v2.7.1

The short version: three research signals that spent the autumn in the lab - each had to pass false-alarm and detection bars fixed before it ran - join the opt-in advisory tier. Nothing on the default path changes, and the classic release round re-measured exactly that.

• Crews that work in shifts. The cohort box signal watches a whole team's traffic pooled together and looks for a repeating on/off rhythm - a crew scraping in 36- or 48-hour rotations. In the lab it flagged rotating crews 9 of 9 (36 h) and 8 of 9 (48 h) with 0 false alarms across 250 legitimate group tests, sale weeks included. It judges the group, never a person - and if your own team works declared shifts, you declare the roster and it stands down.
• Swarms of one-use accounts. The missing-mass signal watches each area of your site instead of each visitor: when a crowd of accounts each shows up exactly once and never returns, the share of one-time visitors jumps. In the lab it caught herds of 100-400 one-use accounts at 100% with a 0.36% legitimate flag rate, and sale weeks stayed clean (0 of 140). A swarm disciplined enough to reuse every account still escapes this one signal - it hands itself to the other meters instead, a trade-off designed and recorded before the lab ran.
• Accounts aged, then spent all at once. The lifecycle cohort signal ignores the quiet aging phase and watches the wake-up: old accounts returning together, bursting far above their own history, in sync. Legitimate comebacks - a product launch pulling old users back - stayed clean in the lab (0 false alarms in 210 group tests) while the aged-then-burst crew was flagged 18 of 18. Its per-account score exists too, but the lab measured it flagging too many innocents (2.9%), so it ships as description only - there is deliberately no per-account verdict to wire up.
• Honest limits, printed on the box. A crew rotating exactly with the day is invisible to the shift signal; strangers who view one deep page and leave (a viral link) were never measured on real logs; and all three signals are simulation numbers until a real host calibrates them - the farm calibration gate (~16 Nov) is unchanged. None of the three blocks anything: each only reports.
• The default path, re-measured. The full classic round ran again against this build: the export hammer still stops at 16 of 80 records, declared teams and ordinary users still see zero friction, and every number matches the previous release - no new regressions.

Full technical write-up with every mechanism and measurement: v2.7.1 deep dive. What the previous release changed: v2.7.0 deep dive.

Automated tests: 621 total, 619 pass, 0 fail, 2 skip (RSA-PSS Web Bot Auth vectors, Ed25519-only by design).