"Partial" is permanent and unexplained for large guilds

[Erilla]

Question

A snapshot is partial for four different reasons, and the reason is internal by deliberate decision (Snapshot and limitation model for probabilistic results keeps the limitation reason internal; Public presentation of inferred matches keeps discovery method and confidence out of public output):

Internal limitation	What it means
fingerprint_sweep_capped	the sweep hit its request cap
privacy_hidden	the root's Raider.IO ownership is not public
request_cap	the Raider.IO discovery phase hit its own cap
unsupported_member	a related character fell outside the supported key space

When those decisions were taken, partial was expected to be an occasional state. It is not: with a fixed cap and alphabetical candidate ordering (#40), every root in a guild larger than roughly cap − 4 publishes partial on every sweep, permanently. The first live sweep on test showed this immediately — 12 alts found, 393-member roster, partial forever at that cap.

So the badge now says, to most visitors of a large guild's characters, "this list is knowingly incomplete and we will not tell you why or by how much" — and the maintainer had the same reaction on first seeing it, which is the clearest evidence it does not communicate.

To decide:

• Whether partial earns any public qualification. A phrase distinguishing "we stopped early" from "some data was not public" leaks no discovery method, no confidence score, and no provenance, so it may not actually conflict with Public presentation of inferred matches #11 — that decision was about not disclosing how a link was found, not about how complete a list is.
• Whether the state should even be surfaced when its cause is a routine cap rather than an upstream limitation, versus being surfaced more prominently because incompleteness is now the norm rather than the exception.
• Whether the /privacy or an about page explains what completeness means for these lists, given a character name is personal data and the page already carries the fingerprint disclosure.

Raising this as a decision, not a UI tweak: it touches two closed decisions that were taken under an assumption the live behaviour has now contradicted.

[Erilla]

Evidence from the #30 verification run, which sharpens this considerably.

With the cap at 1,100, a fresh root in the same 393-member guild (eu/draenor/Shurkvoker) swept every candidate — 396 requests of 1,100 reserved, no fingerprint_sweep_capped — and still published partial, because the Raider.IO stage had already recorded privacy_hidden (packages/domain/src/discovery.ts:349).

So the framing above is now too narrow in one respect and too generous in another:

• Raising the cap does not retire partial. Even an exhaustive sweep publishes it whenever the root's Raider.IO ownership is not public — which, after feat: infer links regardless of Raider.IO ownership visibility #34 removed the ownership filter, is a case we deliberately chose to keep serving rather than exclude. Those are now the majority of roots we can usefully sweep, since a privacy-hidden root is precisely the one Raider.IO cannot link for us.
• privacy_hidden is nonetheless an honest signal, not a spurious one: with no ownership link, any related character outside the guild roster is genuinely invisible to us, and no cap increase can reach it.

Which makes the choice in this issue starker than "explain the cap". The two live causes of partial mean materially different things to a reader:

Cause	What the reader could usefully be told
fingerprint_sweep_capped	we stopped early; more may exist and a later sweep may find it
privacy_hidden	we could only look inside this character's guild; related characters elsewhere are out of reach

Collapsing both into an unqualified Partial tells the reader neither. Worth deciding alongside the third bullet above, because the second row is closer to a completeness disclosure than to a discovery-method leak.