Scope: Receipt STR Re-Stamp + Contamination Sweep

The bug

sift-sync.mjs (loadStrLookup, lines 100-115) builds its stamping map keyed by taxpayer_number alone, then stamps every receipt row of that taxpayer with that one STR number. A taxpayer that files hotel tax for multiple properties (management companies, owners with 2+ hotels) gets ALL of its locations stamped with a single hotel's STR number. str_hotel_summary then sums those receipts into one hotel's TTM and divides by that one hotel's rooms, inflating estimated_revpar.

Proven case: STR 54889 (Hilton Garden Inn Beaumont, 100 rooms). Its TTM receipts of $8,107,857 include $3,782,347 from Hilton Garden Inn Houston/Clear Lake NASA (750 W Texas Ave, Webster, 126 rooms), filed by shared taxpayer EPIC Hotel Group LLC (32065202775). Displayed RevPAR $222.13; Beaumont-only receipts of $4,325,510 give the true $118.51 (receipts query, 2026-07-14).

Blast radius (authoritative, from the location-grained join)

Joining every receipt row to hotel_tax_summary on (taxpayer_number + normalized location_address), which is the correct location-grained key (query run 2026-07-14, 960,124 receipt rows total):

So the write touches 6,923 rows of 960,124 (0.7%). The Clear Lake NASA rows fall in the strip-to-NULL bucket; they regain their own STR (59355) later through the existing match-str-to-tax pipeline, which is unchanged by this work.

Contaminated hotels (TTM window, cross-city confirmed)

Sizing by two detectors: a name-aware cross-city classifier confirms 30 hotels with $27,074,410 of foreign TTM receipts (lower bound; it misses same-brand cases like Beaumont itself, where "Hilton Garden Inn" tokens defeat name matching). The city-only classifier finds 39 hotels with $58,373,834 foreign (upper bound; it false-positives on mailing-city quirks like The Westin at The Woodlands, whose own receipts file under Spring, TX). The exact per-hotel deltas fall out of the re-stamp dry run, which uses the authoritative key and no fuzzy matching. The 30 name-aware-confirmed hotels, worst first:

Add Beaumont (54889, $3,782,347 foreign, $222.13 to $118.51) which the name detector misses but the authoritative key catches. A same-city review bucket of 69 locations across 53 STR numbers (e.g. Drury Inn Houston Galleria receipts of $4,671,375 sitting under Heritage Inn & Suites The Woodlands, STR 32784) resolves mechanically in the dry run via the same key.

The fix (three code sites + one data pass)

1. scripts/sift-sync.mjs (upstream, prevents recurrence). loadStrLookup keys change from taxpayer_number to taxpayer_number + normalized address (upper, collapse whitespace), reading taxpayer_number, location_address, str_number from hotel_tax_summary. Fallback: taxpayer-only match allowed ONLY when the taxpayer has exactly one location in the summary, which preserves stamping through minor address drift for single-property taxpayers.
2. scripts/backfill-receipt-str-number.mjs (the re-contamination trap). This script fills NULL stamps from hotel_tax_summary by taxpayer. Run after the re-stamp, it would put the bad stamps straight back. It gets the same composite-key change, in the same PR, before any nightly-cron wiring of it happens.
3. New scripts/restamp-receipt-str-by-location.mjs (the data pass). Recomputes the stamp for every receipt row from the (taxpayer + address) summary join. Dry-run by default: prints per-hotel before/after RevPAR deltas, row counts per bucket, and a list of any THM-owned or deal-pipeline STR numbers touched. --execute applies in batches with keyset pagination (id-ordered; PostgREST range-without-order silently drops rows). Idempotent: second run reports zero changes.
4. Guard rail (post-fix monitor). The sweep query from this scope (2+ distinct material addresses under one STR in the trailing 12 months) becomes a data-health check; expected steady-state result is zero confirmed cross-city rows, so any regression pages the Data Health screen.

Verification plan

• HGI Beaumont estimated_revpar reads $118.51 (within cents) after execute; Clear Lake receipts carry NULL stamp pending its own match.
• The contamination sweep returns zero confirmed cross-city STR numbers.
• Row-count reconciliation: exactly the dry-run's predicted 6,811 + 8 + 104 rows changed, zero others (re-run the bucket query).
• Spot-check 5 hotels from the offender table against raw Comptroller receipts by address.
• THM-owned properties: confirm zero rows touched (none appear in the offender list today; the dry run re-verifies).

Effort

• Code (two key changes + new script + data-health check): one working session.
• Dry-run review: the report is a few hundred lines, one pass with eyes on the strip list.
• Execute + verify: under an hour including the re-sweep.