Adjacent-Domain Disclosure from Public Occupancy in GBFPlus

Archival preprint and reproducible evidence, version 1.0.0. Not peer reviewed. GBFPlus (Qin et al., Entropy 2026, 28:947, DOI 10.3390/e28090947) describes adjacent-domain metadata as protected. This note gives a protocol-specific counterexample: an honestly generated attestation released after one successful insertion exposes the complete share set through public occupancy. XORing its occupied payloads reveals the unmasked adjacent-domain identifier suffix, without a query token or candidate data identifier. If occupied count equals successful insertion count times the share count, the same operation reveals an aggregate XOR for disjoint batches. The observer requires permissioned-ledger read access, public widths and occupancy, and the stated honest construction and release rules. Repeated queries read one frozen snapshot. The written identities hold for every admissible share realization. The note does not claim a break of the separate data-identifier game, general publisher deanonymization, full-path recovery, measured deployment prevalence, or a complete repair. XOR sharing, disclosure versus membership acceptance, and masking/padding ideas are established and credited to predecessors. The deposit contains a five-page manuscript, self-contained LaTeX and Python source/evidence archive, citation metadata, and SHA-256 checksums. Reproduction includes 256 singleton choices, 1,024 disjoint-pair choices, 64 saved seeded arrays, 17 unit/integration tests, and a separate 771,787-transition finite oracle. Tests, lint, types, coverage, and clean archive reproduction were checked for this release. These are finite computational checks, not formal proofs or security-probability estimates. Alexander Richard Towell reviewed and approved the manuscript on October 18, 2026 and authorized archival release on October 20. Substantial OpenAI Codex assistance covered research, derivations, code, testing, writing, internal AI review, and packaging; no external human peer review or formal verification is claimed. The historical model-version record is incomplete. Novelty was assessed through bounded searches, not established exhaustively. The preprint, original explanatory text, and generated data are CC BY 4.0; software is MIT licensed as specified inside the packet. The primary article and other third-party publications are cited and linked, not redistributed. The owning workspace remains private; this archive is the canonical public source for this exact contribution. Local development and review dates are separate from this archival release date.