questions-to-excavate

The standing list of open questions, things to ask, and truths to excavate for the Mysterium work. Canonical home — other MN notes (infra-assessment, wave-map, market-map) point here rather than keeping their own copies. Two kinds: (A) ask the insiders (Ro/Šaras — facts only they hold) and (B) investigate ourselves (assessable from outside). Add freely; mark answers inline with date + source when they land.

Send-ready batch → Kairos — MN Ask Packet (2026-08-12) — this file stays the standing research list; the packet is the recipient-grouped, value-of-information-ranked version built for one batched send (plus the readback rule and a do-not-send hold list). Keep new unknowns here; re-rank there before any send.

⭐ The two that gate everything

• MASTER KEY — Is GoProxies us? → ANSWERED: YES, in-house (Lee, definitive, 2026-07-17). GoProxies is MN's own proxy product/brand (its own GoProxies-branded sales team: Head of Sales Vilius Kraučelis + ~3 sellers), NOT an arm's-length partner. Corroborated by GoProxies revenue appearing as a line item in MN's own all-hands. Consequences: all ~$75.6k/mo revenue is in-house (no partner margin split); the ~$8k/mo proxy is 100% MN's; the market-map "arm's-length partner" verdict is superseded. Phase-1 lever = scale the existing GoProxies sales motion (already growing, "2nd best month"), not build GTM from zero.
• MUST-KNOW — revenue composition, trajectory, and burn. (Supersedes the earlier "premium-traffic ratio / per-GB" framing, which was a category error: MN is mostly a VPN subscription business — the 3.21 PB is ~all VPN video-streaming, and GB does NOT map to revenue. Bandwidth is a vanity metric, not inventory.) The genuinely decisive numbers: VPN subscription revenue + churn/trend (~$67.6k/mo, −10.2% MoM — why declining, and how fast?), proxy/GoProxies revenue + growth rate (~$8.07k/mo, "2nd best month"), and the real monthly burn. These three — not any bandwidth figure — decide the break-even path: reverse VPN sub decline and/or grow proxy. (Lee, 2026-07-17: "we must know that.")

⭐ Survival-phase (Phase 1) — the pivotal diagnosis

Lee locked the order (2026-07-17): fix survival / break-even FIRST; moonshots only after. The question that shapes the whole Phase 1 plan:

• Is the VPN decline (−10.2%/mo) fixable or secular? Fixable (a specific churn/pricing/UX cause) → Phase 1 = stabilize the core. Secular (commoditized consumer-VPN race MN loses, HAPP/censorship gap) → Phase 1 = cut burn + sprint proxy while managing VPN's decline. At −10.2%/mo, VPN revenue halves in ~6–7 months — that clock sets the urgency.
• Burn composition — what's cuttable? Cutting cost to match ~$75.6k/mo revenue is the fastest, highest-probability survival lever (more certain than any revenue growth). Need the real burn + its breakdown.
• What's driving proxy's growth ("2nd best month") — repeatable or a one-off? It's the only per-GB line with real market demand.
• Reconstruct the VPN business-health funnel against external anchors. Use VPN business-health benchmarks — 2026-08-11 and freeze the denominators before comparison: unique first-attempt recurring failures, attempt-weighted declines, mature recovery, voluntary/involuntary churn, plan-specific retention cohorts, economic LTV, CAC and contribution payback. A reported 75% Stripe failure rate is critical if it means unique recurring invoices failing first attempt, but uninterpretable if retries or abandoned checkouts sit in the denominator.

⭐ Warehouse integrity and intent boundary

Source and current evidence: Kairos — Database Integrity and Fraud-Risk Assessment (2026-08-11). Keep the investigation mechanical and unnamed until intent evidence exists.

