SOURCE · 14 MARCH 2017
Signed FAJNLpLZ note
Nothing is random.
2, 8, 20, 28, 50, 82, ...
http://bit.ly/2mUF7XyThe quote appears after the 11×14 matrix in the PGP-signed note linked by the BURUMUTREFAMTU tweet.
FORENSIC RESEARCH ARCHIVE
Chronology
A compact timeline of the book, its documented solve history, and later research.
CASE MAP · PRIMARY ARTIFACTS AND REPRODUCED RESULTS
How the puzzle branches, closes, and remains open
This map separates the book’s solved mechanisms from the signed 2017 routes. Solid nodes are reproducible results or authenticated transitions; dashed nodes identify a question that the surviving evidence cannot yet settle.
Key artifacts
Selected tweet-to-artifact chain
The signposts below are the shortest route through the case. They are a selection from the full archive, not the account’s complete output.
| UTC | Tweet | What it leads to | Current result |
|---|---|---|---|
| 2016-03-14 14:09 | 3.14 − 15:9 | Pi / Exodus 3:14–15 material in the book. | Explained as a thematic pointer, not a separate ciphertext. |
| 2016-09-16 11:00 | 137 = [Pastebin] | Signed a1nqC79N, then bit.ly/2bFjsQO and the 23-page book. | Resolved launch path. |
| 2017-03-14 14:09 | BURUMUTREFAMTU | Signed FAJNLpLZ: the 11×14 matrix, nuclear magic numbers, and bit.ly/2mUF7Xy to the MP3 challenge. | The MP3 branch is solved. The matrix yields BUNU YAZAN TOSUN OKUYANA KOSUN; whether that sentence is every intended layer remains unsigned. The magic-number sequence does not authenticate a password. |
| 2017-03-29 19:00 | Link only | Signed YUPZsz9n: reversed matrix headed NOTHING IS RANDOM. | Authenticates the mirror edition and independently preserves the same row-prefix sentence. |
| 2017-04-03 14:09 | “We are not Mossad…” | Response to agency speculation. | Self-description only; no technical puzzle payload. |
The 2017 publication spine, restored
The account audit recovered the transitions omitted by the earlier five-row summary.
- 2 Apr · 20:00 UTC“The gate is open now for few moments.” The signed Pastebin names
666666m7x6x5regc.onion. - 4 Apr · 20:38 UTC
STOP!!!links a signed denial that Defango is Tengri 137. - 12 Apr · 11:10 UTCA signed Pastebin announces “WE OPEN THE SECOND GATE” and names
nothingwasrandom.onion. - 4–31 MayHelper recruitment, countdown, FLOOD instructions, video, address lists, and the final Dropbox document release turn the puzzle into a coordinated publication campaign.
- 22 Nov · 00:18 UTCA signed post says the first path was missed and redirects solvers to
bit.ly/rendezvous137.
Case study: the nuclear-number clue
ARTIFACT · AUDIO ROUTE
Original MP3 challenge
The link led to the signed MP3 route, later traced through the spectrogram, timed signals, onion service, bitmap, and themessage.txt.
RESULT · WHAT IS KNOWN
Sequence identified, password unproven
2, 8, 20, 28, 50, 82, 126 are nuclear shell magic numbers. Reading the six printed values as atomic numbers gives:
He · O · Ca · Ni · Sn · Pb
126 is a continuation of the nuclear sequence, not a discovered element with an official symbol. Neither string is a verified word, password, or key in the preserved corpus. The demonstrable consequence of the note is the MP3 route; any further role for the sequence remains open.
One connected path
→
→
→
→
themessage.txt.→
knowledge.txt.→
→
reproduced or authenticated strong but not author-confirmed open or unavailable evidence
Chronological record
- 2012All 23 book-page files receive the Pi-Day timestamp 3.14 15:09:26.
- 2016The book appears under @666ab731 / Tengri 137, using a PGP identity and staged puzzle languages.
