UBUNTU CHINESE PASTEBIN — HISTORICAL ACCESS AND TIMESTAMP AUDIT 2026-09-05 UTC. Bounded live review complete; 13 origin GETs, nine paste bodies, no bulk enumeration. MAIN RESULT Historical pastes from March, May, June, July and August 2026 remain accessible from indexed or explicitly linked IDs. April coverage is unresolved. A public archive/calendar route was not established. Numeric ID bracketing plus dated search results can support a later bounded historical scrape, but current RSS timestamps are incorrectly labeled or otherwise inconsistent and must not be treated as reliable UTC. No verified research-agent scratch-memory or link-format batch in the nine reviewed bodies. One July full-article copy merits context if a future batch reveals joins; it is not a positive by itself. DATE AUDIT At fetch 2026-09-05 10:44:20 UTC, the server HTTP Date was Sat, 05 Sep 2026 10:44:20 GMT. Latest paste 4552953 displayed 2026-09-05 15:28; homepage displayed 3 hrs ago. RSS gave 2026-09-05 15:28:55 +0100, which converts to 14:28:55 UTC—about 3h45m AFTER capture. These cannot all be correct. If the wall-clock date is interpreted as UTC+08:00, it becomes 07:28:55 UTC, about 3h15m before capture and consistent with the 3hrs display. Latest xorg-config paste similarly shows 11:29 and 7hrs ago, also consistent with UTC+8. Thus an incorrect hardcoded +0100 RSS offset is a plausible explanation. Actual server timezone/configuration was not inspected, so this is an inference, not a proven correction. Record three separate fields in future work: literal displayed local timestamp, literal RSS timestamp, independently captured HTTP/fetch time. For analysis, a UTC+8 conversion may be retained explicitly as inferred. Near-midnight or boundary-day attribution requires an independent archive capture or another dated witness. ACCESS ROUTES AND LIMITATIONS Homepage https://paste.ubuntu.org.cn/ exposes seven latest IDs and RSS https://paste.ubuntu.org.cn/rss2; RSS includes current paste bodies but no history-pagination link. No archive/calendar link appeared in homepage or inspected paste navigation. The visible search form uses POST /search; it was inspected as HTML but not submitted, per no-forms/no-posts constraint. No write form, update action, or source code from a paste was executed. robots.txt returned HTTP200, no sitemap declaration. /sitemap.xml also returned HTTP200 but was ordinary Ubuntu Paste HTML, not XML/urlset—a fallback page, not a working sitemap. This matters: arbitrary routes returning 200 do not establish an archive endpoint. Paste pages link raw download routes /d and explicit parent/reply IDs. Raw links were not required for this sample because the page's textarea holds the underlying paste text. Parent/reply links are a useful real-ID discovery source; for example 4548081 explicitly links 4548088, and June18 paste4548290 links several same-day revisions. No guessed numeric ID was requested in this phase. VERIFIED LIVE SAMPLE ID Claimed local date Discovery Reviewed context 4548081 2026-03-17 03:51 prior indexed result Repeated pastebinit client test, 62 characters; no URLs. 4548088 2026-03-18 10:32 parent4548081 link 43-character derivative of same client test; explicit parent relation. No URLs. 4548160 2026-05-20 11:19 indexed exact date Python/model-training traceback; no body URLs. Ordinary development log. 4548180 2026-06-02 20:08 indexed exact date vllm-ascend expert-weight transfer code. Only URL is Apache license. Copyright/vendor naming is not actor attribution. 4548290 2026-06-18 14:49 indexed exact date Browser-console referral automation code, with same-day revisions linked. Account/invite operations, not research-source retrieval or citable scratch memory. Script not executed; endpoints not called. 4548705 2026-07-11 19:24 indexed exact date ~20,609-character French news article copy with original publication/update labels and source URL. One repost is compatible with ordinary user archiving; no rare test marker, fetch workaround, or cross-host join observed. 4552704 2026-08-04 14:55 indexed exact date 738-character PowerShell API-billing usage checker with placeholder key. Ordinary service-account tooling; never executed. 4552834 2026-08-11 16:18 indexed exact date 567-character C++ competitive-programming solution. 4552953 2026-09-05 15:28 latest listing 1637-character C++ competitive-programming solution; used for timestamp comparison. Source URLs are https://paste.ubuntu.org.cn/. All nine returned HTTP200 with actual paste headers/bodies. Body length counts use textarea text, not HTML bytes. The latest-seven RSS set is additional recent-only visibility and does not extend historical coverage. No historical sample hit government/statistics endpoints, distinctive known-swarm data-source links, or a link-encoding/format test sequence. The tiny test family is explicitly a pastebinit client test; it lacks a research-task payload. The July article copy is the only historical body here that resembles source-content caching, and is presently UNATTRIBUTED/INSUFFICIENT rather than swarm-positive. One other indexed July result exposed a live-looking credential alongside model-service configuration. Its body was not fetched and neither credential nor its paste ID is reproduced here. Search-index availability is not a reason to redistribute secrets. CONCRETE NEXT HISTORICAL PLAN (NOT EXECUTED) Known local-time anchors bracket March17 ID4548081, May20 ID4548160, June2 ID4548180, June18 ID4548290, July11 ID4548705, August4 ID4552704, August11 ID4552834 and September5 ID4552953. Adjacent anchor spans vary sharply in activity, so do not linearly interpolate dates over the whole ID space. For a newly authorized numeric historical survey, first do a sparse bounded date-bracketing phase between these public anchors, with at least1.5s spacing, maximum20 probes, stop/backoff on 429/503 or challenges, and verify every response actually contains the requested paste. Split the longest intervals adaptively to locate March1, April1, May1, June1, July1, August1 and September1 date transitions; monotonic IDs are a working assumption to test, not proof. Record missing/expired/deleted IDs separately from empty pastes. Only after boundaries are measured should a capped sequential scrape be considered. The currently anchored March17–September5 inclusive range spans4873 numeric positions. At1.5s delay alone that is about122 minutes, plus network time; it is not a four-million-page crawl. Earlier March needs an additional lower anchor. A search-index-first alternative avoids guessing entirely: query exact displayed month/year plus host, collect public IDs, then follow explicit same-family revision links and independent dated forum/IRC references. Obtain historical captures for candidate dates through Common Crawl/Wayback when accessible. No archive endpoint requests were made in this pass because the inherited report already had archive-access failures and the immediate question was live historical retention. Search snippets' crawl-age labels do not independently prove original creation dates. ARTIFACTS AND REPRODUCIBILITY Raw files: pastebins/data/paste.ubuntu.org.cn/china-codex-history-*.html Capture metadata: pastebins/data/paste.ubuntu.org.cn/china-codex-history-fetch.jsonl — all13 requests, UTC, HTTPDate/status, URL, SHA256, bytes, path. Safe structured sample metadata: investigation/china/011-ubuntu-samples.json Read-only fetching script: investigation/china/probe-ubuntu-history.py Raw files remain internal pending redaction; report does not reproduce credentials, private paths, or full copyrighted article text. BACKGROUND PRIMARY SOURCE Ubuntu China's 2013 team application identifies this pastebin as long-standing community support infrastructure: https://wiki.ubuntu.com/ChinaTeam/ReVerificationApplication2013 That establishes legitimate background use, not the absence of later abuse. The present nine-paste sample is too small and selection-biased to exclude another actor.