Read the disguise description carefully
The Demo text describes a disguise as a tainted, revealed Underling that is in play. A separate sentence says one in-play Underling is revealed. It does not describe an active ability where you choose a resident to reveal, and it does not give a reveal trigger to plan around here.
Those words describe the disguise’s appearance and case relation. They do not by themselves prove that Wannabe’s actual category is Underling, that Wannabe itself is always tainted, or that every possible statement from it must be false.
The Researcher question is narrower than “good?”
Suppose address 9 is actually a Wannabe and displays a revealed Scoundrel. A reliable Researcher asked about 9 can reject the Innocent category. That is consistent with the actual Meddler category.
To turn that result into “#9 is evil” would skip an entire possible category. Keep a good Meddler explanation alive until an alignment-relevant clue distinguishes it from a genuine evil Underling. The recent player question about exactly this confusion is a reminder to read the property being tested.
Normal alignment is not a permanent guarantee
Wannabe’s reference label describes its ordinary good starting alignment. An alignment-changing role or case condition can change that state. Check the current case before assuming that a known Wannabe can never become an arrest target.
Your next step after an evil-looking display is to record all three fields: displayed Underling, possible actual Meddler, current alignment still to establish. Then use a clue that tests the unresolved field rather than repeating the same category question.