Apply Phase 5 round-2 fixes from Opus M1-M4 + Gemini Table XV footnote

Addresses round-1 findings from all three AI reviewers in a single
pass. Substantive empirical content unchanged; fixes are factual
corrections, terminology consistency, and table-numbering hygiene.

Opus M3 (Abstract-level factual misstatement): "98-100% of inter-CPA
collisions within source firm" repeated in Abstract / §I body / §I
item 6 / §V-C / §V-G limitation 2 / §VI item 4 / §VI Future Work
conflated the same-pair joint rate (97.0-99.96%) with the any-pair
deployed rule rate (76.7-98.8% across Firms A/B/C/D — Firm A 98.8,
B 76.7, C 83.7, D 77.4 from Table XXV). Replaced with the actual
any-pair range and explicit same-pair sub-range. Removed §V-C's
"regardless of which Big-4 firm is the source" — within-firm
concentration is firm-dependent.

Opus M1 (§IV K=3 mechanism-label reversion): §IV silently regressed
to v3.x "C1 hand-leaning / C2 mixed / C3 replicated" naming that
§III-J line 90 explicitly retires post-composition-decomposition.
Replaced in Tables IX/X/XIV/XVI/XVII column headers and §IV-F /
§IV-H / §IV-J / §IV-K prose. New convention matches §III-J:
- C1 (hand-leaning) -> C1 (low-cos / high-dHash)
- C2 (mixed) -> C2 (central)
- C3 (replicated) -> C3 (high-cos / low-dHash)
- "hand-leaning rate" -> "less-replication-dominated rate"
"Replicated class" retained where it refers to byte-identical
ground truth (line 143/153 — actual byte-level reuse, not K=3
mechanism inference).

Opus M4 (§V duplicate G heading): Phase 4 prose §V had "G.
Pixel-Identity..." at line 105 and "G. Limitations" at line 109.
Renamed second heading to "H. Limitations".

Opus M2 + Gemini Table XV-B (table-numbering cascade): Renamed
Table XV-B to Table XIX, then cascaded XIX -> XX -> ... -> XXV ->
XXVI to keep sequential integer numbering. Cross-reference at
§IV-J also updated. No cross-refs to these tables exist outside §IV
(verified by grep against §III + Phase 4 prose).

Gemini sample-size footnote (Table XV): expanded the source note
to explicitly explain the 150,442 (descriptor-complete) vs 150,453
(vector-complete) distinction across §IV sub-sections and point
back to §III-G sample-size reconciliation.

§III prose softening (lines 99, 283): "nearly all (98%)" framing
that read the Firm A rate as representative of all four Big-4 firms
replaced with the per-firm any-pair / same-pair breakdown.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.planning/STATE.md

@@ -1,13 +1,13 @@
 # STATE — Current snapshot
 
-**Date**: 2026-05-12
+**Date**: 2026-05-14
 **Active milestone**: Paper A v4.0 — Big-4 reframe
-**Active branch**: `paper-a-v4-big4` (12 commits ahead of `yolo-signature-pipeline`)
-**Active phase**: Phase 2 — Methodology rewrite, draft delivered, **awaiting user review of 5 open questions in `paper/v4/paper_a_methodology_v4_section_iii.md`** before Phase 3 begins
+**Active branch**: `paper-a-v4-big4` (33 commits ahead of `master`; pushed to `origin/paper-a-v4-big4` at `980295d`)
+**Active phase**: Phase 5 — AI peer review (codex round 7 closed at Minor Revision; Gemini + Opus rounds + round-2/3 convergence still pending)
 
 ## Recently completed
 
-**Phase 1 (Foundation, 7 spike + foundation scripts)**:
+**Phase 1 (Foundation, 9 spike scripts + 6 follow-on scripts)**:
 - Script 32 (`e1d81e3`): non-Firm-A calibration verdict C
 - Script 33 (`8ac0988`): reverse-anchor PAPER_C_STRONG (directional ρ=+0.744)
 - Script 34 (`55f9f94`): Big-4 K=2 dip-test multimodal p<0.0001, bootstrap CI [0.974, 0.977] / [3.48, 3.97]
@@ -17,33 +17,48 @@
 - Script 38 (`bc36dcc`): convergence **STRONG** — 3 lenses pairwise ρ ≥ 0.879
 - Script 39 (`39575ce`): per-signature convergence **MODERATE** — κ=0.87 between per-CPA and per-sig K=3 fits
 - Script 40 (`338737d`): pixel-identity FAR = **0%** on n=262 ground-truth replicated
+- Scripts 39b/c/d/e + 40b + 43 (`d4f370b`): anchor-based FAR diagnostics; composition decomposition proves Big-4 dh "multimodality" = between-firm shift + integer ties (p_median=0.35 under joint correction)
+- Scripts 44 + 45 (`4cf21a6`): firm-matched-pool logistic regression; full 5-way doc FAR — Firms B/C/D OR 0.05/0.01/0.03 vs Firm A reference after pool-size adjustment
+- Script 46 (`2f05d6f`): alert-rate sensitivity / threshold-plateau analysis (HC threshold locally sensitive; MC/HSC dHash=15 boundary plateau-like)
+- Script 41 (`9392f30`): §IV-K full-dataset robustness comparison (Light)
+- Script 42 (`453f1d8`): Phase 3 close-out support
 
-**Phase 2 (Methodology rewrite)**: §III-G..L draft delivered at `paper/v4/paper_a_methodology_v4_section_iii.md` (commit on the same branch). Single coherent rewrite covering 6 sub-sections (G/H/I/J/K/L); cross-references to all 9 spike scripts; 5 open questions flagged at end of draft for user decision.
+**Phase 2 (Methodology rewrite)**: §III v7 delivered at `paper/v4/paper_a_methodology_v4_section_iii.md` (`723a3f6`). Anchor-based ICCR framework + composition-decomposition finding; covers §III-G through §III-M.
 
-## Pending — Phase 2 user review (BEFORE Phase 3)
+**Phase 3 (Results regeneration)**: §IV v3.3 delivered at `paper/v4/paper_a_results_v4_section_iv.md` (`980295d`). 12 sub-sections A–L + §IV-M added; Table XV filled; Big-4 reframe + light §IV-K full-dataset robustness; round-23/24/25/27 codex corrections applied; §IV-D/E framing softened; §IV-I renamed.
 
-5 decisions needed from user before Phase 3 (Results regeneration) starts:
+**Phase 4 (Prose rewrite)**: Abstract + §I + §II (LOOO addition) + §V + §VI delivered at `paper/v4/paper_a_prose_v4_phase4.md`. Prose v3 (`b33e20d`) rewritten to match §III v7. Abstract trimmed to 243 words (`918d551`). Round-25/26/27 codex corrections applied.
 
-1. §III-G scope justification — three-point argument enough, or add a fourth?
-2. §III-H Firm A phrasing — "case study of templated end" vs an alternative framing?
-3. §III-J K=3 vs K=2 selection — lean on LOOO (current draft) or strengthen BIC argument?
-4. §III-L hybrid classifier — keep inherited 5-way box rule, or commit to K=3 hard label as primary?
-5. Section IV table numbering scheme — confirm before Phase 3 builds tables.
+**v4 methodological pivot** (recorded for context): Distributional path to thresholds (K=3 / dip / antimode) shown composition-driven and abandoned; replaced by anchor-based inter-CPA coincidence-rate (ICCR) calibration at three units (per-comparison / per-signature / per-document). "FAR" terminology replaced by "ICCR" throughout. K=3 demoted to descriptive firm-compositional partition. Positioning: specificity-proxy-anchored screening framework with human-in-the-loop review, **not** a validated forensic detector. Codex round-32 verdict: SOUND_WITH_QUALIFICATIONS, IEEE Access-publishable.
 
-Plus: any prose-level edits the user wants on the §III draft.
+## Phase 5 — AI peer review (in progress)
+
+**Codex (GPT-5.5) rounds 1–7 complete** on the v4 drafts. Round-7 verdict (2026-05-12): **Minor Revision**. All round-26 Major findings closed substantively; remaining blockers were packaging/copy-edit only.
+
+**Mechanical copy-edit pass applied 2026-05-14** (uncommitted on `paper-a-v4-big4`):
+- Replaced residual "candidate classifiers" wording with "candidate checks" in §V-G prose (line 107) and §III-K methodology (line 149 + table heading)
+- Added references [42] Stone 1974, [43] Geisser 1975, [44] Vehtari et al. 2017 to `paper/paper_a_references_v3.md` (now 44 entries)
+- Removed §II placeholder caveat sentence at Phase 4 prose line 67
+
+**Pending Phase 5 work**:
+1. Gemini 3.x Pro full-manuscript review on v4 drafts (round 1)
+2. Opus 4.7 max-effort full-manuscript review on v4 drafts (round 1)
+3. Round-2 cross-check across the three reviewers (address any new Major findings)
+4. Round-3 convergence — Accept/Minor consensus from ≥2 of 3 reviewers
+5. Manuscript-splice copy-edit (strip internal draft notes at line 3 of all three v4 files + Phase 4 close-out checklist at lines 153–162 + §IV close-out checklist at line 365+; update stale abstract-count note)
+
+## Pending — partner-side decision still open
+
+2026-05-13 partner alignment: partner wants high-specificity threshold and asked if firm heterogeneity could be framed as "statistically insignificant." Decision: **no** — heterogeneity is highly significant (40–62σ in logistic regression). v4 frames it explicitly as decisive firm heterogeneity. Confirm framing with partner before Phase 6.
 
 ## Blockers
 
-None.
-
-## Open questions deferred from spike
-
-- Bootstrap stability of cosine and dHash crossings *jointly* (not just marginally) — addressed in Phase 1 if time permits
-- K=2 vs K=3 final choice for §III-J — both reported, but operational classifier needs to commit to one (recommend K=2 for interpretability; K=3 in supplementary)
+None on the critical path. Phase 5 substantive empirical work is complete; remaining tasks are reviewer rounds + manuscript-splice copy-edit.
 
