncertain: ic4o / icu4j jar]
> [uncertain: icutil icu4jle root Ø]"
**Entities and technical context.** [[Nextcloud|Nextcloud]] is an open-source self-hosted content-collaboration platform ([Nextcloud](https://nextcloud.com/)). [[droidVNC-NG|droidVNC-NG]] provides remote screen access to Android devices. `sunfish` is the device codename associated with the Pixel 4a. `R.drawable.ic_launcher` is an Android compiled-resource reference; [[ICU4J|ICU4J]] is the Java implementation of International Components for Unicode. “Android Java Shell App” and the `org.ligi` namespace likely point to a shell or code-execution utility.
**Whole-page reconstruction.** This is a small Android control stack: power controls, self-hosted file access, remote desktop, and a Java shell. The lower half looks like reverse engineering or inspection of the shell app’s resources rather than ordinary app usage.
**Evidentiary status.** Product names and code-like strings are visible, but several package characters are uncertain.
**Cross-notebook connection.** The remote-access layer parallels Remmina and virtualization on [[Scanned_20260730-1706#PDF page 13 — Remote desktop, display managers, and desktop environments|1706 pages 12–14]], now focused on the phone rather than a workstation.
**Missed Signals and Open Leads.** Confirm the exact app package from an APK manifest. “ICE” may mean an icon/resource name, a communications framework, or a mistaken reading.
## PDF page 9 — Windows boot configuration prompt
**Source:** `Scanned_20260730-1719.pdf`, PDF page 9.
**Visible page.** A sparse page with one Windows keyboard sequence near the top; faint reverse-side show-through occupies the rest.
**Transcription.**
> "Windows
> win + R
> msconfig"
**Entities and technical context.** [[MSConfig|MSConfig]] is the Windows System Configuration utility, reachable through the Run dialog. It exposes boot, service, and startup-diagnostic controls.
**Whole-page reconstruction.** This is a quick recovery mnemonic: open the Run box and reach system configuration without navigating the graphical settings hierarchy.
**Cross-notebook connection.** It is the Windows counterpart to the Apple startup-key and Linux boot-loader notes that dominate later pages.
**Missed Signals and Open Leads.** None beyond the possibility that missing text was too faint to scan.
## PDF page 10 — FDD, Charles Lieber, NIH/DOD funding, and Thousand Talents
**Source:** `Scanned_20260730-1719.pdf`, PDF page 10.
**Visible page.** A public telephone number at the top, an organization name and social-media handle, then a news-case cluster involving Harvard, Boston, NIH, DOD, and China’s Thousand Talents program.
**Transcription.**
> "xxx-xxx-xxxx (see Scanned_20260730-1719.pdf, page 10)
> foundation for Defensive Democracies
> [uncertain: ff info cfdd.org]
> @fdd"
> "NIH DOD Tech
> woman Harvard Professor
> Charles Liber ([uncertain: Treasory] Trial)
> Boston
> chin 1000 talent"
**Entities and technical context.** The organization is [[Foundation for Defense of Democracies|Foundation for Defense of Democracies]], a Washington research institute focused on foreign policy and national security ([FDD about page](https://www.fdd.org/about-fdd/)). The other cluster points to [[Index - People#Charles Lieber|Charles Lieber]], the former chair of Harvard’s Chemistry and Chemical Biology Department. On December 21, 2021, a federal jury convicted him on false-statement and tax-related counts involving his affiliation with China’s Thousand Talents Program and Wuhan University of Technology; DOJ records also note NIH and DOD grant funding ([DOJ conviction announcement](https://www.justice.gov/usao-ma/pr/harvard-university-professor-convicted-making-false-statements-and-tax-offenses)). The page’s “woman Harvard Professor” remains unresolved and may refer to another commentator or case.
**Whole-page reconstruction.** This appears to be a news-monitoring page created near the December 2021 verdict. FDD’s public contact details may have been copied from a broadcast or website during broader national-security research. The page does not establish any operational relationship between FDD and the Lieber case.
**Evidentiary status.** The Lieber case and FDD identity are externally verifiable. Their adjacency is notebook evidence only; no causal or institutional link should be inferred.
