Mine real-attacker confusables from BitCore and upstream to Unicode.org

[raeq]

Idea

Mine the real subset of BitAbuse — BitCore (~26k genuine phishing visually-perturbed sentences, not the synthetic BitViper portion) — for confusables that real attackers actually used but that UTS#39 / the bundled table lacks. Verify each, and upstream them to Unicode rather than carry a private divergence.

Why this is principled (and why BitViper is not)

• BitCore = real attacker choices → legitimate real-world signal about which homoglyphs are used in the wild.
• BitViper = Viper's visual-nearest-neighbor confabulations → synthetic; encoding them would overfit a benchmark and produce a circular recovery number. Explicitly out of scope (see the coverage-expansion discussion).

The bar here is deliberately high so this doesn't become benchmark-fitting by the back door:

1. Real subset only. Restrict to BitCore; exclude BitViper-generated rows.
2. Human / rendered-glyph verification. Each candidate must be a genuine visual confusable of its target (render and compare), not merely "improves the metric."
3. Authoritative destination. Propose verified pairs to the Unicode Consortium (UTS#39 confusables.txt). translit then picks them up automatically on the next Unicode data refresh — no private fork of the standard.
4. Measurement stays honest. BitAbuse remains a measuring instrument; do not tune the table to it.

Scope / steps

• Separate BitCore from BitViper in the dataset (id/source field).
• Align perturbed → clean (text↔label) to extract candidate confusable → target pairs (reuse the difflib miss-mining harness).
• Filter to pairs absent from the bundled confusables.txt; dedupe; rank by frequency.
• Rendered-glyph similarity check per candidate; drop ambiguous/many-to-one ones.
• Draft a submission to Unicode for the surviving, clearly-confusable pairs.

Non-goals

• No private additions to translit's table to "win" on BitAbuse.
• No BitViper-derived mappings.

Acceptance

• A short, human-verified list of real-attacker confusables missing from UTS#39, with rendered-glyph evidence.
• A Unicode submission (or a documented decision not to, per case).

Context: sibling to the transitive-ASCII coverage issue; this is the real-world-signal path, kept separate and lower priority because it requires human verification and an external (Unicode) destination.

[raeq]

Concrete first candidates for this verify-and-upstream pass (high-frequency in the BitAbuse miss-mining, non-TR39, plausibly real visual confusables): ǝ U+01DD / ɘ U+0258 / ɛ U+025B / ε U+03B5 / є U+0454 → e; ꞓ U+A793 → c/e; ә U+04D9 → a/e. Each still needs the rendered-glyph check (some are ambiguous, e.g. ǝ→e vs a) before any Unicode submission. Surfaced when #39 was closed — these are not transitive-ASCII cases (TR39 makes them terminal non-ASCII prototypes by design).