SURFACE / EXACT-ARTIFACT PIVOT SCAN 2026-09-05 UTC. Status: completed in243seconds. One useful archived-date anchor and one cross-surface reference; no verified second actor. Purpose: test cross-host references to newly investigated publishing surfaces and exact candidate markers. These are hypothesis pivots, not positive actor indicators. Generic host mentions can be software documentation, self-links or template echoes. Even exact prompt reuse does not establish autonomous upload. 15 terms in terms_china_codex_surface_pivots.tsv: - QA_REPORTING (weight5) and two exact share-text candidate IDs (weight8) as rare artifact joins. - share-text.org/, textdb.online/, webnote.cc/, netcut.cn/, paste.ubuntu.org.cn/, getnote.top/, note.ms/, netnr.eu.org/ (weight1) as broad surface references. - Three exact titles from report013's saved source: AgentDesk · 本地优先的智能多Agent工作台; NIE Coding Agent — Multi-AI Collaborative Coder; Qwen Coder Studio — Local WebGPU AI (weight4). Each title's literal presence was rechecked in the corresponding local HTML. Potential design/template joins, not attribution. - nie-ai.vercel.app (weight2), a literal backend reference in html.cafe/x69226946 source. Not contacted or executed. Remote existing EC2 44.222.74.56, preflight idle with load0 and unused port8097 at10:54 UTC. Output /data/runs/china-codex-surface-pivots. Log ~/china-codex-surface-pivots.log. Invocation: ./target/release/ccsearch --corpus /data/corpus --s3 --s3-endpoint http://s3.us-east-1.amazonaws.com --crawl CC-MAIN-2026-34 --concurrency 384 --out /data/runs/china-codex-surface-pivots --port 8097 --exit-when-done --score-terms /data/runs/terms_china_codex_surface_pivots.tsv --report-domains 100000 --report-pages 20000 Text-only existing corpus. No links corpus scan, new infrastructure, target writes or forbidden private terms. As in prior scans, source fallback can stream missing corpus files; final downloaded-byte count will establish whether this happened. All groups will be counted separately. Archived context recovery, if warranted, is capped at eight paced index/WARC requests. Limits: text extraction omits most href URLs and code/script text, so a host-reference negative is particularly weak without a WAT links scan. Common Crawl coverage and exact spelling/case also limit recall. Short note.ms is explicitly requested as a host pivot despite its potential accidental/ambiguous matches. Page score is a retrieval priority, never a probability of agent activity. COMPLETE SCAN RESULTS 100,000/100,000 WET files;2,083,525,558 pages;0 failures;0 downloaded bytes. 138 matching pages on51 registrable domains. Groups:2 rare-marker pages,135 surface-reference pages,1 derived-backend substring page. No exact candidate-ID or demo-title text hits. Files: cc-surface-pivots/{scores.tsv,domains.tsv,report.html,china-codex-surface-pivots.log};016-term-counts.json. Scores and counts are retrieval indicators, not attribution. free.co.tz alone contributes65 pages, consistent with repeated host-reference/template noise; those65 were not separately verified. No broad links-corpus scan is justified solely by these counts. 1. QA_REPORTING — SAME SURFACE, INDEPENDENT PRE-DISCLOSURE LISTING Two hits are https://share-text.org/public-notes?page=19 and https://share-text.org/ru/public-notes?page=19. They are localized listings, not two independent agent episodes. Recovered the English listing through the existing local zipnum cluster index and one WARC byte-range request. CDX timestamp20260810075302 (August10 at07:53:02 UTC), HTTP200. The Russian listing also has a CDX record at20260810072637 but its WARC was not fetched. The English archived row links /view/1784928797078 and contains QA_REPORTING, displayed date Jul24,2026 and8611characters. This independently establishes candidate A's listing and visible prompt introduction by August10, before disclosure. It does not independently prove July24 creation or who uploaded it. The archived React payload repeats the truncated snippet; no historical full note body was recovered. This is new evidence strength, not a swarm-positive. A guessed Chinese prior did not find it; the exact newly observed marker did. Exact-ID text terms scored zero despite the archived link existing, illustrating the WET-text versus href visibility limitation. Coordinator follow-up recovered the current full body via a read-only origin fetch and safely parsed React data: a reusable QA-reporting prompt with blank finding/question fields, no URLs and no completed issue/research state. See report019 (current full-body review) and china-codex-qa-full-body-internal.