diff --git a/apps/docs/scripts/auth-cli.ts b/apps/docs/scripts/auth-cli.ts
index b52a8e9..69e8296 100644
--- a/apps/docs/scripts/auth-cli.ts
+++ b/apps/docs/scripts/auth-cli.ts
@@ -184,7 +184,7 @@ async function main() {
   const research = await researchResponse.json();
   assert.equal(research.companies.length, 1156);
   assert.equal(research.categories.length, 11);
-  assert.equal(research.evidence.length, 3520);
+  assert.equal(research.evidence.length, 3540);
   assert.equal(research.observations.length, 453);
   assert.equal((await request("/api/research/ai-companies", { method: "POST", headers })).status, 405);
   const researchPage = await request("/docs/other-research/ai-company-research/overview", { headers });
diff --git a/apps/docs/tests/research.test.ts b/apps/docs/tests/research.test.ts
index 0f301be..b84946b 100644
--- a/apps/docs/tests/research.test.ts
+++ b/apps/docs/tests/research.test.ts
@@ -24,7 +24,7 @@ test("research revisions share the authentication database and preserve replay l
     assert.equal(consumeCode(config, "invalid"), "limited");
     const initial = readResearchSnapshot();
     assert.equal(initial.companies.length, 1156);
-    assert.equal(initial.evidence.length, 3520);
+    assert.equal(initial.evidence.length, 3540);
     assert.equal(initial.observations.length, 453);
     assert.deepEqual(initial.candidateBatches, seed.candidateBatches, "candidate gaps persist in the same database metadata");
     assert.deepEqual(initial.directoryRechecks, seed.directoryRechecks, "follow-up classifications persist without rewriting the discovery audit");
@@ -65,7 +65,7 @@ test("research validation rejects broken evidence and unsafe source links", () =
 test("reviews link explicit companies without turning global or excluded cases into companies", () => {
   const snapshot = structuredClone(seed) as ResearchSnapshot;
   assert.equal(snapshot.reviews.filter((r) => r.scope === "companies").length, 198);
-  assert.equal(snapshot.reviews.filter((r) => r.scope === "dataset").length, 34);
+  assert.equal(snapshot.reviews.filter((r) => r.scope === "dataset").length, 35);
   assert.equal(snapshot.reviews.filter((r) => r.scope === "excluded-candidate").length, 44);
   const review = snapshot.reviews.find((r) => r.id === "R4")!;
   assert.deepEqual(reviewCompanyIds(snapshot, review), ["AI007", "AI013", "AI021", "AI034"]);
diff --git a/content/research/ai-companies.seed.json b/content/research/ai-companies.seed.json
index 7781c56..76efd55 100644
--- a/content/research/ai-companies.seed.json
+++ b/content/research/ai-companies.seed.json
@@ -1,5 +1,5 @@
 {
-  "version": "2026-10-31-missing-year-8",
+  "version": "2026-10-31-tc-security-1",
   "asOf": "2026-10-31",