- Early 2017Pages 17–22 are publicly solved. The audio/onion route yields the bitmap and signed 6,448-letter message.
- 2 April 2017
bit.ly/aabbbccccreaches the first ending: signedknowledge.txtsays the last step is coming and asks solvers to return. - 22 November 2017A signed post declares that the time-limited first path was missed and opens
bit.ly/rendezvous137as a second path. - November 2017The replacement route publishes signed
rendezvous.png: eleven numbered kolams and timestamp2143762625. - 25 January 2018I am the method appears on the Tengri 137 YouTube channel. Its linked PGP text verifies under the established key; a current uploader-labelled comment later identifies Bach's Contrapunctus I and says the hidden key is in the video.
- 7 December 2037The timestamp resolves to Monday at 01:37:05 UTC—the future appointment encoded by the image.
- 2026Reproducible work decrypts
themessage.txt, proves the bitmap encoding, decodes the eleven labels, and transcribes every kolam to a 16-by-16 binary matrix.
Primary source for the nuclear sequence
The original signed message is Pastebin FAJNLpLZ, linked by the 14 March 2017 tweet. It prints 2, 8, 20, 28, 50, 82, ... and points onward to bit.ly/2mUF7Xy.
11–14 APRIL 2017 · ARCHIVE CORRECTION
A small public contest branch, restored and bounded
Two early @666ab731 replies to @MathEasySolns were not present in the original archival status-ID harvest. Saved direct syndication responses and retained historical screenshots now restore them to the account chronology. The 14 April reply's ten visible numbers total 777; the surrounding seven-path mathematics contest still provides no stated route from that fact to an original Tengri plaintext.
“What is shown is easy to imitate. Try without our example to find it now!” The post links a contest example, rather than a Tengri-hosted artifact.
The numerical reply is historically real and arithmetically checkable. It is not promoted to a cipher result without an author-selected operation.
Open the recovered tweet in the archive → · Read the evidence audit →
20 JANUARY 2018 · PGP-SIGNED RIDDLE
“To run, I x.” remains a lead, not a decode
Pastebin 98DZzeYr is signed by the Tengri key and contains a seven-line, 23-word poem about a hidden reward. A bounded audit records its literal structure. Removing spaces and punctuation from the first line gives JUSTINSUN; that is an exact textual observation, but neither the next line nor any adjacent recovered author post gives a deterministic bridge to a person, cryptocurrency, wallet, or location. It is retained as an unconfirmed lead rather than promoted to solution status.
Read the reproducible poem audit → · Machine-readable audit →
20 JANUARY 2018 · PGP-POEM FEATURE CONTROL
Two exact compact strings, but still no wallet or route
The poem's deliberately awkward first two lines have a source-visible result under one shared operation: remove spaces and punctuation. That produces JUSTINSUN and TORUNIX. The latter can be respaced as TOR UNIX without changing any letters; it is compatible with the pre-existing onion/Tor branch, but it contains no onion address, command, wallet, or new endpoint.
EXACT LETTERS
JUSTIN SUN
Just, in sun. becomes JUSTINSUN. It is fair to record the name-shaped string, but the signed text never names a person.
EXACT RESPACE
TOR UNIX
To run, I x. becomes TORUNIX. Splitting it as TOR UNIX is lossless; the nearest same-day Reddit comment mentions a Tor-browser check, but that comment is community evidence, not the author.
REJECTED OVER-READ
Not TRONIX
A possible mixed outer-letter construction gives TRONIX, but it changes reading order and leaves the U of run unused. No author material chooses that rule, even though Justin Sun and Tronix were contemporarily associated outside the ARG.
Finite control: thirteen whole source-visible channels—seven compact lines, the full body, line/word initials and finals, and word lengths—contain no direct URL, domain, onion address, Bitcoin address, hexadecimal byte string, or previously documented route handle. That does not prove the poem purposeless; it rules out an immediately encoded endpoint in this deliberately limited reading set.
