@@ -81,6 +81,7 @@ All notable changes to CallShield will be documented in this file.
 - On a phone with two SIMs, the caller ID popup for a call on the second SIM closed the moment it opened. It went by the main SIM's call state, and that reads idle while the other SIM rings. The popup now watches each SIM and closes once every one of them is idle, the same way an outgoing call's warning does.
 - On a phone with two SIMs, Answer and hang up now rejects a spam call when either SIM is roaming. Android doesn't tell call screening apps which SIM a call came in on, so CallShield only checked the main one, and a call on a roaming second SIM could get answered abroad, where answering can cost you.
 - The report service now takes a number sent without a + only when it has ten digits, read as a US or Canadian number. Any other bare length is turned away, since nothing says which country it's from. A Chinese mobile sent as 15017944158 was being stored as +1 501-794-4158, a line in Arkansas, and could end up on the watch list. The import scripts for North American feeds still read a bare 1 plus ten digits as +1.
+- The community report merge and the watch list now set aside reports from before that fix that were most likely misread that way. That's a +1 number whose +86 reading is already a known number, or one in an area code no phone line uses that didn't come from the app. A number already in the database or approved by hand is never set aside, and neither is a report from after the fix.
 
 ## v1.12.0 (2026-10-09)
 
 
@@ -17,7 +17,7 @@
 import sys
 from datetime import datetime, timezone, timedelta
 from pathlib import Path
-from phone_normalization import validated_report_number
+from phone_normalization import bare_digit_misreading, validated_report_number
 
 from pipeline_io import (
     FeedCollapseError,
@@ -152,6 +152,26 @@ def main(argv: list[str] | None = None) -> int:
             except Exception as e:
                 print(f"  Skipping {report_file.name}: {e}")
 
+    # Reports stored before 2026-10-30 may carry a bare foreign number read as
+    # +1 (see bare_digit_misreading); the merge drops the same ones.
+    db_numbers: set[str] = set()
+    if DB_FILE.exists():
+        with open(DB_FILE) as f:
+            db_numbers = {str(entry.get("number", "")) for entry in json.load(f).get("numbers", [])}
+    known_numbers = db_numbers | {entry[0] for entry in pending}
+    files_with_id = {token for report_id, _, token in report_ids if report_id}
+    misread = {
+        entry[4]
+        for entry in pending
+        if entry[0] not in db_numbers
+        and bare_digit_misreading(
+            entry[0], known_numbers, entry[4] in files_with_id, entry[1].astimezone(timezone.utc).date().isoformat()
+        )
+    }
+    if misread:
+        print(f"  Dropped {len(misread)} report(s) for +1 numbers that read as bare foreign numbers")
+        pending = [entry for entry in pending if entry[4] not in misread]
+
     # A report the app sent twice under one id is one reporter, even when the
     # resend came from another network and so from another reporter bucket.
     resent_reports = find_resent_reports(report_ids)
 
@@ -15,7 +15,12 @@
 from datetime import date, datetime, timedelta, timezone
 from pathlib import Path
 
-from phone_normalization import is_plausible_number, split_country_code, validated_report_number
+from phone_normalization import (
+    bare_digit_misreading,
+    is_plausible_number,
+    split_country_code,
+    validated_report_number,
+)
 from pipeline_io import (
     atomic_write_json,
     report_queue_digest,
@@ -1036,6 +1041,37 @@ def main(argv: list[str] | None = None):
     if revoked_released or revoked_removed:
         print(f"Revoked approvals: {revoked_removed} rows unpublished, {revoked_released} left to their other sources")
 
