Simulated card — the layout is real, the account is not.
You are looking at a coin. Someone is calling it. The only question that matters is who is this, and the honest answer lives in things X does not put in front of you: what this account was called before, what it has posted before, and who actually follows it.
Finding that out by hand takes minutes you do not have. Scroll their posts for old contract addresses. Squint at the follower list. Try to remember whether the bio said something different when you looked yesterday. By the time you have an answer, the entry you were considering is gone — or it was never worth taking and you spent five minutes learning that.
X-Ray does that reading for you, continuously, in the background, on the pages you already open.
It is already there when the page loads
The card does not wait for anything. PaperTrench remembers what it has seen about an account, so the panel paints from local storage in the same frame the page routes, then fills in live as X's own data lands. Open a profile: it is there. Open a post: the card reads the author of the post you are reading, because the moment a stranger's tweet is in front of you is exactly when their history matters most.
X's own system pages get no card at all. It appears where an account is the subject, and nowhere else.
What the card shows
Contract addresses posted
Every CA the account has posted, dated by the post itself, newest first — click one to copy. This is the coin history: what else has this account put in front of people, and how recently. A CA sitting in the bio right now gets its own flag, because that is a different claim than one posted three weeks ago.
Long posts get read past the 280-character fold, which is exactly where the address usually is.
Bio changes
How many times the bio changed, when it last changed, and what it said before. An account that has rewritten its identity three times this week is telling you something the current bio is not.
Name and @handle changes
Counted separately, because a display-name swap and a rename are different tells. Case-only differences do not count as renames — a fake counter is worse than no counter.
Smart Following
The biggest accounts following this one, ranked by follower count, with the ones you personally follow marked as such. Who vouches, weighted by who they are.
The part other tools will not tell you
Nobody can tell you a bio changed on a day they never saw the bio. A product that shows you a confident "12 bio changes" for an account you just discovered is reading someone else's surveillance database — a service that has been scraping X wholesale for years and selling the archive.
PaperTrench does not have one of those, and will not fake one.
So every change counter on the card carries the window it was observed over: "no change seen · watching since Aug 5". CA history and Smart Following say which posts and lists they were built from. The watch window starts the first time you view an account, which means the card gets sharper the longer you use it — and it never pretends to know about the time before that.
A floor, labelled as a floor, is worth more than a confident number that is wrong. "2 changes seen since Aug 3" tells you what to do with it. "2 changes" invites you to conclude the account has been stable forever, and that conclusion can cost you money.
It is the same rule as the rest of the product: every number on screen is true or absent — never wrong.
Where the data comes from, exactly
X-Ray reads the X app's own responses, as your browser receives them, for a fixed allowlist of operations: the profile, that account's posts, and follower lists. That is the whole surface.
- Home timeline, DMs and notifications are never parsed. Not filtered out later — never read.
- What leaves the page is a digest — dates, ids, addresses, follower counts. Never the text of anyone's posts.
- The ledger is
chrome.storage.localon your machine. No server, no shared database, no upload, no account of yours used to follow or interact with anything. - Zero new extension permissions. X-Ray shipped inside the permissions PaperTrench already had.
- Opt-in. Off until you turn it on, and off means off.
Deep scan
On with X-Ray and separately switchable. Deep scan lets the page re-issue a request it has already made — the same one X fires when you scroll — to read a few more pages of posts or the follower list. It is throttled by minimum spacing, a per-minute cap and a per-account cooldown, runs only while you are on that account, and uses your existing X session against x.com itself. The service worker never contacts X.
If X rotates its API, the deep scan quietly stops and the passive layer keeps working. The card degrades; it does not break.
Update — the dock that never ran (v2.7.0)
A postscript worth telling, because it is the most instructive bug we have shipped a fix for.
The card is meant to dock into the profile header — take its own space in the page rather than float over your timeline. That code existed from day one. It had never run. Not once, on any profile.
The reason: X renders the Posts / Replies bar as a <div role="tablist">, and we were looking for nav[role="tablist"]. The selector returned null on every profile, the anchor lookup bailed, and the dock silently gave up and floated instead.