**Cross-notebook connection.** The archive repeatedly combines public-policy institutions with technical infrastructure. Here, national-security framing enters a notebook otherwise concerned with system control and supply chains.
**Missed Signals and Open Leads.** Identify the “woman Harvard Professor,” the misspelled domain fragment, and the exact broadcast or article that joined these notes.
## PDF page 11 — Organizational “cohorts” map
**Source:** `Scanned_20260730-1719.pdf`, PDF page 11.
**Visible page.** A red heading “Cohorts” above a long mixed list of foundations, media, finance, technology, entertainment, government, and political personalities.
**Transcription.**
> "Cohorts
> Bill & Melinda Gates Foundation
> CERN
> World Bank
> Bloomberg Media
> Soft Bank
> WSJ
> FOUNDATION for a Better Life
> [REDACTED]
> (Open) AI
> CNBC
> Inc. Magazine
> United Nations
> Foundation for a Better Life
> Nasdaq
> Pinewood Studios
> IMDB
> Toys for Tots
> Ruckus (tech)
> Peter Thiel (paypal), Palantir
> Rumble
> Alex Jones
> Live Aid
> [PERSON REDACTED]
> Little Things
> [uncertain: LBS (LadyBirdLake)]"
**Entities and technical context.** The list includes [[Bill & Melinda Gates Foundation|Bill & Melinda Gates Foundation]], [[CERN|CERN]], [[World Bank|World Bank]], [[Bloomberg|Bloomberg]], [[SoftBank|SoftBank]], [[The Wall Street Journal|WSJ]], [[Foundation for a Better Life|Foundation for a Better Life]], [REDACTED], [[OpenAI|OpenAI]], [[United Nations|United Nations]], [[Nasdaq|Nasdaq]], [[Pinewood Studios|Pinewood Studios]], [[IMDb|IMDb]], [[Toys for Tots|Toys for Tots]], [[Index - People#Peter Thiel|Peter Thiel]], [[Palantir Technologies|Palantir]], [[Rumble|Rumble]], [PERSON REDACTED], and [[Index - People#Alex Jones|Alex Jones]]. The vault owner resolves [PERSON REDACTED] as [PERSON REDACTED], also associated with `[PERSON REDACTED]` and `[PERSON REDACTED]`. “Cohorts” should be read as the author’s grouping label, not proof of partnership or coordination.
**Whole-page reconstruction.** This is an exploratory entity set rather than a coherent corporate family. Possible common dimensions include large-scale influence, philanthropy or public messaging, media reach, advanced technology, and institutional legitimacy. Repetition of Foundation for a Better Life suggests emphasis rather than accidental duplication.
**Evidentiary status.** Only presence on the list is established. No relationship among the listed entities is independently supported by the page.
**Cross-notebook connection.** The list anticipates the “federation” metaphor on pages 73–75: the author repeatedly organizes heterogeneous entities into imagined cohorts or systems.
**Missed Signals and Open Leads.** Determine whether the list was sourced from a television-program sponsor crawl, a browsing recommendation graph, or a personally constructed influence map. “[PERSON REDACTED]” is resolved by the vault owner as [PERSON REDACTED]; “Little Things” and “LBS” remain unresolved.
## PDF page 12 — Products, companies, and Texas associations
**Source:** `Scanned_20260730-1719.pdf`, PDF page 12.
**Visible page.** Two red category headings, “Products” and “Texas Companies,” with a short mixed list.
**Transcription.**
> "Products
> Intertek (Austin, Houston)
> Xfinity"
> "Texas Companies
> [uncertain: Wayfair (Channel Islands Isle of Man)]
> Bill Gates (Houston)
> Tech
> FOSS"
**Entities and technical context.** [[Intertek|Intertek]] provides testing, inspection, and certification services; [[Xfinity|Xfinity]] is Comcast’s consumer connectivity brand. [[Wayfair|Wayfair]] is a retailer, while Channel Islands and Isle of Man references may concern corporate registration or an unrelated entity. [[Free and Open Source Software|FOSS]] becomes a central theme later.