{html,txt} under pastebins/data/share-text.org/. That current body is not an independently archived August full body and cannot prove historical text unchanged. Evidence: pastebins/data/share-text.org/surface-pivot-archive/metadata.json, cdx-selected.json, safe-candidate-A-anchor.json. INTERNAL-listing.warc.gz/.warc/.html contain the archived full listing and must not be published unredacted because unrelated rows may contain sensitive material. WARC: crawl-data/CC-MAIN-2026-34/segments/1786091385322.54/warc/CC-MAIN-20260810065506-20260810095506-00354.warc.gz offset424530177 length31392. Decompressed WARC SHA256:3e0b506ce20a060cc38b9851b38603a016d7bf96a124c64d9f2ff23413a677a7. 2. TEXTSHARE.ONLINE — VERIFIED CROSS-SURFACE REFERENCE, ACTOR UNKNOWN https://textshare.online/d4622e/ matched share-text.org/. Its archived HTTP200 body (August12 at19:00:13 UTC) is a Text Share Online plain-text paste labelled Anonymous and July31,2026. The authored content is a link to https://share-text.org/view/1785436446544. It displays plain-text syntax and no expiry. This is a concrete public-paste-to-public-paste reference, not merely a directory mentioning a service. The destination note was not visited. No source-task links, research scratch state, autonomous posting provenance or actor identity have been established. Human link sharing remains an ordinary explanation. Treat as a low-confidence surface-connection lead, not an escaped research-agent event. WARC: crawl-data/CC-MAIN-2026-34/segments/1786091385525.56/warc/CC-MAIN-20260812165636-20260812195636-00504.warc.gz offset465410547 length20877. Raw evidence and capture metadata: investigation/china/surface-pivot-reviews/textshare.warc.gz,.warc,-metadata.json. Raw includes site scripts; no scripts or linked destinations were executed. 3. NIE BACKEND — FALSE POSITIVE FROM SUBSTRING MATCHING https://muzbox.tistory.com/483691?category=1217861 matched nie-ai.vercel.app. Archived HTTP200 August11 at20:29:38 UTC reveals the actual destination is https://shop-genie-ai.vercel.app/, a ShopGenie AI shopping-product-page application described by a Korean blog. The suffix overlaps the detector; this is not a reference to the NIE Coding Agent backend. It is therefore not even a verified template/client join. Future backend searches should use a scheme-qualified or hostname-boundary detector. Raw evidence: surface-pivot-reviews/nie-blog.warc.gz,.warc,-metadata.json; selected-captures.json supplies locator. 4. OTHER USEFUL SURFACE URLS (URL-TRIAGED, NOT POSITIVE ARTIFACTS) https://webnote.cc/llms.txt and https://webnote.cc/p/e8b0d71721e85527 — actual indexed service documentation/published-page routes; content review belongs to live-agent work. Self-hosted references do not demonstrate agent activity. https://gist.github.com/zhugezifang; https://cn.v2ex.com/t/957841; https://meta.appinn.net/t/topic/79424; https://pknote.top/77.html — potential service discussions/reference lists. Not all were fetched, so do not call them cleared. https://netnr.com/1606/edit and /448/edit — indexed edit-shaped URLs; no live requests or form actions made. Existing netnr.eu.org proxy/tutorial reference remains non-agent evidence. ARCHIVE REQUEST ACCOUNTING Six paced requests total: one share-text CDX block+one listing WARC; one textshare CDX block+one WARC; one Korean-blog CDX block+one WARC. Every request succeeded. Sequential pulls within loops slept1.6seconds; other requests were separated by tool/read/analysis work. No requests to original targets, no writes, no callback/credential-note visits, no new infrastructure and no full links scan. The compute job exited after completion; EC2 remains running. EXACT TERM COUNTS (id,weight,page count,term) 0 5 2 QA_REPORTING 1 8 0 1784928797078 2 8 0 1786814922347 3 1 8 share-text.org/ 4 1 0 textdb.online/ 5 1 7 webnote.cc/ 6 1 96 netcut.cn/ 7 1 9 paste.ubuntu.org.cn/ 8 1 3 getnote.top/ 9 1 79 note.ms/ 10 1 3 netnr.eu.org/ 11 4 0 AgentDesk · 本地优先的智能多Agent工作台 12 4 0 NIE Coding Agent — Multi-AI Collaborative Coder 13 4 0 Qwen Coder Studio — Local WebGPU AI 14 2 1 nie-ai.vercel.app FOLLOW-UP020: The textshare destination received one live read, returningHTTP503/error1102; a targeted August index check found no capture. The cross-surface source link remains verified, destination content unknown. See020-textshare-bridge-review.txt.