The OPCW's IIT Issues its First Report

April 9, 2020
rough, incomplete
edits April 12, 14...

So after much delay and coronavirus, the first report of IIT is released, just after the 2-year anniversary of the Douma chemical massacre (which it does not consider, by the way).
S/1867/2020
8 April 2020
Original: ENGLISH
NOTE BY THE TECHNICAL SECRETARIAT
FIRST REPORT BY THE OPCW INVESTIGATION AND IDENTIFICATION TEAM
PURSUANT TO PARAGRAPH 10 OF DECISION C-SS-4/DEC.3
“ADDRESSING THE THREAT FROM CHEMICAL WEAPONS USE”
LTAMENAH (SYRIAN ARAB REPUBLIC)
24, 25, AND 30 MARCH 2017

https://www.opcw.org/media-centre/news/2020/04/opcw-releases-first-report-investigation-and-identification-team

The IIT had promised last year to consider nine incidents including Douma, one attack blamed on ISIS, and 7 others blamed so far on Damascus, ranging from 2014 to 2017. I took a good look at most of those with work assembled here. Three of those cases are covered in this initial report, the three in al-Lataminah, Hama, spanning about one week in March, 2017.

The motive aspect has never been very clear. the Syrian government has negative motive to have committed any of these attacks; they deny all of them and logically the denials should be true. It'll take some actual facts - not just authority - to show otherwise.

Bashar Assad learned that US president Obama had a "Red Line" over CW use; after Ghouta alleged sarin attack was taken as killing over 1,000, threats of war led to Syria joining the OPCW and surrendering its CW program. Allegedly, Assad spent the following years mainly avoiding deadlier agents like sarin, attacking instead with relatively harmless chlorine. Then in late 2016, after using chlorine to random effect in his efforts to re-take all of Aleppo city, he seemingly wondered if Trump had a sarin "red line" too, and started sneaking the deadly nerve agent back in. As soon as Trump was elected, a string of December 2016 attacks near Uqayribat, Hama (ISIS-held) killed nearly 100, it seems with sarin. This was reported, but to little protest and no action - maybe Trump just didn't want to be seen as bailing out ISIS. So Assad tries in "moderate" turf, replicating a near-100-dead sarin attack in Khan Sheikhoun on 4 April, just after signals the US administration would take a more favorable stance on Syria. Then he finds Trump has "many, many lines" that crossed, Washington's softer line was withheld, and US missiles fell on Syria, damaging an airfield.

Prior to that gamble, these 3 Lataminah attacks (among a few others) allegedly tested the waters:
3-24 a bomb with deadly sarin used near militant cave base, affects at least 16, kills no one - doesn't even get mentioned publicly by anyone. I reviewed that one here.
3-25 a cylinder with caustic chlorine used at a cave hospital, affects 30+ and kills 3 - moderate protest. I reviewed that one here
3-30 a bomb with deadly sarin near militant cave base affects 170 mostly militants, kills no one - mild protest, followed by friendly US signals (I did a review of the 3-30 evidence, which I'll use to flesh out a main post on that fairly soon.)
So we can see how Assad might be emboldened to try the Khan Sheikhoun stunt - if that made sense, etc.

In blaming these three incidents more explicitly on Syrian military aviation, the report explains "the IIT gradually came to these conclusions as the  only ones that could reasonably be reached from the information obtained, taken as a whole." Huh.

…
Michael Kobs: After a first look at the IIT (OPCW) report, I have to say that it looks like a rebranding of old evidence to construct a somehow halfway credible narrative.
The opus revolves around the assertion that the SAA wanted to reclaim territories that it had lost to advancing HTS.
https://twitter.com/MichaKobs/status/1248038976650391554


New details on 24-3:
- M-4000 identified from debris
- the one fragment shown might is the same exact one already used for the 30-3 incident ...
I wasted some time with this visual proof before reading the explanation that 04SDS does in fact = 04SDS. "7.29 Moreover, the IIT identified through videos and forensic analyses another fragment as originating from the area of the crater of 24 March 2017 (which the FFM marked as 04SDS when the object was handed over to it with samples related to the incident of  30 March 2017)."
Report S/1548/2017 gives 04SDS date of receipt 18-7 (meaning 17-8, after being recovered 30-7). That report being about the 30 March incident, it had seemed related to that, but nothing in there really specifies - it's not seen at the sarin impact point, and not given as being there either.