**Whole-page reconstruction.** The page is a sorting surface. Consumer products, local corporate presence, jurisdictional clues, prominent names, and “FOSS” are being collected under provisional headings rather than argued into a finished theory.
**Evidentiary status.** The words are visible; implied Texas or offshore associations are not validated.
**Cross-notebook connection.** The movement from companies to FOSS foreshadows the notebook’s later choice between vendor dependence and open, inspectable infrastructure.
**Missed Signals and Open Leads.** Identify the source that placed Wayfair near Channel Islands/Isle of Man and clarify what “Bill Gates (Houston)” denotes.
## PDF page 13 — Lost-access inventory
**Source:** `Scanned_20260730-1719.pdf`, PDF page 13.
**Visible page.** A domain-like string above a heading “Lost Access,” followed by consumer, developer, and social accounts.
**Transcription.**
> "[uncertain: articud.com]"
> "Lost Access
> MintMobile
> Magic Jack
> [uncertain: Dumpster]
> Multiple Accts
> Twitter
> Pinterest
> Mailchimp
> [uncertain: BootBoi]
> GoogleFi
> Buffer
> GetHub
> Facebook
> Catima"
**Entities and technical context.** [[Mint Mobile|Mint Mobile]], [[MagicJack|MagicJack]], [[Google Fi|Google Fi]], [[Twitter|Twitter]], [[Pinterest|Pinterest]], [[Mailchimp|Mailchimp]], [[Buffer|Buffer]], [[GitHub|GitHub]], [[Facebook|Facebook]], and [[Catima|Catima]] span telephony, identity, publishing, code hosting, social media, and digital-card storage.
**Whole-page reconstruction.** This is a blast-radius inventory: which capabilities disappear when identity or credentials fail. The list reveals that account recovery was not one service problem but a cross-platform continuity problem affecting phone numbers, publishing, audience access, source code, and stored credentials/cards.
**Evidentiary status.** The notebook states “Lost Access”; it does not record cause, date, recovery status, or whether every service belonged to the same identity.
**Cross-notebook connection.** This directly extends the provisioning and wallet-custody pages [[Scanned_20260730-1706#PDF page 4 — Mint Mobile activation and account recovery|1706 pages 4–7]] and the email/device recovery chronology on [[Scanned_20260730-1706#PDF page 32 — Email/device recovery chronology|1706 page 32]].
**Missed Signals and Open Leads.** Build a recovery matrix with service, owner identity, recovery channel, MFA method, export path, and current status. That operational artifact is missing from the notebook.
## PDF page 14 — Android root, ROM, app-store, monitoring, and removal tools
**Source:** `Scanned_20260730-1719.pdf`, PDF page 14.
**Visible page.** A long Android utility list spanning root access, ROM installation, settings, app stores, removal, browsers, SMS control, and monitoring.
**Transcription.**
> "Top Root Browser
> Kinguser
> APNSwitch
> Lineage Downloader
> Cyanogen mod Installer
> Smart Quick Settings
> Rom Manager Premium Manager
> ~~[uncertain crossed word]~~ Software Update (Warning-)
> Voice Recorder
> Amazon App Store
> Jars
> Get Jar
> Black Mart Pro
> System App Remover No Root
> GetJar.com
> [uncertain: BitIamPlus Assistance for Car Rom]
> Total SMS Control
> mSpy
> UC Browser"
**Entities and technical context.** [[LineageOS|LineageOS]] succeeded CyanogenMod as a community Android distribution. ROM managers, root managers, alternate app stores, system-app removers, SMS-control apps, and commercial monitoring software operate at very different trust levels. [[mSpy|mSpy]] is marketed as monitoring software; “Black Mart Pro” names an unofficial app source. A historical list like this can document prior Android experiments, but it is not a safe installation recommendation.
**Whole-page reconstruction.** The author is assembling ways to escape a stock Android environment: obtain root, replace the ROM, bypass an app store, remove bundled software, and remotely observe/control the device. That is consistent with the notebook’s sovereignty theme, but the list collapses liberating tools and high-risk surveillance or piracy-adjacent tools into the same search space.
**Evidentiary status.** Product names are visible; installation, use, legitimacy, and current safety are not established.