   "scope": "全球公开资料研究：保留首批个案，并扩展核查2025—2026八个YC批次候选池；成立年份以官方公司页面字段为依据。",
   "limitations": [
@@ -81741,6 +81741,226 @@
       "kind": "公司自述官方资料复核",
       "summary": "原缺年54项第49—54项，6项成立/主体待核；全54项均已完成本轮外部资料补查和缺项登记，不等已确认成立或完成全来源研究。",
       "limitation": "原发现54缺年及1428总计不回写；全54项累计2关联/10范围外/40成立待核/2 AI待核，不将未知当零收入。"
+    },
+    {
+      "id": "TCSEC25-INDEX",
+      "companyId": null,
+      "title": "2025竞赛安全类别候选入口",
+      "url": "https://techcrunch.com/2025/12/26/the-9-top-cybersecurity-startups-from-disrupt-startup-battlefield/",
+      "publishedAt": "2025-12-26",
+      "accessedAt": "2026-10-31",
+      "kind": "媒体候选发现",
+      "summary": "本篇当前9个公司标题全部登记，业务与年份逐项追原始资料。",
+      "limitation": "仅该篇条目，不代表全部参赛者、两年档案或新公司；参赛年不作成立年，正文介绍不替独立性能验证。"
+    },
+    {
+      "id": "TCSEC25-AIM-HOME",
+      "companyId": null,
+      "title": "AIM Intelligence 当前交付与访问范围",
+      "url": "https://www.aim-intelligence.com/",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司自述官方资料复核",
+      "summary": "自动红队、实时护栏及AI/物理AI安全咨询，可云端或本地部署。",
+      "limitation": "论文/专利/机构标志和攻击效果为厂商自述；本批未核独立产品效能或合同。"
+    },
+    {
+      "id": "TCSEC25-AIM-YEAR",
+      "companyId": null,
+      "title": "AIM Intelligence 成立/旧业务年份线索",
+      "url": "https://www.aim-intelligence.com/about",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司官网",
+      "summary": "公司官网About列Founded2024，NAVER投资方名录亦列2024。",
+      "limitation": "公司自述年份暂判范围外，精确注册和集团边界未知；MWC年化收入另保留，非两年新公司ARR。"
+    },
+    {
+      "id": "TCSEC25-CORGEA-HOME",
+      "companyId": null,
+      "title": "Corgea 当前交付与访问范围",
+      "url": "https://corgea.com/",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司自述官方资料复核",
+      "summary": "AI应用安全扫描、业务逻辑风险识别与修复，涵盖代码、依赖、IaC、容器和Agent接入。",
+      "limitation": "演示及自动修复准确率为厂商描述，未独立测试；招聘薪资和开发者人数不作收入。"
+    },
+    {
+      "id": "TCSEC25-CORGEA-YEAR",
+      "companyId": null,
+      "title": "Corgea 成立/旧业务年份线索",
+      "url": "https://www.ycombinator.com/companies/corgea/jobs/flq0ShW-security-researcher",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "YC官方公司字段",
+      "summary": "YC官方招聘公司资料列Founded2023、S23、Team6。",
+      "limitation": "批次与Founded分开，招聘页仅作为官方字段来源；精确注册、合同和净费未核。"
+    },
+    {
+      "id": "TCSEC25-CYDEPLOY-HOME",
+      "companyId": null,
+      "title": "CyDeploy 当前交付与访问范围",
+      "url": "https://www.cydeploy.com/about",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司自述官方资料复核",
+      "summary": "自动环境依赖映射、数字孪生/沙箱及变更前验证，为企业持续变更保障服务。",
+      "limitation": "业务依据About可读正文；首页本轮文本不足，不把自动测试主张当独立系统验证或收入。"
+    },
+    {
+      "id": "TCSEC25-CYDEPLOY-YEAR",
+      "companyId": null,
+      "title": "CyDeploy 成立/旧业务年份线索",