Every piece of geometry tuning built on top of it was dead code, tuned against a path that never executed.
The fix is small — match the role alone, verified against real x.com markup rather than assumed. The interesting part is the second half:
The test fake now fails nav-shaped selectors the way the real page does. The old fake was more permissive than x.com, so the tests passed on a selector production could never match. A fixture that is kinder than reality is not a test.
Every host now carries data-pt-dock="docked" or float:<reason>. If the card ever floats again, it says why, in devtools, in one word — instead of leaving someone to infer it from geometry.
Three attempted fixes went by before anyone checked the live markup. The lesson stuck: probe the real DOM first, and make failures name themselves.
What we tested
The suite went to 749 passing for this release, including a hand-built DOM that drives the card end to end — an intel card that throws is an intel card that is not there — plus tests pinning the three ways this feature could lie:
- A first sighting can never be reported as a change.
- A sparse user object embedded in a tweet cannot register as "bio cleared".
- A forged page-world digest cannot write a fake contract address into the ledger.
X-Ray (opt-in)
Open any X profile — or any post, where the card reads the author — and the intel is already on screen. No button, no "analyze", no waiting: PaperTrench remembers what it has seen about an account, so the card paints from local storage in the same frame the page routes, then fills in live as X's own data lands.
Bio changes
How many times the bio changed, when it last changed, and what it said before.
Name and @handle changes
Counted separately, because a display-name swap and a rename are different tells. Case-only differences are not renames — a fake counter is worse than no counter.
Contract addresses posted
Every CA the account has posted, dated by the post itself, newest first, click to copy. A CA sitting in the bio right now gets its own flag. Long posts are read past the 280-character fold, which is exactly where the address usually is.
Smart Following
The biggest accounts following this one, ranked by follower count, with the ones you personally follow marked as such.
Where the data comes from, exactly
X-Ray reads the X app's own responses for a fixed allowlist of operations (profile, that account's posts, follower lists) as your browser receives them. Home timeline, DMs and notifications are never parsed. What leaves the page is a digest — dates, ids, addresses, follower counts — never the text of anyone's posts. The ledger is chrome.storage.local on your machine. No server, no shared database, no upload, no account of yours used to follow or interact with anything. Zero new extension permissions.
What it refuses to pretend
Nobody can tell you a bio changed on a day they never saw the bio. Products that imply otherwise are reading someone else's surveillance database; PaperTrench does not have one and will not fake one. So every change counter on the card carries the window it was observed over — "no change seen · watching since Aug 5" — and CA history and Smart Following say which posts and lists they were built from. A floor, labeled as a floor, is worth more than a confident number that is wrong. The watch window starts the first time you view an account, so the card gets sharper the longer you use it.
Deep scan (on with X-Ray, separately switchable)
Lets the page re-issue a request it already made — the same one X fires when you scroll — to read a few more pages of posts or the follower list. Throttled by minimum spacing, a per-minute cap and a per-account cooldown; runs only while you are on that account; uses your existing X session against x.com itself. The service worker never contacts X. If X rotates its API, the deep scan quietly stops and the passive layer keeps working — the card degrades, it does not break.
Suite
749/749, including a hand-built DOM that drives the card end to end (an intel card that throws is an intel card that is not there) and tests pinning that a first sighting can never be reported as a change, that a sparse user object embedded in a tweet cannot register as "bio cleared", and that a forged page-world digest cannot write a fake contract address into the ledger.
The X-Ray dock fix
X renders the Posts/Replies bar as a div with role=tablist, so a nav[role=tablist] lookup returned null and the header anchor bailed on every profile — the dock never ran, and all the geometry tuning built on it was dead code. The role is now matched on its own (verified against live x.com markup), the test fake fails nav-shaped selectors the way the real page does, and every host is stamped data-pt-dock=docked or float:<reason> so any future float is diagnosable from devtools instead of by geometry guesswork.
Get the complete build
The dock fix landed after v2.7.0 was tagged, so it is not in the 2.7.0 zip. v2.7.1 is the complete batch — if you downloaded 2.7.0, update.