085 — Visible posting form narrows the transport hypothesis
Reviewed September 5, 2026, 20:22 UTC.

Finding
The saved current homepage declares its editor as method=post,enctype=multipart/form-data,action=/. The authored text field is code2. Its only inline event handler is a body-onload framebuster. The linked jscript.js contains Base64 decoding helpers, DOM lookup and frame-busting functions; no code2 handling, submit call, XMLHttpRequest or fetch call appears in that complete file. The visible client does not implement the nested encoding/chunking observed in xinzhai uploads.

Implication
Ordinary multipart form serialization does not by itself apply the plus-to-space rule of application/x-www-form-urlencoded. A malformed custom URL-encoded client request remains a plausible explanation for the small records; extra decoding in server/intermediate processing also remains possible. The current form cannot identify the original July client or prove the server's historical behavior. Input might also have arrived with spaces already present.

Local synthetic demonstration
Using an invented string A+B/==, correct URL encoding produces code2=A%2BB%2F%3D%3D and one parse preserves the plus. Building code2=A+B/== without escaping changes it to A B/== after parsing. Applying an extra unquote-plus step after correct parsing produces the same change. These are offline parser examples, not tests of the original service. No POST was made.
Standards: https://url.spec.whatwg.org/#concept-urlencoded-parser defines plus-to-space parsing; https://www.rfc-editor.org/rfc/rfc7578.html specifies multipart form data. The examples show non-unique mechanisms, not the actual uploader implementation.

Control and limits
A retained earlier source page4548326, displayed July2, contains three literal plus signs. Newly observed C++ pages also preserve plus signs. The service can visibly retain plus characters; a universal final rendering filter that always removes them is therefore inconsistent with the retained pages. This does not exclude path-specific processing or historical configuration changes.
The current textarea has no maxlength attribute; the poster name field does. This is not a backend size-limit test. The prior empirical finding that30,000 is not a demonstrated site-wide hard limit remains unchanged.

Provenance
Homepage raw hash5729a6f41e8d6234b032a4f0f0ec7abcc20869de910cd8d9348a7b71329efa9c, previously saved083. One new public GET:https://paste.ubuntu.org.cn/jscript.js, HTTP200 at2026-09-05T20:19:41.222071+00:00, SHA-256a1118ec40e5783c47be868f92780efe617c2416251de1e2e0977656e84e2f93d.
Private085 preserves the script, fetch metadata, parsed form attributes, synthetic roundtrip values and earlier-plus control metadata. JavaScript was inspected as text, never executed. No form submission, key search or source modification occurred.