What we’ve learned

The short version

Delete the five carved Ws at positions 20, 36, 48, 58 and 74 and the old width-21 vertical-bigram anomaly disappears. That looked for a while like an explanation. A May 2026 audit showed it is not one: replace every W with any one other letter, keeping the text 97 characters long, and all eleven repeated bigrams survive intact. A September 2026 audit explained why: the count depends only on which positions hold the same letter, so replacing every W with one other letter cannot remove any of the eleven, while deleting a letter shifts every later position and breaks the pairs that straddle the deletion. Deleting other letters spread through the middle of the text weakens or removes the anomaly in the same way. What the anomaly responds to is where letters are deleted, not which letters they are. By April 2026, 80+ direct single-layer W-segmentation hypotheses had been tested, with no signal. W-segmentation is therefore no longer the primary anchor. It remains admissible inside multi-layer hypotheses, and the public reading is still “if K4 has a delimiter or row-end mechanism, the W positions are the cleanest bounded place to test it,” not “the Ws are proven delimiters.”

The short version

In one region of K4 (positions 55–63), every pair of characters four apart differs by exactly 5 in the alphabet. This pattern appears nowhere else in the ciphertext. Counting the whole search that found it — any run this long, at any spacing — the odds of it happening by chance are about 1 in 205. That is a real pattern carrying weak evidence, not a discovery.

Science progresses by testing and discarding hypotheses. Several observations initially appeared statistically significant but were retired after more rigorous controls. We document them here because intellectual honesty matters more than looking right.

The Filler-Letter (“Null”) Palette (retired April 2026)

The project previously presented, as its strongest signal, a claim that 17 suspected filler letters in K4 (the “null palette”) used only seven distinct letters. That claim did not survive a control that repeated the same search on shuffled text, and it is now retired. The underlying lesson is methodological rather than cryptographic: picking out anomalies after the fact can manufacture persuasive-looking structure unless the chance baseline is spelled out and deliberately challenged. Full report.

Follow-up audit (2026-04-08): An adversarial internal review reclassified 19 additional “interesting” results as eliminated once their dependence on the retired palette or on structural disqualifiers (the self-keying family, the VIC family, key lengths too long for the clues to test; the self-keying reason has since proved too broad, see below) was identified. We also ran a pre-registered checklist. Its non-columnar three-layer enumeration of 838,350 compositions returned zero candidates under pre-committed conjunctive thresholds. Its other two items, Carter Vol 1 and Kahn Codebreakers as running-key sources against columnar widths 6/8/9, turned out in August 2026 to have tested nothing: the faulty key-consistency check described below discarded every arrangement before either text was read. Carter’s volume was also tested in other searches under column and route rearrangements, with no signal; Kahn’s book has not been re-run. Full records are in the internal status audit (docs/exhaustion_audit_2026_04_08.md in the research repository), which is deliberately adversarial about our own claims.

Our own errors, corrected (August and September 2026)

In August 2026 we found that a key-consistency check used across the project (the Bean constraints) had been applied in the wrong frame in tests that also rearranged the letters, so the failures it reported in those tests could not be trusted. That withdrew an earlier proof that claimed to rule out repeating keys of most lengths under any rearrangement, together with the list of “surviving” key lengths it produced, and reopened 18 records we had marked exhausted. The column-rearrangement cases (widths 4 to 9, key lengths 1 to 24, standard alphabet) were then searched again without that check, and nothing fits. In September 2026 we found that most of the same check (all but its one equality and the pairs Bean himself published) only works on the standard A-to-Z alphabet and gives false failures on the KRYPTOS alphabet used for K1 and K2. No recorded elimination is overturned by that, but one search had skipped half its cases because of it; that half has since been run, with nothing found, though the search’s detection tests later proved weak and its result is now marked provisional. The same month, an audit found that 57 older experiment scripts carried copies of the K1 to K3 texts that match the real texts only for a stretch (often the first 20 to 60 letters) and then diverge, often into invented text. Results computed from those copies did not test the real texts beyond that point. The main conclusion, that the K1 to K3 texts do not work as a running key for K4 read straight across, was re-checked on the verified texts and still fails (best 8 of 24 known letters, a chance-level score); that re-check is not yet in the repository. Also in September 2026, we found that an older claim, that self-keying (autokey) ciphers cannot fit the known letters even when combined with any letter rearrangement, was wrong: an explicit rearrangement of the 97 carved letters followed by ciphertext-keyed self-keying decryption reproduces all 24 known letters. Self-keying applied directly to the carved text is still ruled out for starting keys of up to 25 letters; with a rearrangement it is not ruled out, though that is not a lead.