The batch markers

Forty-two posts are a GUID that is all zeros apart from a code and a small number. In summer 2012 they open and close batches of NN filler posts, and the batches line up with the runs of the count RNG.

Forty-two of A858's posts are a single GUID that is almost entirely zeros. Here are three posted on 2012-08-02 within six hours of each other (xjjxh, xl4zb, and the post that closed its batch, xm7qx):

0000000000000000 0000000000000000        xjjxh  all zeros
0000000000004000 0000000000000008        xl4zb  4000/08
0000000000000000 0000000000000000        xm7qx  all zeros

Read as a GUID, the second one is 00000000-0000-4000-0000-000000000008. The 4000 sits where a GUID's version field is, and the last byte carries a small number, NN. They are never encrypted and never appear inside a decrypted post: they are always posts of their own. The community called them status or marker posts.

There are only three kinds:

Finding: in summer 2012 the markers frame batches of filler. 4000/NN opens a batch of NN posts, and an all-zero marker closes it one or two seconds after the last post. In 13 of the 18 batches the number of filler posts between the markers is exactly NN, and the other four are explained by what the count RNG shows about the runs around them.

The 2012 batches

Every batch, with the filler posted from its opening marker to the next marker, and the run each of those posts belongs to. The draw numbers are the positions in that run's count Random.

13 of 18 batches contain exactly NN filler posts. † marker titled on the operator's clock rather than the posting app's.

How the batches relate to the runs

A run is one start of A858's posting program: one Random, seeded with the machine's uptime, that draws the GUID count for every post until the program stops (see the count RNG and the runs). Lined up against the runs, the batches fall into a few patterns.

A batch is not a program start. Run 22 (seed 528,385,484) served seven batches between August 2 and August 13, asking for 8, 12, 10, 14, 6, 24 and 13 posts. Its draws run straight through them: 0–7, 8–19, 20–29, 30–43, 44–49, 50–73 and 74–84. So the program stayed up between batches and did not touch its Random while it waited, and the batch size is not one of its draws. NN came from somewhere else: an operator, or a scheduler outside the program. The posting interval was set per batch as well: run 22's batches went out every 125, 20, 6, 14, 2 and 10 minutes.

Some batches are a whole run. Run 19 (5 posts), run 20 (6), run 21 (8) and run 23 (5) are each exactly one batch: the program was started, posted NN, and was not heard from again. The short xhllk run (4) is the same. Its seed is only probable, since four posts are few, but its start time narrows the search enough that one seed fits (377,361,921). The apps behind runs 19 and 20 seem to have been started about two hours before their first batch and sat idle until it was opened.

x9ewo (44) is run 18 plus a test post. Run 18 is 44 posts, exactly NN. The extra post in the window is x9ily, a lone post with a Pacific-time title, posted an hour before the run started. Both x9ewo and its close x9p6r are on the operator's clock, not the program's.

ybxui asked for 300. Run 24 (seed 39,416,093) first served ya6yd's batch of 3 (draws 0–2). The next marker asks for 0x12C = 300 posts. Run 24 posted 98 of them (draws 3–100) and stopped on the evening of August 16. On the morning of August 17 a new program start, run 25 (seed 158,297,437), posted 21 posts in all, alone, and stopped at 09:43 UTC. Together the two runs fell 181 posts short of 300, and the batch was never closed.

zcj5p asked for 40. On 2012-09-04 at 18:30 it was followed four seconds later by one post, zcj5x, and nothing else that day. Runs 28 and 29, new program starts the next day, account for the rest of the window. It is the last batch marker. Runs 26 and 27 just before it, and every run after it, post with no markers at all.

The 405C pair and the stalled batch

The strangest batch is y4ylg (13), on Monday 2012-08-13:

1. Run 22 had stopped posting 28.7 hours earlier, after draw 73. It resumed with the same Random on a 5-minute interval and posted draws 74–84: 11 posts. The titles of these posts change time zone mid-batch, from UTC−4 to UTC+9.
2. Then nothing for 8 hours 19 minutes.
3. Three more posts came in, from another source: their counts (51, 29, 11) are not run 22's next draws (39, 37, 32). That makes 14, one more than NN.
4. The all-zero close, y5nxc, at 18:39.
5. y5o0x, 405C/00, a minute later, and y5o4g, 405C/01, two minutes after that, with a hand-typed title.

The next day was Patch Tuesday. Until then A858's titles had run ahead of Reddit's clock by a slowly growing lead (about +1 minute in June 2012, +2.6 minutes on August 13). From August 14 on the lead is zero: the posting clock was synced, and it stayed synced to the end. Small test batches followed on August 14 and 15 (y7kng and y8sqr, 3 posts each, in the August 13–15 test group), and run 23 started after a new boot on August 15.

So 405C belongs to cleaning up a stalled batch the evening before an update reboot. One reading: the marker is 0x4000 plus a 12-bit command, 0x000 meaning "batch", and 0x05C some maintenance or hand-over command with argument 0 and then 1. That is speculation. 405C occurs nowhere else: not in any other post body, not inside any decrypted list, not in the sidebar history. With only one use there is nothing to test a reading against.

Who posted the markers

A858's titles are timestamps, and every posting clock has its own offset from Reddit's time. That shows who posted each marker. Most markers match the clock of the filler around them to the second: the program posted them. Nine do not. Their titles are on the operator's own clock, in true Pacific time, or were typed by hand (marked † in the table above): ifhqx, ijsoj, n2mjz, wwsxw, x9ewo, x9p6r, xjjxh, y5o4g and 4cgudj.

Several of the all-zero markers posted by hand close no batch. They come just after the program stopped:

• wwsxw (2012-07-21) about two minutes after two runs that had been posting side by side, run 16 and run 17, both stopped;
• n2mjz (2011-12-06) 18.8 hours after the last 32-bit word post, n1ley;
• 4cgudj (2016-03-29 18:42) 77 minutes after the last two-hourly filler post, at a round minute on the operator's clock. It is A858's last post.

Read that way, the all-zero GUID is a "stop" record, posted by the program at the end of a batch and by the operator at the end of everything.

2011: a status word, not a count

The three 2011 4000/NN markers come before the scheduled program and its count RNG (which started on 2012-06-26), so there are no runs to check them against, and no reading as a post count fits them. They look more like a status value that was being changed by hand:

The edit to ifhqx was caught by readers at the time: "When I first commented on this, the last one was a two, not a four." The markers also date a change in A858's output format: ifhqx is printed like the GUID lists before it, 32 lower-case hex digits, and ifxow, later the same day, is the first post in the upper-case two-halves layout that every filler post used from August 2011 to the cutover in October 2013.

What is still open

• What 405C means. It was used once, as 00 then 01, and nothing else in the corpus carries it.
• What the 2011 status values (02, 04, 00, FFFF, 05) stood for.
• Where NN came from. It is not drawn from the count RNG. Whether the operator typed it or another program chose it is unknown.