+      "url": "https://jobs.techstars.com/companies/cydeploy",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "投资机构公开名录",
+      "summary": "Techstars投资/公司名录列founded in2020，链接同域名。",
+      "limitation": "名录为投资机构公开资料非独立登记；精确法人、功能商业使用与收入仍未核。"
+    },
+    {
+      "id": "TCSEC25-CYNTEGRA-HOME",
+      "companyId": null,
+      "title": "Cyntegra 当前交付与访问范围",
+      "url": "https://www.cyntegra.com/",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司自述官方资料复核",
+      "summary": "硬件安全存储、固件控制和恢复操作系统构成勒索后恢复产品，兼有部署/支持服务。",
+      "limitation": "恢复时间/索赔降低为厂商模型或主张，不是本轮恢复演练；硬件/许可/服务收入需拆，AI核心作用未证。"
+    },
+    {
+      "id": "TCSEC25-CYNTEGRA-YEAR",
+      "companyId": null,
+      "title": "Cyntegra 成立/旧业务年份线索",
+      "url": "https://www.lloyds.com/insights/lloyds-lab/programmes-and-initiatives/lloyds-lab-accelerator/alumni/cyntegra",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "加速器官方名录",
+      "summary": "Lloyd’s Lab官方校友名录列Founded2020、Cohort11/2023。",
+      "limitation": "项目参与与成立分别列示；保险损失下降、加速器支持或同站Lloyd’s集团利润不是公司收入。"
+    },
+    {
+      "id": "TCSEC25-HACKERVERSE-HOME",
+      "companyId": null,
+      "title": "HACKERverse 当前交付与访问范围",
+      "url": "https://hackerverse.ai/",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司自述官方资料复核",
+      "summary": "在隔离Arena以AI bots对安全产品进行攻击模拟/验证，输出签名记录和检测证据。",
+      "limitation": "85%评估加速、240K美元符号客户节省和23%缺口是厂商指标；签名可验证记录不自动证明测试有效或独立性，本轮未运行任何攻击。"
+    },
+    {
+      "id": "TCSEC25-HACKERVERSE-YEAR",
+      "companyId": null,
+      "title": "HACKERverse 成立/旧业务年份线索",
+      "url": "https://www.linkedin.com/company/hackerverse",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司公开主页自述",
+      "summary": "公司公开主页链接hackerverse.ai，Founded2021、规模2—10。",
+      "limitation": "自述非登记，不与hackerverse.com的EC-Council CTF产品或其2001成立混同；实际付费与法人仍待核。"
+    },
+    {
+      "id": "TCSEC25-MILLPOND-HOME",
+      "companyId": null,
+      "title": "Mill Pond Research 当前交付与访问范围",
+      "url": "https://www.millpondresearch.com/",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司自述官方资料复核",
+      "summary": "官网直达本轮仅取得无正文外壳；业务与沿革据下列公司公开主页补证。",
+      "limitation": "不认定首页已阅读全文，也不执行任何站点脚本或把搜索片段替代官网正文。"
+    },
+    {
+      "id": "TCSEC25-MILLPOND-YEAR",
+      "companyId": null,
+      "title": "Mill Pond Research 成立/旧业务年份线索",
+      "url": "https://www.linkedin.com/company/mill-pond-research",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司公开主页自述",
+      "summary": "公司主页明确Founded2023，从专业服务转为AI设施软件，Xilos观察、保护、编排Agent生态。",
+      "limitation": "服务转软件不是新成立；专利/机构参与为自述，原有服务收入和新软件收入未取得合同拆分。"
+    },
+    {
+      "id": "TCSEC25-POLYGRAF-HOME",
+      "companyId": null,
+      "title": "Polygraf AI 当前交付与访问范围",
+      "url": "https://www.polygraf.ai/",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司自述官方资料复核",