- Video of crater said to filmed 26-3 per metadata - can be faked, but logically 24-3 would be a bette date - likely filmed on 26-3, possibly because it didn't exist yet on 24-3, or not...
- soil collection said to be done then, possibly explaining how active sarin could be detected in it 10 months later.

Unseen Debris 
Remnants and possible origin "7.18 On 19 February 2018,74 the FFM received metal fragments retrieved from the crater as remnants of munition parts related to the incident of 24 March 2017 in the southern outskirts of Ltamenah. These were later analysed by OPCW designated laboratories. The IIT assessed all six metal pieces retrieved from the crater and listed by the FFM. After consulting with munition specialists, the IIT reached the conclusion that, out of the six fragments, two can be linked to potential chemical weapons use. "

The other four were either inconclusive or perhaps even contradictory. Let's presume the former and move on to the two that seemed clearer on the point.

"The first of these two fragments, which the FFM identified as SDS28, consists of a very heavy thick metal cone-shaped part, with an attached metal sheet/liner.76 Forensic analysis of this fragment also shows traces of paint. According to munition specialists, the form and shapes of the fragment are consistent with the design of the nose part of Syrian chemical air-delivered bombs, namely the MYM6000 and the M4000 models."

This is not shown, but described as similar to 04SDS (see above): "both SDS28 and 04SDS originate from the same aerial bomb, “based on the similar steel layer assembly, thickness, curvature, and specific linear indentation in the steel liner”.

"7.25 The second fragment received by the FFM, SDS29,77 consists of a large corroded fragment of sheet metal of approximately 38 cm by 50 cm, with traces of dark green paint. According to munition specialists, the form and shape of this fragment are consistent with a fragment resulting from the explosion of an ordnance with limited explosive quantity, and fragments from the explosion of conventional explosives filled munitions would be smaller and have sharper edges. Some of its measurements lower the possibility that this is part of a chemical aerial bomb from the stockpile of the Syrian Arab Republic, and further analyses would be required to reach solid conclusions on the origin of this fragment. "

As described, this might be paneling similar to these partly-connected plates logged for 30-3, but one huge piece bigger than all these combined. The size was apparently an issue, and a big enough one they had to drop one of two rather vague pieces of evidence.

"7.26 The IIT, aware of the importance of the chain of custody in this type of investigation, pursued several lines of inquiry in order to establish it. However, in light of the uncertainty on the origin of this fragment, and as the IIT was unable to fully confirm its chain of custody, it did not pursue this second fragment in this area of inquiry. "
So - two fragments considered, then one discarded as a possible non-fit and unverified provenance, and neither is shown. But somehow there's more; it seems the other 4 recovered items are not described, and it's a coincidence that four other items are then discussed as also relevant, three of them seemingly not recovered. If so, that's 6 recovered plus the other 4 for 10 items. Otherwise, these are the other four:

"7.28 The IIT further considered three fragments that are visible in a video of a crater taken on 26 March 2017, which the IIT confirmed through witnesses and assessment by a specialised forensic institute as being the crater of the incident of 24 March 2017. Two of these remnants were partly buried. Although these large metal fragments are consistent with those created by an ordnance with limited explosive quantity, not enough details are available to confirm their origin. The third fragment, however, is more visible: it consists of what appears as a flat metal part with holes, some containing bolts, and a folded end. The specialists consulted by the IIT found that the visible characteristics of the fragment in the crater are consistent with a ring-shaped component used to attach the membrane of the M4000."

So 3 items seen in the video but not handed over, and the video frames aren't shared, so that's 5/6 all unseen. We've seen a partial support ring … I don't suppose this is the same item.

"7.29 Moreover, the IIT identified through videos and forensic analyses another fragment as originating from the area of the crater of 24 March 2017 (which the FFM marked as 04SDS when the object was handed over to it with samples related to the incident of 30 March 2017)."

And there's an item seen in the video, and handed over - but as recorded that was in August, 2017, as samples related to the 30 March incident were received. It was listed with them, seemed to be one of them. The two fragments they considered SDS28 and 29 were handed over (apparently with four others) on 19 February 2018, AS debris from the 24-3 crater, months after they had 04SDS. So this item was double-booked.

Report S/1548/2017 listed 04SDS(B) date: 18/7 (apparently with 18-7 swapped in for 17-8, as the report gives, noting some fragments were collected on 30 July). It had Sarin, DIMP, IMPA, MPA, MPFA, HFP, TPP, DIPF, hexamine.