**Cross-notebook connection.** The page’s root/ROM ambition is the mobile equivalent of the later Coreboot/Libreboot firmware replacement work. Both seek control below the vendor’s default interface.
**Missed Signals and Open Leads.** A modern reconstruction should add provenance, signatures, source availability, permissions, legal status, and threat-model fit for every tool before execution.
## PDF page 15 — Faint media/name fragments
**Source:** `Scanned_20260730-1719.pdf`, PDF page 15.
**Visible page.** Extremely faint writing near the top; most of the page is blank or affected by show-through.
**Transcription.**
> "[uncertain: Feumes / Fiomues]
> [uncertain: Ralph Fiennes? ‘Beat the Devil’ ‘Oxford Circ’]
> [uncertain: Groop]"
**Entities and technical context.** [[Index - People#Ralph Fiennes|Ralph Fiennes]] is a plausible reading, and “Beat the Devil” is a title shared by multiple works. The scan does not support a confident identification of the surrounding words.
**Whole-page reconstruction.** This may be a media or theater note unrelated to the technical sequence, or it may preserve search terms from a broadcast.
**Evidentiary status.** All readings are low confidence.
**Missed Signals and Open Leads.** Reinspect only if another notebook supplies the same phrase; otherwise leave unresolved.
## PDF page 16 — Android source-domain fragment
**Source:** `Scanned_20260730-1719.pdf`, PDF page 16.
**Visible page.** Nearly blank page with one faint domain at the bottom edge.
**Transcription.**
> "[uncertain: android-source.githuh.io]"
**Entities and technical context.** The string likely intends a GitHub Pages domain (`github.io`), but the exact account or project cannot be recovered confidently.
**Whole-page reconstruction.** This is a source-code or documentation pointer, positioned after the Android root/ROM page.
**Missed Signals and Open Leads.** Do not normalize the domain without corroboration. It may have been copied incorrectly at the time.
## PDF page 17 — Windows packages, connected devices, and alternate operating systems
**Source:** `Scanned_20260730-1719.pdf`, PDF page 17.
**Visible page.** Windows package and service fragments above a list of ChromeOS/Android-derived operating systems.
**Transcription.**
> "IHDR
> DCU.Centennial_3.0.160.0_x64.appx
> Unistore
> Connected Devices Platform
> [uncertain: ComExp.msc]
> [uncertain package suffix: Buekyb3d8bbwe]"
> "FydeOS.com
> [uncertain: Sotrawids]
> Blisslabs roms os
> Sailfish / FydeOS"
**Entities and technical context.** `.appx` identifies a Windows application package. [[Connected Devices Platform|Connected Devices Platform]] supports cross-device experiences in Windows. [[FydeOS|FydeOS]] is a Chromium-OS-based system that supports web, Android, and Linux application environments ([FydeOS overview](https://fydeos.io/help/faq/about-fydeos/what-is-fydeos/)). [[Bliss OS|Bliss OS]] brings Android-derived systems to PCs, while [[Sailfish OS|Sailfish OS]] is a mobile Linux platform.
**Whole-page reconstruction.** The page begins in Windows package archaeology and then escapes into alternate operating systems. The common question is how a device’s application model can be replaced or extended across Windows, Chromium, Android, and mobile Linux.
**Evidentiary status.** The exact APPX package and several strings are uncertain. The OS names are clear.
**Cross-notebook connection.** This is an early version of the multi-boot shortlist on [[Scanned_20260730-1706#PDF page 22 — Boot and enterprise-platform shortlist|1706 page 22]], now emphasizing Android/Chromium compatibility.
**Missed Signals and Open Leads.** Resolve the APPX publisher suffix and whether “IHDR” is a filename, PNG chunk type, or acronym copied from inspection output.
## PDF page 18 — macOS installer image fragment
**Source:** `Scanned_20260730-1719.pdf`, PDF page 18.
**Visible page.** Three short lines near the top.
**Transcription.**
> "ESD
> InstallESD.dmg
> [uncertain: cd boot type=1_]"
**Entities and technical context.** [[InstallESD.dmg|InstallESD.dmg]] is associated with macOS installer media. `DMG` is Apple’s disk-image container; “ESD” commonly denotes electronic software distribution.
