@@ -2422,7 +2422,8 @@ function entityServe(ctx, data, filter) {
 }
 
 // Who told the entity registry (plugin `entity_canonical` / `canonical_adopt` context), in the order a re-slug is
-// usually seen: the origin documents crawlers pull, the renders, the serve-time checks, the nightly probe.
+// usually seen: the origin documents crawlers pull, the renders, the serve-time checks, the nightly probe. A move
+// is a re-slug, or one observer correcting another (an endpoint and a page that disagree flap between them).
 const ENTITY_OBSERVERS = [
 	['origin', 'proxied origin documents'],
 	['render', 'renders'],
@@ -2490,7 +2491,7 @@ function entityRegistry(ctx, data) {
 		body: [
 			stats([
 				stat(
-					'Re-slugs seen',
+					'Canonical moves',
 					fmtCount(seen('moved')),
 					byObserver((from) => seen('moved', from))
 				),
 
@@ -1408,7 +1408,7 @@ test('the entity-serve panel names the newer fall-throughs and what an evaluatio
 	assert.match(text, /median · p95/);
 });
 
-test('the registry panel: re-slugs seen by the observer that saw them, and the adoption dry-run number', async () => {
+test('the registry panel: canonical moves by the observer that saw them, and the adoption dry-run number', async () => {
 	const analytics = {
 		...ANALYTICS,
 		series: [
@@ -1432,7 +1432,7 @@ test('the registry panel: re-slugs seen by the observer that saw them, and the a
 	const text = everything(ctx);
 	assert.match(text, /Entity registry/);
 	assert.match(text, /adoption dry run/);
-	assert.match(text, /Re-slugs seen/);
+	assert.match(text, /Canonical moves/);
 	assert.match(text, /60 proxied origin documents · 25 renders · 15 the nightly probe/);
 	assert.match(text, /Would adopt/);
 	assert.match(text, /70 under the hourly budget · 5 past it/);
 
@@ -196,13 +196,17 @@ Notes that bite:
   a target by then (since v0.102.0 a spelling suppressed as a canonical verdict is answered, not
   `has-target`). `unconfirmed` climbs right after the anchor and falls as the pass and the serve-time
   checks confirm canonicals. If a route stays there, no check compares its `canonical`. `moved`
-  (v0.102.0, `entities.enabled`) is a page the registry has since heard re-slugged: it should be rare,
-  and should not persist for an entity, because the observation that moved the registry also adopted
-  the new canonical. `entity_serve_ms` (v0.102.0) is each evaluation's duration, every outcome: a
+  (v0.102.0) is a page the origin has since been heard naming another canonical: by the registry
+  (`entities.enabled`), or by the spelling's own canonical verdict when it is newer than the page's last
+  confirmation and did not name it. It should be rare. With adoption armed it should not persist for an
+  entity, because the observation that moved the registry also filed the new canonical; under the
+  adoption dry run, or past `maxPerHour`, it lasts until the new canonical renders by another path. `entity_serve_ms` (v0.102.0) is each evaluation's duration, every outcome: a
   duration, so read its percentiles.
 - **The entity registry is `prerender_ops` / `entity_canonical` and `canonical_adopt`** (v0.101.0,
   `entities.enabled`). `entity_canonical`: one emit per observation of an entity's canonical, detail =
-  what it did to the registry (`new`, `moved`, `same`, `older`, `foreign`, `unreadable`, `error`),
+  what it did to the registry (`new`, `moved`, `same`, `older`, `foreign` — another entity's prefix, or a
+  query string — `untracked` — a crawler's proxied miss of an entity with no row, which creates none —
+  `unreadable`, `error`),
   context = the observer: `probe`, `render` (a stored page, or a canonical verdict's declared canonical),
   `check` (a serve-time check) or `origin` (a proxied origin document on an `entityServe` route; the last
   two since v0.102.0). `moved` per day is the re-slug rate, and which observer moves it first says how
 