 ## Things to remember (per memory)
 
+- Inter-CPA "FAR" is NOT true FAR; it's a coincidence rate (ICCR) under an assumption violated by within-firm template sharing — never write "FAR" or "specificity" without the disclaimer ([[feedback-inter-cpa-negative-anchor-assumption]])
+- Dip test on Big-4 dh is composition + integer artefact, not mechanism — §III-I.1 "dip justifies finite mixture" framing must NOT be used; K=3 is descriptive of firm composition ([[feedback-dip-test-composition-artifact]])
 - Provenance-verify all empirical claims against fresh sqlite/grep ([[feedback-provenance-fabrication]])
-- Don't mock the DB or use placeholders — every number must trace to a script + query
-- Partner Jimmy already proposed Big-4 direction (this is execution, not pitching a new direction)
-- Paper C standalone is shelved — folded into v4.0 §IV-K
+- AI peer reviewers have accepted fabricated claims in the past; verify numbers against scripts, not against reviewer agreement ([[feedback-ai-review-provenance]])
+- Paper C standalone is shelved — folded into v4.0 §IV-K (Light full-dataset robustness)

paper/codex_review_gpt55_v4_round7.md

@@ -16,6 +16,8 @@ The remaining issues are packaging / copy-edit blockers, not empirical blockers:
 
 ## Round-26 finding closure table
 
+Note: the round-26 file contains 11 labelled Major rows and 15 labelled Minor rows; this table covers every labelled row. The prompt's 9 Major / 12 Minor tally appears to merge duplicate themes.
+
 ### Major findings
 
 | # | Round-26 finding | v2 status | Round-27 note |

paper/gemini_review_v4_round1.md

@@ -0,0 +1,75 @@
+# Paper A Phase 5 Round 1 — Gemini 3.1 Pro independent review
+
+Reviewer: Gemini 3.1 Pro
+Date: 2026-05-14
+Target: paper/v4/paper_a_prose_v4_phase4.md + paper/v4/paper_a_methodology_v4_section_iii.md + paper/v4/paper_a_results_v4_section_iv.md
+Prior reviewer artifact: paper/codex_review_gpt55_v4_round7.md (codex GPT-5.5, Minor Revision)
+
+## Verdict
+Minor Revision. I corroborate codex's overall conclusion of Minor Revision, as the central empirical narrative (inter-CPA coincidence-rate calibration, K=3 descriptive demotion, and composition decomposition) is robust and strongly supported by the methodology and results sections. However, I explicitly dissent from codex on several critical findings. Most importantly, codex missed that references [42]-[44] *are* already present in the reference list, and codex did not flag the partner's dangerous suggestion to frame firm heterogeneity as "statistically insignificant." These gaps are addressed below.
+
+## Codex round-7 closure cross-check
+
+| # | Spot-checked finding | Verdict | Evidence |
+|---|---|---|---|
+| 1 | Replace "candidate classifiers" with "candidate checks" | CLOSED | `paper_a_prose_v4_phase4.md` explicitly uses "candidate checks" (e.g., "all three candidate checks — the inherited box rule..."); `paper_a_methodology_v4_section_iii.md` §III-K.4 uses "candidate check's positive-anchor miss rate". |
+| 2 | §II LOOO paragraph with refs [42]-[44] | CLOSED | `paper_a_prose_v4_phase4.md` §II contains a fully drafted addition citing Stone [42], Geisser [43], and Vehtari et al. [44]. |
+| 3 | Restore inherited v3.20.0 limitations in §V-G | CLOSED | `paper_a_prose_v4_phase4.md` §V-G lists "The last five are inherited from v3.20.0 §V-G..." and explicitly covers ImageNet features, red-stamp HSV, longitudinal confounds, source-exemplar misattribution, and legal interpretation. |
+| 4 | Limit full-dataset claims to K=3 + Spearman re-run | CLOSED | `paper_a_prose_v4_phase4.md` §V-G clarifies that full-dataset claims are limited: "We did not perform the full per-signature pool-normalised ICCR analysis at the full n = 686 scope; the §IV-K full-dataset Spearman re-run shows the K=3 + box-rule rank-convergence is preserved". |
+
+## Major findings
+
+1. **[Partner Query / Framing Risk] "Statistically insignificant" firm heterogeneity framing is unsupported.** (Codex missed) The partner queried whether firm heterogeneity could be framed as "statistically insignificant." This is completely unsupported and must be explicitly rejected. In `paper_a_results_v4_section_iv.md` §IV-M.5 (Table XXIII) and `paper_a_methodology_v4_section_iii.md` §III-L.4, logistic regression odds ratios for Firms B/C/D versus Firm A are 0.053, 0.010, 0.027. This indicates that Firms B/C/D have 19x to 100x *lower* odds than Firm A of firing the HC hit indicator even after controlling for pool size. This is an order-of-magnitude difference and highly statistically/practically significant.
+2. **[Codex Disagree] Codex falsely claimed refs [42]-[44] were absent.** (Codex disagree) Codex's round-7 review claimed that references [42]-[44] remained placeholders and were absent from `paper_a_references_v3.md`. This is incorrect; the reference file contains these three citations at the end of the list. The only residual issue is the draft note in the phase 4 close-out section (line ~145) stating `[add citation]`, which simply needs to be deleted.
+3. **[Disclaimer Adequacy] Unsupervised limits effectively disclosed.** The text properly disclaims the limits of its unsupervised setting. The "FAR" to "ICCR" terminology replacement reflects the structural fact that inter-CPA collision acts as a specificity proxy, fully acknowledging the "within-firm template-like collision" caveat in §III-L.4.
+4. **[K=3 Demotion Language] Consistent descriptive framing.** The language properly frames the K=2 and K=3 mixtures as firm-compositional partitions rather than inferential evidence for discrete mechanisms, correctly demoting K=3's operational standing based on the dip-test decomposition.
+5. **[Feature-Derived Scores] Caveat phrasing.** §III-K.1 and §V-E clearly caveat the high Spearman correlations ($\rho \ge 0.879$) as "not statistically independent measurements" since they are deterministic functions of the same descriptor pair, successfully framing it as internal consistency rather than external validation.
+
+## Minor findings
+
+1. **[m1] Stale internal draft notes and checklists.** The Phase 4 prose (`paper_a_prose_v4_phase4.md`) still contains internal draft notes at the top and the "Notes for Phase 4 close-out" at the bottom. Section III and IV files also contain similar `internal — remove before submission` blocks. These must be stripped.
+2. **[m2] Table numbering clash (XV-B vs XIX).** In `paper_a_results_v4_section_iv.md` §IV-J, a note acknowledges Table XV-B might need to be renumbered to Table XIX depending on journal style. This should be finalized to ensure sequential integer numbering (preferring Table XIX to avoid "B" suffixes).
+3. **[m3] Word count note.** The abstract word count note in the close-out checklist should be removed, as the abstract is independently verified at 243 words, satisfying the $\le 250$ requirement.
+
+## Provenance spot-checks
+
+1. **Spearman $\rho \ge 0.879$ floor.**
+   - *Claim Text:* "Three feature-derived scores agree on the per-CPA descriptor-position ranking at Spearman $\rho \ge 0.879$"
+   - *Location:* `paper_a_prose_v4_phase4.md` (Abstract & §V-E) and `paper_a_methodology_v4_section_iii.md` (§III-K.1).
+   - *Cited Script:* Script 38.
+   - *Verdict:* VERIFIED.
+2. **Firm A per-doc HC+MC alarm 0.62.**
+   - *Claim Text:* "Firm A's per-document HC+MC alarm rate is 0.62 versus 0.09–0.16 at Firms B/C/D"
+   - *Location:* `paper_a_prose_v4_phase4.md` (Abstract & §V-C).
+   - *Cited Script:* Script 45.
+   - *Verdict:* VERIFIED.
+3. **145/8/107/2 byte-identical split.**
+   - *Claim Text:* "262 byte-identical signatures in the Big-4 subset (Firm A 145, Firm B 8, Firm C 107, Firm D 2)"
+   - *Location:* `paper_a_methodology_v4_section_iii.md` (§III-K.4).
+   - *Cited Script:* Script 40.
+   - *Verdict:* VERIFIED.
+4. **Dip test $p_{\text{median}} = 0.35$ under joint centring + jitter.**
+   - *Claim Text:* "Once both confounds are removed (firm-mean centring plus uniform integer jitter), the Big-4 pooled dHash dip test yields $p_{\text{median}} = 0.35$"
+   - *Location:* `paper_a_methodology_v4_section_iii.md` (§III-I.4).
+   - *Cited Script:* Script 39e.
+   - *Verdict:* VERIFIED.
+5. **Logistic OR 0.053 / 0.010 / 0.027.**
+   - *Claim Text:* "logistic regression... yields odds ratios of 0.053 (Firm B), 0.010 (Firm C), and 0.027 (Firm D)"
+   - *Location:* `paper_a_methodology_v4_section_iii.md` (§III-L.4) and `paper_a_results_v4_section_iv.md` (Table XXIII).
+   - *Cited Script:* Script 44.
+   - *Verdict:* VERIFIED.
+
+## Newly introduced issues
+
+1. **Sample size nuance between text and tables:** §IV-J Table XV correctly sums to 150,442 signatures across Firms A-D, consistent with the descriptor-complete count. However, the vector-complete count of 150,453 used in the ICCR analyses (§III-L.2) could confuse readers comparing numbers across tables. A small footnote in Table XV directing readers back to the sample-size reconciliation in §III-G is recommended.
+
+## Phase 5 readiness
+
+Partial. The technical framing is solid and the methodological pivot is successfully integrated. Phase 5 readiness requires stripping the remaining internal draft notes and firmly rejecting any attempt to describe firm heterogeneity as "statistically insignificant."
+
+## Recommended next-step actions
+
+1. **[Empirical Blocker]** Explicitly reject the "statistically insignificant" framing of firm heterogeneity. The odds ratios derived from Script 44 confirm a massive, statistically significant difference between Firm A and Firms B/C/D.
+2. **[Copy-Edit Blocker]** Strip all internal draft notes, metadata tags, and the Phase 4 and Phase 3 close-out checklists from the prose, methodology, and results files.
+3. **[Copy-Edit Blocker]** Finalize Table XV-B's numbering (to Table XIX) to comply with sequential integer numbering formats typically preferred by IEEE Access.
+4. **[Copy-Edit Blocker]** Remove the `[add citation]` placeholder string in the notes; references [42]-[44] are fully integrated and listed in `paper_a_references_v3.md`.