+    # Reports the Worker stored before 2026-10-30 may carry a bare foreign
+    # number read as +1. A number the database lists or a maintainer approved
+    # stands on its own evidence; an unpublished ledger row doesn't. A row
+    # judged here still holds its reports, so a row whose app report aged out
+    # isn't mistaken for one no app sent.
+    approved_numbers = {approval["number"] for approval in approvals}
+    known_numbers = set(existing) | set(pending) | {number for _, number, _ in peeked}
+
+    def misread(number: str, has_report_id: bool, reported_day: str) -> bool:
+        return (
+            number not in existing
+            and number not in approved_numbers
+            and bare_digit_misreading(number, known_numbers, has_report_id, reported_day)
+        )
+
+    misread_rows = sorted(
+        number
+        for number, state in pending.items()
+        if not state["published"]
+        and state["events"]
+        and misread(
+            number,
+            any(str(event.get("key", "")).startswith("id:") for event in state["events"]),
+            max(event["day"] for event in [*state["events"], *state.get("watch_events", [])]),
+        )
+    )
+    for number in misread_rows:
+        del pending[number]
+    if misread_rows:
+        print(f"Dropped {len(misread_rows)} pending +1 rows that read as bare foreign numbers: {', '.join(misread_rows)}")
+
     demoted = 0
     for number, entry in list(existing.items()):
         if canonical_source_ids(entry) != {"community_reports"}:
@@ -1063,6 +1099,7 @@ def main(argv: list[str] | None = None):
     # Counting them by raw value keeps the run auditable without reprinting one
     # line per file for a burst of the same fictional number.
     implausible: Counter[str] = Counter()
+    misread_reports: Counter[str] = Counter()
     processed_files = []
     counted_ids: set[str] = set()
     already_merged = 0
@@ -1090,6 +1127,15 @@ def main(argv: list[str] | None = None):
                 skipped += 1
                 continue
 
+            parsed_at = parse_reported_at(report.get("reported_at"))
+            reported_at = parsed_at.astimezone(timezone.utc).date().isoformat() if parsed_at else today
+            reported_at = min(reported_at, today)
+
+            if misread(number, bool(validated_report_id(report.get("report_id"))), reported_at):
+                misread_reports[number] += 1
+                processed_files.append(report_file)
+                continue
+
             if report_file.name in previously_merged:
                 processed_files.append(report_file)
                 already_merged += 1
@@ -1109,9 +1155,6 @@ def main(argv: list[str] | None = None):
             report_id = validated_report_id(report.get("report_id"))
 
             spam_type = report.get("type", "unknown")
-            parsed_at = parse_reported_at(report.get("reported_at"))
-            reported_at = parsed_at.astimezone(timezone.utc).date().isoformat() if parsed_at else today
-            reported_at = min(reported_at, today)
 
             # Handle false-positive reports: collect one vote per reporter for review.
             # SECURITY: anonymous not_spam votes may only weaken COMMUNITY rows.
@@ -1395,6 +1438,10 @@ def main(argv: list[str] | None = None):
         print(f"\nRejected as implausible ({skipped} report(s), {len(implausible)} distinct):")
         for raw, count in sorted(implausible.items(), key=lambda item: (-item[1], item[0])):
             print(f"  {raw} x{count}")
+    if misread_reports:
+        print(f"\nDropped as bare foreign numbers read as +1 ({sum(misread_reports.values())} report(s)):")
+        for number, count in sorted(misread_reports.items(), key=lambda item: (-item[1], item[0])):
+            print(f"  {number} x{count}")
 
     print(
         f"\nMerged: {added} new, {updated} updated, {skipped} skipped (implausible), "
 
@@ -1,5 +1,17 @@
 """Shared phone normalization helpers for report and import scripts."""
 
+import csv
+import os
+from collections.abc import Container
+from functools import lru_cache
+from pathlib import Path
+
+NANP_AREA_CODES_FILE = Path(__file__).resolve().parent.parent / "data" / "nanp-area-codes.csv"
+# The Worker stopped reading bare digits as NANP on 2026-10-30, so a report
+# dated from the next UTC day on went through the fixed Worker. Tests move the
+# day with CALLSHIELD_BARE_DIGIT_FIX_DAY.
+BARE_DIGIT_FIX_DAY = os.environ.get("CALLSHIELD_BARE_DIGIT_FIX_DAY", "2026-10-31")
+
 FORMAT_CONTROL_CODES = {0x200B, 0x200C, 0x200D, 0x200E, 0x200F, 0xFEFF}
 
