> The perpetrator would expect buyers of the pamphlet to try reproduce the decoding of the second ciphertext, so presumably there were versions of the declaration that correctly formed the key.
The version of the DoI that was used to decode ciphertext #2 was included with the pamphlet. It does not produce an error-free decoding.
> I would like to see a python (or other) script with the most important observations reproduced (such as the alphabet like sequence)
The link in the post to which you are replying contains, at the bottom, all three ciphertexts, the key text, and a C++ program that performs the decoding.
The alphabetic sequences in the first "cipher" may simply be key material: you can speed up your work by constructing a look-up table that maps each letter of the alphabet to a list of suitable numbers for words starting with that letter.
While encoding is a work in progress this is a perfectly good tool to use, but it is dangerous to explicitly write the letter i.e. "A: 107, 204, ... B: 48, 87, ..." (I made up the numbers) because if the lookup table is found with the ciphertext, the attacker no longer needs to find the correct book (DoI)!
An alternative to actually writing down the letters on the same piece of paper is to have a second strip of paper, to be held above/below the numbers, in an aligned fashion, so that one paper has "A [whitespaces] B [whitespaces] C ..." and the second has some numbers corresponding to the letters. (if you look at things like "indenture" the concept of aligning paper was a commonly used trick for verification etc purpouses)
The grass is always greener on the other side:
1) whenever the encoder was working without lookup table, he labouriously had to traverse the DoI lookinng for a suitable word, wishing he had a lookup table
2) whenever the encoder retried constructing a good lookup table, he (erroneously?) felt he was wasting his time constructing a lookup table instead of encoding the text
this could explain the restarting runs of the alphabet (with letters recurring i.e. aaaabbbccc..., and also explains why the number distribution is flatter compared to N and E as in "Where are the N and E characters" at http://rogergrambihler.tripod.com/BealeHoax.htm )
although he doesn't notice his own mismatcc of "hith" instead of "with" (I haven't checked/reproduced his mapping in code, I intend to implement his decoding with quirks by adapting your .c file, if you wish I can send it over when done)
Regarding the similar distribution you pointed out in the plot, I was considering that perhaps the cipher numbers were ordered in a gridlike fashion on the original, such that perhaps vertical or diagonal reading, or more exact positioning would reveal extra information.
So I was browsing the NSA pdf files "The Beale Papers" from archive.org, and apperently according to these files theres even different versions of the CIPHERTEXTS!
It is unclear to me why there would be different ciphertexts floating around, possibly:
1) the pamphlet author published multiple versions
2) after analysis, later authors "fixed" the ciphertexts as opposed to describing the encryption errors in the decoding mechanism
3) flat out disinformation by: the publisher (how does the anonymous author defend the true ciphertext? would other publishers at the time dare to publish a second version of the cipher? how does this author prove he is the same anonymous person?), disinformation by treasure hunters (you can recognnize your own manipulation, but this confuses everyone else)
Do we know what happened with the publisher? did it merge with others, and is it still in existence under a new name? Do they perhaps have any early original (from the box, or original manuscript from the anonymous person, etc...)
The version of the DoI that was used to decode ciphertext #2 was included with the pamphlet. It does not produce an error-free decoding.
> I would like to see a python (or other) script with the most important observations reproduced (such as the alphabet like sequence)
The link in the post to which you are replying contains, at the bottom, all three ciphertexts, the key text, and a C++ program that performs the decoding.