paper/opus_review_v4_round1.md

@@ -0,0 +1,235 @@
+# Paper A Phase 5 Round 1 — Opus 4.7 max-effort independent review
+
+Reviewer: Claude Opus 4.7
+Date: 2026-05-14
+Target: paper/v4/paper_a_prose_v4_phase4.md + paper/v4/paper_a_methodology_v4_section_iii.md + paper/v4/paper_a_results_v4_section_iv.md
+Prior reviewer artifacts: paper/codex_review_gpt55_v4_round7.md (codex, Minor Revision); paper/gemini_review_v4_round1.md (Gemini 3.1 Pro, Minor Revision)
+
+## Verdict
+
+**Minor Revision (corroborates codex + Gemini on overall disposition), but I dissent on readiness.** The central empirical narrative — anchor-based multi-level ICCR calibration, the composition-decomposition demolition of distributional thresholds, the K=3-as-firm-compositional demotion, and the disclosed unsupervised-validation ceiling — is methodologically sound and survives my spot-checks. However, my independent pass surfaces three substantive blockers that both prior reviewers missed: (1) the headline "98–100% of inter-CPA collisions concentrated within the source firm" claim, repeated verbatim in the Abstract, §I contribution 6, §V-C, §V-G limitation 2, and §VI conclusion item 4, is **factually wrong for the deployed any-pair rule** at three of the four firms (Firms B/C/D within-firm rates are 77%/84%/77%, not 98–100%; the 98–100% range applies only to the stricter same-pair joint event); (2) §IV retains the demoted mechanism labels ("hand-leaning / mixed / replicated" in Table XVI columns, "hand-leaning rate" in Tables IX, X, XVII, XVIII, and prose at lines 102, 215, 226, 232, 254) that §III-J line 90 explicitly says are "replaced"; (3) §V has two sub-sections labelled "G" (line 105 "Pixel-Identity ..." and line 109 "Limitations"). I therefore corroborate Minor Revision on the empirical core but treat these three findings as additional copy-edit-or-rewrite blockers that must close before Phase 5 splice — finding (1) verges on empirical depending on whether the author chooses to rewrite or restrict scope.
+
+## Cross-reviewer agreement matrix
+
+| Theme | codex round-7 | Gemini round-1 | Opus round-1 |
+|---|---|---|---|
+| Overall disposition | Minor Revision | Minor Revision | Minor Revision |
+| Refs [42]-[44] present in `paper_a_references_v3.md` | Missed — claimed they were placeholders | Caught codex error | **Agree with Gemini.** Refs are at lines 87–91 of `paper/paper_a_references_v3.md` |
+| Partner "statistically insignificant" framing risk | Not flagged | Flagged as Major | **Agree with Gemini.** OR magnitudes 0.05/0.01/0.03 are decisive heterogeneity, not absence-of-effect |
+| Table XV-B → XIX renumbering | Not flagged | Flagged as Minor | **Agree with Gemini AND extend:** renumbering cascades — see Major M2 below |
+| Sample-size 150,442 vs 150,453 | Not flagged | Flagged as newly-introduced issue | **Partial agree:** the §IV-J line 177 footnote already reconciles this inline; the missing piece is a Table XV cross-pointer to §III-G |
+| Internal draft notes / checklists | Flagged | Flagged | **Agree.** Three draft-note blocks remain (Phase 4 prose, §III v7, §IV v3.3) plus three close-out checklists |
+| Three-score "feature-derived" caveat coverage | Closed | Closed | **Partial dissent.** Caveat is present at Abstract / §I / §III-K / §V-E, BUT §IV Tables IX/X/XVII/XVIII reintroduce mechanistic "hand-leaning" framing without the §III-K caveat |
+| K=3 demotion language consistency | Closed | Closed (line 25 says "Consistent descriptive framing") | **Dissent.** See Major M1 — §IV retains mechanistic labels throughout |
+| Cross-firm collision concentration "98–100%" | Closed implicitly | Verified VERIFIED in §IV-M.5 / §III-L.4 spot-check, but did not check whether prose claim matches the any-pair table | **Strong dissent.** See Major M3 |
+| Duplicate §V-G heading | Not flagged | Not flagged | **Both missed.** See Major M4 |
+
+## Major findings
+
+1. **§IV retains "hand-leaning / mixed / replicated" mechanism labels that §III-J line 90 explicitly demotes (both missed).**
+
+   - *Issue.* §III-I.4 establishes that the descriptor distributions contain no within-population bimodality; §III-J line 90 states: "The 'descriptive position' column **replaces** v3.x's 'hand-leaning / mixed / replicated' mechanism labels." §V-D, §I item 7, and §VI item 5 propagate the descriptive framing. **§IV does not.**
+   - *Where.*
+     - `paper_a_results_v4_section_iv.md` line 219 (Table XVI column headers): `C1 (hand-leaning) | C2 (mixed) | C3 (replicated)` — verbatim mechanism labels
+     - line 85 (Table IX): "K=3 P(C1) vs Paper A box-rule **hand-leaning** rate"
+     - line 86 (Table IX): "Reverse-anchor cosine percentile vs Paper A box-rule **hand-leaning** rate"
+     - line 93 (Table X): "mean Paper A **hand-leaning** rate"
+     - line 100: "more **hand-leaning** relative to the non-Big-4 reference"
+     - line 102: "the most-**hand-leaning** end of Big-4"; "more **hand-leaning**"; "ranks Firm D fractionally above Firm C"
+     - line 147 (Table XIV column): "Misclassified as **hand-leaning**"
+     - line 215 (§IV-J): "the per-CPA **hand-leaning** ranking"
+     - line 226 (Table XVI reading): "C3 **replicated** component"; "highest **hand-leaning** concentration of the Big-4"
+     - line 232 (§IV-K): "Paper A operational **hand-leaning** rate"
+     - line 238 (Table XVII): "C1 **hand-leaning**" / "C3 **replicated**"
+     - line 244 (Table XVIII title): "Paper A operational **hand-leaning** rate"
+     - line 246 (Table XVIII): "P(C1) vs Paper A **hand-leaning** rate"
+     - line 254 (§IV-K reading): "more non-templated CPAs"; "more mid/small-firm **hand-leaning** CPAs"
+   - *Reasoning.* §III-K explicitly renames Score 3 to "**inherited binary high-confidence box rule rate**" / "less-replication-dominated rate" (lines 119, 129), and §V-E uses "less-replication-dominated rate" (line 97). The §IV body silently retains v3.x mechanistic naming. A reader reaching §IV after §III-J's demotion will perceive that §IV has reverted to causal/mechanistic K=3 framing. This is the exact regression the v4 pivot is supposed to prevent.
+   - *Fix.* Global s/hand-leaning/less-replication-dominated/ in §IV; rename Table XVI columns to `C1 (low-cos / high-dHash)` / `C2 (central)` / `C3 (high-cos / low-dHash)` matching the §III-J Table 8 "descriptive position" column; rename Table XVII C1/C3 row labels and Table XVIII row labels likewise; rewrite the §IV-K Reading prose to use descriptor-position language ("CPAs whose descriptor mean sits further from the templated end of the descriptor plane").
+   - *Tag.* **Both missed.**
+
+2. **Table-numbering cascade if XV-B → XIX is finalised (Gemini missed the cascade; codex did not flag).**
+
+   - *Issue.* Gemini correctly recommended renumbering Table XV-B → Table XIX. But the §IV-M tables (§IV-M.1 through §IV-M.6) currently occupy Tables XIX, XX, XXI, XXII, XXIII, XXIV, XXV. Bumping XV-B → XIX forces a cascade renumber of all seven §IV-M tables to XX–XXVI. There is no acknowledgement of this cascade in either §IV-J close-out item 2 (line 370) or in Gemini's recommendation. Without addressing the cascade, fixing XV-B alone produces a duplicate Table XIX in the manuscript.
+   - *Where.* `paper_a_results_v4_section_iv.md` lines 192 (XV-B), 266 (XIX), 280 (XX), 300 (XXI), 317 (XXII), 329 (XXIII), 340 (XXIV), 353 (XXV).
+   - *Reasoning.* Sequential integer numbering is the IEEE Access norm. Either Table XV-B stays (and §IV-M tables stay XIX–XXV) or the rename cascades.
+   - *Fix.* If XV-B → XIX is preferred, also renumber §IV-M tables XIX→XX, XX→XXI, ..., XXV→XXVI; update all in-text references (§III provenance table at line 387 onward; §IV-J line 188 and 217 referencing "Table XVI"; §I and §V cross-references). Run a manuscript-wide grep on "Table XVI"…"Table XXVI" after the renumbering to catch stale internal pointers.
+   - *Tag.* **Gemini missed (cascade implication); codex missed entirely.**
+
+3. **The "98–100% of inter-CPA collisions concentrated within the source firm" claim is factually wrong for the deployed any-pair rule at three of four firms (both missed).**
+
+   - *Issue.* The Abstract (line 11), §I item 6 (line 53), §V-C (line 87), §V-G limitation 2 (line 115), and §VI conclusion item 4 (line 147) report "98–100% of inter-CPA collisions concentrated within the source firm". This range applies only to the **same-pair joint event** (a single inter-CPA candidate satisfying both cos>0.95 AND dHash≤5), which is the **stricter alternative** classifier explicitly contrasted to the deployed any-pair rule in §III-L.0 (line 183) and §III-L.4 (line 281).
+   - *Verification.* §IV-M Table XXIV (line 342) reports any-pair cross-firm hit counts. Computing within-firm fractions from Table XXIV:
+     - Firm A: 14,447 / 14,622 = 98.8%
+     - Firm B: 371 / 484 = 76.7%
+     - Firm C: 149 / 178 = 83.7%
+     - Firm D: 106 / 137 = 77.4%
+     - **Any-pair within-firm range: [76.7%, 98.8%]**, not [98%, 100%]. The 98–100% range corresponds to the same-pair rates (99.96/97.7/98.2/97.0%) stated separately at §III-L.4 line 281 and §IV-M.5 line 349.
+   - *Reasoning.* §III-L.0 makes a careful any-pair vs same-pair distinction and emphasises the deployed rule is **any-pair**. The Abstract / §I / §VI summarise the within-firm concentration using the same-pair number while attributing it to the deployed rule. §V-C line 87 is even worse: "98–100% of inter-CPA collisions originate from candidates within the source firm, **regardless of which Big-4 firm is the source**" — explicitly asserting the strong claim across all four firms, contradicted by Firms B/C/D any-pair rates of 77/84/77%.
+   - *Fix options.*
+     - **Option A (preferred):** Restate as "98% within-firm at Firm A, 77–84% at Firms B/C/D for the deployed any-pair rule; 97–100% within-firm under the stricter same-pair joint event across all four firms" in Abstract / §I / §V / §VI. This preserves the headline finding (within-firm dominance) while accurately characterising the gap between any-pair and same-pair.
+     - **Option B:** If the manuscript prefers the cleaner same-pair number, every occurrence must be re-attributed to "the same-pair joint event under the stricter alternative classifier (§III-L.4)", not to "the deployed rule" / "inter-CPA collisions". The current Abstract / §I framing ties the number to "inter-CPA collisions" without qualifier, which reads as applying to the deployed rule.
+   - *Severity.* This is the headline forensic finding in the Abstract and §I. Mis-stating it across five locations is more than a copy-edit — partners and reviewers form their understanding of "what the paper shows" from the Abstract.
+   - *Tag.* **Both missed.** Gemini's provenance spot-check #3 verified the byte-identical split (145/8/107/2) but did not verify whether the 98–100% claim in the Abstract matches the deployed-rule numbers in Table XXIV.
+
+4. **Duplicate §V-G heading (both missed).**
+
+   - *Issue.* `paper_a_prose_v4_phase4.md` has two §V-G headings: line 105 "G. Pixel-Identity as a Hard Positive Anchor; Inherited Inter-CPA Negative Anchor Reframed as Coincidence Rate" and line 109 "G. Limitations". The second should be "H. Limitations".
+   - *Where.* `paper_a_prose_v4_phase4.md` lines 105, 109. Also: line 37 (§I) cross-references "§V-G" for the conservative-subset caveat — ambiguous given two G sections; the content actually lives in BOTH (line 105 has "we caution that this result is necessary but not sufficient: for the box rule it is close to tautological", and line 119 has the "Pixel-identity is a conservative subset" bullet).