04SDS was never seen at the sarin impact site for the 30-3 incident, and wasn't labeled or specified as being found there. Its appearance in situ at what's said to be another crater that could be geolocated clearly trumps any basis for inclusion in the other set. That is this item belongs with 24-3, not 30-3.

The only one they show is the one of six we've already seen, linked to two incidents now. The other was vague paneling that may not fit, and one piece seen on video SOUNDS interesting. No more filler caps, unique tail assembly, parts for a mixing arm, etc. In summary:

Soil returns and sarin samples
Previously it seems the soil sample that tested for sarin was only handed to the FFM on 19 February, 2018, perhaps after being collected recently, but possibly back to April, 2017. That could mean active sarin was found on samples that had weathered for nearly ten months, plus an unclear delay to actual analysis.  But according to the new report, munition fragments were delivered in 2018, while the soil came in earlier, after being collected and sealed just days after the alleged attack. If true, that should make the later finding entirely plausible (which is not to say it was dropped there by a Syrian jet)

Paragraph 7.31 relates the two key areas the IIT verified sarin in relation to this incident:
"In relation to this incident, the IIT specifically–though not exclusively–focused on the analysis performed for the FFM by two OPCW designated laboratories of the fragment SDS28, for which the chain of custody was described above...."
(not clear why they didn't also cite the similar 04SDS seen in the same crater and tested to show sarin as well)
"... Moreover, the IIT requested two OPCW designated laboratories to carry out analyses for a subsample (denominated SLS35) of a sample which had been identified (but not analysed) by the FFM as 01SLS. ..."

Okay, the FFM had this soil sample (SLS) dubbed 01SLS, but didn't have it analyzed for some reason. The FFM or IIT sets out a subsample and gives it a name SLS35 - where the SLS switches order (as it does between uses, for reasons I'm not sure of).

".. This environmental sample from the crater was collected on 26 March 2017 and provided to the FFM on 12 August 2017."

S/1548/2017 (2 Nov. 2017) has SLS02, 03, 04, 05 - any SLS01 is missing from that, which makes sense, except … this shouldn't be included in that list of samples for 30-3 - its missing 01 should be a coincidence. But then again, debris from this incident (04SDS) shouldn't have been included there and it was. Maybe this is the same 01?  It shouldn't be - the Next in line: 02SLS to 06SLS, came on 17 July - nearly a month before the IIT now say investigators were handed that 01SLS.

So presumably - or most innocently - that was 01 in its own system relating to the 24-3 incident. Report S/1636/2018 relates the acquisition of samples for the that incident, giving only the Feb. 2018 date. There's no SLS sample #01 OR #35 listed here. Instead it's SLS18 to SLS23, all with evidence numbers including the date 20180219. No sign of anything dating back to August. So where has this 01 and its subset 35 been since the FFM got it?

To risk adding to the confusion ... they say this 01SLS had a portion set aside called 35SLS. But was it the other way around? There is a 35SLS Soil, ostensibly from the sain impact point for the 30 March incident. Date of Receipt: 12/4/17. It was analyzed, found to have DIMP IMPA, MPA - no active sarin.
It might go like this:
- There were some 30 soil samples (SLS) that didn't matter, or they start counting at 30 instead of 0
- then 31-35 are logged in April
- the last has a portion set out and given the number 01SLS - because now they start at zero again?
- That sits in some limbo, later has its subest develop sarin and becomes the 24-3 soil described with a backwards origin story and an August date
- Later in July they get more from the 30-3 crater, under metal, and dub these SLS02 and so on.

Likely it didn't go like that - the same numbers might be used and passed in different systems, besides for each incident, allowing for confusing coincidences. But in this case, the lines between one incident and the other are so blurry, it seems likely they share the same numbered samples that came in whenever, described as whatever suited the day's purpose.

"Staging" considered 
The IIT addresses the possibility of a false-flag incident or staged chemical attack for each of the three incidents. Previously when this was aired, it was rejected, said too close to attributing blame; we know who's hands those would be. To decide an object is falling from the air with a velocity is just as specific; we know who operates aircraft in Syria. But that line of investigation was not just allowed, but actively pursued even when the evidence didn't support it. https://libyancivilwar.blogspot.com/2019/06/the-ffms-mysterious-mandate-to-blame.html

In light of last year's troubles and growing awareness of the OPCW's gross institutional bias, they bring it up - always in quotes as "staging" - and find that it would count as a "use" of weapons worthy of calling out: "“staging” of chemical attacks (or organising “false flag” chemical attacks, as this is at times described), if done through the use of chemical weapons as defined in this section of the report, would constitute “use” of chemical weapons under the Convention."