+      "summary": "企业数据/AI治理，阻止敏感数据进入模型、识别未授权AI使用及深伪，提供端侧与本地安全功能。",
+      "limitation": "公司称独立验证但本轮未取得报告，不据宣传升独立技术等级；模型组件与整套治理交付不同，不直接归基础模型公司。"
+    },
+    {
+      "id": "TCSEC25-POLYGRAF-YEAR",
+      "companyId": null,
+      "title": "Polygraf AI 成立/旧业务年份线索",
+      "url": "https://www.polygraf.ai/news/polygrafs-ai-governance-software-awarded-best-product-in-ai-data/",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司官方历史材料",
+      "summary": "官网原始新闻资料明确Founded2021、Austin总部。",
+      "limitation": "2025获奖/参赛非成立，精确注册与产品许可/服务收入仍待核，奖项不当财务收入。"
+    },
+    {
+      "id": "TCSEC25-TRUSOURCES-HOME",
+      "companyId": null,
+      "title": "TruSources（现站TruClaw） 当前交付与访问范围",
+      "url": "https://trusources.ai/",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司自述官方资料复核",
+      "summary": "当前同域展示TruClaw，为Agent提供人工同意/授权凭证；免费1000次/月，Growth99美元符号/月含10000次，超额0.01/次。",
+      "limitation": "旧KYC/深伪SDK与现Agent同意产品分开，价格不是已实现MRR，模板版权Yella非已核运营法人；没有安装或执行其工具。"
+    },
+    {
+      "id": "TCSEC25-TRUSOURCES-YEAR",
+      "companyId": null,
+      "title": "TruSources（现站TruClaw） 成立/旧业务年份线索",
+      "url": "https://www.linkedin.com/company/trusources",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司公开主页自述",
+      "summary": "同域名公司主页自报Founded2023，描述原端侧KYC/深伪业务并列同创始人。",
+      "limitation": "同创始人/域名支持产品转向线索，不证明完整法人连续；不凭新产品发布新增2026公司，精确主体待核。"
+    },
+    {
+      "id": "TCSEC25-ZEST-HOME",
+      "companyId": null,
+      "title": "ZEST Security 当前交付与访问范围",
+      "url": "https://www.zestsecurity.io/",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "公司自述官方资料复核",
+      "summary": "Agent云风险暴露管理、修复及缓解路径，结合现有云控制与代码。",
+      "limitation": "减少风险/运营成本非自身收入；原Cider创业履历及收购不能归当前ZEST，也未核独立安全效果。"
+    },
+    {
+      "id": "TCSEC25-ZEST-YEAR",
+      "companyId": null,
+      "title": "ZEST Security 成立/旧业务年份线索",
+      "url": "https://www.zestsecurity.io/resources/news/zest-security-enables-security-teams-to-proactively-block-attacker-activity-using-aws-service-control-policies-as-a-mitigation-pathway",
+      "publishedAt": "2025-07-30",
+      "accessedAt": "2026-10-31",
+      "kind": "公司官方历史材料",
+      "summary": "2025-07-30官网原始发布明确2023年11月成立，纽约/特拉维夫办公室。",
+      "limitation": "功能发布日期不等成立；融资、客户安全成本与前事业ARR不作当前收入，精确法人待补。"
+    },
+    {
+      "id": "TCSEC25-AIM-MWC",
+      "companyId": null,
+      "title": "AIM展商年化收入口径",
+      "url": "https://www.mwcbarcelona.com/exhibitors/35004-aim-intelligence",
+      "publishedAt": null,
+      "accessedAt": "2026-10-31",
+      "kind": "参展公司公开自述",
+      "summary": "展商介绍列Founded2024，运营第一年超过USD0.9M annualized revenue及15+客户。",
+      "limitation": "参展公司自述，期间具体截至日/底表未取得；annualized revenue不等ARR；范围外旧公司不混入两年新公司收入图。"