**Whole-page reconstruction.** This is a reminder about locating or interpreting the bootable payload inside macOS installation media.
**Cross-notebook connection.** It pairs with disk-image mounting and ISO cloning on [[Scanned_20260730-1706#PDF page 11 — ISO cloning and image-mounting toolkit|1706 page 11]].
**Missed Signals and Open Leads.** The final command fragment is too incomplete to execute or normalize.
## PDF page 19 — macOS kernel extensions, storage controllers, and historical dates
**Source:** `Scanned_20260730-1719.pdf`, PDF page 19.
**Visible page.** Dates, ACPI and SMC terms, a `/Library/Extensions` path, a device ID, XPC, and two storage-controller vendors.
**Transcription.**
> "07 aug 1 2015
> 07 July 8 2016
> 06 Jun 23 2016
> June 2016
> 6/23/16
> [uncertain: Hotbuy]"
> "ACPI Accusys, Inc.
> ACPI SMC
> Location /Library/Extensions/ACS6x/ACS6x.kext
> ID. [uncertain device identifier]
> XPC Service framework"
> "Highpoint Technologies, Inc. 8/14/14
> HighPoint
> [uncertain: com.highpoint-Tech.text]
> HighPointIOP"
**Entities and technical context.** [[Kernel Extension|Kernel extensions]] (`.kext`) historically extended the macOS kernel for hardware such as RAID or storage controllers. Apple now prefers system extensions, which run in user space and reduce kernel-level risk ([Apple deployment guide](https://support.apple.com/guide/deployment/system-extensions-in-macos-depa5fb8376f/web)). [[Accusys|Accusys]] and [[HighPoint Technologies|HighPoint Technologies]] make storage and RAID hardware. [[Advanced Configuration and Power Interface|ACPI]] describes platform configuration/power interfaces; [[System Management Controller|SMC]] is Apple’s hardware-management controller.
**Whole-page reconstruction.** The dates likely come from driver files, certificates, builds, or device metadata rather than the notebook’s writing date. The author is tracing which third-party storage extension attaches to which hardware and framework.
**Evidentiary status.** Paths and vendors are visible. The identifier and bundle name are too uncertain to use for exact driver matching.
**Cross-notebook connection.** The page adds macOS driver provenance to the disk-imaging and filesystem stack on [[Scanned_20260730-1706#PDF page 16 — APT package inventory for filesystems and forensics|1706 page 16]].
**Missed Signals and Open Leads.** Capture `kextstat`, bundle identifiers, code-signing data, and hardware PCI IDs together to distinguish installed, loaded, and merely present extensions.
## PDF page 20 — macOS recovery and command-line tool inventory
**Source:** `Scanned_20260730-1719.pdf`, PDF page 20.
**Visible page.** Dense two-column list of macOS utilities, daemons, storage commands, identity tools, and help syntax.
**Transcription.**
> "[faint: usage commandline ... -h ... ascii / asctl / bash / domainname]
> AppleFileServer
> BootCacheControl
> NetBootClientStatus
> KernelEventAgent
> nvram
> ./ --help
> command --help
> csrutil
> fmt
> host / hosting / hostname
> installer
> [uncertain: LAM / lower]
> mDNSResponder
> resetFileVaultPassword
> resetpassword
> [uncertain: ocsp]
> ipconfig
> ioreg"
> "security
> scutil
> host
> coreaudio
> comm
> df
> [uncertain: disktool]
> diskutil
> hdiutil
> netstat
> xar
> [uncertain: mpioutil]
> dscl
> filevaultRecovery
> bsdtar
> system_profiler
> [uncertain: fi]
> fibreconfig"
**Entities and technical context.** The list spans [[macOS Recovery|macOS Recovery]], boot caching and network boot, [[NVRAM|NVRAM]], System Integrity Protection (`csrutil`), disk and image administration (`diskutil`, `hdiutil`), identity (`dscl`), network configuration (`scutil`, `ipconfig`, `netstat`, `mDNSResponder`), security/keychain interfaces (`security`), and hardware profiling. Apple documents FileVault as full-volume encryption with recovery-key or account-based recovery paths ([Apple FileVault guide](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac)).
