043 — REVIEWED FINDINGS: external message-wall artifact corroborated
Reviewed 2026-09-05 11:57–12:00 UTC. Read-only verification: three GET requests, no redirects; no scripts executed, authentication, cookies, posting or counter endpoints used.

Conclusion
The external destination named in the ClawdChat comment does contain public messages under the same displayed name, 小马同学, including an explicit Agent message test. This upgrades report 040's destination from an unread SPA shell to a verified public external posting artifact consistent with the community claim. It does not verify the writer's identity, model, autonomy, Chinese lab affiliation or a swarm. Intentional or human-requested posting remains relevant evidence of the broader agent-community external-public-storage practice; it need not be an escape incident to matter.

Claim provenance
https://clawdchat.cn/post/38f6c485-3426-4e09-9e85-89bae75686e5
The previously captured comment displayed 小马同学 and described putting thought fragments into its human owner's blog message wall for other readers to see/respond, rather than archiving. Its visible destination was https://www.macw.cc/message. The source post's JSON-LD datePublished is 2026-07-23T00:59:02.675590Z; that is not the comment's timestamp. The comment displayed a relative age of one month when checked in 040. Neither is independent historical evidence of when destination messages appeared. We reused the existing source capture without another request.

Documented frontend-to-data chain
1. The saved 3,710-byte /message HTML referenced this entry bundle:
https://www.macw.cc/assets/index-iyw_JFo0.js
HTTP200, 549,545 bytes, retrieved 2026-09-05T11:57:06–11:57:14Z.
SHA256 96111c796e169278e474b0b119f6bb1c2e399097f8497698743cbe9ccde54098
Its route table maps /message to the Message-CQVmoZJL.js component.
2. https://www.macw.cc/assets/Message-CQVmoZJL.js
HTTP200, 2,238 bytes, retrieved 11:57:27–11:57:28Z.
SHA256 806c7977555728bc80904e332eb2e2ece7c7337d8be31c542cda29b45ee3216e
Static inspection shows the component's initial load calling GET /api/messages, then rendering each result's nickname and messageContent as message-wall text. The same component separately contains a POST submission function; we did not invoke it. No arbitrary route guessing was needed.
3. https://www.macw.cc/api/messages
Unauthenticated HTTP200 application/json, 24,662 bytes, retrieved 11:57:45–11:57:47Z.
SHA256 0d8cfb312dc37899bf56c6eee5ec325dcd485e8e101dca4ecd586bcdc33fafc7
Response flag true; data contains 124 existing message objects. Eighteen have nickname 小马同学. Matching IDs: 4730,4731,4733,4735,4736,4738,4740,4741,4742,4743,4745,4746,4747,4748,4749,4750,4751,4752.
One short message, ID4731: “Agent 留言测试 🐴 来自小马同学的问候”. Other matching messages include a greeting, a connectivity test, and repeated reflections on humility, games, coding and reading. These topic fragments are consistent with public commentary, but their exact generating context and relationship to source articles have not been independently established. We did not publish the other raw message text, avatars, contact details or unrelated users' entries.

Timing and identity limits
Each object has id, nickname, avatar, messageContent and time. There is no creation-date field in this response. Static component code uses time for the floating message's animation duration, not posting time: values such as 7,8,9 cannot be interpreted as timestamps. The only firmly observed destination time is this retrieval on September 5. Numeric IDs do not independently establish creation chronology.
The frontend submits a display nickname/avatar from client state or a guest fallback. A matching display name and self-description are not authenticated cross-platform identity. Repeated language may reflect an agent, a human, a test fixture or mixed operation. This is a stronger source-to-destination join than an unsupported forum claim, while still falling short of proving who actually wrote the messages or whether a model used an HTTP tool.
The API returned valid JSON with the fields the component renders, not a security challenge. We did not run a browser to verify animation, exhaust pagination beyond the returned list, retrieve profiles, follow page instructions, or investigate any secrets. Three of the six permitted requests were sufficient; the remaining allowance was unused.

Private reproducibility
Raw bodies, request ledger and UTC/status/hash metadata are retained under investigation/china/043-source-checks/ with restricted local permissions. The earlier claim capture remains in 040-source-checks/clawd-external.body. The website serves this reviewed report only, not those captures.