fix(verdict): a public suffix is not a domain (#1605)

classifyPage decides "offsite-redirect" by comparing the registrable domain of
the requested host against the final one, and computed it as `parts.slice(-2)`.
That reads every Brazilian host as "com.br", so a redirect from one .com.br
site to an unrelated one compared EQUAL, the hop was never flagged, and a page
that had moved to somebody else's business went on being judged on its own
content — a false LIVE, the opposite of the false deaths this file exists to
prevent. Same shape for co.uk, com.au, co.jp and the rest.

src/lib/partner-project-identity.ts already carries the suffix list and its
tests, so this drops the local copy and calls registrableDomain. Third place in
the codebase to hit it this week; scripts/data/backfill-deployment.ts has its
own correct copy, and scripts/eval/engine-b-sweeps.ts still has a naive one
whose inputs I have not checked.

Exposure today is small and worth stating: three directory rows sit on .com.br
and none on the other multi-label suffixes. The cost of the bug is not its
current blast radius — it is that the failure is silent and lands on the
"still live" side.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: theboycoder

src/lib/__tests__/page-verdict.test.ts

@@ -60,3 +60,33 @@ describe("classifyPage — a 200 is not a business", () => {
 		expect(classifyPage({}).verdict).toBe("unknown");
 	});
 });
+
+describe("offsite redirect across a multi-label public suffix", () => {
+	it("flags a hop between two different .com.br sites", () => {
+		// `parts.slice(-2)` read both of these as "com.br", compared them equal,
+		// and let a page that had moved to somebody else's business go on being
+		// judged on its own content.
+		const v = classifyPage({
+			status: 200,
+			requestedHost: "bwbi.com.br",
+			finalHost: "someoneelse.com.br",
+			title: "Outra empresa",
+			metaDescription: null,
+			bodyText: null,
+		} as never);
+		expect(v.verdict).toBe("offsite-redirect");
+		expect(v.reason).toBe("bwbi.com.br → someoneelse.com.br");
+	});
+
+	it("does not flag a www or subdomain hop inside one .com.br site", () => {
+		const v = classifyPage({
+			status: 200,
+			requestedHost: "www.bwbi.com.br",
+			finalHost: "app.bwbi.com.br",
+			title: "BWB",
+			metaDescription: null,
+			bodyText: null,
+		} as never);
+		expect(v.verdict).not.toBe("offsite-redirect");
+	});
+});

src/lib/page-verdict.ts

@@ -18,6 +18,7 @@
  * a non-product verdict, because this feeds a basis DOWNGRADE (never a
  * status change) and a false "parked" costs a live project its evidence.
  */
+import { registrableDomain } from "./partner-project-identity";
 
 export type PageVerdict =
 	| "product"
@@ -48,13 +49,19 @@ const SCAFFOLD =
 const PLACEHOLDER =
 	/\b(coming soon|under construction|site is under construction|we('| a)re changing home|changing home|home changing|launching soon|stay tuned|join (our|the) waitlist|waitlist only)\b/i;
 
+/** The offsite-redirect test compares these, so a wrong answer here is a wrong
+ * VERDICT. `parts.slice(-2)` read every Brazilian host as "com.br", so a
+ * redirect from one .com.br site to an unrelated one compared EQUAL and the
+ * hop was never flagged — a page that had moved to somebody else's business
+ * went on being judged on its own content. Same shape for co.uk, com.au and
+ * the rest. src/lib/partner-project-identity.ts already carries the suffix
+ * list and its tests; three directory rows sit on .com.br today. */
 function registrable(host: string | null | undefined): string {
 	const h = (host ?? "")
 		.toLowerCase()
 		.replace(/^www\./, "")
 		.replace(/:\d+$/, "");
-	const parts = h.split(".").filter(Boolean);
-	return parts.length >= 2 ? parts.slice(-2).join(".") : h;
+	return registrableDomain(h) || h;
 }
 
 /** Classify what a URL served. See the file header for why this exists. */