@@ -341,8 +341,10 @@ origin, exactly as before:
 - **The spelling has no target the render path keeps.** A spelling with no row of its own is answered,
   and so is one whose own target was suppressed as a canonical verdict (`canonical-mismatch`,
   `canonical-variant`): its own render found that the page names its canonical elsewhere. Measured on
-  one deployment, one crawler made ~11k such misses a day. A row in rotation (a new canonical arriving
-  from the sitemap) or one suppressed about the URL itself (a 404, a noindex) is `has-target`.
+  one deployment, one crawler made ~11k such misses a day. Such a spelling is answered only with the page
+  its own verdict named (`Target.suppressedCanonical`, browser ≥ 1.40.0), or with a page confirmed after
+  that verdict; otherwise it is `moved`. A row in rotation (a new canonical arriving from the sitemap) or
+  one suppressed about the URL itself (a 404, a noindex) is `has-target`.
 - **One candidate.** One target of the entity in rotation has a page for this device that is a 200,
   indexable, inside its own expiry (not SWR), and not covered by an invalidation it predates. When more
   than one does, the [entity registry](#the-entity-registry-and-adopting-the-canonical-the-origin-names-entities)
@@ -425,15 +427,17 @@ entities:
   - `check`: a serve-time check, from the endpoint's canonical slot or the origin document's canonical.
   - `origin`: a miss proxied to the origin on an `entityServe` route. Its canonical is read off the head
     as the crawler's bytes stream by (at most 128 KiB, and at most 32 at once per worker), so it costs no
-    second request and nothing the response waits on.
+    second request and nothing the response waits on. It moves a row the registry already holds and never
+    creates one (`untracked`), so a crawler asking for invented product ids cannot create rows; a URL with a
+    query string is not read, and the tap stops with `ingress.entityServe.enabled`.
   - When two observations disagree, the newer wins. A render's instant is when it read the origin
     (store time less the sum of its renders), so a render claimed before a re-slug can't undo the probe
     that saw it.
   - An unchanged observation writes nothing, and neither does the same canonical spelled otherwise
     (`%27` for an apostrophe). That is one document, as the probe's own `path` comparator already
     treats it.
-  - A canonical under another entity's prefix is ignored, and so is a relative path (only an absolute
-    URL or a `/`-rooted path counts).
+  - A canonical under another entity's prefix is ignored, and so is one with a query string, and a relative
+    path (only an absolute URL or a `/`-rooted path counts).
 - **Adoption.** When any observer names a canonical that is another URL of the same entity than the one
   it observed, and no target holds it in rotation, its target is filed due now and urgent, as redirect
   adoption does.
 
@@ -620,7 +620,7 @@ async function resolveResource({ request, url, cacheUrl, deviceType, routeClass,
 	// entityServe route every spelling is one document, so every fetch that reaches here — a miss, a stale or an
 	// invalidated page — says where the product lives now. Read off the head as the bytes stream by: no second
 	// origin request, and nothing this response waits on.
-	const observed = tapsOriginCanonical(info.route, request.method)
+	const observed = tapsOriginCanonical(info.route, request.method, cacheUrl)
 		? tapOriginCanonical(resource, { url: cacheUrl })
 		: resource;
 	// Keep what we just fetched, for the next crawler asking the same question. The capture rides the
 