In contrast, the FFM had put manual placement (staging) as outside its mandate for being too blamey AND not being a "use" of CW, which is all they were tasked with finding. Now they explicitly consider it and talk about that, to clarify that's not off-the table. As we'll see, it's just set precariously at the table's edge and then knocked off - "gradually."

5.4 lists four scenarios "developed for this investigation" and "bearing in mind the specific circumstances of each specific incident"
(a) chemical weapons were prepared elsewhere, brought to–or around–the sites of the incidents identified by the FFM, and used; or
(b) chemical weapons were air-delivered on–or around–the sites of the incidents identified by the FFM; or
(c) chemical weapons were launched, spread, or deployed otherwise to–or-around–the sites of the incidents identified by the FFM; or
(d) no chemical weapons attack occurred, but conventional weapon(s) were deployed or brought to–or around–the sites of the incidents identified by the FFM, while chemicals were used at the sites later to “stage” a chemical attack and blame one side of the conflict.

I don't see this list as very helpful. It's not clear what a and c actually mean (CWs were "brought", or deployed by whom?), with ony two being clear on perpetrator. The choice is mainly between b (government airstrike) and d - the CWs were brought in order to blame someone else, perhaps planted via deployment (d via c). In other cases, I find the an option like that generally explains the evidence best.

The report helpfully gives some detail on how they presumed an option d might play out. 11.4 "... the aerial munitions used on both 24 and 30 March 2017 are very likely M4000 aerial bombs, developed and built only by the Syrian Arab Republic." 11.5-11.7 sarin made using the same formula of DF as Syria's (or one that yielded the same markers they were looking for). 11.9 ... the IIT could not find any information supporting the hypothesis that the Syrian Arab Republic lost control of its chemical weapons stockpile, whether aerial bombs or sarin and its precursors."

But it's still not clear the sarin they keep finding is made by Syria or even uses the same formula as them. The DF similaities seem to be genuine and might even be fairly specific, but even exact forumlas can be reverse-engineered and replicated by states or non-state actors who could get their counterfeit agent into the right hands in Syria to have the govenment framed. The main thing anyone has poven is the same kind of sarin keeps being used - they think by the authoities, but maybe it's the terrorists behind all these incidents. (see here).

As for the bomb, the IIT notes the Syrians claiming to have repurposed all their remaining M4000s in 2013 to carry conventional explosives and help in the fight against the foreign-backed militants. The IIT pointedly didn't agree to this, but didn't dispute that at least some M400s were so converted. Bellingcat noting two examples found totally or mostly intact were probably of this kind and had failed to detonate. Presumably others had been dropped, some of them would have worked, and they'd have scraps from these. There's no need to raid stockpiles when the things are falling into rebel hands, as I had noted here, sometimes from petty low altitudes (low enough it hadn't even settle on a nose-down position?).

Or maybe the one shows there HAD BEEN some raiding? It's also quite possible the militants used their skills and tools to fabricate their own copies of the M4000, as soon as the design was known to them. In fact the noted differences between the schematics and field examples always suggested this (but far from poved it - the authoritativeness of the schematic is unclear).

The IIT and its experts doubted the fragments were small and twisted enough to be from a TNT bomb that detonated, suggesting ather a limited-size CW bursting (or opening) charge but I think they were wrong. The small number, small size, and extreme distortion of some fragments might prove that to a true expert (the distortion might require partial melting like in a very high energy blast, and some of it seems to include black scorching as well). The back end didn't fare too poorly, but the rest of it seems to have nearly vaporized. Only the most solid and central bit(s) of the front survived, joined by almost nothing from the middle, or the bulk of its exterior. Be it a full load of TNT or just the opening charge, if it was so powerful to rip the bomb into such small pieces, how would it fail to vaporize the sarin blamed for sickening some 170 people? That's with what IIT calls the "overabundance of elements" from the most intact of three uses alleged, arguing this pointed to a limited-power opening charge. But that point doesn't hold up well with the other two alleged uses.

It's most likely these things were planted manually at each of the sites. With three filler caps seen between the 3 incidents, we're looking at parts of 2 bombs. But aside from the caps, the remnants might all be from one unit they just gathered the biggest pieces from and divvied them up unevenly between their two and then thee incidents.