 # Every assigned two-digit country calling code (ITU-T E.164). Calling codes are
@@ -148,6 +160,34 @@ def is_plausible_number(e164: str | None) -> bool:
     return True
 
 
+@lru_cache(maxsize=1)
+def nanp_area_codes_in_service() -> frozenset[str]:
+    """Area codes the pinned NANPA snapshot (data/nanp-area-codes.csv) lists as in service."""
+    with NANP_AREA_CODES_FILE.open(encoding="utf-8-sig", newline="") as source:
+        rows = csv.DictReader(line for line in source if not line.startswith("#"))
+        return frozenset(row["npa"] for row in rows if row["status"] == "in_service")
+
+
+def bare_digit_misreading(e164: str, known: Container[str], has_report_id: bool, reported_day: str) -> bool:
+    """Whether a stored +1 number is most likely a bare foreign number read as NANP.
+
+    Until 2026-10-30 the report paths read any bare 11 digits as "+digits", so
+    a Chinese mobile sent as 15017944158 was stored as +1 501-794-4158, an
+    Arkansas line. The stored form can't show that, so two signs decide: its
+    +86 reading is already a known number, or no subscriber can hold it (its
+    area code isn't in service) and no app sent it (the app has attached a
+    report id since v1.10.0). A spoofed caller ID can sit in a dead area code
+    too, which is why the second sign needs both halves, and why a report
+    dated BARE_DIGIT_FIX_DAY or later is never judged: the fixed Worker stored
+    it as sent.
+    """
+    if reported_day >= BARE_DIGIT_FIX_DAY or len(e164) != 12 or not e164.startswith("+1"):
+        return False
+    if f"+86{e164[1:]}" in known:
+        return True
+    return not has_report_id and e164[2:5] not in nanp_area_codes_in_service()
+
+
 def validated_report_number(raw: str | None) -> str | None:
     """Normalize and plausibility-check a community report number.
 
 
@@ -35,6 +35,9 @@ def run_script_result(
     # The merge asks FCC about pending numbers. Here it reads a saved lookup
     # instead, and a test that has no such file gets no complaints.
     env["CALLSHIELD_FCC_COMPLAINTS_FILE"] = str(fcc_complaints_file(data_dir))
+    # Reports dated BASE_DAY came in before the Worker's bare-digit fix and
+    # reports dated TODAY after it, whatever day the suite runs.
+    env["CALLSHIELD_BARE_DIGIT_FIX_DAY"] = TODAY
     result = subprocess.run(
         [sys.executable, str(SCRIPTS_DIR / name), *(args or [])],
         cwd=ROOT,
@@ -1164,6 +1167,78 @@ def assert_a_published_number_leaves_the_watch_list(data_dir: Path) -> None:
     assert feed["numbers"] == [] and feed["cleared"] is True, feed
 