@@ -731,7 +731,9 @@ export const METRICS = Object.freeze({
 			'util/entity.js), by what it did to the registry: new (the entity\u2019s first row), moved (the canonical ' +
 			'changed — a re-slug, or one observation correcting another), same (nothing written), older (a ' +
 			'disagreeing observation made before the stored one, ignored), foreign (a canonical under another ' +
-			'entity\u2019s prefix, ignored), unreadable, error; context = the observer: probe (the change probe\u2019s ' +
+			'entity\u2019s prefix, or carrying a query string, ignored), untracked (a crawler\u2019s proxied miss of an ' +
+			'entity with no row: no row is created from crawler traffic), unreadable, error; context = the observer: ' +
+			'probe (the change probe\u2019s ' +
 			'mapped canonical), render (a stored page\u2019s canonical, or the one a canonical verdict declared), ' +
 			'check (a serve-time check\u2019s endpoint or document) or origin (a proxied origin document on an ' +
 			'entityServe route). moved per day is the re-slug rate; which observer moves it first says how fast a ' +
@@ -933,7 +935,7 @@ export const METRICS = Object.freeze({
 					'(gated, would-gate, suppressed-only, no-siblings, no-prefix, error). entity_serve: the outcome ' +
 					'(served, would-serve, no-prefix, has-query, has-target, no-sibling, no-page, not-indexable, stale, ' +
 					'invalidated, ambiguous, unconfirmed, moved, not-self-canonical, unreadable, error). entity_canonical: the outcome ' +
-					'(new, moved, same, older, foreign, unreadable, error). canonical_adopt: the outcome (adopted, ' +
+					'(new, moved, same, older, foreign, untracked, unreadable, error). canonical_adopt: the outcome (adopted, ' +
 					'reactivated, would-adopt, exists, suppressed, recent, capped, refused, error). raw_cache: THE OUTCOME — stored, ' +
 					'stored-unshared, or the refusal name; this is the slot the console reads that panel from. ' +
 					'negative_cache: the outcome — stored/stored-unshared; a refusal (has-cookie, private, no-store, ' +
@@ -1171,7 +1173,7 @@ export const metrics = Object.freeze({
 
 	/**
 	 * One observation of an entity's canonical (util/entity.js) — a prerender_ops series. `outcome` is what it
-	 * did to the registry (new, moved, same, older, foreign, unreadable, error); `from` is the observer: 'probe',
+	 * did to the registry (new, moved, same, older, foreign, untracked, unreadable, error); `from` is the observer: 'probe',
 	 * 'render', 'check' or 'origin'.
 	 */
 	entityCanonical: (outcome, from) =>
 
@@ -880,17 +880,16 @@ export class RenderQueue extends Resource {
 			const { deleted, absent, held } = await Target.suppress(url, {
 				reason: verdict.reason,
 				statusCode: verdict.statusCode,
+				canonical: verdict.declaredCanonical ?? null,
 			});
 			// THE CANONICAL THE VERDICT NAMED (browser >= 1.40.0 `declaredCanonical`), into the entity registry: on a
 			// site where every spelling of a product is one document, the render of an old spelling after a
 			// re-slug is often the first fetch from the origin to see the new canonical, and this is where the
 			// product lives now. Recorded and, when no target holds it, adopted — so the new canonical renders now
 			// rather than at the next nightly probe. Observed when the origin was read. Never rejects.
-			await observeRenderedCanonical(
-				url,
-				verdict.declaredCanonical,
-				Date.now() - (Number(verdict.renderTime) || 0)
-			).catch(() => {});
+			await observeRenderedCanonical(url, verdict.declaredCanonical, Date.now() - renderSpanMs(variants)).catch(
+				() => {}
+			);
 			// The other half of `suppression_lifted` below: a suppressed target rendered, and the verdict
 			// stood. Together they are the precision of every early recheck — a gone target rendered
 			// before its `recheckInterval` was filed by a reopen (util/goneReopen.js), and this is where
@@ -1085,9 +1084,14 @@ export class RenderQueue extends Resource {
 				// was READ — the store time less the stored renders, which run one after another — so a render
 				// claimed before a re-slug cannot outrank the probe that saw it. A point read, and a write only
 				// when the canonical moves; a canonical no target holds is adopted. Never rejects.
-				observeRenderedCanonical(scheduleUrl, describing.pageFacts?.canonical, cachedAt - renderSpanMs(stored)).catch(
-					() => {}
-				),
+				// A sitemap target is stored even when its canonical names another URL: its page record says so,
+				// and so does the verdict's `declaredCanonical`, which stands in when the record's extraction failed.
+				observeRenderedCanonical(
+					scheduleUrl,
+					describing.pageFacts?.canonical ??
+						stored.find((variant) => typeof variant.declaredCanonical === 'string')?.declaredCanonical,
+					cachedAt - renderSpanMs(stored)
+				).catch(() => {}),
 				...observed.map((variant) =>
 					recordReadinessExpectation({ url: scheduleUrl, deviceType: variant.deviceType }, variant.readiness)
 				),
@@ -1352,7 +1356,11 @@ export class RenderQueue extends Resource {
 			// suppression is a genuine content/gone verdict about the destination. A destination too long
 			// to key has no row to suppress, and needs none: nothing can ever schedule it.
 			if (keyable !== false && (!config.domains.length || config.domains.includes(domain))) {
-				await Target.suppress(destinationUrl, { reason: variant.reason, statusCode: variant.statusCode });
+				await Target.suppress(destinationUrl, {
+					reason: variant.reason,
+					statusCode: variant.statusCode,
+					canonical: variant.declaredCanonical ?? null,
+				});
 			}
 			return;
 		}
 