+   - *Reasoning.* §V originally went A through F in the v3 draft. The Phase 4 prose added a new §V-G ("Pixel-Identity ...") between §V-F and the existing §V-G Limitations without renaming the latter. Both prior reviewers spot-checked §V-G Limitations content for completeness (codex M9, Gemini codex-closure check #3) and confirmed the inherited v3.20.0 limitations are restored — but neither noticed the duplicate letter.
+   - *Fix.* Rename the second to §V-H ("H. Limitations"). Update every internal §V-G cross-reference: line 37, line 111 ("inherited from v3.20.0 §V-G"), line 160 (close-out checklist), and any §III or §IV pointer.
+   - *Tag.* **Both missed.**
+
+5. **Stale "seven limitations" assertion in close-out checklist (both missed).**
+
+   - *Issue.* Phase 4 close-out item 4 (line 160) says "The seven limitations are listed flat". Actual count in the §V-G Limitations section is **14** (9 v4.0-specific + 5 inherited from v3.20.0). §V-G line 111 correctly says "The first nine are v4.0-specific; the last five are inherited". The checklist item is stale from a previous version where the v4.0-specific count was 2.
+   - *Fix.* Either update to "The fourteen limitations are listed flat" or remove the checklist on Phase 5 splice (already on Gemini's list under m1 and codex's list under A8).
+   - *Tag.* **Both missed (a small instance of the broader internal-notes cleanup).**
+
+6. **§I contribution 4 and §IV-D both refer to a "2×2 factorial diagnostic" but only §IV-M Table XIX summarises it; §IV-D's body does not reproduce the 2×2 factorial table from §III-I.4 (codex implicitly covered; Gemini partly covered).**
+
+   - *Issue.* §IV-D line 23 says "the v4-new composition-decomposition diagnostics that establish this finding are tabulated in §IV-M below". The reader expects to find the §III-I.4 factorial table (4 rows: raw / centred-only / jittered-only / both) reproduced in §IV-M. But §IV-M Table XIX only summarises three of the four rows (collapses the "centred-only" and "jittered-only" cells into descriptive prose) and omits the "raw" baseline row's $p$-value comparison. Readers comparing §III-I.4 line 67 to §IV-M Table XIX will see a partial reproduction.
+   - *Severity.* Cosmetic — the same content is in §III-I.4 in full. But the §IV reader is implicitly told §IV-M is the destination for the §III-I.4 evidence, and §IV-M is not as complete as §III-I.4.
+   - *Fix.* Either reproduce the full 4-row 2×2 factorial table in §IV-M (currently Table XIX), or change §IV-D line 23 to "see §III-I.4 Table for the full factorial; §IV-M Table XIX summarises the key diagnostic outcomes".
+   - *Tag.* Both implicitly missed.
+
+7. **Inconsistent precision in three-score Spearman across §III-K and §IV-F (Gemini implicitly missed).**
+
+   - *Issue.* §III-K Table at line 125–127 reports three-score pairwise Spearman as +0.963, +0.889, +0.879 (3 decimal places). §IV-F Table IX at lines 85–87 reports the same correlations as +0.9627, +0.8890, +0.8794 (4 decimal places). §III provenance table line 365 uses 3 decimals.
+   - *Severity.* Low — the values are consistent at 3-dp rounding. But mixed precision across §III table / §IV table / Abstract is a copy-edit signal.
+   - *Fix.* Standardise on 4 decimal places everywhere (the §IV precision matches Script 38's output more faithfully) and update §III-K Table + §III provenance row + the Phase 4 abstract / §I body to match. Alternatively, standardise on the lower-bound floor "ρ ≥ 0.879" that the Abstract uses.
+   - *Tag.* Both missed (low priority).
+
+## Minor findings
+
+1. **Stale "approximately 235 words" / "243-244 words" abstract counts in two checklists.** Phase 4 close-out item 1 (line 157) says "Current draft is 243–244 words"; codex round-7 verified `wc -w` returns 243. Both are within the IEEE Access 250-word budget. Just remove the abstract-word-count notes before splice. (Gemini m3.)
+
+2. **Three "internal — remove before submission" draft notes still present.** Phase 4 line 3, §III v7 line 3 (lines 1–5), §IV v3.3 line 3. Plus two close-out checklists (§IV lines 365–375, Phase 4 lines 153–162) and §III's cross-reference index (lines 431–448). All flagged by codex (A8) and Gemini (m1). I corroborate.
+
+3. **§IV-J Table XV-B header pointer.** §IV-J line 228 "Document-level worst-case aggregation outputs are reported in Table XV-B above." — fine prose but does not specify which table number is the document-level table when XV-B → XIX renumber occurs. Once Major M2 is resolved, update accordingly.
+
+4. **Mixed pp vs decimal vs percentage notation across Abstract / §I / §III-L / §IV-M for the same numerical claims.** Examples:
+   - Abstract line 11 uses "0.34 for the operational HC+MC alarm"
+   - §I line 33 uses "33.75% of Big-4 documents"
+   - §III-L.3 Table reports "0.3375 [Wilson 95% [0.3342, 0.3409]]"
+   - §IV-M Table XXII reports "0.3375"
+   - Phase 4 conclusion line 147 uses "(0.34 for the operational HC+MC alarm)"
+   - Standardise on either decimal or percentage throughout numeric quotations; the lossy "0.34" in the Abstract drops the 95% CI which is reported elsewhere. The IEEE Access norm in this corpus is decimal-with-CI in tables, percentage-without-CI in prose summary.
+
+5. **"v3.x §IV-F.1" cross-reference is not validated against the v3 file's actual section letter.** §III-H line 37 and §V-C line 85 both cite "v3.x §IV-F.1" for the 145 pixel-identical signatures across ~50 distinct Firm A partners. If `paper_a_results_v3.md` uses a different sub-section letter (e.g., §IV-G or §IV-F-1), the citation will be stale at splice time. I did not verify this but flag it as a splice-time check.
+
+6. **"~50 distinct partners of 180" vs §III-H "50 distinct Firm A partners of 180 registered" — Firm A registered partner count of 180 is inherited from v3.20.0 / Script 28 with no in-paper provenance verification.** This is flagged in §III-H line 37 ("inherited from v3 §IV-F.1 / Script 28 / Appendix B byte-decomposition output and were not regenerated in v4.0 spike scripts") — adequately disclosed. Just confirm at splice that v3.20.0's count of 180 is reproducible.
+
+7. **§I.5 contribution 5 line 51 claim "We adopt 'inter-CPA coincidence rate' as the metric name throughout and reserve 'False Acceptance Rate' for terminology that requires ground-truth negative labels".** §IV-I line 159 prose uses "False Acceptance Rate (FAR)" in the historical-context phrase "previously reported as 'False Acceptance Rate' in v3.x" — this is intentional historical reference, but it does mean "FAR" appears once in §IV body, which contradicts the §I claim of "throughout". Either weaken §I.5 to "throughout v4.0 framing, with one historical-reference exception in §IV-I" or strip "FAR" from §IV-I line 159 and reword to "previously reported using biometric-verification 'False Acceptance Rate' terminology".
+
+8. **MC band per-firm proportions in §IV-J line 215.** "10.76% / 35.88% / 41.44% / 29.33% across Firms A through D". Cross-checking against Table XV per-firm breakdown line 183–186: Firm A MC = 10.76%, Firm B MC = 35.88%, Firm C MC = 41.44%, Firm D MC = 29.33%. Consistent ✓.
+
+9. **§V-G limitation 1 list says "first nine are v4.0-specific" but Phase 4 close-out item 4 calls them "seven limitations".** Already covered under Major M5.
+
+10. **Provenance-table cross-references inside the §III provenance table.** Line 364: "K=3 LOOO held-out C1 absolute differences 1.8–12.8 pp | direct | Script 37 held-out prediction check". Cross-checked against §IV-G Table XIII (line 134–137): the four held-out absolute differences are 4.68, 1.76, 12.77, 5.81 → range 1.76 to 12.77, which rounds to "1.8–12.8" ✓.
+
+11. **Abstract line 11 phrasing "98–100% of inter-CPA collisions concentrated within the source firm — consistent with firm-level template-like reuse"** —  this is the most-public statement of Major M3. The Abstract is the only thing many readers will read; the imprecision is more costly here than in §V-G.
+
+## Provenance spot-checks
+
+I deliberately chose 5 claims NOT covered by Gemini's spot-checks.
+
+1. **Within-source-firm any-pair collision rates (the "98–100%" claim).**
+   - *Claim text.* "with $98$–$100\%$ of inter-CPA collisions concentrated within the source firm" (Abstract line 11, §I line 53, §V-C line 87, §V-G line 115, §VI line 147).
+   - *Manuscript location of evidence.* Table XXIV in §IV-M.5 (line 342); §III-L.4 cross-firm hit matrix (line 274–281).
+   - *Cited script.* Script 44.
+   - *Verdict.* **INCONSISTENT.** Computed from Table XXIV: any-pair within-firm fractions are 98.8% / 76.7% / 83.7% / 77.4% (range 76.7–98.8%, not 98–100%). The 98–100% range corresponds to the same-pair joint event explicitly reported as the **stricter alternative** at §III-L.4 line 281 and Table XXIV line 349 (99.96% / 97.7% / 98.2% / 97.0%). The narrative-level claim conflates two distinct rule semantics. The script logic (44_firm_matched_pool_regression.py lines 274–327) does compute both matrices; the manuscript reports both correctly inside §III-L.4 / §IV-M.5; the failure is in the Abstract / §I / §V-C / §V-G / §VI narrative-summary layer. See Major M3.
+
+2. **Per-pair conditional ICCR dHash≤5 given cos>0.95 = 0.234 (Wilson [0.190, 0.285], 70 of 299 pairs).**
+   - *Claim text.* §III-L.1 line 208; Phase 4 §V-F line 103.
+   - *Cited script.* Script 40b.
+   - *Verdict.* **VERIFIED for logic; numerical value not independently verifiable from worktree.** Script 40b at lines 22–23 explicitly computes "Conditional FAR(dh<=k | cos>0.95)" for k∈[0, 20] and prints "P(dh<=k | cos>0.95)" for each k (lines 226–229 of the script). The 0.234 / 70 / 299 numbers cannot be checked without access to `/Volumes/NV2/PDF-Processing/signature-analysis/reports/v4_big4/inter_cpa_far_sweep/` (not in the worktree). Wilson [0.190, 0.285] is a plausible 95% CI for $\hat{p} = 70/299 = 0.2341$ (manual check: SE ≈ $\sqrt{0.234 \cdot 0.766/299} = 0.0245$, normal-approx 95% CI [0.186, 0.282] — Wilson CIs are slightly wider on each side, so [0.190, 0.285] is consistent). Logic + analytic plausibility verified.
+
+3. **Pooled Big-4 per-signature any-pair ICCR 0.1102 with Wilson [0.1086, 0.1118].**
+   - *Claim text.* §III-L.2 Table at line 220; Phase 4 §V-F line 101.
+   - *Cited script.* Script 43.
+   - *Verdict.* **VERIFIED analytically.** For $\hat{p} = 0.1102$ on $n_{\text{sig}} = 150{,}453$, the Wilson-approximate 95% CI half-width is $\approx 1.96 \cdot \sqrt{0.1102 \cdot 0.8898 / 150453} = 0.00159$, giving [0.1086, 0.1118] — exactly the reported interval. CPA-block bootstrap [0.0908, 0.1330] is much wider, as expected once CPA-level clustering is recognised (CIs widen by factor of $\sim 9\times$ here), consistent with the strong within-CPA correlation that the manuscript discusses.
+
+4. **Logistic OR pool-size effect = 4.01.**
+   - *Claim text.* §III-L.4 Table line 266; §IV-M.5 Table XXIII line 336.
+   - *Cited script.* Script 44.
+   - *Verdict.* **VERIFIED for logic; magnitude is intuitive.** Script 44 at lines 219–227 fits `logistic(hit) ~ intercept + FirmB + FirmC + FirmD + log(pool_size_centered)` and reports `OR = exp(beta)`. A 4× per-log-unit pool-size effect means each $e\times$ pool-size increase quadruples the per-signature odds — consistent with the §III-L.2 decile trend (decile 1 = 0.0249, decile 10 = 0.1905, ratio 7.65×, pool ratio approximately $1115/201 \approx 5.5$, log-ratio $\approx 1.71$, predicted OR $\approx 4.01^{1.71} = 10.7$ vs observed 0.1905/0.0249 = 7.65; the gap is small enough to be consistent with monotonicity + finite-sample). No red flag.
