Log Compression and Archive Structure in the iOS 27.0 Sysdiagnose: An Early Observation Tested Against Ten Archives

A sysdiagnose parser that fits one iOS release can return less on the next without an error, and a list of release differences drawn from one archive per release cannot separate the release from the device. We compare one iOS 27.0 sysdiagnose with nine iOS 26 sysdiagnoses from two other iPhones and re-test the thirteen claims of an initial comparison of one archive per release: a claim survives only if no iOS 26 archive contradicts it. Four differences survive; with one iOS 27.0 capture they remain hypotheses about the release. In the iOS 27.0 archive 94.5 percent of log chunksets use LZBITMAP compression, against none in the iOS 26 archives, and a decoder without the codec recovered 4.6 percent of the records yet reported completion with warnings. A container-manager state file, a launch-services list and four small stores occur only in the iOS 27.0 archive, and its BatteryUI time buckets are stored 86,400 s wide instead of 3,600 s. Six claims fail because an iOS 26 device shows the same property, so comparing one archive per release overstated what is new. Decoder maintainers documented the codec change first; we confirm it on a complete archive and measure its cost.