     }
   ],
   "reviews": [
@@ -88186,6 +88406,36 @@
         "MISSINGYEAR8-38556-HOME"
       ],
       "handling": "仅补证与分类，无新收入；成立、主体、合同及性能缺项逐项保留。全缺年池补查不等确认全部年份/AI或完成其他来源。"
+    },
+    {
+      "id": "TCSEC25-R-BOUNDARY",
+      "type": "竞赛年、旧主体与安全效果口径",
+      "company": "2025竞赛安全类别9项",
+      "scope": "dataset",
+      "summary": "原始/公司公开材料显示均有2025之前的主体或业务；代码安全、变更验证、AI治理、实体恢复、产品测试与Agent授权按交付细分。",
+      "evidenceIds": [
+        "TCSEC25-INDEX",
+        "TCSEC25-AIM-MWC",
+        "TCSEC25-AIM-YEAR",
+        "TCSEC25-CORGEA-YEAR",
+        "TCSEC25-CYDEPLOY-YEAR",
+        "TCSEC25-CYNTEGRA-YEAR",
+        "TCSEC25-HACKERVERSE-YEAR",
+        "TCSEC25-MILLPOND-YEAR",
+        "TCSEC25-POLYGRAF-YEAR",
+        "TCSEC25-TRUSOURCES-YEAR",
+        "TCSEC25-ZEST-YEAR",
+        "TCSEC25-AIM-HOME",
+        "TCSEC25-CORGEA-HOME",
+        "TCSEC25-CYDEPLOY-HOME",
+        "TCSEC25-CYNTEGRA-HOME",
+        "TCSEC25-HACKERVERSE-HOME",
+        "TCSEC25-MILLPOND-HOME",
+        "TCSEC25-POLYGRAF-HOME",
+        "TCSEC25-TRUSOURCES-HOME",
+        "TCSEC25-ZEST-HOME"
+      ],
+      "handling": "不因参赛或产品转向新增公司。AIM展商annualized revenue非ARR，HACKERverse客户节省、Cyntegra保险损失模型、ZEST前事业财务不入当前收入图；未执行攻击或安装工具，未获独立产品验证。"
     }
   ],
   "coverage": {
@@ -94702,6 +94952,152 @@
           ]
         }
       ]
+    },
+    {
+      "id": "TC-2025-battlefield-security-1",
+      "sourceId": "S02",
+      "url": "https://techcrunch.com/2025/12/26/the-9-top-cybersecurity-startups-from-disrupt-startup-battlefield/",
+      "accessedAt": "2026-10-31",
+      "scope": "本篇9项标题全部登记并逐项尝试官网及年份来源；9项均有2020—2024成立/旧业务线索，暂归范围外。只完成该篇候选台账，不等全部200参赛者、TechCrunch两年档案或独立财务技术核验。",
+      "complete": false,
+      "records": [
+        {
+          "id": "TC25-SEC-AIM",
+          "name": "AIM Intelligence",
+          "url": "https://aim-intelligence.com/en",
+          "categoryId": "C03",
+          "kind": "company",
+          "profileStatus": "readable",
+          "status": "outside-cohort",
+          "note": "原始/公司公开资料列2024，暂归年份范围外，不新增公司；自动红队、实时护栏及AI/物理AI安全咨询，可云端或本地部署。论文/专利/机构标志和攻击效果为厂商自述；本批未核独立产品效能或合同。 公司自述年份暂判范围外，精确注册和集团边界未知；MWC年化收入另保留，非两年新公司ARR。",
+          "evidenceIds": [
+            "TCSEC25-INDEX",
+            "TCSEC25-AIM-HOME",
+            "TCSEC25-AIM-YEAR",
+            "TCSEC25-AIM-MWC"
+          ]
+        },
+        {
+          "id": "TC25-SEC-CORGEA",
+          "name": "Corgea",
+          "url": "https://corgea.com/",
+          "categoryId": "C04",
+          "kind": "company",
+          "profileStatus": "readable",
+          "status": "outside-cohort",
+          "note": "原始/公司公开资料列2023，暂归年份范围外，不新增公司；AI应用安全扫描、业务逻辑风险识别与修复，涵盖代码、依赖、IaC、容器和Agent接入。演示及自动修复准确率为厂商描述，未独立测试；招聘薪资和开发者人数不作收入。 批次与Founded分开，招聘页仅作为官方字段来源；精确注册、合同和净费未核。",