+
+5. **Alert-rate sensitivity local-gradient ratios (cos=0.95: ≈25×; dHash=5: ≈3.8×; dHash=15: ≈0.08).**
+   - *Claim text.* §III-L.5 line 291; §IV-M.6 Table XXV line 357–359.
+   - *Cited script.* Script 46.
+   - *Verdict.* **PARTIALLY VERIFIABLE.** Script 46 at lines 236–276 explicitly computes the local-to-median gradient ratio at the v3-inherited threshold (cos=0.95 and dh=5) and emits `ratio_local_to_median` for both. **However**, the script does NOT emit a dh=15 ratio: `DH_GRID = np.arange(0, 21, 1)` covers 15 (so the swept rates ARE available in the saved JSON), but the script only computes the ratio at dh=5. The ≈0.08 ratio at dh=15 in Table XXV must therefore be a **derived quantity** computed by the author from the JSON output post-hoc, not a direct script output. This is not a fabrication risk (the author has access to the swept rates), but the manuscript should either (a) add a brief in-paper note that the dh=15 ratio is computed identically to the dh=5 ratio but post-hoc on the JSON, or (b) extend Script 46's plateau-detection block to emit ratios at both dh=5 and dh=15.
+
+   *Secondary note.* The cosine sweep prose at §III-L.5 line 291 quotes "cosine sweep at dHash ≤ 5 yields rates of 0.5091 at cos > 0.945 vs 0.4789 at cos > 0.955". From Script 46 line 56–57: `COS_FOR_2D = np.arange(0.85, 1.00, 0.01)` only covers integer hundredths, so 0.945 and 0.955 are NOT on the 2D grid. The 1D `COS_GRID` covers the sweep at which 0.945 / 0.955 may be in the grid; I cannot fully verify without seeing the saved JSON. The numerical specificity is suspiciously precise (four decimals on a derived rate) — flag for partner spot-check at splice.
+
+## Newly introduced issues
+
+1. **The "specificity-proxy-anchored screening framework with human-in-the-loop review" positioning is consistent across Abstract / §I / §III-M / §V-G / §VI — except that the term "human-in-the-loop" appears NOWHERE in §III or §IV, only in §I line 30 (item 5), §III-L.3 line 255, §III-M line 334, and §VI line 147.** §I item 5 promises "anchor-based threshold calibration at three units of analysis ... against an inter-CPA negative-anchor coincidence-rate proxy", and §III-M closes with "positioning as a specificity-proxy-anchored screening framework with human-in-the-loop review". But §IV's results discussion never operationalises what "human-in-the-loop review" means: the per-document HC+MC alarm rate of 0.34 is reported as a number; whether the human reviewer triages all 34% of flagged docs or only a sub-set is not specified. Newly introduced v4-positional claim that v3.20.0 did not make, lacking a concrete operationalisation. Either explicitly punt to future work or describe the intended triage workflow briefly in §V or §VI.
+
+2. **The "feature-derived" qualifier coverage IS reliable across §III-K, §V-E, Abstract, §I, §VI — but breaks down in §IV.** Major M1 above. Newly introduced in v4 because v3.20.0 used "three independent scores" without the caveat; v4 added the caveat in §III/§V/§I/§VI but not §IV.
+
+3. **The "9-tool nine-diagnostic" validation collection (§III-M Table at lines 318–329) and §VI item 8 nine-tool claim — count is internally consistent (9 rows in the §III-M table), but the table is currently unnumbered.** All other tables in §III/§IV have a Table N: header. The §III-M validation table should be Table XXVI (or whatever number after the §IV-M cascade) for IEEE Access. Otherwise it is an unnumbered table inside a discussion of "Table-numbering scheme" elsewhere — inconsistent.
+
+4. **The §I cross-reference list at line 29 ("(1) signature page identification...; (2) signature region detection...; ... (8) a multi-tool unsupervised validation strategy") promises 8 pipeline steps in numbered order, but the actual pipeline order in §III is steps 1–5 are the embedding pipeline and 6–8 are validation framework / decomposition / framework positioning, not strict pipeline stages.** Cosmetic; the v3.20.0 contribution list had 7 sequential pipeline-stages; the v4.0 list collapses pipeline + validation into 8 items, blurring stage vs framework. Either say "Eight elements" rather than imply 8 pipeline steps, or split into "Pipeline (1–4): ...; Calibration and validation framework (5–8): ...".
+
+## Disagreements with prior reviewers
+
+1. **I disagree with codex round-7 M6 (closed) "§II citation-number gap and placeholder contradiction."** codex round-7 says "[42]-[44] remain placeholders and absent from the reference list." Gemini correctly identified that codex was wrong: [42]–[44] **are** present at lines 87–91 of `paper_a_references_v3.md`. I corroborate Gemini's correction. The only residual is the `[add citation]` placeholder string in Phase 4 close-out note line 159 (just a stale comment in a checklist that will be stripped at splice). codex's claim was based on the file ending at [41] in some earlier snapshot; the current file ends at [44].
+
+2. **I partially disagree with Gemini's finding #4 "K=3 Demotion Language Consistency" (verdict: "CLOSED. Consistent descriptive framing.").** §III, §I, §V, §VI properly demote K=3, but §IV (which Gemini did not separately enumerate for this check) retains mechanism labels throughout (Major M1 above). The K=3 demotion is **partially closed**, not fully closed.
+
+3. **I corroborate Gemini's finding #1 on "statistically insignificant" framing risk** (Major in Gemini's review, missed by codex). The OR magnitudes are 0.05/0.01/0.03 — these are 19×/100×/37× effects after pool-size adjustment, with standard errors that the manuscript flags as needing cluster-robust treatment but which are nonetheless an order of magnitude below 1. There is no defensible reading under which this is "statistically insignificant"; any such partner framing must be rejected.
+
+4. **Neither codex nor Gemini examined the cross-firm hit matrix arithmetic** to verify that the Abstract's "98–100%" claim is consistent with Table XXIV. Major M3 is my net-new finding.
+
+5. **Neither codex nor Gemini flagged the duplicate §V-G heading.** Major M4 is my net-new finding.
+
+6. **Neither codex nor Gemini flagged the §IV vs §III terminology drift around "hand-leaning / replicated".** Major M1 is my net-new finding.
+
+7. **codex M1 (Abstract independent-score correction closed) — I corroborate the closure for the Abstract** (line 11 says "Three feature-derived scores"), but extend the finding: the same correction is NOT propagated to §IV Tables IX/X/XVII/XVIII where the "Paper A box-rule hand-leaning rate" label retains mechanistic framing. This is Major M1 again.
+
+## Phase 5 readiness
+
+**Partial — closer to "blocked on copy-edit pass" than to "ready".** Three major issues require manuscript-text rewrites before Phase 5 splice:
+
+- **Empirical-language blocker:** Major M3 (98–100% within-firm claim) requires Abstract / §I / §V-C / §V-G / §VI prose rewrite. This is more than copy-edit — the headline finding's numerical scope must be reconciled with Table XXIV.
+- **Terminology blocker:** Major M1 (§IV mechanism labels) requires global s/hand-leaning/less-replication-dominated/ across §IV tables and prose plus Table XVI column-header rename.
+- **Structural blocker:** Major M4 (duplicate §V-G heading) requires §V renumber.
+- **Numbering blocker:** Major M2 (table-numbering cascade) requires either keeping XV-B suffix or cascading XIX→XX→...→XXVI across §IV-M and updating every cross-reference.
+
+The empirical core (scripts 32–46, ICCR multi-level calibration, composition decomposition, three-score convergence, byte-identical anchor, logistic regression) is sound and reproducible from script inspection. No new statistical work is required for Phase 5.
+
+## Recommended next-step actions
+
+Ranked by severity, distinguishing prose-rewrite blockers from copy-edit-only items.
+
+1. **[Manuscript rewrite — prose blocker]** Reconcile the "98–100% within-firm" claim with Table XXIV. Adopt Major M3 Option A or Option B in Abstract / §I item 6 / §V-C / §V-G limitation 2 / §VI item 4. Preferred phrasing (Option A): "98% of inter-CPA collisions at Firm A and 77–84% at Firms B/C/D under the deployed any-pair rule, rising to 97–100% across all four firms under the stricter same-pair joint event".
+
+2. **[Manuscript rewrite — terminology blocker]** Global s/hand-leaning/less-replication-dominated/ across §IV (Table IX/X column labels, Table XIV column, Table XVI columns, Table XVII rows, Table XVIII title, §IV-J/K/M prose). Rename Table XVI columns to match §IV-E Table VIII's "descriptive position" column. Keep §I, §V, §VI as currently worded.
+
+3. **[Manuscript rewrite — structural blocker]** Rename §V's second "G. Limitations" to "H. Limitations". Update every §V-G cross-reference.
+
+4. **[Manuscript rewrite — partner framing]** Explicitly state at §V-C or §V-G that firm heterogeneity is highly statistically significant (OR magnitudes 19×, 100×, 37× after pool-size adjustment with $z$-equivalent ≥ 10 in absolute value on standard SE; cluster-robust SE is flagged as a robustness check, not as the reason heterogeneity might be insignificant). Reject any reframing as "statistically insignificant". (Gemini Major #1.)
+
+5. **[Copy-edit blocker — table renumbering]** Decide on the XV-B suffix. If renamed to XIX, cascade through §IV-M XIX→XX, XX→XXI, …, XXV→XXVI. Update §III provenance table cross-references. Update §IV-J line 188 / 217 / 228 references. Update §IV-L line 258 to disambiguate from v3.20.0 Table XVIII.
+
+6. **[Copy-edit blocker — strip internal artefacts]** Remove:
+   - Phase 4 prose draft note (line 3) and close-out checklist (lines 153–162)
+   - §III v7 draft note (lines 1–5) and cross-reference index + open-questions block (lines 431–448)
+   - §IV v3.3 draft note (line 3) and close-out checklist (lines 365–375)
+
+7. **[Copy-edit — terminology consistency]** Decide on decimal vs percentage notation for the headline ICCRs (0.34 vs 33.75% etc.) and apply uniformly across Abstract / §I / §V / §VI.
+
+8. **[Copy-edit — Spearman precision]** Standardise three-score correlations on either 3-dp (0.963/0.889/0.879) or 4-dp (0.9627/0.8890/0.8794) across §III-K / §IV-F / §III provenance.
+
+9. **[Copy-edit — §III-M validation table]** Assign a table number (Table XXVI after the §IV-M cascade) to the nine-tool validation table at §III-M lines 318–329.
+
+10. **[Copy-edit — §V-G item count]** Update Phase 4 close-out item 4 "seven limitations" to "fourteen limitations" (or strip the checklist).
+
+11. **[Splice-time check]** Verify v3.20.0 §IV-F.1 cross-reference letters resolve correctly when §III-H / §V-C are spliced into the master file. Verify v3.20.0 Table XVIII (backbone ablation) does not collide with v4 Table XVIII (Spearman drift) once the final renumbering is applied. Verify all "v3.x" pointers point to actual sections that survive in the master manuscript.
+
+12. **[Minor — script 46 dh=15 ratio]** Either add a brief note in §IV-M that the dh=15 plateau ratio is computed post-hoc from the swept JSON (the swept rates themselves are emitted by Script 46), or extend Script 46 to compute the ratio at dh=15 directly.
+
+13. **[Minor — pipeline-step vs framework-element framing]** Reword §I line 29's "(1)…(8)" enumeration to distinguish pipeline stages (1–4) from validation/framework elements (5–8).
+
+14. **[Minor — human-in-the-loop operationalisation]** Add one sentence in §V or §VI describing what "human-in-the-loop review" means operationally (e.g., manual inspection of the 0.34 flagged-document fraction; sampling strategy; reviewer-effort estimate).

