# Egress test: droplet (137.184.166.194) against mosiah (184.66.107.113)

Control run 2026-09-10T18:03:13+00:00, candidate run 2026-09-10T22:05:31+00:00. Same user agent, same headers, same URLs; the address is the only variable.

| Host | robots | page (control) | page (candidate) | bytes c/c | edge | finding |
|---|---|---|---|---|---|---|
| athens.shopdutyfree.com | page/page | page 200 | page 200 | 772234/772274 |  | same |
| barcelona.shopdutyfree.com | page/page | page 200 | page 200 | 716583/716582 |  | same |
| buenosaires.shopdutyfree.com | page/page | page 200 | page 200 | 699686/699682 |  | same |
| hongkong.shopdutyfree.com | page/page | page 200 | page 200 | 661570/661570 |  | same |
| jfk.shopdutyfree.com | page/page | page 200 | page 200 | 730281/730281 |  | same |
| london-heathrow.worlddutyfree.com | page/page | page 200 | page 200 | 716096/716095 |  | same |
| madrid.shopdutyfree.com | page/page | page 200 | page 200 | 707967/707966 |  | same |
| mexicocity.shopdutyfree.com | page/page | page 200 | page 200 | 715921/715920 |  | same |
| toronto.shopdutyfree.com | page/page | page 200 | page 200 | 717530/717529 |  | same |
| zurich.shopdutyfree.com | page/page | page 200 | page 200 | 735456/735456 |  | same |
| co.attenza.net | page/page | page 200 | page 200 | 293601/293604 | cloudflare | same |
| es.attenza.net | page/page | page 200 | page 200 | 262160/262181 | cloudflare | same |
| pa.attenza.net | page/page | page 200 | page 200 | 337364/335864 | cloudflare | same |
| www.montrealdutyfree.ca | page/page | page 200 | page 200 | 376742/376745 | cloudflare | same |
| www.bordershop.com | page/page | page 200 | page 200 | 800586/800586 |  | same |
| www.heinemann-shop.com | page/page | page 200 | page 200 | 446428/446428 |  | same |
| www.heinemanndutyfree.com.au | page/page | page 200 | page 200 | 275374/275374 |  | same |
| www.islanddutyfree.is | page/page | page 200 | page 200 | 419728/419728 |  | same |
| www.dubaidutyfree.com | challenge/challenge | challenge 403 | challenge 403 | 461/461 | AkamaiGHost | same |
| www.dublinandcorkdutyfree.ie | page/page | page 200 | page 200 | 331225/331225 | cloudflare | same |
| www.extime.com | page/page | page 200 | page 200 | 628879/628836 |  | same |
| www.ishopchangi.com | page/page | page 200 | page 200 | 62218/62218 | Apache | same |
| www.shilladfs.com | page/page | page 200 | page 200 | 671007/670917 | cloudflare | same |

**Summary:** 23 same, 0 better on the candidate, 0 worse on the candidate.

## What this shows, and what it does not

- Text fetches with the declared reader identity get the same answer from DigitalOcean's
  Toronto address (137.184.166.194, AS14061) as from the dev server's residential address,
  at every one of the 23 hosts, including the four Cloudflare-fronted ones (Montreal, Dublin,
  Seoul, Changi's Apache edge). Dubai refuses both by name at the Akamai edge, as it has since 3 Sep.
- Not tested here: the rendered path (the browser sidecar at Changi and Seoul). A rendered
  page is a full page load with scripts, and Cloudflare's challenge can differ for that.
  The next step is a bounded real collection run from the droplet against a scratch
  database (Changi and Seoul first, then one Avolta store), before the collectors decision.
- One-off snapshot, not a trend. Reputation scoring changes; the go-live checklist (E7)
  re-runs this from the production address, and `deploy/egress-test.py` stays for that.

## Rendered path: bounded collection from the droplet (same day, 22:13 to 22:16 UTC)

Scratch stack `dfpsmoke` on bwlive, built from the current tree (the build itself: about
four minutes on 2 vCPU / 4 GB, swap untouched), its own empty database, torn down after.

| Source | Path | Limit | Result |
|---|---|---|---|
| ishopchangi-sin | browser sidecar | 5 | 5 rendered, status 200, prices 5 |
| shilla-icn | browser sidecar | 5 | 5 rendered, status 200, prices 5 |
| avolta-lhr | text fetch | 10 | prices 10 |

20 price observations written; `collector_finished status=ok` for all three. Log:
`droplet-smoke-collect-2026-09-10.log`. Together with the text-fetch table above, nothing
in the collection path answers DigitalOcean's address differently from the residential one.