Bounded context: in the recovered account timeline from 1 January through 15 February 2018, the only post is the bare Pastebin URL. I x can also be read as Roman IX = 9, but it gives different results depending on whether one indexes words or letters. The poem therefore remains a documented lead, not a solved crypto clue. Read the structure audit → · Read the finite controls → · Control data →
2018 VIDEO · PRIMARY PLATFORM RECORD + PGP COMPANION
“I am the method”
The Tengri 137 YouTube upload “I am the method” ↗ is dated 25 January 2018 in the downloaded platform metadata. Its description points to Pastebin Xxx3ypsK ↗, whose short text says “I am the method. I can tell you how to find the message.” The saved clearsigned copy verifies with the established Tengri 137 key (fingerprint 2A2C…B731); this authenticates the companion text, while the YouTube channel itself remains a platform attribution record rather than an identity proof.
VIDEO
Negative visual checks
Gamma and local-contrast variants reveal image texture only. RGB least-significant-bit planes follow H.264 image edges and compression quantisation, not a separate legible graphic.
TIME-STACK CONTROL
149 frames, one stable globe
A temporal mean over 149 one-second samples and a 15-frame median reveal no QR payload or new visual instruction. The one geometry-only detector response has three unique corners, so it is recorded as a false positive rather than presented as a code.
AUDIO
Mono and L−R checked
Neither 48 kHz mono nor the stereo difference channel has readable spectrogram lettering, a QR/barcode image, or an unambiguous Morse sequence. Two short quiet gaps at about 122–125 seconds are insufficient to define a code.
REPRODUCIBLE
What was checked
One H.264 stream and one AAC stereo stream; no subtitles or extra data stream; no readable appended plaintext. The full machine-readable result is preserved with the analysis rather than inferred from a screenshot.
NEW MATERIAL LEAD · PLATFORM-ATTRIBUTED CHANNEL REPLY
The video remains open: a named musical key
A current public-comment snapshot contains a reply marked by YouTube as coming from the upload owner, @tengri1378. It calls the soundtrack “Contrapunctus 1 from The art of Fuga” and says that a key to understanding the next message is hidden in the YouTube video. This does not have a PGP signature and does not identify the operator in the real world, but it is strong enough platform provenance to keep the 2018 route open.
The reply's only supplied date label is relative (“8 years ago”), so this dossier deliberately does not turn the downloader's inferred timestamp into an exact historical event time.
UPLOADER-LABELLED REPLY
A direct statement of intent
The account says the music is part of a message and that the hidden key is in the video. That makes the earlier visual/audio negative checks controls, not closure.
SCORE BASELINE
Timing consistency, not a cipher
A partial chroma alignment chosen from the musical portions maps the two literal PCM-zero gaps to the reference score's only two full-ensemble rests, with endpoint residuals no larger than 0.16 s. That supports the named music, but it does not identify a deliberate alteration or decode a message.
WHAT DID NOT WORK
No generic stego payload found
The preserved download still has no readable QR, text frame, data stream, appended plaintext, visible spectrogram lettering, or defensible LSB image. These results narrow methods; they do not contradict the channel reply.
NEXT VALID TEST
Test deviations, do not invent them
A solution must name a stable difference from the score or performance, a deterministic transformation, and controls showing that the output is not available from arbitrary musical features.
APRIL 2018 · CONTEMPORARY SECONDARY RECORD
The video lead was circulating at the time
A preserved 8 April 2018 Reddit post links the video, copies the purported uploader reply about a hidden key, and links a Spek spectrogram album. This gives the lead a contemporary community record. It is still not a PGP-signed statement, and it does not independently authenticate the Reddit or Imgur uploader as Tengri 137.
WHAT IT ADDS
Contemporaneous circulation
The uploader-attributed wording was being reported by a solver in April 2018, not inferred solely from a current comment snapshot.
WHAT IT CHECKS
The gaps predate this audit
A community MP3 rendition visibly retains both breaks. The timing audit explains them more simply as the reference score's two full-ensemble rests.