paper/paper_a_references_v3.md

@@ -84,4 +84,10 @@
 
 [41] H. White, "Maximum likelihood estimation of misspecified models," *Econometrica*, vol. 50, no. 1, pp. 1–25, 1982.
 
-<!-- Total: 41 references (v2: 36 + 5 new statistical methods refs) -->
+[42] M. Stone, "Cross-validatory choice and assessment of statistical predictions," *J. R. Statist. Soc. B*, vol. 36, no. 2, pp. 111–147, 1974.
+
+[43] S. Geisser, "The predictive sample reuse method with applications," *J. Amer. Statist. Assoc.*, vol. 70, no. 350, pp. 320–328, 1975.
+
+[44] A. Vehtari, A. Gelman, and J. Gabry, "Practical Bayesian model evaluation using leave-one-out cross-validation and WAIC," *Stat. Comput.*, vol. 27, no. 5, pp. 1413–1432, 2017.
+
+<!-- Total: 44 references (v3: 41 + 3 new LOOO refs for v4 §II addition) -->

paper/v4/paper_a_methodology_v4_section_iii.md

@@ -96,7 +96,7 @@ $\text{BIC}(K{=}3) = -1111.93$, lower than $K{=}2$ by $3.48$ (mild numerical pre
 - Firm C: $23.5\%$ C1, $75.5\%$ C2, $1.0\%$ C3
 - Firm D: $11.5\%$ C1, $\sim 84\%$ C2, $\sim 4.5\%$ C3
 
-Firm A accounts for $141$ of the $143$ C3-assigned CPAs; Firm C accounts for $24$ of the $40$ C1-assigned CPAs. The K=3 partition is therefore well-described as a firm-compositional decomposition: C3 is essentially "Firm A and any non-Firm-A CPA whose mean descriptors happen to land in the high-cos / low-dHash corner"; C1 is essentially "non-Firm-A CPAs whose mean descriptors land in the low-cos / high-dHash corner." The composition contrast that K=3 captures at the accountant level reappears at the deployment level in the cross-firm hit matrix of §III-L.4 (Script 44): nearly all (98%) of the inter-CPA-anchor hits for a Firm A source signature have a Firm A candidate, and the same within-firm concentration holds for Firms B, C, D individually. The K=3 partition and the cross-firm hit matrix therefore describe the same underlying firm-compositional structure at two different units of analysis.
+Firm A accounts for $141$ of the $143$ C3-assigned CPAs; Firm C accounts for $24$ of the $40$ C1-assigned CPAs. The K=3 partition is therefore well-described as a firm-compositional decomposition: C3 is essentially "Firm A and any non-Firm-A CPA whose mean descriptors happen to land in the high-cos / low-dHash corner"; C1 is essentially "non-Firm-A CPAs whose mean descriptors land in the low-cos / high-dHash corner." The composition contrast that K=3 captures at the accountant level reappears at the deployment level in the cross-firm hit matrix of §III-L.4 (Script 44): under the deployed any-pair rule, within-firm collision concentration is $98.8\%$ at Firm A and $76.7$–$83.7\%$ at Firms B/C/D (the stricter same-pair joint event saturates at $97.0$–$99.96\%$ within-firm across all four firms). The K=3 partition and the cross-firm hit matrix therefore describe the same underlying firm-compositional structure at two different units of analysis.
 
 **Leave-one-firm-out stability (Scripts 36, 37).** Leave-one-firm-out cross-validation shows that K=2 is unstable across folds: holding Firm A out gives a fold rule cos $> 0.938$ AND dHash $\leq 8.79$, while holding any single non-Firm-A Big-4 firm out gives a fold rule near cos $> 0.975$ AND dHash $\leq 3.76$ (Script 36). The maximum absolute deviation of the four fold cosine crossings from their across-fold mean is $0.028$ (the corresponding pairwise across-fold range is $0.0376$, from $0.9380$ for the held-out-Firm-A fold to $0.9756$ for the held-out-Firm-D fold; Script 36 stability summary). The $0.028$ value is $5.6\times$ the report's $0.005$ across-fold stability tolerance. K=3 in contrast has a *reproducible component shape*: across the four folds the C1 cosine mean varies by at most $0.005$, the C1 dHash mean by at most $0.96$, and the C1 weight by at most $0.023$ (Script 37). K=3 hard-posterior membership for the held-out firm is composition-sensitive — for Firm C the held-out C1 rate is $36.3\%$ vs the full-Big-4 baseline of $23.5\%$, an absolute difference of $12.8$ pp; for Firm A the held-out C1 rate is $4.7\%$ vs baseline $0.0\%$; the report's own legend classifies this pattern as `P2_PARTIAL` ("the C1 cluster exists but membership is not well-predicted by the held-out fit"). We accordingly do not use K=3 hard-posterior membership as an operational label.
 
@@ -146,9 +146,9 @@ The Script 39 report verdict is `SIG_CONVERGENCE_MODERATE`. The $\kappa = 0.870$
 
 **4. Positive-anchor miss rate on byte-identical signatures (Script 40).** The corpus provides one hard ground-truth subset: signatures whose nearest same-CPA match is byte-identical after crop and normalisation. Independent hand-signing cannot produce pixel-identical images, so byte-identical signatures are conservative-subset ground truth for the *replicated* class. The Big-4 byte-identical subset comprises $n = 262$ signatures ($145 / 8 / 107 / 2$ across Firms A through D; Script 40).
 
-We report each candidate classifier's *positive-anchor miss rate* — the fraction of byte-identical signatures classified as belonging to the less-replication-dominated descriptor positions. This is a one-sided check against a conservative positive subset, **not a paired specificity metric in the usual two-class sense**; we do not report a paired negative-anchor metric here because no signature-level hand-signed ground truth exists. The corresponding signature-level inter-CPA negative-anchor ICCR evidence is developed in §III-L.1 (Big-4 sample) and the v3.x §IV-I corpus-wide version (reported under prior "FAR" terminology):
+We report each candidate check's *positive-anchor miss rate* — the fraction of byte-identical signatures classified as belonging to the less-replication-dominated descriptor positions. This is a one-sided check against a conservative positive subset, **not a paired specificity metric in the usual two-class sense**; we do not report a paired negative-anchor metric here because no signature-level hand-signed ground truth exists. The corresponding signature-level inter-CPA negative-anchor ICCR evidence is developed in §III-L.1 (Big-4 sample) and the v3.x §IV-I corpus-wide version (reported under prior "FAR" terminology):
 
-| Candidate classifier | Pixel-identity miss rate (Wilson 95% CI) |
+| Candidate check | Pixel-identity miss rate (Wilson 95% CI) |
 |---|---|
 | Inherited Paper A binary high-confidence box rule (cos $> 0.95$ AND dHash $\leq 5$) | $0\%$ $[0\%, 1.45\%]$ |
 | K=3 per-CPA hard label (C3 high-cos / low-dHash corner; descriptive only) | $0\%$ $[0\%, 1.45\%]$ |
@@ -280,9 +280,9 @@ The per-decile per-firm breakdown (Script 44) confirms the pattern: within every
 
 For the same-pair joint event (a single candidate satisfying both $\text{cos} > 0.95$ and $\text{dHash} \leq 5$), the candidate firm is even more strongly concentrated within the source firm: Firm A source $\to$ Firm A candidate in $11{,}314$ of $11{,}319$ same-pair hits ($99.96\%$); Firm B source $\to$ Firm B candidate in $85$ of $87$ ($97.7\%$); Firm C source $\to$ Firm C candidate in $54$ of $55$ ($98.2\%$); Firm D source $\to$ Firm D candidate in $64$ of $66$ ($97.0\%$).
 
-**Interpretation.** The cross-firm hit matrix shows that nearly all inter-CPA collisions under the deployed rule originate from candidates within the source firm (different CPA, same firm). This pattern is consistent with — but not by itself diagnostic of — firm-specific template, stamp, or document-production reuse: within-firm scanning workflows, common form templates, and shared report-generation infrastructure could produce visually similar signature crops across different CPAs within the same firm. The byte-level evidence of v3.x §IV-F.1 (Firm A's $145$ pixel-identical signatures across $\sim 50$ distinct certifying partners) provides direct evidence that firm-level template reuse does occur at Firm A; the broader inter-CPA collision pattern in §III-L.4 is consistent with that mechanism extending in milder form to Firms B/C/D. We report this as "inter-CPA collision concentration is within-firm" — a descriptive observation about deployed-rule behaviour — and refrain from inferring that the within-firm hits constitute deliberate or systematic template sharing.
+**Interpretation.** Under the deployed any-pair rule, the within-firm collision concentration is $98.8\%$ at Firm A and $76.7$–$83.7\%$ at Firms B/C/D — Firm A's pattern is markedly more within-firm-concentrated than the other three firms', though every Big-4 firm still has more than three quarters of its any-pair collisions falling on candidates within the same firm. The stricter same-pair joint event — a single candidate satisfying both cos $> 0.95$ and dHash $\leq 5$ — saturates at $97.0$–$99.96\%$ within-firm across all four firms. This pattern is consistent with — but not by itself diagnostic of — firm-specific template, stamp, or document-production reuse: within-firm scanning workflows, common form templates, and shared report-generation infrastructure could produce visually similar signature crops across different CPAs within the same firm. The byte-level evidence of v3.x §IV-F.1 (Firm A's $145$ pixel-identical signatures across $\sim 50$ distinct certifying partners) provides direct evidence that firm-level template reuse does occur at Firm A; the broader inter-CPA collision pattern in §III-L.4 is consistent with that mechanism extending in milder form to Firms B/C/D. We report this as "inter-CPA collision concentration is within-firm" — a descriptive observation about deployed-rule behaviour — and refrain from inferring that the within-firm hits constitute deliberate or systematic template sharing.
 
-This connects back to §III-J: the K=3 firm-composition contrast at the accountant level (Firm A dominating C3; Firm C dominating C1) reappears at the deployment level in the cross-firm hit matrix, where nearly all collisions are within-firm. The K=3 partition and the cross-firm hit matrix describe the same underlying firm-compositional structure at two different units of analysis.
+This connects back to §III-J: the K=3 firm-composition contrast at the accountant level (Firm A dominating C3; Firm C dominating C1) reappears at the deployment level in the cross-firm hit matrix, where the within-firm collision concentration is the dominant pattern at all four Big-4 firms — most strongly at Firm A ($98.8\%$ any-pair, $99.96\%$ same-pair) and at materially lower but still majority levels at Firms B/C/D ($76.7$–$83.7\%$ any-pair; $97.0$–$98.2\%$ same-pair). The K=3 partition and the cross-firm hit matrix describe the same underlying firm-compositional structure at two different units of analysis.
 
 ### L.5. Alert-rate sensitivity around inherited thresholds (Script 46)
 

paper/v4/paper_a_prose_v4_phase4.md

@@ -8,7 +8,7 @@
 
 > *IEEE Access target: <= 250 words, single paragraph.*
 
-Regulations require Certified Public Accountants (CPAs) to attest each audit report with a signature, but digitization makes reusing a stored signature image across reports — through administrative stamping or firm-level electronic signing — technically trivial and visually invisible, undermining individualized attestation. We build an end-to-end pipeline detecting such *non-hand-signed* signatures at scale: a Vision-Language Model identifies signature pages, YOLOv11 localizes signatures, ResNet-50 supplies deep features, and a dual-descriptor layer combines cosine similarity with an independent-minimum perceptual hash (dHash) to separate *style consistency* from *image reproduction*. Applied to 90,282 Taiwan audit reports (2013–2023), the pipeline yields 182,328 signatures from 758 CPAs; primary analyses are scoped to the Big-4 sub-corpus (437 CPAs; 150,442 signatures). Distributional diagnostics show that the apparent multimodality of the descriptor distribution dissolves under joint firm-mean centring and integer-tie jitter ($p$ rises to $0.35$), so no within-population bimodal antimode anchors the operational thresholds. We instead adopt an anchor-based inter-CPA coincidence-rate (ICCR) calibration at three units: per-comparison ($0.0006$ at cos$>0.95$; $0.0013$ at dHash$\leq 5$; $0.00014$ jointly), pool-normalised per-signature ($0.11$ under the deployed any-pair high-confidence rule), and per-document ($0.34$ for the operational HC+MC alarm). Firm heterogeneity is decisive: Firm A's per-document HC+MC alarm rate is $0.62$ versus $0.09$–$0.16$ at Firms B/C/D after pool-size adjustment, with $98$–$100\%$ of inter-CPA collisions concentrated within the source firm — consistent with firm-level template-like reuse. We position the system as a specificity-proxy-anchored screening framework with human-in-the-loop review, not as a validated forensic detector; no calibrated error rates are reportable without signature-level ground truth.
+Regulations require Certified Public Accountants (CPAs) to attest each audit report with a signature, but digitization makes reusing a stored signature image across reports — through administrative stamping or firm-level electronic signing — technically trivial and visually invisible, undermining individualized attestation. We build an end-to-end pipeline detecting such *non-hand-signed* signatures at scale: a Vision-Language Model identifies signature pages, YOLOv11 localizes signatures, ResNet-50 supplies deep features, and a dual-descriptor layer combines cosine similarity with an independent-minimum perceptual hash (dHash) to separate *style consistency* from *image reproduction*. Applied to 90,282 Taiwan audit reports (2013–2023), the pipeline yields 182,328 signatures from 758 CPAs; primary analyses are scoped to the Big-4 sub-corpus (437 CPAs; 150,442 signatures). Distributional diagnostics show that the apparent multimodality of the descriptor distribution dissolves under joint firm-mean centring and integer-tie jitter ($p$ rises to $0.35$), so no within-population bimodal antimode anchors the operational thresholds. We instead adopt an anchor-based inter-CPA coincidence-rate (ICCR) calibration at three units: per-comparison ($0.0006$ at cos$>0.95$; $0.0013$ at dHash$\leq 5$; $0.00014$ jointly), pool-normalised per-signature ($0.11$ under the deployed any-pair high-confidence rule), and per-document ($0.34$ for the operational HC+MC alarm). Firm heterogeneity is decisive: Firm A's per-document HC+MC alarm rate is $0.62$ versus $0.09$–$0.16$ at Firms B/C/D after pool-size adjustment, and under the deployed any-pair rule between $77\%$ and $99\%$ of inter-CPA collisions concentrate within the source firm (Firm A $98.8\%$; Firms B/C/D $76.7$–$83.7\%$) — consistent with firm-level template-like reuse. We position the system as a specificity-proxy-anchored screening framework with human-in-the-loop review, not as a validated forensic detector; no calibrated error rates are reportable without signature-level ground truth.
 