+          "evidenceIds": [
+            "TCSEC25-INDEX",
+            "TCSEC25-CORGEA-HOME",
+            "TCSEC25-CORGEA-YEAR"
+          ]
+        },
+        {
+          "id": "TC25-SEC-CYDEPLOY",
+          "name": "CyDeploy",
+          "url": "https://www.cydeploy.com/",
+          "categoryId": "C05",
+          "kind": "company",
+          "profileStatus": "readable",
+          "status": "outside-cohort",
+          "note": "原始/公司公开资料列2020，暂归年份范围外，不新增公司；自动环境依赖映射、数字孪生/沙箱及变更前验证，为企业持续变更保障服务。业务依据About可读正文；首页本轮文本不足，不把自动测试主张当独立系统验证或收入。 名录为投资机构公开资料非独立登记；精确法人、功能商业使用与收入仍未核。",
+          "evidenceIds": [
+            "TCSEC25-INDEX",
+            "TCSEC25-CYDEPLOY-HOME",
+            "TCSEC25-CYDEPLOY-YEAR"
+          ]
+        },
+        {
+          "id": "TC25-SEC-CYNTEGRA",
+          "name": "Cyntegra",
+          "url": "https://www.cyntegra.com/",
+          "categoryId": "C05",
+          "kind": "company",
+          "profileStatus": "readable",
+          "status": "outside-cohort",
+          "note": "原始/公司公开资料列2020，暂归年份范围外，不新增公司；硬件安全存储、固件控制和恢复操作系统构成勒索后恢复产品，兼有部署/支持服务。恢复时间/索赔降低为厂商模型或主张，不是本轮恢复演练；硬件/许可/服务收入需拆，AI核心作用未证。 项目参与与成立分别列示；保险损失下降、加速器支持或同站Lloyd’s集团利润不是公司收入。",
+          "evidenceIds": [
+            "TCSEC25-INDEX",
+            "TCSEC25-CYNTEGRA-HOME",
+            "TCSEC25-CYNTEGRA-YEAR"
+          ]
+        },
+        {
+          "id": "TC25-SEC-HACKERVERSE",
+          "name": "HACKERverse",
+          "url": "https://hackerverse.ai/",
+          "categoryId": "C05",
+          "kind": "company",
+          "profileStatus": "readable",
+          "status": "outside-cohort",
+          "note": "原始/公司公开资料列2021，暂归年份范围外，不新增公司；在隔离Arena以AI bots对安全产品进行攻击模拟/验证，输出签名记录和检测证据。85%评估加速、240K美元符号客户节省和23%缺口是厂商指标；签名可验证记录不自动证明测试有效或独立性，本轮未运行任何攻击。 自述非登记，不与hackerverse.com的EC-Council CTF产品或其2001成立混同；实际付费与法人仍待核。",
+          "evidenceIds": [
+            "TCSEC25-INDEX",
+            "TCSEC25-HACKERVERSE-HOME",
+            "TCSEC25-HACKERVERSE-YEAR"
+          ]
+        },
+        {
+          "id": "TC25-SEC-MILLPOND",
+          "name": "Mill Pond Research",
+          "url": "https://millpondresearch.com/",
+          "categoryId": "C03",
+          "kind": "company",
+          "profileStatus": "readable",
+          "status": "outside-cohort",
+          "note": "原始/公司公开资料列2023，暂归年份范围外，不新增公司；官网直达本轮仅取得无正文外壳；业务与沿革据下列公司公开主页补证。不认定首页已阅读全文，也不执行任何站点脚本或把搜索片段替代官网正文。 服务转软件不是新成立；专利/机构参与为自述，原有服务收入和新软件收入未取得合同拆分。",
+          "evidenceIds": [
+            "TCSEC25-INDEX",
+            "TCSEC25-MILLPOND-HOME",
+            "TCSEC25-MILLPOND-YEAR"
+          ]
+        },
+        {
