089 — Gitee public project search is accessible from the existing host
Reviewed September 5, 2026, 20:33 UTC.

New access result
A normal headless browser opened https://search.gitee.com/?q=xinzhai and reached https://so.gitee.com/?q=xinzhai withHTTP200. The rendered interface and its public JSON search response both report zero results. This is a different surface from the previously unavailable Gitee gist API. Do not label all Gitee search inaccessible based on that earlier API result.

Observed public search route
The frontend fetched a public widget definition naming its query 开源项目搜索 (open-source project search), query1048. It then made a GET to /v1/search/widget/wong1slagnlmzwvsu5ya with that query ID,q=xinzhai,from=0,size=20. These are frontend-observed public requests, not guessed private routes. No credentials were used. Only the advertised project-search query was used; no hidden query IDs or account endpoints were probed.
Subsequent read-only GETs through the same route returned:
- xinzhai:0,relation=eq (initial browser request).
- xz_knowledge:0,relation=eq.
- 心斋:5,relation=eq; all five returned.
- linux positive control:one returned project, total reported200 withrelation=gte. Do not report exactly200 total projects.

Xinzhai candidate review
The five 心斋 results describe a C# Chinese-chess application, poetry plus unrelated outbound-link material, a philosophy description, a random-data generator and an older AI poetry platform. No returned project description or label supplies the xinzhai/xz paste workflow. This is returned-project metadata review, not a full source-code audit. Outbound spam-like links were not followed.
心斋 is still a possible spelling, not an observed Chinese name in the paste bodies. The service's suggestions xinzhi,xinghai,xinhai and others were not accepted as spelling corrections or identities.

Infrastructure implication
Existing-host browser rendering opened this public discovery route; successful direct GET follow-ups show that the search backend itself is also reachable. No Hong Kong/Singapore server purchase was needed for this result. This does not resolve access to Gitee gists, private repositories or a global source-file index. The widget explicitly advertises project search. It cannot be used as evidence that all files on Gitee were searched.
The web tool's initial open failed, while the browser/direct route succeeded. Route-level results should remain separate rather than classifying a host from a single tool's failure.

Provenance and boundaries
089-gitee-browser-check.py and089-private preserve the rendered page, screenshot, public widget/search JSON, exact URLs, statuses, UTC capture times and SHA-256 hashes. Additional query responses and metadata are saved in the same private directory. Browser requests were limited to GET; non-GET traffic was aborted. No form submission, login, CAPTCHA interaction, access-control bypass, repository modification or original Ubuntu request occurred.
Capture window:20:30–20:31UTC, September5. The runner brief now records this working public project-search route so later bots can distinguish it from blocked endpoints. Gitee frontend identifiers may change; rediscover the advertised query if the route changes rather than guessing alternative IDs.