 ---
 
@@ -32,7 +32,7 @@ The methodological reframing relative to earlier versions of this work is centra
 
 In place of distributional anchoring, v4.0 adopts an anchor-based inter-CPA coincidence-rate (ICCR) calibration. At the per-comparison unit, the inherited cos$>0.95$ operating point yields ICCR $= 0.00060$ on a $5 \times 10^5$-pair Big-4 sample (replicating v3.x's reported per-comparison rate of $0.0005$ under prior "FAR" terminology); the dHash$\leq 5$ structural cutoff yields ICCR $= 0.00129$ (v4 new); the joint rule cos$>0.95$ AND dHash$\leq 5$ yields joint ICCR $= 0.00014$ (any-pair semantics, matching the deployed extrema rule). At the pool-normalised per-signature unit, the same rule's effective coincidence rate is materially higher because the deployed classifier takes max-cosine and min-dHash over a same-CPA pool: pooled Big-4 any-pair ICCR is $0.1102$ (Wilson 95% CI $[0.1086, 0.1118]$; CPA-block bootstrap 95% $[0.0908, 0.1330]$). At the per-document unit, the operational HC$+$MC alarm fires on $33.75\%$ of Big-4 documents under the inter-CPA candidate-pool counterfactual.
 
-The pooled per-signature and per-document rates conceal striking firm heterogeneity. A logistic regression of the per-signature hit indicator on firm dummies (Firm A reference) and centred log pool size yields odds ratios of $0.053$ (Firm B), $0.010$ (Firm C), and $0.027$ (Firm D) — Firms B/C/D are an order of magnitude below Firm A even after controlling for the pool-size confound (Script 44). Cross-firm hit matrix analysis shows that $98$–$100\%$ of inter-CPA collisions originate from candidates within the source firm (different CPA, same firm), consistent with firm-specific template, stamp, or document-production reuse mechanisms — though not by itself diagnostic of deliberate sharing. We retain the inherited Paper A v3.x five-way box rule as the operational classifier; v4.0's contribution is to characterise its multi-level coincidence behaviour against the inter-CPA negative anchor rather than to derive new thresholds.
+The pooled per-signature and per-document rates conceal striking firm heterogeneity. A logistic regression of the per-signature hit indicator on firm dummies (Firm A reference) and centred log pool size yields odds ratios of $0.053$ (Firm B), $0.010$ (Firm C), and $0.027$ (Firm D) — Firms B/C/D are an order of magnitude below Firm A even after controlling for the pool-size confound (Script 44). Cross-firm hit matrix analysis under the deployed any-pair rule shows within-firm collision concentrations of $98.8\%$ at Firm A and $76.7$–$83.7\%$ at Firms B/C/D (Table XXV; the stricter same-pair joint event saturates at $97.0$–$99.96\%$ within-firm across all four firms). The pattern is consistent with firm-specific template, stamp, or document-production reuse mechanisms — though not by itself diagnostic of deliberate sharing. We retain the inherited Paper A v3.x five-way box rule as the operational classifier; v4.0's contribution is to characterise its multi-level coincidence behaviour against the inter-CPA negative anchor rather than to derive new thresholds.
 
 Three feature-derived scores converge on the per-CPA descriptor-position ranking with Spearman $\rho \geq 0.879$ (Script 38): the K=3 mixture posterior (now interpreted as a firm-compositional position score, not a mechanism cluster posterior; §III-J), a reverse-anchor cosine percentile relative to a strictly-out-of-target non-Big-4 reference, and the inherited box-rule less-replication-dominated rate. The three scores are deterministic functions of the same per-CPA descriptor pair, so the convergence is documented as internal consistency among feature-derived ranks rather than external validation. Hard ground truth for the *replicated* class is provided by 262 byte-identical signatures in the Big-4 subset (Firm A 145, Firm B 8, Firm C 107, Firm D 2), against which all three candidate checks achieve $0\%$ positive-anchor miss rate (Wilson 95% upper bound $1.45\%$). For the box rule this result is close to tautological at byte-identity; we discuss the conservative-subset caveat in §V-G.
 
@@ -50,7 +50,7 @@ The contributions of this paper are:
 
 5. **Anchor-based multi-level inter-CPA coincidence-rate calibration.** We characterise the deployed five-way classifier at three units of analysis: per-comparison ICCR (cos$>0.95$: $0.0006$; dHash$\leq 5$: $0.0013$; joint: $0.00014$), pool-normalised per-signature ICCR ($0.11$ for the deployed any-pair high-confidence rule), and per-document ICCR ($0.34$ for the operational HC$+$MC alarm). We adopt "inter-CPA coincidence rate" as the metric name throughout and reserve "False Acceptance Rate" for terminology that requires ground-truth negative labels, which the corpus does not provide.
 
-6. **Firm heterogeneity quantification and within-firm cross-CPA collision concentration.** Per-firm rates differ by an order of magnitude after pool-size adjustment (Firm A's per-document HC$+$MC alarm at $0.62$ versus Firms B/C/D at $0.09$–$0.16$). Cross-firm hit matrix analysis shows that $98$–$100\%$ of inter-CPA collisions originate from candidates within the source firm, consistent with firm-specific template, stamp, or document-production reuse mechanisms — a descriptive finding about deployed-rule behaviour, not a claim of deliberate template sharing.
+6. **Firm heterogeneity quantification and within-firm cross-CPA collision concentration.** Per-firm rates differ by an order of magnitude after pool-size adjustment (Firm A's per-document HC$+$MC alarm at $0.62$ versus Firms B/C/D at $0.09$–$0.16$). Cross-firm hit matrix analysis shows within-firm collision concentrations of $98.8\%$ at Firm A and $76.7$–$83.7\%$ at Firms B/C/D under the deployed any-pair rule (the stricter same-pair joint event saturates at $97.0$–$99.96\%$ within-firm across all four firms); the pattern is consistent with firm-specific template, stamp, or document-production reuse mechanisms — a descriptive finding about deployed-rule behaviour, not a claim of deliberate template sharing.
 
 7. **K=3 as descriptive firm-compositional partition; three-score convergent internal consistency.** We fit a K=3 Gaussian mixture as a descriptive partition of the Big-4 accountant-level distribution (no longer interpreted as three mechanism clusters). Three feature-derived scores agree on the per-CPA descriptor-position ranking at Spearman $\rho \geq 0.879$; we report this as internal consistency rather than external validation, given that the scores share the underlying descriptor pair.
 
@@ -64,7 +64,7 @@ The remainder of the paper is organized as follows. Section II reviews related w
 
 > *Note for the Phase 4 review pass: §II is inherited substantively unchanged from v3.20.0 §II in the master manuscript, with one new paragraph added below. The unchanged content is not reproduced in this Phase 4 file; readers reviewing this draft should consult `paper/paper_a_related_work_v3.md` for the v3.20.0 §II text covering offline signature verification, near-duplicate detection, copy-move forgery detection, perceptual hashing, deep-feature similarity, and the statistical methods adopted (Hartigan dip test, finite mixture EM, Burgstahler-Dichev / McCrary density-smoothness diagnostic). The paragraph below is the only v4.0-specific §II addition.*
 
-**Addition for v4.0: leave-one-firm-out cross-validation in a small-cluster scope.** Cross-validation methodology in the leave-one-out tradition has been developed extensively in statistics since Stone [42] and Geisser [43], and modern surveys including Vehtari et al. [44] discuss its application to mixture models. In document-forensics calibration the technique has been used selectively, typically with the individual document or signature as the hold-out unit. Our application in §III-K differs in two respects from the standard usage: (i) the hold-out unit is the *firm* (not the individual CPA or signature), so the analysis directly probes cross-firm reproducibility of the fitted mixture rather than within-firm sampling variance; and (ii) the held-out predictions are interpreted as a *composition-sensitivity band* on the candidate mixture boundary, not as a sufficiency claim for the inherited five-way operational classifier (which is calibrated separately; §III-L). We treat LOOO drift as descriptive information about how the mixture characterisation moves when training composition changes, not as a pass/fail test for the operational classifier. Numerical references [42]–[44] are placeholders in this draft and will be replaced with the project's preferred references at copy-edit time.
+**Addition for v4.0: leave-one-firm-out cross-validation in a small-cluster scope.** Cross-validation methodology in the leave-one-out tradition has been developed extensively in statistics since Stone [42] and Geisser [43], and modern surveys including Vehtari et al. [44] discuss its application to mixture models. In document-forensics calibration the technique has been used selectively, typically with the individual document or signature as the hold-out unit. Our application in §III-K differs in two respects from the standard usage: (i) the hold-out unit is the *firm* (not the individual CPA or signature), so the analysis directly probes cross-firm reproducibility of the fitted mixture rather than within-firm sampling variance; and (ii) the held-out predictions are interpreted as a *composition-sensitivity band* on the candidate mixture boundary, not as a sufficiency claim for the inherited five-way operational classifier (which is calibrated separately; §III-L). We treat LOOO drift as descriptive information about how the mixture characterisation moves when training composition changes, not as a pass/fail test for the operational classifier.
 
 ---
 
@@ -84,7 +84,7 @@ The Big-4 accountant-level descriptor distribution does reject unimodality on bo
 
 Firm A is empirically the firm whose CPAs are most concentrated in the high-cosine, low-dHash corner of the Big-4 descriptor plane. In the Big-4 K=3 hard-posterior assignment (now interpreted as a firm-compositional position assignment; §III-J), Firm A accounts for $0\%$ of C1 (low-cos / high-dHash position) and $82.5\%$ of C3 (high-cos / low-dHash position); the opposite pattern holds at Firm C, which has the highest C1 concentration at $23.5\%$. Firm A also accounts for 145 of the 262 byte-identical signatures in the Big-4 byte-identical anchor of §IV-H (with Firm B 8, Firm C 107, Firm D 2). The additional v3.x finding that the 145 Firm A pixel-identical signatures span 50 distinct Firm A partners (of 180 registered), with 35 byte-identical matches across different fiscal years, is inherited from v3.20.0 §IV-F.1 / Script 28 / Appendix B byte-decomposition output and was not regenerated in v4.0's spike scripts; we retain those numbers by reference.
 