**Whole-page reconstruction.** This is a rescue-shell vocabulary sheet: the commands most useful when the graphical system is unavailable or a disk, account, boot state, or network must be diagnosed from Recovery.
**Evidentiary status.** Many command names are clear; several faint entries may be legacy tools, misspellings, or output labels.
**Cross-notebook connection.** The page is the macOS analog of the Linux administration package sets on [[Scanned_20260730-1706#PDF page 20 — System-administration control panel|1706 pages 20–22]].
**Missed Signals and Open Leads.** Add command purpose, OS-version availability, required recovery mode, and read-only versus mutating risk. A bare command inventory is easy to misuse.
## PDF page 21 — “Whatever it is” system and NVRAM variables
**Source:** `Scanned_20260730-1719.pdf`, PDF page 21.
**Visible page.** A heading naming an unspecified system, followed by `nvram` option notes and percent-encoded Apple NVRAM variable values.
**Transcription.**
> "‘The Whatever it is’ system
> commands"
> "nvram -p print all nvram vars
> -f set vars from text file
> -d delete named var
> name=value set named value
> name print named value
> -c delete all vals."
> "macbook air ... with nvram -p
> [uncertain: BootCampProcessorPstates %D9%D0]
> bluetoothInternalControllerInfo [see below]
> SystemAudioVolumeDB %F5
> ALS_Data [percent-encoded value]
> bluetoothActiveControllerInfo [percent-encoded value]
> bluetoothInternalControllerInfo same as above except [uncertain]"
**Entities and technical context.** NVRAM retains firmware-readable configuration across reboots. In the UEFI model, the firmware boot manager is configured through defined NVRAM variables that point to boot options and images ([UEFI Boot Manager specification](https://uefi.org/specs/UEFI/2.10/03_Boot_Manager.html)). Apple’s `nvram` utility exposes both boot-related and device-state variables, although variable names and permissions differ across Mac generations.
**Whole-page reconstruction.** “The Whatever it is system” is the most revealing phrase in the notebook. It suggests the author was not documenting one finished platform but assembling a trans-platform recovery environment from commands. NVRAM is important because it sits below the OS and can preserve boot, audio, ambient-light, and Bluetooth state even when the installed system changes.
**Evidentiary status.** Option meanings and variable labels are visible; encoded values are not secrets in the same way as passwords but are not reproduced in full because their transcription is uncertain and adds little interpretive value.
**Cross-notebook connection.** This phrase gives a name to the otherwise implicit recovery platform built across [[Scanned_20260730-1706#PDF page 10 — Boot managers and cloud node|1706 pages 10–22]]. The present notebook takes that system one layer lower, from boot utilities into persistent firmware state.
**Missed Signals and Open Leads.** The notebook lacks a safe NVRAM backup/restore procedure, model compatibility notes, and a distinction between Apple NVRAM variables and UEFI-standard boot variables.
## PDF page 22 — Payment-card and address record
**Source:** `Scanned_20260730-1719.pdf`, PDF page 22.
**Visible page.** A payment-card number with expiration and security code, plus a ZIP code and street/address fragment.
**Transcription.**
> "[REDACTED CREDENTIAL — see Scanned_20260730-1719.pdf, page 22]
> 90210
> [uncertain: 9663 Stanford Monroe]"
**Reconstruction.** This is a live credential-bearing record, probably kept for a purchase, account-recovery, or billing-address task. Its full financial details are intentionally omitted.
**Evidentiary status.** The presence and type of the credential are visible. The street phrase is uncertain.
**Cross-notebook connection.** It is another example of operational secrets co-located with general technical research, as on [[Scanned_20260730-1706#PDF page 6 — Mnemonic exercise, Samsung Blockchain Keystore, and TRX|1706 page 6]]. That storage practice enlarges the compromise radius of a lost notebook.
**Missed Signals and Open Leads.** Secrets should be migrated to a dedicated password/payment vault with recovery documentation; the archival copy should retain only the redaction marker.
## PDF page 23 — Domain-renewal calendar
**Source:** `Scanned_20260730-1719.pdf`, PDF page 23.
**Visible page.** Two deadline groups listing personal, family, media, book, and project domains, with several late-December dates.