@@ -220,7 +220,7 @@ export class Target extends TargetTable {
 	 * pages either way — stale content of a page that said "don't index me" must not keep
 	 * serving.
 	 */
-	static async suppress(url, { reason, statusCode } = {}) {
+	static async suppress(url, { reason, statusCode, canonical = null } = {}) {
 		const existing = await Target.get({
 			id: url,
 			select: [
@@ -294,6 +294,8 @@ export class Target extends TargetTable {
 			state: 'suppressed',
 			suppressedReason: storedReason,
 			suppressedAt: Date.now(),
+			// What the page named, for a canonical verdict: the entity serve's evidence (util/entityServe.js).
+			suppressedCanonical: typeof canonical === 'string' && canonical !== '' ? canonical : null,
 			strikes,
 		});
 
 
@@ -134,6 +134,10 @@ type Target @table(database: "render_service") @export {
 	# Why the last verdict suppressed it: noindex | canonical-mismatch | redirect-loop | ...
 	suppressedReason: String
 	suppressedAt: Date
+	# The canonical a CANONICAL VERDICT's page named (browser >= 1.40.0 `declaredCanonical`), null otherwise.
+	# The entity serve answers this spelling only with the page it named, or one confirmed after the verdict
+	# (util/entityServe.js): the verdict is this spelling's own, newest word on where its product lives.
+	suppressedCanonical: String
 	# Consecutive non-indexable verdicts; render.suppression.maxStrikes deletes the target.
 	strikes: Int
 	# Current demand-ladder rung (ms), when render.demand is enabled. Absent = the target has
@@ -157,10 +161,11 @@ type Target @table(database: "render_service") @export {
 # two unrelated rows; this is where "which of them does the origin call canonical, now" lives.
 #
 # DERIVED, NEVER AUTHORITATIVE: `Target` stays the render registry. Written only by observations of the
-# origin — the change probe's mapped `canonical` slot and a stored render's declared canonical — and only
-# when the canonical MOVES (an unchanged observation writes nothing). Replicated and NOT residency-pinned,
-# like `Target`: writes are rare, and every node answers a point read locally. Not @export: internal state,
-# read through the admin API. Inert unless `entities.enabled`.
+# origin — the change probe's mapped `canonical` slot, a render's declared canonical, a serve-time check, and
+# a document proxied from the origin (which moves a row, never creates one) — and only when the canonical
+# MOVES or a dry run remembers an adoption (an unchanged observation writes nothing). Replicated and NOT
+# residency-pinned, like `Target`: a row per entity plus ~one write per re-slug, and every node answers a point
+# read locally. Not @export: internal state, read through the admin API. Inert unless `entities.enabled`.
 type Entity @table(database: "render_service") {
 	id: String @primaryKey
 	# The canonical URL (a Target key) the newest observation named.
 