The IIT seems to have considered just one method for getting M4000 scraps that could wind up testing positive for sarin:

11.10 The IIT further explored the possibility that armed groups could have retrieved used (fragments of) chemical weapons from sites where the authorities of the Syrian Arab Republic had tested chemical weapons prior to accession to the Convention in order to “stage” chemical attacks. Such an act could in theory have enabled them to place contaminated fragments at the locations of the incidents of 24 and 30 March 2017, for example, in order to “stage” a chemical attack there.
In pursuing this line of inquiry, the IIT identified through its investigations only one such testing range where some warheads and aerial bombs were tested with sarin prior to and in 2009. The IIT obtained information that armed groups close to ISIL/Daesh reached the vicinity of this testing range in 2016 and early 2017, but was unable to confirm that they ever took over the facility. Moreover, the IIT considered the low likelihood of an armed group deciding to retrieve contaminated fragments from before 2009 or before, keeping them in the appropriate conditions, and then using them in March 2017 to “stage” an attack at the exact time when military airplanes of the Syrian Arab Republic were overflying the area of the incidents. However, such an armed group, even if it had succeeded in achieving all this through careful planning and execution, would not have been organised enough to ensure that the area was sufficiently secured to protect the fragments in question carefully collected and stored, or at least to ensure that an independent third party could sample the fragments shortly after the alleged incident. In other words, the planning and execution would have to have been carried out impeccably for the first part of this complex staging operation, while the group would have missed, or would not have been able to properly plan and carry out, the second–critical–aspect of the same operation (i.e., ensuring the proper chain of custody of the staged fragments and samples so as to promote their propaganda aims)."

This is not the only scenario to consider, but it's one that fails, and the one they chose. It assumes sarin can only be deposited on fragments by the Syrian government, and remnants tested in or before to 2009 should have active sarin after planting in 2017? 8+ years? That's an absurd plan no one would have, and the IIT seem proud of themselves for showing it wrong. In fact, they identified a further defect of this straw-man argument:

"11.13 Finally, the IIT obtained information that, in any event, none of the aerial munitions tested at the testing range mentioned above contained sarin, and that the M4000 model (which experts assessed as being most likely the model from which the fragments found for both the 24 and 30 March 2017 incidents derived) was not tested by the Syrian Arab Republic with sarin, but rather with sulfur mustard. In light of various factors, including these considerations, the IIT considered this “staging” scenario as implausible."

So there wouldn't be sarin on the ten-year-old scraps anyway! The IIT didn't want to consider that the foreign-backed terrorists might have their own sarin to contaminate things with, having filled weapons with the stuff and fired them on soldiers several times (at Khan Al-Assal anyway, the UN-OPCW saus it's the same stuff used in Ghouta, Khan Sheikhoun, these Lataminah attacks, and others). And as I've said, a more plausible way to get fragments of an M4000 is to have a repurposed one blow up after it's been dropped on you. They could also seize intact copies as they overrun a military installation, or even make their own, then possibly re-fill it themselves with sarin, and then modify it to be launched from a mortar. Maybe a catapult would work. The likelihoods vary, but there are countless possible ways this could be done. The IIT picked a lame one and then discounted it, leaving the remaining options as open as they ever were.

The IIT calls on a few specifics for each of the thee incidents, so I'll consider each in chronological order.

"Staging" dismissed: 24-3
They didn't have much to say against fakery here: 7.9 explains how the crater, "between 1 to 2 metres deep and approximately 2.5 metres in diameter, with a circular shape" was probably from a jet-dropped bomb; "The estimated size of the crater fits the scenario of an aerial bomb with a burster-type explosive charge, impacting the ground." But they note it "might also be consistent with an event “staged” on the ground, as long as the person(s) “staging” the attack were applying the correct amount of explosive to create similar crater characteristics, and had knowledge of the type of soil in the area." I suppose those points are both true; it could be explained by either option. The remaining evidence will help narrow down which it is.

As seen above, only two pieces of nosecone material and a possible large segment of outer skin, and no other fragments of the bomb were recovered - not a very good set-up to claim small-charge blast of an M4000. And as the scene doesn't support a larger blast, a problem appears.

