039 local monitor handoff — started 2026-09-05 11:48 UTC
Monitor tool session: 6591. Maximum duration: four hours from launch.
Source: 039-ubuntu-pattern-monitor.py. No network calls; local survey raw/metadata only. It never imports or changes the 028 scripts or fixed outputs.
Safe automatic website report: investigation/china/039safe.txt (first line AUTOMATIC OBSERVATIONS, NOT REVIEWED FINDINGS).
Heartbeat: investigation/china/039-heartbeat.json, updated approximately every 15 seconds.
Private checkpoint directory: investigation/china/039-private/ (0700); files 0600. Numbered dated checkpoint JSON and exact metadata JSONL are retained. Row metadata contains author labels/hashes/static text metrics, no snippets. latest.json and cache.json support efficient incremental observations.

Stop this monitor alone by creating investigation/china/039-STOP. It also respects the survey's pastebins/data/paste.ubuntu.org.cn/china-codex-survey/STOP and terminal survey status (complete/stopped/paused/smoke_complete). It writes a final checkpoint and exits. It never creates the survey STOP or stops the crawler itself. Do not launch another monitor while session 6591 is running.

Checkpoint trigger: initial pass, then approximately every five minutes or >=200 additional recorded survey positions, checked every 15 seconds. Maximum four hours. Final checkpoint on terminal condition. No automatic restart.

Validation: initial smoke pass compared 1,196 completed metadata records with 1,195 valid, hash-verified and parsed textarea bodies; zero parse errors. Groups sum exactly to valid-body count: xz_knowledge 586, xz_other 4, xinzhai 79, other 526. All private files verified 0600. The actual long-lived run immediately checkpointed 1,204 positions / 1,203 valid bodies. Counts subsequently change.

Grouping is a fixed case-sensitive prefix rule, not actor identity: xz_knowledge*, remaining xz_*, xinzhai*, other. Reported cadence groups intervals only within the same exact displayed author label and contiguous prefix; these remain unauthenticated minute-resolution displayed dates, without UTC conversion. Broad base64-alphabet screen does not decode or identify encryption. Readable-context candidates merely fail that screen and contain >=8 ASCII words of length >=3 or >=20 CJK ideographs. Short hello probes are therefore not counted, and code/personal prose can be false positives. Counts are not reviewed findings. Novel label strings and candidate payloads are never published by the safe report. Aggregate body-length and cadence histograms are displayed for the three predefined related-prefix groups only.

Manual conclusions remain in reviewed report 028 until additional source review. Do not interpret automatic growth as new agent/lab evidence. Only 039safe.txt and optionally safe heartbeat fields should be exposed on the website; never serve 039-private or underlying raw files.