WHAT IT DOES NOT SHOW
No spectrogram solve
A reply speculated about binary or a barcode. That is an unverified hypothesis; the screenshot itself contains no reproducible decode.
2018 VIDEO · INVESTIGATOR-DERIVED CONTROLLED FOLLOW-UP
Stereo channels do not yield an independent voice key
A broad score-locked chroma comparison produced one initially interesting observation: the strongest complementary partition has the left channel tracking MIDI voices 2+3+4 and the right channel voice 1. Across 200 fixed-seed circular time-shift controls, the maximum partition statistic was not equalled (p = 0.0050). That is a reason to test more carefully, not a text decode or evidence that the channels contain isolated Bach voices.
The direct follow-up does not support that stronger interpretation. It measures 886 collision-filtered MIDI note events, controls exact pitch/register by permuting voice labels only within the same pitch, and finds no significant voice-specific left/right balance under 2,000 controls (p = 0.3143). The aggregate effect therefore has no corroborated note-level panning mechanism and produces no instruction, bytes, or cipher alphabet.
Stereo-audit method and limits → · Stereo audit JSON → · Note-panning audit JSON →
2018 VIDEO · FINAL-CADENCE CONTROL
The apparent extra tail is a sustained final chord
The 2018 soundtrack remains audible for about six seconds after the reference MIDI ends. That could have been mistaken for a second note stream. The score-to-video alignment was fixed first from the musical body and the two internal rests; under that frozen mapping, the MIDI ends at video 136.842 s and literal zero PCM begins at 143.089 s.
In the final four audible seconds, the spectrum is stationary (median frame-to-profile cosine 0.994). Its eight strongest narrowband peaks are all D, F#, or A, matching the score's terminal D-major / Picardy-third sonority. This supports a long rendered final cadence, not a separate changing melody or standalone Morse/binary tail. It does not test an unspecified keyed transform.
2018 VIDEO · SCORE-NOTE PRESENCE CONTROL
The weak notes do not behave like a hidden alphabet
With the score-to-video timing fixed before this test, 808 of 885 eligible reference-score note events (91.3%) have stronger collision-filtered harmonic energy than nearby wrong-pitch controls at the same instant. That confirms ordinary score-pitch presence; it does not decrypt a message.
The 77 weaker or tied events are not a uniform selected subset. They concentrate in the high register (24.5% weak, compared with 3.6% in the low register) and in the terminal cadence (35.3% weak, compared with 6.5% in the preceding body). This pattern is compatible with register, collision, synthesis, and end-of-score timing limitations, not a defensible missing-note bitstream.
2018 VIDEO · CANDIDATE-PERFORMANCE CONTROL
Recognising the score does not name the recording
A public 2017 Kimiko Ishizaka performance of Contrapunctus I is an attractive candidate: the locally retained OGG matches the checksum published by Wikimedia Commons. But a candidate is not an attribution. Broad pitch-class matching returns a cosine of 0.775 for Ishizaka, while a same-work Mutopia-derived synthesized control reaches 0.835. The measure recognises shared musical material, not a performer or a source file.
A fixed-window direct linear-retiming check is also low for all three controls: median maximum Pearson r is 0.011 for Ishizaka I, 0.047 for synthesized I, and 0.028 for Ishizaka IV (the same pianist, wrong work). This excludes only a simple speed/pitch-resampled clone; it does not rule out a pitch-preserving time stretch, remix, separately rendered MIDI, or an unavailable source recording.
Read the candidate-source audit → · Machine-readable result →
2018 VIDEO · NEXT-MESSAGE CHRONOLOGY
Two date-adjacent posts, but no documented handoff
The uploader-labelled reply says the video contains a key to understanding a next message
. The video is dated 25 January 2018; the earliest retained community copy of that wording is dated 8 April. In the canonical recovered account timeline, exactly two non-reply posts fall between those dates. Neither names the video, its comment, or a target message.
14 MARCH 2018
S. H.
The initials plausibly allude to Stephen Hawking, who died on the same date. That is a strong date-context inference, but no author source states the expansion or ties it to the video.