 
+def assert_bare_digit_misreadings_stay_off_the_watch_list(data_dir: Path) -> None:
+    """Reports stored before 2026-10-30 turned bare Chinese mobiles into +1
+    numbers (15017944158 into +1 501-794-4158, an Arkansas line). One whose +86
+    reading is already listed, or one in a dead area code that no app sent,
+    never reaches the watch list, and a ledger row it left behind is dropped.
+    Reports the fixed Worker stored, and numbers the database lists or a
+    maintainer approved, are taken as sent."""
+    def fcc_row(number: str) -> dict:
+        return {"number": number, "type": "spam", "reports": 1, "first_seen": BASE_DAY, "last_seen": BASE_DAY,
+                "description": "FCC complaint", "sources": ["fcc_complaints"]}
+
+    twin_listed = "+15017944158"
+    dead_area_code = "+18957465363"
+    sent_by_the_app = "+18957465364"
+    after_the_fix = "+18957465365"
+    listed = "+18957465366"
+    approved = "+18957465367"
+    aged_out = "+18957465368"
+    ordinary = "+12122340801"
+    twin_listed_later = "+18638657795"
+    write_json(
+        data_dir / "spam_numbers.json",
+        {"version": 1, "updated": TODAY, "sources": ["fcc_complaints"], "prefixes": [],
+         "numbers": [fcc_row("+8615017944158"), fcc_row(listed)]},
+    )
+    write_json(
+        data_dir / "spam_numbers_approved.json",
+        {"approved": [{"number": approved, "type": "scam", "reviewed_at": BASE_DAY, "reference": "https://example.org/review"}]},
+    )
+    reported = (datetime.now(timezone.utc) - timedelta(days=1)).replace(hour=10, minute=0, second=0, microsecond=0)
+    for number in (twin_listed, dead_area_code, sent_by_the_app, listed, approved, ordinary, twin_listed_later):
+        for index, bucket in enumerate(BUCKETS[:2], start=1):
+            report_id = f"00000000-0000-4000-8000-{index:012x}" if number == sent_by_the_app else None
+            write_report(
+                data_dir, f"{number[1:]}-{index}.json", number, bucket, (reported + timedelta(hours=index)).isoformat(),
+                device=BUCKETS[index + 1], report_id=report_id,
+            )
+    for index, bucket in enumerate(BUCKETS[:2], start=1):
+        write_report(
+            data_dir, f"{after_the_fix[1:]}-{index}.json", after_the_fix, bucket, f"{TODAY}T00:0{index}:00+00:00",
+            device=BUCKETS[index + 1],
+        )
+    # Too old to count as a report, the app's report still leaves a watch row.
+    write_report(
+        data_dir, f"{aged_out[1:]}.json", aged_out, BUCKETS[0], (reported - timedelta(days=40)).isoformat(),
+        report_id="00000000-0000-4000-8000-0000000000ff",
+    )
+    run_drain(data_dir)
+    feed = json.loads((data_dir / "community_watch.json").read_text(encoding="utf-8"))
+    watched = sorted(row["number"] for row in feed["numbers"])
+    assert watched == [ordinary, twin_listed_later, sent_by_the_app, after_the_fix], feed
+    pending = json.loads((data_dir / "community_pending.json").read_text(encoding="utf-8"))["numbers"]
+    assert twin_listed not in pending and dead_area_code not in pending, sorted(pending)
+    assert not list((data_dir / "reports").glob("*.json")), "the merge left misread reports in the queue"
+    assert row_for(data_dir, listed)["reports"] == 3, row_for(data_dir, listed)
+    assert row_for(data_dir, approved) is not None and pending_reports_for(data_dir, approved) == 2
+
+    # Its +86 reading listed later, the ledger row an earlier drain kept goes.
+    database = json.loads((data_dir / "spam_numbers.json").read_text(encoding="utf-8"))
+    database["numbers"].append(fcc_row("+8618638657795"))
+    write_json(data_dir / "spam_numbers.json", database)
+    run_script("merge_community_reports.py", data_dir)
+    feed = json.loads((data_dir / "community_watch.json").read_text(encoding="utf-8"))
+    watched = sorted(row["number"] for row in feed["numbers"])
+    assert watched == [ordinary, sent_by_the_app, after_the_fix], feed
+    pending = json.loads((data_dir / "community_pending.json").read_text(encoding="utf-8"))["numbers"]
+    assert twin_listed_later not in pending, sorted(pending)
+    assert pending_reports_for(data_dir, approved) == 2
+    # Its id went with its report, which doesn't make it a report no app sent.
+    assert pending[aged_out]["watch_events"] and not pending[aged_out]["events"], pending.get(aged_out)
+
+
 def assert_maintainer_approval_publishes_a_reviewed_number(data_dir: Path) -> None:
     """Issue #27: one report of a Munich number waits for corroboration no
     imported source can give. The maintainer's review publishes it, and later
@@ -1933,6 +2008,9 @@ def main() -> None:
     with tempfile.TemporaryDirectory() as tmp:
         assert_a_published_number_leaves_the_watch_list(Path(tmp) / "data")
 
+    with tempfile.TemporaryDirectory() as tmp:
+        assert_bare_digit_misreadings_stay_off_the_watch_list(Path(tmp) / "data")
+
     with tempfile.TemporaryDirectory() as tmp:
         assert_spam_issues_listed_with_pool_state(Path(tmp) / "data")