@@ -85,8 +85,17 @@ export const CanonicalOutcome = Object.freeze({
 	SAME: 'same',
 	/** A different canonical, observed before the one stored: ignored. */
 	OLDER: 'older',
-	/** A canonical outside the entity's own prefix: another entity's URL, ignored. */
+	/**
+	 * Not this entity's canonical to record: under another entity's prefix, or carrying a query string the route
+	 * keys (one document per entity has no query to vary by). Ignored.
+	 */
 	FOREIGN: 'foreign',
+	/**
+	 * An `origin` observation (a crawler's proxied miss) of an entity the registry has no row for: not recorded,
+	 * so a crawler asking for invented product ids cannot create rows. Every entity this plugin renders gets its
+	 * row from the probe or a render.
+	 */
+	UNTRACKED: 'untracked',
 	/** A canonical that is not a URL this can key. */
 	UNREADABLE: 'unreadable',
 	/** A read or a write threw. Logged. */
@@ -161,7 +170,7 @@ const safeDecodeURI = (value) => {
 };
 
 /**
- * Record that the origin, observed at `atMs` by `from` ('probe' | 'render'), names `canonical` as the
+ * Record that the origin, observed at `atMs` by `from` ('probe' | 'render' | 'check' | 'origin'), names `canonical` as the
  * canonical of the entity `url` belongs to. Returns `{ outcome, key, canonical, row }`: `canonical` is the
  * keyed form the registry holds for it, `row` the entity as it stands after this observation (null when there
  * is no entity). Never throws.
@@ -174,7 +183,7 @@ const safeDecodeURI = (value) => {
  * two first observations racing — a render and a probe, or two nodes probing two spellings — then merge,
  * and neither can erase what the adoption recorded on the row.
  */
-export async function observeCanonical({ url, canonical, from, atMs }) {
+export async function observeCanonical({ url, canonical, from, atMs, createIfMissing = true }) {
 	if (!entitiesOn()) return { outcome: null, key: null, canonical: null, row: null };
 	const entity = entityOf(url);
 	if (!entity) return { outcome: null, key: null, canonical: null, row: null };
@@ -184,10 +193,12 @@ export async function observeCanonical({ url, canonical, from, atMs }) {
 	};
 	const target = typeof canonical === 'string' && canonical !== '' ? canonicalFormOf(canonical) : null;
 	if (!target) return decided(CanonicalOutcome.UNREADABLE);
-	// The entity's own prefix, and nothing else: a canonical under another prefix names another entity.
-	if (!target.startsWith(entity.key)) return decided(CanonicalOutcome.FOREIGN);
+	// The entity's own prefix, and nothing else: a canonical under another prefix names another entity. And no query
+	// string: a param the route keys can change the document, and a crawler can choose its value.
+	if (!target.startsWith(entity.key) || URL.parse(target)?.search) return decided(CanonicalOutcome.FOREIGN);
 	try {
 		const row = await table().get({ id: entity.key, select: [...ENTITY_SELECT] });
+		if (!row && !createIfMissing) return decided(CanonicalOutcome.UNTRACKED);
 		if (!row) {
 			const created = {
 				id: entity.key,
@@ -346,7 +357,8 @@ export const createCanonicalResolver = ({
 		if (!entitiesOn()) return null;
 		const canonical = canonicalFromValue(value, url);
 		if (!canonical) return null;
-		const observed = await observe({ url, canonical, from, atMs: atMs ?? now() });
+		// A crawler's proxied miss moves a row the registry already holds, and creates none (`untracked`).
+		const observed = await observe({ url, canonical, from, atMs: atMs ?? now(), createIfMissing: from !== 'origin' });
 		// The observed URL IS the canonical (in any spelling), or there is nothing to adopt.
 		if (!observed.row || !observed.canonical || sameDocument(observed.canonical, url)) return observed;
 		const adopt = typeof settings === 'function' ? settings() : settings;