21 MARCH 2018
Bennu
51 6d 56 75 62 6e 55 3d mechanically becomes QmVubnU=, then Base64 Bennu. That decode is genuine, but its role is unassigned.
CHANNEL METADATA
LEI !R6U3+
A current saved channel listing contains this short description. It is a useful lead, but it is editable, undated to 2018, and does not select a cipher or a downstream target.
IMPORTANT LIMIT
Absence is not proof
The recovered account corpus has known gaps, and the copied YouTube reply is secondary/platform evidence. The audit rules out only a claimed documented handoff, not every possible missing message.
2017 AUDIO / NUCLEAR CLUE · BOUNDED AUDITS
Two attractive leads, now with explicit limits
LOST WAV
The transcript still proves its known route
All 2,994 preserved duration digits and 27 token classes reproduce the repeated block and the 176-bit onion address. But the literal tail rssstuvwx is not a decoded English word. Under the extra one-to-one BIRD substitution assumption it leaves 604,800 possible assignments; a public 27 July 2026 CDX check returned no capture for the exact Instaudio WAV or its object prefix.
MAGIC NUMBERS
Element symbols are a rendering, not a password
The signed six values map directly to He O Ca Ni Sn Pb. The later community parse 666666 mod (7×6×5) = 126 coheres with the sequence, but neither it nor four predeclared row-major matrix index variants yields a self-authenticating instruction. regc remains unexplained.
8 APRIL 2017 · SIGNED POINTER TO AN EXTERNAL VIDEO
Baatar Kerei: identified, but not recovered as media
A PGP-signed Tengri note says "We are Tengri and we are real" and points to bit.ly/baatarkerei. The redirect target is YouTube ID XV2AlgPBZPE. A preserved 2022 YouTube payload identifies it as The secret history of Baatar Kerei and future 3, uploaded in 2013 by astromankorea. Its description identifies a Korean pseudohistorical / Tengrist-nationalist reference about a shared Tengri descent for Koreans and Kazakhs; it is not a Tengri 137-produced video.
CURRENT BOUNDARY
Private, not deleted
The research record's 2026 live probe found the video private. Fifteen of eighteen historical videos on the same channel were private, so the loss looks channel-wide rather than targeted at this ARG.
NOT RECOVERED
No hidden payload demonstrated
No video bytes, audio, captions, transcript, or 24 historical YouTube comments survive in this corpus. A retained 2022 storyboard template was also tested: six sampled image sheets now return HTTP 403, and Wayback has no copy of that path. There is no basis for a new spectrogram or steganography claim.
Current YouTube URL → · Preserved platform metadata → · Storyboard recovery check → · Status audit →
22 FEBRUARY 2019 · PGP-SIGNED IMGUR POINTER
Vumarii: the 2019 image is transcribed, not translated
The signed Vumarii pointer resolves to a 1,370-by-1,370 image with a star-map-like upper panel and nine lines of script. Its seven-line body has exactly 154 non-separator glyph slots, followed by the separate TENGRI137 / 666AB731 signature block. Pixel-level segmentation gives 23 letter classes, four numeral classes, and a three-dot word separator. Fifteen values are fixed by the image's own red labels; seven more have contemporary secondary readings; five classes remain unknown. Even when those secondary readings are accepted, only 134 of the 154 body positions have a Latin transliteration; the remaining 20 are the five unresolved classes.
Do not conflate this with the later white-cursive samples. Their proposed Scienceline source-text alignment is a separate, later lead; it does not supply a verified language, glyph mapping, or plaintext for this 2019 image. A conventional RGB low-bit audit also found no byte-aligned file signature or readable text in the tested channel/bit-plane routes; that narrows only this common steganography route, not every possible hidden-data method.
WHAT IS FIXED
Stable transcription
Most repeated glyphs are pixel-identical. The complete line-by-line class sequence, including all separator positions, is preserved as a downloadable text record.