+          "id": "TC25-SEC-POLYGRAF",
+          "name": "Polygraf AI",
+          "url": "https://polygraf.ai/",
+          "categoryId": "C05",
+          "kind": "company",
+          "profileStatus": "readable",
+          "status": "outside-cohort",
+          "note": "原始/公司公开资料列2021，暂归年份范围外，不新增公司；企业数据/AI治理，阻止敏感数据进入模型、识别未授权AI使用及深伪，提供端侧与本地安全功能。公司称独立验证但本轮未取得报告，不据宣传升独立技术等级；模型组件与整套治理交付不同，不直接归基础模型公司。 2025获奖/参赛非成立，精确注册与产品许可/服务收入仍待核，奖项不当财务收入。",
+          "evidenceIds": [
+            "TCSEC25-INDEX",
+            "TCSEC25-POLYGRAF-HOME",
+            "TCSEC25-POLYGRAF-YEAR"
+          ]
+        },
+        {
+          "id": "TC25-SEC-TRUSOURCES",
+          "name": "TruSources（现站TruClaw）",
+          "url": "https://trusources.ai/",
+          "categoryId": "C03",
+          "kind": "company",
+          "profileStatus": "readable",
+          "status": "outside-cohort",
+          "note": "原始/公司公开资料列2023，暂归年份范围外，不新增公司；当前同域展示TruClaw，为Agent提供人工同意/授权凭证；免费1000次/月，Growth99美元符号/月含10000次，超额0.01/次。旧KYC/深伪SDK与现Agent同意产品分开，价格不是已实现MRR，模板版权Yella非已核运营法人；没有安装或执行其工具。 同创始人/域名支持产品转向线索，不证明完整法人连续；不凭新产品发布新增2026公司，精确主体待核。",
+          "evidenceIds": [
+            "TCSEC25-INDEX",
+            "TCSEC25-TRUSOURCES-HOME",
+            "TCSEC25-TRUSOURCES-YEAR"
+          ]
+        },
+        {
+          "id": "TC25-SEC-ZEST",
+          "name": "ZEST Security",
+          "url": "https://zestsecurity.io/",
+          "categoryId": "C05",
+          "kind": "company",
+          "profileStatus": "readable",
+          "status": "outside-cohort",
+          "note": "原始/公司公开资料列2023，暂归年份范围外，不新增公司；Agent云风险暴露管理、修复及缓解路径，结合现有云控制与代码。减少风险/运营成本非自身收入；原Cider创业履历及收购不能归当前ZEST，也未核独立安全效果。 功能发布日期不等成立；融资、客户安全成本与前事业ARR不作当前收入，精确法人待补。",
+          "evidenceIds": [
+            "TCSEC25-INDEX",
+            "TCSEC25-ZEST-HOME",
+            "TCSEC25-ZEST-YEAR"
+          ]
+        }
+      ]
     }
   ],
   "directoryRechecks": [
diff --git a/content/research/ai-companies.sources.json b/content/research/ai-companies.sources.json
index ad40e9c..df9eb51 100644
--- a/content/research/ai-companies.sources.json
+++ b/content/research/ai-companies.sources.json
@@ -1,5 +1,5 @@
 {
-  "version": "2026-10-31-missing-year-8",
+  "version": "2026-10-31-tc-security-1",
   "scopeConfirmedAt": "2026-10-30",
   "acceptance": "以确认的公开来源清单为边界，逐条核对并标明缺项。",
   "provenance": "S01—S12恢复自已提交用户的《AI公司研究_来源与分类模板》来源清单；S13—S16单列后续已使用的补充证据渠道，不将使用次数当作全量覆盖。",
@@ -28,8 +28,8 @@
         "techcrunch.com"
       ],
       "initialAccess": "AI栏目可读取",
