Site sweep report · Tuesday 11 August 2026
Every Priority-1 finding in Ken's sweep checked out against the live site — which is unusual and worth saying plainly. But the line that earned its keep was "each should be a search across every file, with a count reported before anything changes." Page-by-page would have missed about a third of it, including the worst page on the list, which the sweep had marked lowest-risk.
Applied and live: every backlink claim on Authority Builder, the four ROI promises on Paid Ads, the retired Google Q&A feature, the paid endorsement and phantom vetting on Home Pro Network, 14 phone-Spanish claims, 13 "trusted/recommend" instances, the Business Center rename with a redirect, and the agreement acceptance that did not exist.
Held for Ken: five items — four because his own document says they need his ruling, one because it needs a number nobody has yet.
The one finding that didn't hold: the privacy/terms link paths. All four return 200. It's inconsistent styling, not a broken link.
This is the part worth reading. Three patterns, counted across all 21 pages plus the file that generates six of them.
The sweep named Engine 4, Josh and Paid Ads. The claim was also on three pages it never reached:
| Page | Wrong | What it said |
|---|---|---|
| paid-ads | 10 | Sweep counted 7 — the Bilingual block holds three on its own |
| business-center | 2 | "answers on the first ring… in English and Spanish", and demo data showing a whole phone call in Spanish |
| gbp-microsites | 1 | The microsite call-to-action — "answers immediately, in English or Spanish" |
| engine-3-retention | 1 | "Every call answered immediately, in English or Spanish" |
The Bilingual section on Paid Ads is rewritten for the website and now states the limit rather than leaving it to be discovered: "Calls from your ads are answered in English."
47 raw matches for "trusted" and "recommend". 13 were real. The test applied everywhere: does the word attach to a vendor who pays? An agent recommending the inspector, a client trusting him, Google's own LSA "trusted badge" and the third-party clauses in Privacy and Terms are all legitimate and were left untouched.
engine-3-retention had six — more than any other page — including "local tradespeople pay monthly to be listed and recommended" and "whoever you personally recommend" twice. It was on the unswept list, described as lowest risk.
This is the whole argument for counting first. That page carries no pricing, no earnings figures and no SEO claims, so it read as safe — and it held the highest concentration of the exact language that creates the Standards of Practice problem.
The sweep grouped Home Pro Network's six "you approve" instances with the approval-before-send pattern that contradicts A3. They are a different thing.
Approving who is listed on your own website is not approval-before-send of content we produce. It is the inspector's control over his own directory — and the sweep's own replacement wording for the vetting claim makes that control stronger, not weaker. Rewriting those six would have removed a protection while trying to add one.
I fixed Authority Builder's backlink claims by hand and asserted zero remained. The assertion passed. The next FAQ rebuild put them straight back.
The FAQ blocks on six pages are generated from api/inspector/subscription.js.
Editing the HTML looks correct, verifies correct, and is reverted the next time anyone runs the
builder. The same was true of two Google Q&A mentions.
It bit twice before I stopped trusting the page and went to the source. Anything inside a
FAQ:GENERATED block has to be fixed in that file — and a verification that runs
before the rebuild proves nothing.
Checked against the live site after the deploy, not against the repository.
Authority Builder — every backlink claim and every "400+" count is gone. Google discounts syndicated press-release links, so the page's central promise was one Google specifically does not honour; presenting bulk syndicated links as an SEO benefit describes a link scheme, which is a risk to the client's own site; and "400 news publications" implied editorial coverage the MSA already denies. The page now carries the disclosure the contract contains: "This is paid distribution, not editorial coverage. No journalist is obliged to write about you, and we don't promise that any will."
Paid Ads — four promises of a positive return, removed. The MSA says we do not guarantee return on ad spend, and ad performance is the thing least in our control. What replaced them is true and is the actual differentiator: every lead the ads generate gets answered. Also removed the meta description's claim that Meta ads are managed — the page only covers Google.
Home Pro Network — the paid endorsement is gone from the Featured tier and the report P.S., and so is the "vetting process" the MSA explicitly excludes. The page's own FAQ already agreed with the MSA; only that one block claimed a process that does not exist.
The MSA opens "By clicking 'I Agree' at checkout… Customer agrees to this Agreement." There was no such click anywhere in the flow. Every liability cap, indemnity and arbitration clause rested on a checkbox that did not exist — and nothing would ever have said so, because the page looked finished.
It is now an unchecked box linking both documents, it blocks the payment step, and it is refused server-side as well — anyone can post straight to the endpoint, and the enrollment we would be holding in a dispute is the one created without acceptance. Confirmed against the live endpoint: it returns 400.
Stored with the timestamp and the exact wording shown, read off the page rather than retyped in code, so the record cannot drift from what the customer actually read. That is the standard the SMS consent ledger already set; this now matches it. Eleven tests guard the three variants that look fine and are not — pre-ticked, present-but-unenforced, and enforced in the browser only.
SMS consent still does not block checkout, and a test asserts it never starts to. The disclosure says consent is not a condition of purchase.
The page had already been retitled Business Center; the file and URL had not moved. Without
a redirect, /command-center hits the fallback and returns the marketing
homepage with a 200 — the same silent-success failure documented two lines above it in
the server code, and this URL is printed on the Josh page and in the decisions log.
Confirmed live: /command-center → 301 → /business-center.
Part 1 had also left the homepage's step-4 heading reading "Dashboard" while the body directly beneath it read "Business Center". Eight places corrected in total. Two keep the word deliberately — "Not a dashboard of metrics nobody reads" is the pejorative sense, and the word is doing real work there.
Four because his own document asks for a ruling. One because it needs a number.
These are decisions, not work items
And the rest of enroll.html, which needs decisions rather than a developer
The count-first instruction was right and should be standard. It is what surfaced the three missed pages and the six instances on the page marked lowest-risk. A page with no pricing and no earnings claims is not therefore safe — it can still be carrying the language that creates the legal problem.
Sweeping the live HTML will mislead you on six pages. Their FAQ
blocks are generated. A future sweep will read correct text on the page that regenerates wrong
from the source. Check for FAQ:GENERATED before trusting what a page says.
The repository moved 117 commits while this work was in flight. My first countercheck of the orphaned Notice said the sweep was wrong — because I was reading a three-day-old copy. It was right. Anything that compares against "the live site" has to start by proving the local copy matches it; mine did, byte for byte, only after rebasing.
Every Priority-1 finding was accurate against the live site, including the subtle one — Call 7's second Notice really did belong to a call that had been replaced by the 11 August recordings and left its description behind. One item out of roughly forty did not hold, and it was a guess the document flagged as a guess.