WHAT REMAINS OPEN
Not a page-23 solve
The shared 154 count was tested directly: across eight ordinary Page-23 grid orientations, neither simple glyph-class mapping nor the 134 provisional Latin readings beat 5,000 letter-shuffled controls (p >= 0.7313 and p >= 0.5855). A deliberately generous English simple-substitution search also fails to return readable prose: it leaves the image's red legend unconstrained, recovers two of three matched 154-letter English controls exactly, but produces only gibberish for the Vumarii body. That closes ordinary Caesar/Atbash-style English as a useful lead without proving the image has no message, another language, or a keyed cipher. A conditional Turkish-completion control then accepts the seven historical community readings and exhaustively assigns the five remaining glyph classes to the eight unused Latin letters (6,720 assignments). The optimum is more Turkish-like than both pre-declared null families: none of 512 glyph-position shuffles and only 3 of 512 randomised-secondary-key controls score as well (empirical p = 0.0019 and p = 0.0078). But the best 154-letter candidate is still 8.70 standard deviations below held-out Turkish and has no full dictionary segmentation. This is a conditional phonotactic lead, not plaintext. A nearby C20=K completion makes isolated ETMEK and ANDAMAK; it cannot make ANLAMAK while the accepted Layer-3 reading fixes C07 as D. The source still does not select a translation or show that these glyphs encode Page 23. The upper panel is now strongly attributable to a cleaned, re-inked north-polar detail of the Dunhuang Star Map, but the reference supplies no author-selected traversal, glyph mapping, or plaintext.
Glyph transcription → · Counts and evidence tiers → · RGB bit-plane audit → · 154-slot alignment controls → · Upper-diagram geometry → · English-substitution control → · Turkish-completion controls → · Affine-Turkish control →
VUMARII 2019 · CONDITIONAL LANGUAGE CONTROL
Turkish-like surface, not Turkish plaintext
The test deliberately gives the Turkish hypothesis every fair advantage: it retains the image's red crib, provisionally accepts the seven historical community readings, and enumerates all 8P5 = 6,720 injective assignments for the five unresolved glyph classes. That produces a measurable surface-level signal, but not a translation.
WHAT THE TEST FOUND
A constrained anomaly
The best score is higher than all 512 glyph-position-shuffled maxima and 509 of 512 randomised-secondary-key maxima.
WHAT IT DID NOT FIND
No readable sentence
The optimum is -8.70 sigma versus real Turkish, with no full dictionary segmentation or author-selected key.
LOCAL WORD TRAP
ANDAMAK is not ANLAMAK
A tempting C20=K near-candidate yields ETMEK but also ANDAMAK. Making ANLAMAK would contradict the accepted C07=D reading.
Read the Turkish-completion audit → · Machine-readable result →
VUMARII 2019 · CLASSICAL-CIPHER CONTROL
Classical affine maps do not unlock the Turkish lead
The historical Solver key suggested Caesar/Atbash-style ideas, so the conditional Turkish surface was retested under every invertible affine map over A-Z. That covers all 312 maps, including Caesar shifts and Atbash-like transformations, and all 6,720 residual glyph completions per map: 2,096,640 scored candidates in total.
GLOBAL BEST
The identity map
Doing nothing remains the highest Turkish score: -5.4116 bits per character. It is the same non-readable, non-segmentable conditional surface already documented above.
BEST ALTERNATIVE
Still worse
The strongest non-identity affine map scores -6.6174 bits per character, far below the already-unsolved identity candidate.
BOUNDARY
A family closed, not Vumarii
This rules out a simple 26-letter affine layer for this conditional Turkish route. It does not choose another language, a polyalphabetic key, a transposition, or an interpretation of the upper diagram.
5 SEPTEMBER 2018 · CONTEMPORARY COMMUNITY CONTEXT
A Patreon link is chronology, not a Vumarii key
A contemporary Reddit post linked patreon.com/posts/vumarii-21229946, called it an official Tengri 137 account, and said a possible new puzzle would arrive the next year. The 2019 signed image followed. That makes the post a useful chronological lead, but the Reddit writer—not a preserved Patreon page—also described the account's purpose as giving money to children and other help organisations.
