# 2026-07-11 — Methodology: identity linking + the person layer

Registered **before the person layer influences any client-facing number**, and anchored
independently (see `calibration/ANCHORS.md`). This document does NOT modify, reinterpret, or
supersede any anchored text. `calibration/hypothesis_log.md`, `calibration/shadow_adjustments.json`,
and every prior anchored file remain byte-identical to their OpenTimestamps-anchored digests.
Nothing here touches a lock, `locks.log`, `certified_results`, or any statewide client-facing number.

## Why a person layer

The dome counts ACCOUNTS. One person can hold several accounts (an X handle, an Instagram handle, a
TikTok handle). Counting each as a distinct resident overstates the electorate behind a number. The
person layer groups accounts believed to be one human so the **equal-weight companion** can dedupe
by person. It changes only the equal-weight companion, and only where a link exists.

## The one linking method: `identity_transfer` (conservative by construction)

A link between two accounts is created **only** when:

1. The **source** account's profile **bio** carries an **explicit, exact handle reference** to a
   **target account that is already confirmed** in the same market — e.g. a TikTok bio containing
   `IG: @jane_doe_614` where `@jane_doe_614` is an already-confirmed Instagram account in that market.
2. The reference matches the target's handle under a fixed **normalization**: lowercase, strip a
   leading `@`, strip a leading platform tag (`ig:`, `insta:`, `tiktok:`, `tt:`, `x:`, `twitter:`),
   strip surrounding whitespace/punctuation. The comparison is on the **whole** normalized token —
   never a substring, never a fuzzy or name match.
3. The matched string and the field it was found in are stored as **provenance** on the link.

No other signal creates a link. **No name matching, no display-name matching, no fuzzy matching, no
co-location inference, no shared-device inference.** A bio that merely mentions a platform ("also on
IG") without an exact confirmed handle creates no link. Ambiguity resolves to NO link.

## What a link does and does not do

* **Does:** group the two accounts under one `person_entity`; let the equal-weight companion count
  that person once. Provenance is stored (`identity_link.provenance`).
* **Does NOT:** confirm residence. A linked account is in the dome only if it was independently
  confirmed by the normal residence gate. Linking never adds a resident, never removes one, and
  never changes the raw account count, the headline number, or any lock.
* **Direction:** the link points from the source account to an already-confirmed target. The source
  may itself be confirmed, or may be a `pending_identity` account (linking is one route by which a
  non-disclosing pending account can later be attributed — but until it is independently confirmed
  it is still never counted).

## Stratum safety

The person layer is inert for any market with no links. **`us_arizona` and `us_sc` have no identity
links** (no confirmed account there carries an exact cross-handle bio reference to another confirmed
account), so their equal-weight companion numbers are **provably unchanged** — pinned by test. If a
future market's numbers are ever to be person-deduped, the links must exist and be provenance-backed
first; there is no global toggle that silently changes an un-linked market.

## Scope

Runs across `confirmed_accounts` and the `pending_identity` pool. Additive tables `person_entity`
and `identity_link` only; no existing row is altered. This methodology governs identity linking
only — residence confirmation, locks, and statewide scoring are untouched by construction.