-      "boundary": "2026首页定向3项已登记，另从AI第3—4页登记5项：3项关联公司、1项范围外、1项待核；不等全部卡片核验。另已读2025年度档案入口与AI第二页，并完整登记一篇2025企业竞赛名单32项：复用1项、范围外29项、待核2项；每项均尝试原始链接，未知与不可读保留。单篇32项不等全部200参赛者、全部分页或两年全量；RSS/API普通请求受限。 另从AI第5—6页定向4项：2项原始资料归范围外，2项原始成立/年份待核；不是全部卡片、参赛者或档案。 首次登记2025政府/法律名单正文11项（标题称10）时：7项范围外或既有业务、4项成立/主体待核；当时未新增主公司或ARR，非全部200或两年档案。 另将2025金融/地产名单14项全部登记：11项范围外/既有业务，3项年份/主体/AI待核；不新增公司或收入，不等其余竞赛类别。 另将2025生物技术名单9项全部登记：8项范围外或既有业务，1项产品与主体对应待核；不新增公司或收入，非全部竞赛类别。 后续补证：政府/法律名单Aparti关联2025主公司，Pytho按既有业务排除；该11项现1关联、8范围外、2待核，原始访问记录保留。",
-      "nextCheck": "继续核本篇2项的成立、主体及AI主营，优先解决Billow批次与发现年份时序、Sponstar原始年份冲突；既有业务的法律沿革及不可读项仍留缺；沿普通2025档案和AI分页扩展其余来源台账，区分参赛年、批次与公司成立年。 继续核Laplace原始年份及Eka精确注册主体；Recursive的2025/2026年份冲突保留。 继续核Honeyjar主字段与转载的年份差异、Blueprints原始可读资料与旧建筑业务主体；不把包价、演示金额或建设项目价值当ARR。 本篇待核Aparti精确注册、JustiGuide的2024/2026语义、orchestraos主体与年份及Pytho原始登记；补其余竞赛类别和年度档案，不用同名链接替代核查。 补ticker原始可读页面、Investwise主营及主体、Soundspace成立与AI实际交付；保留Genia结果收费与首页套餐的合同缺项，不把交易、返佣或客户资产年化为ARR。 补Avara可读条款和Lumos登记号对应、其他生物技术候选的AI实际作用及地域主体链；研发、临床、审批计划和药企赞助与当前商业收入分开。 Aparti已补公司自述成立，精确注册/付费及Amie收入仍待核；Pytho已由官网链接原始采访补范围外，不再列年份待核，精确注册留缺。",
+      "boundary": "2026首页定向3项已登记，另从AI第3—4页登记5项：3项关联公司、1项范围外、1项待核；不等全部卡片核验。另已读2025年度档案入口与AI第二页，并完整登记一篇2025企业竞赛名单32项：复用1项、范围外29项、待核2项；每项均尝试原始链接，未知与不可读保留。单篇32项不等全部200参赛者、全部分页或两年全量；RSS/API普通请求受限。 另从AI第5—6页定向4项：2项原始资料归范围外，2项原始成立/年份待核；不是全部卡片、参赛者或档案。 首次登记2025政府/法律名单正文11项（标题称10）时：7项范围外或既有业务、4项成立/主体待核；当时未新增主公司或ARR，非全部200或两年档案。 另将2025金融/地产名单14项全部登记：11项范围外/既有业务，3项年份/主体/AI待核；不新增公司或收入，不等其余竞赛类别。 另将2025生物技术名单9项全部登记：8项范围外或既有业务，1项产品与主体对应待核；不新增公司或收入，非全部竞赛类别。 后续补证：政府/法律名单Aparti关联2025主公司，Pytho按既有业务排除；该11项现1关联、8范围外、2待核，原始访问记录保留。 另将2025安全类别名单9项全部登记并逐项追原始/公司公开资料，9项均有2020—2024成立或旧业务线索，暂归范围外。官网外壳、产品转向及同名不同站点单列，不新增公司或收入；非完整200或两年档案。",
+      "nextCheck": "继续核本篇2项的成立、主体及AI主营，优先解决Billow批次与发现年份时序、Sponstar原始年份冲突；既有业务的法律沿革及不可读项仍留缺；沿普通2025档案和AI分页扩展其余来源台账，区分参赛年、批次与公司成立年。 继续核Laplace原始年份及Eka精确注册主体；Recursive的2025/2026年份冲突保留。 继续核Honeyjar主字段与转载的年份差异、Blueprints原始可读资料与旧建筑业务主体；不把包价、演示金额或建设项目价值当ARR。 本篇待核Aparti精确注册、JustiGuide的2024/2026语义、orchestraos主体与年份及Pytho原始登记；补其余竞赛类别和年度档案，不用同名链接替代核查。 补ticker原始可读页面、Investwise主营及主体、Soundspace成立与AI实际交付；保留Genia结果收费与首页套餐的合同缺项，不把交易、返佣或客户资产年化为ARR。 补Avara可读条款和Lumos登记号对应、其他生物技术候选的AI实际作用及地域主体链；研发、临床、审批计划和药企赞助与当前商业收入分开。 Aparti已补公司自述成立，精确注册/付费及Amie收入仍待核；Pytho已由官网链接原始采访补范围外，不再列年份待核，精确注册留缺。 补本批精确注册/集团沿革、Mill Pond可读官网、TruSources/TruClaw运营主体；安全自述、签名记录和实际独立效能分开，AIM年化收入与合同、经常性及截至日仍缺。继续补其他竞赛类别与两年公开档案。",
       "limitation": "需追溯原始披露，部分文章受访问限制",
       "accessRecheckedAt": "2026-10-30"
     },
diff --git a/content/research/ai-income-analysis.json b/content/research/ai-income-analysis.json
index 783cce2..6b2bbae 100644
--- a/content/research/ai-income-analysis.json
+++ b/content/research/ai-income-analysis.json
@@ -1,5 +1,5 @@
 {
-  "sourceVersion": "2026-10-31-missing-year-8",
+  "sourceVersion": "2026-10-31-tc-security-1",
   "asOf": "2026-10-31",
   "metric": "platform-mrr-usd",
   "sampleUnit": "product-or-business",