WHAT THE RECORD SUPPORTS
A claimed precursor
It documents that the community connected the 2018 Patreon post to a future Tengri puzzle before the signed 2019 image appeared.
WHAT IT DOES NOT SUPPLY
No source-selected key
No Patreon bytes, author-signed instruction, language choice, or full glyph alphabet survives in this record. The charitable description is context, not a cryptographic clue.
RECOVERY BOUNDARY
Current access is forbidden, not absent
The unauthenticated JSON endpoint returns ViewForbidden, not a recovered post body; the page itself is Cloudflare-blocked. Several archive requests were incomplete, so this dossier reports no recovered bytes rather than claiming that no historical copy exists.
Read the bounded recovery/context audit → · Read the API access check → · Machine-readable archive observation →
2019 VUMARII · COMMUNITY LANGUAGE LABELS, TESTED
Esperanto and Swahili were leads on a solver sheet—not the answer
Defango's preserved community Solver key 1.0 visibly lists Esperanto and swahili beside Caesar, Vigenere, and Atbash ideas. That does not make either an author-selected key. It does make two precise hypotheses worth testing without guessing: retain the image's red legend, conditionally retain the seven community readings, enumerate every 8P5 = 6,720 completion of the five remaining glyph classes, and compare the whole 154-letter body with held-out language-tagged prose.
ESPERANTO
Not natural Esperanto
The strongest of 6,720 conditional completions is 18.05σ below held-out Esperanto and at the 0.00th percentile. It is unusual under the random-key controls, but still nowhere near readable Esperanto.
SWAHILI
Not natural Swahili
The strongest completion is 13.91σ below held-out Swahili and at the 0.00th percentile. Thirteen of 256 randomized secondary keys do at least as well, so the apparent Swahili fit is not selected beyond that freedom.
What this closes: a simple A–Z monoalphabetic completion under Defango's seven extra readings for these two named languages. What it does not close: a different language, transliteration, keyed/polygraphic cipher, or the upper diagram. Read the audit → · Machine-readable result →
2019 VUMARII · HISTORICAL VISUAL REFERENCE
The upper diagram is a Dunhuang star-chart reference
The upper panel is strongly attributable to a cleaned, re-inked north-polar detail of the Dunhuang Star Map (British Library Or.8210/S.3326). This is not a loose thematic comparison: nine labelled regions preserve the same distinctive asterism clusters, enclosing wall, dotted arc, spokes, and lower chain. In one documented bounded source comparison, the normal orientation has local-darkness contrast 3.1935, above horizontal mirror 2.5729, vertical mirror 2.3113, and 180-degree rotation 2.0162.
NOW IDENTIFIED
A visual reference
The source image and its north-polar historical-chart context are identified. This reclassifies the upper panel from an unknown star-map-like drawing to a traceable re-inking/crop.
STILL OPEN
No extraction rule
The comparison does not name every asterism, select a star order, map stars to glyphs, translate the script, or connect the diagram to Page 23. The external chart is not an author-signed cipher key.
Read the attribution audit → · Machine-readable comparison → · Open labelled figure →
2019 VUMARII · DUNHUANG COUNT CONTROL
Thirty-four is a count, not a decoder
A scholarly inventory of the matching north-circumpolar Dunhuang panel lists 34 asterisms. The full Vumarii image also has 34 whitespace-separated groups—but only if its two visible signature groups, TENGRI137 and 666AB731, are treated as asterism tokens alongside the seven-line 32-group body. The image itself supplies no such instruction, so this is a testable coincidence rather than a key.
OBSERVED
Five length matches
The best direct pairing produces only 5 exact group-length / on-map-star-count matches. The best correlation is 0.2011; the smallest total difference is 85.
100,000 CONTROLS
Ordinary fit
Randomized lists meet or beat those results with p = 0.5315 (matches), 0.4615 (correlation), and 0.3857 (difference). There is no selected order, traversal, or plaintext.