**Transcription.**
> "More 18 days
> jeniumcgill.info, me, net, org, us
> [PRIVATE NAME REDACTED]
> lovelifeagain.com
> mcgills.org
> meowmeowradio.com
> mysimplereminders.com"
> "18 days (or less)
> endpovertee.com, org
> mcgillradio.com
> [PRIVATE DOMAIN REDACTED] 12/31
> [PRIVATE DOMAIN REDACTED] 12/26
> simpleremindersbook.com
> successutilities.com 12/31
> [PRIVATE DOMAIN REDACTED] 12/26"
**Entities and technical context.** This is a domain-portfolio renewal list. The grouping by “18 days” and exact December dates suggests a registrar expiration dashboard copied near the end of 2021. The names span identity domains, radio/media projects, books, utilities, and anti-poverty branding.
**Whole-page reconstruction.** Domain custody is being treated as part of identity continuity. Page 13 lists platforms with lost access; this page identifies another set of expiring assets whose loss could break email, public identity, or project discoverability.
**Evidentiary status.** Domain spellings are transcribed as written and do not imply present ownership or availability.
**Cross-notebook connection.** This extends the domain ideation and account inventory on [[Scanned_20260730-1706#PDF page 8 — Domain-name ideation|1706 pages 8–9 and 23]] from brainstorming into renewal operations.
**Missed Signals and Open Leads.** Add registrar, registrant identity, auto-renew status, payment method, transfer lock, DNS host, email dependency, and archive/export location.
## PDF page 24 — VLAN, Bluetooth protocol layers, hot-plug, and IOMMU
**Source:** `Scanned_20260730-1719.pdf`, PDF page 24.
**Visible page.** A compact list of network and kernel initialization terms, resembling boot-log messages.
**Transcription.**
> "802.1q vlan
> RF Bluetooth protocol
> HCI connecting
> L2CAP Socket Layer
> SCO Socket
> BNEP ethernet emulation
> BNEP multicast & socket
> XFRM Netlink
> PCIeHP slot 3-1
> IOMMU"
**Entities and technical context.** [[IEEE 802.1Q|802.1Q]] tags Ethernet frames for VLAN segmentation. In Bluetooth, [[Host Controller Interface|HCI]] connects host software to the controller, [[Logical Link Control and Adaptation Protocol|L2CAP]] multiplexes higher protocols, [[Synchronous Connection-Oriented link|SCO]] carries synchronous audio, and [[Bluetooth Network Encapsulation Protocol|BNEP]] emulates Ethernet networking. [[XFRM|XFRM]] is Linux’s IPsec transformation framework. [[PCI Express Hot Plug|PCIe hot-plug]] and [[Input-output memory management unit|IOMMU]] concern hardware attachment, isolation, and DMA address translation.
**Whole-page reconstruction.** The sequence likely comes from a Linux kernel boot log. It describes a machine bringing up segmentation, radio networking, packet transformation, hot-pluggable PCIe, and DMA isolation—precisely the substrate needed for secure virtualization and flexible networking.
**Evidentiary status.** Terms are visible, but the notebook does not preserve kernel version, complete log, or success/failure state.
**Cross-notebook connection.** IOMMU directly expands [[Scanned_20260730-1706#PDF page 36 — Intel VT-d and network-boot firmware notes|1706 page 36]], where VT-d was being enabled at firmware level. Here its operating-system initialization appears in the same chain as network stacks.
**Missed Signals and Open Leads.** Record IOMMU group topology, interrupt-remapping state, kernel parameters, and device assignment. “RF Bluetooth protocol” may be a paraphrase of an initialization message.
## PDF page 25 — antiX, runlevels, terminals, and an alternate-OS shortlist
**Source:** `Scanned_20260730-1719.pdf`, PDF page 25.
**Visible page.** antiX boot/session details, a terminal download action, and a large alternate-OS cluster.
**Transcription.**
> "antiX on Grup Yorum
> KMS i915 video?
> Rox-icewm legacy
> Runlevel 5 3 dbus (legacy)
> drag and drop files: urxvt -e wget