Paper A v3.18.4: address codex GPT-5.5 round-18 self-comparing review findings

Codex round-18 (paper/codex_review_gpt55_v3_18_3.md) caught a falsified
provenance claim I introduced in v3.18.3 plus four cleaner narrative items
that survived the prior 17 rounds. Verdict was Minor Revision; this
commit closes all 5 actionable items.

- Harmonize signature_analysis/28_byte_identity_decomposition.py to use
  accountants.firm (joined on signatures.assigned_accountant) for Firm A
  membership, matching the convention in 24_validation_recalibration.py.
  Regenerated reports/byte_identity_decomp/byte_identity_decomposition.json.
  Cross-firm convergence now reports Firm A 49,389 / 55,922 = 88.32% and
  Non-Firm-A 27,595 / 65,514 = 42.12% (percentages unchanged at two
  decimal places; counts now match Table IX exactly).
- Replace the Section IV-H.2 reconciliation note. The previous note
  speculated that the one-record discrepancy was a snapshot/floating-point
  artifact, which codex round-18 falsified by direct DB queries: the real
  cause was that script 28 used signatures.excel_firm while Table IX uses
  accountants.firm. With script 28 now harmonized, Table IX and the
  cross-firm artifact agree exactly at 55,922; the new note documents the
  Firm A grouping convention plus the dHash-non-null filter.
- Replace residual "known-majority-positive" wording with
  "replication-dominated" in Introduction (contributions 4 and 6) and
  Methodology III-I (anchor-rationale paragraph).
- Correct Methodology III-G's auditor-year description: the per-signature
  best-match cosine that feeds each auditor-year mean is computed against
  the full same-CPA cross-year pool, not within-year only. The aggregation
  unit is within-year, but the underlying similarity statistic is not.
- Add the 145 / 50 / 180 / 35 Firm A byte-decomposition sentence to
  Results IV-F.1 with explicit pointer to script 28 and the JSON artifact;
  this resolves the round-18 finding that several manuscript locations
  cited IV-F.1 for a decomposition that was not actually reported there.
- Rebuild Paper_A_IEEE_Access_Draft_v3.docx.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

paper/paper_a_methodology_v3.md

@@ -116,7 +116,7 @@ Cosine similarity and dHash are both robust to the noise introduced by the print
 
 Two unit-of-analysis choices are relevant for this study, ordered from finest to coarsest: (i) the *signature*---one signature image extracted from one report; and (ii) the *auditor-year*---all signatures by one CPA within one fiscal year.
 The signature is the operational unit of classification (Section III-K) and of all primary statistical analyses (Section IV-D, IV-F, IV-G).
-The auditor-year is used in the partner-level similarity ranking of Section IV-G.2 as a deliberately within-year aggregation that avoids cross-year pooling.
+The auditor-year is used in the partner-level similarity ranking of Section IV-G.2 as a within-year aggregation unit: each auditor-year's mean is computed over its own fiscal-year signatures, although the per-signature best-match cosine that feeds the mean is computed against the full same-CPA cross-year pool (Section III-G's max-cosine / min-dHash definition).
 We do not use a coarser CPA-level cross-year unit, because pooling a CPA's signatures across the full 2013--2023 sample period would conflate distinct signing-mechanism regimes whenever a CPA's practice changes during the sample, and we make no claim about the within-CPA stability of signing mechanisms over time.
 
 For per-signature classification we compute, for each signature, the maximum pairwise cosine similarity and the minimum dHash Hamming distance against every other signature attributed to the same CPA (over the full same-CPA set, not restricted to the same fiscal year).
@@ -177,7 +177,7 @@ The two roles are kept separate by design.
 
 The reason for the split is empirical.
 The three statistical diagnostics jointly find that per-signature similarity forms a continuous quality spectrum (Section IV-D, summarised below): the dip test fails to reject unimodality for Firm A; BIC strongly prefers a 3-component over a 2-component Beta fit, so the 2-component crossing is a forced fit; and the BD/McCrary candidate transition lies inside the non-hand-signed mode rather than between modes (and is not bin-width-stable; Appendix A).
-Under these conditions the natural anchor for an operational cosine cut is a transparent percentile of a known-majority-positive reference population (Firm A) rather than a mixture-fit crossing whose location depends on parametric assumptions the data do not support.
+Under these conditions the natural anchor for an operational cosine cut is a transparent percentile of a replication-dominated reference population (Firm A) rather than a mixture-fit crossing whose location depends on parametric assumptions the data do not support.
 
 We describe the three diagnostics and the assumptions underlying each in the subsections below.
 The two threshold estimators rest on decreasing-in-strength assumptions: the KDE antimode/crossover requires only smoothness; the Beta mixture additionally requires a parametric specification, and the logit-Gaussian cross-check reports sensitivity to that form.