044 — REVIEWED FINDINGS: sustained posting and interleaved size cohorts Review: 2026-09-05. Fixed source checkpoint: 039 checkpoint 0003, captured 11:53:39.935702 UTC. Conclusion The later two/three-minute aggregate cadence is explained by two perfectly alternating payload-size cohorts, each retaining approximately five-minute posting intervals. This strengthens the evidence for scheduled publishing/storage behavior. It does not establish two processes, two agents, autonomous reasoning, or a swarm: one program could schedule both streams, or alternate its payload types. A separate six-hour sequence uses the improvement-plan label. Payload meaning, operator and producing client remain unknown. Scope and reproducibility No GETs, payload decoding, key searches, decryption or code execution. The 039 monitor and original survey were not modified. Input is a private copy of the completed 039 checkpoint, containing hash-verified raw-source metadata and authored-text structural measurements, without payload snippets. The analysis script reads only that fixed checkpoint. Run: python3 investigation/china/044-cadence-review.py Input: investigation/china/044-private/snapshot.json SHA256: 533962c84bb62631ec8ca4fccf309966cb204f7a88755e5ce7ac5ed7731ca83a Output: investigation/china/044-private/analysis.json Private directory is 0700; snapshot and analysis files are 0600. The source checkpoint retains exact per-page raw hashes; 039 also preserves the matching metadata JSONL. Public URL template: https://paste.ubuntu.org.cn/. Coverage The checkpoint contains 1,317 valid bodies: 1,308 in the contiguous prefix IDs 4548081–4549388 and nine later sparse anchors. Among them, xz_knowledge_p1 has 707 bodies; cadence calculations deliberately use only the 704 in the contiguous prefix. The three later sparse samples are not included in time-gap analysis. The prefix reaches displayed July 13 09:39. This extends report 028's fixed sample; it does not replace or silently change that report's denominator. Observed size cohorts, exact authored textarea character counts 124 characters: 178 posts, ID4548564 July10 22:24 through ID4548835 July12 05:10. Of 177 gaps, 133 are five minutes; there are early duplicate-minute batches, a 936-minute hiatus, and other irregular gaps. Median five. 424 characters: 339 posts, ID4548837 July12 05:15 through ID4549387 July13 09:37. All 338 within-cohort gaps are five (326) or six (12) displayed minutes. 304 characters: 143 posts, ID4549003 July12 18:02 through ID4549300 July13 05:58. All 142 within-cohort gaps are five (136) or six (6) minutes. 364 characters: 44 posts, ID4549302 July13 06:03 through ID4549388 July13 09:39. All 43 gaps are five (42) or six (1) minutes. First transition: replacement in a continuing five-minute sequence The last 124-character post at July12 05:10 is followed by the first 424-character post at 05:15. A first improvement-plan post appears between them at 05:12. After the size change, the 424 cohort maintains five/six-minute spacing. Timing supports a change in payload length within a continuing periodic workflow; it does not show why the payload changed. Primary onset sources: https://paste.ubuntu.org.cn/4548835 https://paste.ubuntu.org.cn/4548836 https://paste.ubuntu.org.cn/4548837 Second transition: onset of an interleaved cohort Starting July12 18:02, a 304-character cohort appears while 424-character posts continue. From that onset to the snapshot end, all 372 consecutive xz_knowledge_p1 transitions alternate between 424 and the other size cohort. There are 373 posts: 186 at 424,143 at 304 and44 at 364. No same-cohort consecutive pair occurs in this interval. The combined gap histogram is 179 three-minute, 174 two-minute, 11 four-minute and 8 one-minute intervals. The two/three-minute intervals account for 353/372 (94.9%). Each size cohort separately retains five/six-minute cadence. Thus the simple description 'the writer sped up to every 2–3 minutes' loses the strong payload-type structure. Primary new-cohort onset: https://paste.ubuntu.org.cn/4549003 Third transition: secondary cohort changes size without losing cadence The 304-character series ends July13 05:58; the 364-character series begins 06:03, five displayed minutes later. Combining those two as a proposed secondary stream yields 187 posts and 186 intervals: 179 five-minute and 7 six-minute gaps. The424 cohort continues alongside it. This supports a secondary stream whose serialized payload grows by 60 characters; it does not reveal plaintext size, object type, meaning or software revision. https://paste.ubuntu.org.cn/4549300 https://paste.ubuntu.org.cn/4549302 Longer-period label Five xz_improvement_plan_p1 posts all have 864 characters and distinct body hashes: ID4548836 — July12 05:12 ID4548920 — July12 11:13 ID4548992 — July12 17:14 ID4549139 — July12 23:15 ID4549283 — July13 05:15 Their successive gaps are 361, 361, 361, 360 minutes: approximately six hours, with minute-level drift. This resembles a second scheduled task or timer in the publishing workflow. The phrase improvement_plan is user-supplied labeling; the opaque payloads have not demonstrated an actual plan or improvement process. Hypotheses versus evidence Supported observation: repeated size-specific periodic sequences and complete alternation in the examined overlap interval. Plausible model: one client with a five-minute recurring output, a second staggered five-minute output, and an approximately six-hour output. A single scheduler or loop can produce all three; independent writers could also do so. Not established: sender count, machine count, identity, shared state, memory semantics, learning, research-lab provenance, nationality or Chinese-language origin. Identical author strings are not authentication. The initial 124-to424 change and later 304-to364 change could reflect ordinary serialization/configuration changes or synthetic tests. Limitations All times are literal website displays with one-minute resolution. We neither normalize them to UTC nor assume reliable creation timestamps; the earlier RSS offset contradiction remains unresolved. Minute rounding, response delay or timer drift can explain five/six-minute variation. We have not fitted an exact oscillator, identified operating-system scheduling, or measured independent event timestamps. The local readable-context heuristic finds no readable context among these opaque xz groups; that is not evidence of concealed agent reasoning. More scheduled output increases confidence in automation, not attribution. The ongoing monitor will continue producing clearly automatic counts; later conclusions require another fixed-snapshot review.