That's encouraging then. It looks like stripts -E can properly detect whether a recording is encrypted by analysing it. I'll add that to the automatic decryption as a final check before swapping the decrypted version into place.
It's a shame we don't still have access to the failed decrypted recording as that would prove that this would pick it up but the decryption works on a block basis so if decryption has failed then it should not be possible to parse the PAT.
It's a shame we don't still have access to the failed decrypted recording as that would prove that this would pick it up but the decryption works on a block basis so if decryption has failed then it should not be possible to parse the PAT.