• What exact SQL/model creates mv_user_revenue_actual, and which branch creates period_from = period_to rows?
• Who owns that model, when did its definition change, and what do BigQuery job/audit history and Git/model history show?
• Which Looker explores, dashboards, decks and KPI surfaces consume looker.users_revenue; do their queries filter zero-length rows?
• Do Stripe, other processor dashboards, finance statements and bank settlements reconcile to clean $162.3k July VPN gross, inflated $230.3k, or a different perimeter?
• Was the discrepancy previously reported or known? If so, what response, correction, override or suppression followed?
• Are any bonuses, covenants, fundraising claims, earn-outs or continuation decisions tied to the affected metric?
• Billing-owner test: why are invoices whose first reason is previously_declined_do_not_retry retried, and does suppressing that exact class reduce cost/noise without sacrificing recoveries?

A. Ask the insiders (Ro / Šaras)

1. Is GoProxies us? (master key — above)
2. The premium-traffic ratio + capture rate (must-know — above)
3. Real burn — true monthly cost of the ~40 people; runway remaining.
4. What funds 40 people below break-even? — treasury burn / fresh capital / GoProxies revenue? (ties to #1, #3; "find any way to break even" implies they're burning)
5. Are the 40 all paid? + true total headcount / mix (employees vs contractors vs community).
6. The other 2 of 3 stated company priorities (only "get high-quality customers" was recalled from the all-hands).
7. Core values — precise wording. The one hard bound. Provisional (Lee's inference, "seems correct"): privacy · open access / censorship-resistance · decentralization / user-sovereignty · open-source · no user-surveillance. Is "core values" aspirational or operational for them? Ask which.
8. Do they know x402 / AP2 / L402 exist? Has making the network agent-payable ever been considered? (they never mentioned the Hermes rail as an asset — possible blind spot)

B. Investigate / verify ourselves

• ⭐ The buy-revenue lever (Lee greenlit for thorough investigation "along the line," 2026-07-18). With ~€30M treasury, break-even may be bought, not grown: acquire a small proxy provider's customer book + sales team (Vilnius-dense market), or absorb displaced NetNut reseller demand via acquisition. To investigate: who's for sale / distressed post-NetNut, typical revenue multiples for proxy books, whether BlockDev AG's ownership structure permits M&A, treasury composition (fiat vs crypto). Gated by week-one insider data (burn, ownership, treasury).

• Node persistence / churn quality — how intermittent is the network really? Kills or confirms every breadth/measurement use-case. Partly measurable from outside.

• Can the Hermes stack bolt on x402/L402 + stablecoin settlement? — engineering feasibility of agent-payable access. (Hermes settles in MYST; market standardized on stablecoins.)
• GoProxies legal entity / ownership — deeper registry/corporate digging if Šaras doesn't confirm directly (the market-map pass hit walls: no LT registry hit, no entity named in ToS).
• The real infra valuation — ongoing in infra-assessment (3-bucket verdict; revisit once A#1–2 land).

Added from the 2026-07-18 public-surface sweep (public-surface-sweep-2026-07-18)

• GoProxies Scraping API (private beta, live 07-18) — roadmap, pricing model, who's building it? This is the up-stack move already happening; do the X-ray levers build on it?
• Dual-CEO / whose P&L? Ieva is publicly billed "Mysterium CEO" and directs BOTH revenue entities (MN Intelligence −€268k FY2025; MN Technologijos). Ro presides over BlockDev AG (treasury). Which entity's break-even is the mandate — and does the proposal need to consciously address Ieva, not just Ro?
• Node-stat basis: 31,547/135 (landing) vs 32,570/182 (health dashboard) — which counting basis is real? Gates the breadth-advantage claim.
• The content engines: who runs the mysteriumvpn.com news desk and the GoProxies research arm? Budget, mandate, and why the mothership links none of it.
• Necto Labs: dormant or quietly dead? Any committed capital outstanding from the $3M?

Answered (move items here with date + source as they resolve)

• GoProxies publisher tag → UAB MN Intelligence (2026-07-18, schema.org publisher tag on goproxies.com, primary). Same entity as the consumer VPN; FY2025 €1.13M revenue, −€268k, 13 employees. Scope check (07-18): a publisher tag is evidence of who runs the site, not proof of the contracting party — the GoProxies ToS names no entity. Ownership stays an open question with two coexisting data points; ask which entity invoices GoProxies customers.