Small xz records: additional encoding and compression wrapper check
Reviewed 2026-09-05 UTC

Result
------
All 3,495 small records were checked after the established space-to-plus repair
and canonical Base64 decoding. None is valid UTF-8 or a canonical second layer
of standard/URL-safe Base64. None produced a complete checked gzip, zlib, bzip2
or XZ stream under the bounded, whole-record tests below.

This narrows simple wrapper explanations; it does not identify encryption.
The UTF-8 result repeats the earlier knowledge-only result while including all
11 improvement plans. The extra Base64/compression checks address a distinct
question from the earlier measurement that opaque bytes do not compress well.

Scope and findings
------------------
Source: supplied archive, SHA256
4a202ecd9dbe3dfcc40c1dac00984573cdffb38102e9d4ba4e04ce09b9a9105c.
Only bodies.jsonl was read from the archive. All selected body hashes match the
fixed survey. Counts: 3,484 knowledge records and 11 improvement plans.

At byte offset zero, no records match gzip, bzip2 or XZ magic. Two match the
basic zlib header constraints. One fails with an invalid back-reference; the
other requests a preset dictionary. No dictionary was supplied, so that second
record is unresolved under a dictionary-based zlib interpretation. A short
header match alone is also compatible with chance in thousands of opaque
records. It must not be described as a recovered compressed message.

The parsers required stream completion and no trailing bytes; output was capped
at 64 KiB and XZ memory at 16 MiB. No decompressed data was printed or saved.
The checks exclude neither raw/headerless compression nor embedded streams,
custom wrappers, other codecs, or data compressed before encryption. They do
not exclude every possible representation of text or every possible zlib stream.

Interpretation
--------------
Simply decoding another Base64 layer, as with the large xinzhai exports, does
not work for these small records. Common self-contained compressed wrappers
also did not explain them in this test. Existing evidence remains compatible
with ciphertext, other opaque serialization or generated random-looking data.
The actual small-record cipher/format and plaintext remain unknown.

Artifacts: 124-private/check_wrappers.py and 124-private/analysis.json.
No keys, decryption, remote requests or downloaded code execution were used.