What remains open: a source-specified star path, name alphabet, geometric route, or later cipher could still be proposed and tested. The count itself is now closed as a direct decoder. Read the count-control audit → · Machine-readable result →
27 JULY 2025 · AUTHOR-LINKED PAGE-23 HINT
“An animal name … but not the fox”
The public capture confirms the exact wording. In the independently recovered row-prefix sentence, TOSUN means a young bull or steer and is therefore the strongest semantic answer. OKUZ (“ox”) is also a literal forward substring; SNAKE appears only across syllable boundaries in the mirror. The hint supports the Turkish solution but still supplies no signed next-stage instruction.
23 APRIL 2025 · AUTHOR-LINKED NUMBER CLUE
2222 / 4444 / 6666 / 8888: a separate magic square
The account re-posted a 16×16 grid of factorized integers and, 3,637 seconds later, wrote Seek also for 2222, 4444, 6666 and 8888.
The captured parent replies are missing, so the association is not an explicit author statement. But the table itself supplies those exact values under one simple, reproducible rule: even-aligned 2×2, 2×4, 2×6, and 2×8 blocks sum to 2,222, 4,444, 6,666, and 8,888.
WHAT IS SOLVED
A numerical referent
The four number words point naturally to this table's block-sum ladder and its nested-square sums.
WHAT IS NOT
Not a new plaintext
Nothing in the source selects a letter extraction, key, or continuation into Page 23.
4–31 MAY 2017 · ACCOUNT-LED PUBLICATION CAMPAIGN
FLOOD is a documented document release—not an undecoded cipher
The recovered @666ab731 posts form a concrete campaign: helper recruitment on 4 May, a countdown, a 19 May post reading We are ready, we are FLOOD
, a video link, a photographed envelope mailing, and a 31 May instruction that all documents were in the Dropbox folder. These are primary platform records from the account reconstruction, though not PGP-signed declarations.
CURRENT FOLDER CHECK
Two 2017 files match
A 27 July 2026 read-only Dropbox ZIP contains byte-identical copies of energy.pdf and manifesto.pdf: their preserved SHA-256 hashes are recorded in the audit.
RECOVERED CONTENT · SECONDARY
instructions.pdf was a distribution plan
A readable 2024 third-party visual repost preserves the visible instruction sheet: on 1 June, print or email the documents to media and institutions; print and display the manifesto; and share the files through personal and social networks. It is operational campaign material, not a hidden message.
PROVENANCE LIMIT
Original PDF still lost
The original instructions.pdf bytes, its Dropbox object, metadata, signature status and complete provenance remain unrecovered. The repost is therefore labelled secondary and does not establish a new signed artifact.
TEMPORAL BOUNDARY
Do not backdate later files
The same mutable folder now carries Uniqmos, TLP and Politeia material stamped 2024–25. Their presence today is not evidence that they were part of the 2017 release.
Read the provenance and container audit → · Read the repost audit → · Machine-readable repost record → · Current public folder route ↗
27 JULY 2026 · PUBLIC-ARCHIVE RECOVERY CONTROL
The original 2017 beep WAV remains unrecovered
The preserved transcript can be mechanically audited, but it is not the audio file. A source-led archival check found no byte-bearing record in Wayback CDX, all Common Crawl collections from 2017-13 to 2018-51, or Arquivo.pt; the live S3 address returns NoSuchBucket. This documents a failed public recovery route, not proof that a private cache or unindexed copy does not exist.
27 JULY 2026 · FIRST-ENDPOINT SOURCE CHECK
The signed return note is now preserved as bytes
The still-live Dropbox route was downloaded as a 1,221-byte ONION.zip, whose sole file is the 967-byte clear-signed knowledge.txt. The v4 RSA/SHA-256 signature verifies under the established Tengri fingerprint. Its layout is ordinary CRLF text with no tabs or trailing spaces, closing the proposed simple whitespace-cipher branch without claiming to rule out every conceivable external code.