XZ_KNOWLEDGE_P1 — OPAQUE PASTE CLUSTER, STRUCTURAL FORENSICS 2026-09-05 UTC. PRIORITY UNRESOLVED LEAD; no research-agent or lab attribution established. MAIN OBSERVATION Six independently fetched public paste bodies share the displayed author xz_knowledge_p1, language tag python, and a single-line Base64-like format. The bodies are not readable Python. A repeatable encoding anomaly is present: all six contain literal spaces and no plus signs; replacing spaces with '+' makes all six valid Base64. Merely removing whitespace fails for four of six. This is consistent with '+' being converted to spaces during form-urlencoded submission, but the original intended bytes are not proven. Decoded bytes remain opaque. No plaintext research content, recognizable file header, or successful basic decompression was recovered. Automated/encrypted storage, a client test, arbitrary binary data, or some other posting tool remain alternatives. This is stronger evidence of a repeated posting format than of a research-agent swarm. OBSERVED SCOPE AND PROVENANCE The six IDs were already indexed/fetched in the unverified CN26F017 report. Their swarmhunt cache files existed, but held HTML-to-text extractions, not exact HTML or canonical authored text. The ongoing numeric survey had not yet downloaded these six when this review started. Therefore six additional sequential origin GETs were made, with1.6s delay between responses and requests, while the independent survey continued. No other origin URL was fetched by this task. All six returned HTTP200 with actual matching numeric pages, author/date headers and authored textarea data. Local fetch interval: 2026-09-05 11:17:08–11:17:20 UTC (HTTP Date headers). Authored text is extracted from textarea[name=code2], not from prettified syntax highlighting or model excerpts. No pasted code was executed, no embedded URL called, and no decoded payload content was printed or published. SIX STRUCTURALLY REVIEWED PASTES Public source URL for each: https://paste.ubuntu.org.cn/ ID Claimed local date Text chars Spaces Padding Decoded bytes* Entropy(bits/byte)* zlib ratio* 4548782 2026-07-12 00:43 124 2 0 93 6.106 1.118 4548856 2026-07-12 06:50 424 3 2 316 7.306 1.035 4550067 2026-07-14 21:42 488 8 2 364 7.433 1.030 4550729 2026-07-16 11:35 500 5 1 374 7.433 1.029 4551521 2026-07-18 16:20 500 5 1 374 7.496 1.029 4552198 2026-07-20 04:18 572 7 1 428 7.517 1.026 *For the explicitly hypothetical spaces-to-plus transformation. Ratios are compressed size/original byte size; values above1 mean compression made the data larger. Small samples have biased entropy estimates and cannot diagnose a cipher. All six are one line, all six bodies have distinct hashes, and the longest common prefix between any pair is only one character. Alphabet is limited to Base64 characters plus spaces; none has an unexpected punctuation/content character. All six transformed strings decode to non-UTF8 byte sequences. Approximately36–39% of the transformed decoded bytes are printable ASCII/whitespace, consistent with opaque binary rather than text but not proof of encryption. No recognized leading gzip, ZIP, bzip2, xz, PNG, PDF or OpenSSL Salted__ header. Bounded local zlib/gzip/raw-DEFLATE attempts failed for every decoded variant; no decompressed content was recovered. No password guessing, decryption or execution was attempted. Decoded lengths modulo16 vary, so there is no simple uniform block-padding signature in these six examples. No opaque blob, credential candidate or decoded byte excerpt is reproduced here. Whitespace-removal alone happens to decode two samples; one of those is non-canonical when re-encoded. Therefore silently stripping whitespace and treating the result as the original payload would be unsound. The plus-restoration hypothesis fits all six lengths and padding more consistently, without establishing what the binary contains. ADDITIONAL LOCAL SURVEY EVIDENCE (HEADERS ONLY, NOT SIX MORE BODY ANALYSES) While this review was running, the existing numeric survey supplied eight further distinct pages whose actual author header is xz_knowledge_p1 [python]: 4548564 — 2026-07-10 22:24 4548565 — 2026-07-10 22:25 4548575 — 2026-07-10 22:30 4548578 — 2026-07-10 22:30 4548579 — 2026-07-10 22:35 4549705 — 2026-07-13 23:48 4550704 — 2026-07-16 09:29 4550705 — 2026-07-16 09:34 This makes14 distinct known author-attributed IDs in the union at this checkpoint and moves the earliest observed claim from July12 to July10. The July10 group contains five postings within11 minutes, including pairs at the same displayed minute or one minute apart. That suggests a batch/tool process worth measuring, but a small selected subset cannot establish a fixed cadence or full posting count. These eight were discovered from already-present local HTML only; no extra network request was made for them here. Their contents were not added to the six-body structural table. CROSS-SOURCE SEARCH Five web queries were used: exact xz_knowledge_p1; xz_knowledge excluding this host; exact author plus host/July; author plus pastebin; xz_knowledge plus github. The tool returned no results. This is limited indexing/search coverage, not evidence the handle exists nowhere else. No cross-host join, attributable lab identity, creator IP or authenticated ownership was found. The pinyin-like handle and the Chinese interface do not establish nationality or model provider. DATING LIMITATIONS All July dates are server-rendered claims observed September5. No independently obtained July capture was verified. The separate Ubuntu timestamp audit found RSS timezone inconsistency, so dates are preserved literally and not normalized to UTC. Displayed author strings are user-supplied labels; they can be copied/spoofed and are not authenticated identity evidence. Same handle plus same encoding shape is a candidate cluster, not proof one person or one program authored every paste. ASSESSMENT AND NEXT DISCRIMINATORS Confidence: high that the six saved artifacts share a distinctive opaque encoding format; moderate that some scripted posting process is involved when combined with short-interval header batches; unknown content/purpose; no evidence sufficient for a research-agent or second-lab conclusion. The ongoing authorized survey can measure all matching author headers, exact posting cadence, p1/p2-style label variants, body-length distributions and repeated payload hashes without decoding private content. Compare a sample of neighbouring author labels and encoding shapes to determine whether this is a broader storage client or spam/testing run. A date-anchored public source identifying the client/software would be more discriminating than another guessed model name. Seek independently dated archives of a few already-public IDs. Stop short of publishing or interpreting opaque payloads as research memory without recoverable, relevant context. No change made to NEW_SITES.md as a swarm-positive finding. Numeric survey continues separately; this report did not stop or restart it. ARTIFACTS Exact raw HTML: pastebins/data/paste.ubuntu.org.cn/china-codex-xz/.html (private directory). Per-paste response and authored-body SHA256, HTTP/fetch dates, lengths, author/date header and structural metrics: pastebins/data/paste.ubuntu.org.cn/china-codex-xz/metadata.json Copy of structural metadata: investigation/china/024-xz-structural-metadata.json Additional header checkpoint: investigation/china/024-xz-survey-author-observations.json Reproducible bounded fetch/decode script: investigation/china/xz_structural_review.py The source model report and finding record remain unverified: swarmhunt/runs/CN26F017.md and its low-confidence thread=? finding. This review supersedes its assumption that whitespace should simply be removed before decoding.