"7.10 Flight data, including information from an early warning network, show that between 5:30 and 5:45 a Syrian Su-22 military airplane took off from Shayrat airbase and attacked Ltamenah. ..."
(I don't believe this Sentry Syria is radar-reliable or verifiable. They issue specific notices that don't seem entirely made-up, may be all true or partly untrue)

"... The attack was further confirmed by persons who either saw or heard a military airplane–with its distinctive sound–around the location of the site of the incident between 5:30 and 6:00 that morning, with one specifically recognising it as a warplane engaged in a diving manoeuvre described as typical of Syrian military aircraft."
(so they say, with an excess of condemnatory information )

"7.11 In assessing the information from witnesses to the event, the IIT sought and obtained additional information corroborating the accounts by the victims."
The witnesses - including sentry Syria - were supported by: "Su-22s were based at Shayrat, "flight data from 24, 25, and 30 March 2017 reveal that Su-22s departed from Shayrat airbase at least 19 times" and "the Su-22 is used in that theatre of operations only by the Syrian Arab Air Force." (7.12, 7.13)

11.4 In addition,... The IIT was provided with expert advice that the aerial munitions used on both 24 and 30 March 2017 are very likely M4000 aerial bombs, developed and built only by the Syrian Arab Republic."
and as noted above - falling into rebel hands, sometimes from not so high.

But it seems their favorite agument for this case simply inverts its biggest problem. This same move was made earlier by Eliot Higgins: "I've been unable to find any social media posts or open source reporting on the attack, so it doesn't really stand up that it's a false flag, because if it was why did no-one talk about it?" It doesn't "stand up" that it was real, at the time. Why else would no one talk about it? The IIT also seems to miss that point:

"11.11 With specific reference to the incident of 24 March 2017, such an intricate staging exercise is also at odds with an almost complete lack of publicity, not consistent with the complex and lengthy efforts which would have been necessary to retrieve from elsewhere, store, and prepare contaminated fragments for use and collection as samples. ..."

As Michael Kobs noted "After the OPCW report, however, Higgins hastily rowed back. How could it have been a 'false flag' operation if nobody talks or writes about it? Interestingly, the IIT report coughs up Eliot Higgins' argument. Coincidence? Certainly not."


Well it's hard to say if they did or would have come up with that thought on their own, but either way, it's a lame point. If the militants had faked it correctly at the time, it is almost certain they would have mentioned it. Therefore we conclude they staged it later, either because they did it wrong the first time didn't do it at all. Lacking a time machine, they had to stick with the existing lack of mention. I've suspected that they simply didn't think of the allegation at the time, and would therefore have done none of those "intricate" things. The IIT report adds reference to a video, which was never shown publicly. To the extent they may have filmed a video on the 26th (as the metadata says), maybe there was such a plan by then. But if so, their failure to follow up with mention is a problem, not a strength; it suggests the plan didn't work out right, perhaps leading them to delete the event and try it again a week later.

"... Even assuming that this was a case of “staging” an incident that did not fully work out as originally intended (because, for instance, the contaminated sarin was released in the wrong place or at the wrong time), had an armed group gone through the trouble of retrieving, storing safely, and preparing sarin-contaminated fragments of a weapon, it remains unclear why it would have then failed to properly publicise the intended message."

Uh ... IF the video proof or other aspect of their allegation didn't support the intended claims, the IIT wonders why they didn't just publicize the claims anyway. Probably because they wanted the video and a correct story for an important claim on the re-emergence of sarin. If the relevant story was mucked-up badly enough to ignore it, then it WAS mucked-up that badly, and that's why you didn't hear about it.
Perhaps the problem was with the 25-3 incident - maybe their use of sarin there was deemed problematic (I couldn't say just why), so they reported just the chlorine. But then they had sarin in the samples sent in, and at about that same time, had the 24-3 incident to explain it - patients had washed off there prior to treatment. It could be that anomaly was the central reason FOR the 24-3 incident to materialize.

To be clear, that "almost complete lack of publicity" is a TOTAL LACK, AFAIK, until the FFM got to break the story. The better question stemming from that was always why no one mentioned it then - except to say it DIDN'T HAPPEN - if it did happen? Because the "elaborate staging" was done long after the window for at-time reports had closed. This video from well-connected parties followed the 30 March incident and they still didn't know to mention this had also happened last week - they still say it's never happened before. From this, we can deduce the idea to claim a 24-3 incident still hadn't gelled even at this point. It was thought up by the time they mentioned it first to the FFM sometime afte 10 April, but not long before that.

Furthermore, if there were messed-up plan they didn't want talked about, people might conspicuously deny any such prior event But I don't see that as suggested; the few denials feel sporadic and natural, not the work of people told to deny it - the newness of a jet sarin attack is just another feature of it some mention but most don't. It seems as if the prior event just hadn't been thought up yet.

"Staging" dismissed: 25-3
…

"Staging" dismissed: 30-3
...

More to come ...