-In v4.0 we treat Firm A as a *templated-end case study* rather than as the calibration anchor for the operational threshold. Firm A enters the Big-4 anchor-based ICCR calibration on equal footing with the other three Big-4 firms (§III-L). The cross-firm hit matrix of §III-L.4 strengthens this framing: $98$–$100\%$ of inter-CPA collisions originate from candidates within the source firm, regardless of which Big-4 firm is the source. Firm A's high per-document HC$+$MC alarm rate of $0.62$ (versus Firms B/C/D's $0.09$–$0.16$) reflects high inter-CPA collision concentration under the deployed rule on real same-CPA pools, consistent with firm-specific template, stamp, or document-production reuse — though the inter-CPA-anchor analysis alone is not diagnostic of deliberate template sharing. The byte-level evidence of v3.x §IV-F.1 (Firm A's 145 pixel-identical signatures across $\sim 50$ distinct partners) provides direct evidence that firm-level template reuse does occur at Firm A; the within-firm collision pattern at all four Big-4 firms is consistent with that mechanism extending in milder form to Firms B/C/D.
+In v4.0 we treat Firm A as a *templated-end case study* rather than as the calibration anchor for the operational threshold. Firm A enters the Big-4 anchor-based ICCR calibration on equal footing with the other three Big-4 firms (§III-L). The cross-firm hit matrix of §III-L.4 strengthens this framing: under the deployed any-pair rule, within-firm collision concentration is $98.8\%$ at Firm A and $76.7$–$83.7\%$ at Firms B/C/D (the stricter same-pair joint event saturates at $97.0$–$99.96\%$ within-firm across all four firms). Firm A's high per-document HC$+$MC alarm rate of $0.62$ (versus Firms B/C/D's $0.09$–$0.16$) reflects high inter-CPA collision concentration under the deployed rule on real same-CPA pools, consistent with firm-specific template, stamp, or document-production reuse — though the inter-CPA-anchor analysis alone is not diagnostic of deliberate template sharing. The byte-level evidence of v3.x §IV-F.1 (Firm A's 145 pixel-identical signatures across $\sim 50$ distinct partners) provides direct evidence that firm-level template reuse does occur at Firm A; the within-firm collision pattern at all four Big-4 firms is consistent with that mechanism extending in milder form to Firms B/C/D.
 
 ## D. K=2 / K=3 as Descriptive Firm-Compositional Partitions
 
@@ -104,15 +104,15 @@ Two additional findings refine the calibration story. First, the per-pair condit
 
 ## G. Pixel-Identity as a Hard Positive Anchor; Inherited Inter-CPA Negative Anchor Reframed as Coincidence Rate
 
-The only hard ground-truth subset in the corpus is pixel-identical signatures: those whose nearest same-CPA match is byte-identical after crop and normalisation. Independent hand-signing cannot produce byte-identical images, so these signatures are conservative-subset ground truth for the *replicated* class. On the Big-4 subset ($n = 262$ pixel-identical signatures), all three candidate classifiers — the inherited box rule, the K=3 hard label, and the reverse-anchor metric with a prevalence-calibrated cut — achieve $0\%$ positive-anchor miss rate (Wilson 95% upper bound $1.45\%$). We caution that this result is necessary but not sufficient: for the box rule it is close to tautological, because byte-identical neighbours have cosine $\approx 1$ and dHash $\approx 0$, well inside the rule's high-confidence region. The corresponding signature-level *negative* anchor evidence is developed in §III-L.1 above (v4 spike: cos$>0.95$ per-comparison ICCR $= 0.00060$, replicating v3.20.0's reported $0.0005$ under prior "FAR" terminology). We frame the per-comparison rate as a specificity proxy under the assumption that inter-CPA pairs constitute a clean negative anchor, and we document in §III-L.4 that this assumption is partially violated by within-firm cross-CPA template-like collision structures.
+The only hard ground-truth subset in the corpus is pixel-identical signatures: those whose nearest same-CPA match is byte-identical after crop and normalisation. Independent hand-signing cannot produce byte-identical images, so these signatures are conservative-subset ground truth for the *replicated* class. On the Big-4 subset ($n = 262$ pixel-identical signatures), all three candidate checks — the inherited box rule, the K=3 hard label, and the reverse-anchor metric with a prevalence-calibrated cut — achieve $0\%$ positive-anchor miss rate (Wilson 95% upper bound $1.45\%$). We caution that this result is necessary but not sufficient: for the box rule it is close to tautological, because byte-identical neighbours have cosine $\approx 1$ and dHash $\approx 0$, well inside the rule's high-confidence region. The corresponding signature-level *negative* anchor evidence is developed in §III-L.1 above (v4 spike: cos$>0.95$ per-comparison ICCR $= 0.00060$, replicating v3.20.0's reported $0.0005$ under prior "FAR" terminology). We frame the per-comparison rate as a specificity proxy under the assumption that inter-CPA pairs constitute a clean negative anchor, and we document in §III-L.4 that this assumption is partially violated by within-firm cross-CPA template-like collision structures.
 
-## G. Limitations
+## H. Limitations
 
 Several limitations should be transparent. The first nine are v4.0-specific; the last five are inherited from v3.20.0 §V-G and still apply to the v4.0 pipeline.
 
 *No signature-level ground truth; no true error rates reportable.* The corpus does not contain labelled hand-signed or replicated classes at the signature level. We therefore cannot report False Rejection Rate, sensitivity, recall, Equal Error Rate, ROC-AUC, precision, or positive predictive value against ground truth. All quantitative rates reported in §III-L are inter-CPA negative-anchor coincidence rates (ICCRs) under the assumption that inter-CPA pairs constitute a clean negative anchor; this is a specificity proxy, not a calibrated specificity (§III-M).
 
-*Inter-CPA negative-anchor assumption is partially violated.* The cross-firm hit matrix of §III-L.4 shows that $98$–$100\%$ of inter-CPA collisions under the deployed rule originate from candidates within the source firm, consistent with firm-specific template, stamp, or document-production reuse. The inter-CPA-as-negative assumption is therefore not exactly satisfied — some inter-CPA pairs may share firm-level templates rather than being independent random matches. Our reported per-comparison ICCRs are best read as specificity-proxy rates under a partially-violated assumption, not as calibrated FARs.
+*Inter-CPA negative-anchor assumption is partially violated.* The cross-firm hit matrix of §III-L.4 shows that under the deployed any-pair rule, within-firm collision concentration is $98.8\%$ at Firm A and $76.7$–$83.7\%$ at Firms B/C/D (the stricter same-pair joint event saturates at $97.0$–$99.96\%$ within-firm across all four firms), consistent with firm-specific template, stamp, or document-production reuse. The inter-CPA-as-negative assumption is therefore not exactly satisfied — some inter-CPA pairs may share firm-level templates rather than being independent random matches. Our reported per-comparison ICCRs are best read as specificity-proxy rates under a partially-violated assumption, not as calibrated FARs.
 
 *Scope.* The v4.0 primary analyses are scoped to the Big-4 sub-corpus. We did not perform the full per-signature pool-normalised ICCR analysis at the full $n = 686$ scope; the §IV-K full-dataset Spearman re-run shows the K=3 $+$ box-rule rank-convergence is preserved at $n = 686$ but does not validate the Big-4 operational ICCRs, the LOOO firm-fold structure, or the five-way operational classifier at the broader scope.
 
@@ -144,9 +144,9 @@ Several limitations should be transparent. The first nine are v4.0-specific; the
 
 We present a fully automated pipeline for detecting non-hand-signed CPA signatures in Taiwan-listed financial audit reports and a multi-tool framework for characterising and disclosing its operational behaviour at the Big-4 sub-corpus scope. The pipeline processes raw PDFs through VLM-based page identification, YOLO-based signature detection, ResNet-50 feature extraction, and dual-descriptor (cosine + independent-minimum dHash) similarity computation. The operational output is an inherited Paper A five-way per-signature classifier with worst-case document-level aggregation (§III-L). Applied to 90,282 audit reports filed between 2013 and 2023, the pipeline extracts 182,328 signatures from 758 CPAs, with the Big-4 sub-corpus (437 CPAs at accountant level; 150,442–150,453 signatures at signature level) as the primary analytical population.
 
-Our central methodological contributions are: (1) a composition decomposition (Scripts 39b–39e) that establishes the absence of a within-population bimodal antimode in the Big-4 descriptor distribution: the apparent multimodality dissolves under joint firm-mean centring and integer-tie jitter ($p_{\text{median}} = 0.35$), so distributional "natural-threshold" framings of the inherited operating points are not empirically supported; (2) an anchor-based inter-CPA coincidence-rate (ICCR) calibration at three units of analysis — per-comparison ($0.0006$ at cos$>0.95$; $0.0013$ at dHash$\leq 5$; $0.00014$ jointly), pool-normalised per-signature ($0.11$ for the deployed any-pair HC rule), and per-document ($0.34$ for the operational HC$+$MC alarm) — with explicit terminological replacement of "FAR" by "ICCR" given the unsupervised setting; (3) firm heterogeneity quantification: logistic regression with pool-size adjustment gives odds ratios $0.053$, $0.010$, $0.027$ for Firms B/C/D relative to Firm A reference, indicating a large multiplicative effect that pool-size differences do not explain; (4) cross-firm hit matrix evidence that $98$–$100\%$ of inter-CPA collisions under the deployed rule originate from candidates within the source firm, consistent with firm-specific template, stamp, or document-production reuse mechanisms; (5) K=3 mixture demoted from "three mechanism clusters" to a descriptive firm-compositional partition; (6) three feature-derived scores converging on the per-CPA descriptor-position ranking at Spearman $\rho \geq 0.879$, reported as internal consistency rather than external validation; (7) $0\%$ positive-anchor miss rate on 262 byte-identical Big-4 signatures with the conservative-subset caveat; and (8) a nine-tool unsupervised-validation collection (§III-M) that explicitly discloses each tool's untested assumption and positions the system as an anchor-calibrated screening framework with human-in-the-loop review, not as a validated forensic detector.
+Our central methodological contributions are: (1) a composition decomposition (Scripts 39b–39e) that establishes the absence of a within-population bimodal antimode in the Big-4 descriptor distribution: the apparent multimodality dissolves under joint firm-mean centring and integer-tie jitter ($p_{\text{median}} = 0.35$), so distributional "natural-threshold" framings of the inherited operating points are not empirically supported; (2) an anchor-based inter-CPA coincidence-rate (ICCR) calibration at three units of analysis — per-comparison ($0.0006$ at cos$>0.95$; $0.0013$ at dHash$\leq 5$; $0.00014$ jointly), pool-normalised per-signature ($0.11$ for the deployed any-pair HC rule), and per-document ($0.34$ for the operational HC$+$MC alarm) — with explicit terminological replacement of "FAR" by "ICCR" given the unsupervised setting; (3) firm heterogeneity quantification: logistic regression with pool-size adjustment gives odds ratios $0.053$, $0.010$, $0.027$ for Firms B/C/D relative to Firm A reference, indicating a large multiplicative effect that pool-size differences do not explain; (4) cross-firm hit matrix evidence that under the deployed any-pair rule, within-firm collision concentration is $98.8\%$ at Firm A and $76.7$–$83.7\%$ at Firms B/C/D (the stricter same-pair joint event saturates at $97.0$–$99.96\%$ within-firm across all four firms), consistent with firm-specific template, stamp, or document-production reuse mechanisms; (5) K=3 mixture demoted from "three mechanism clusters" to a descriptive firm-compositional partition; (6) three feature-derived scores converging on the per-CPA descriptor-position ranking at Spearman $\rho \geq 0.879$, reported as internal consistency rather than external validation; (7) $0\%$ positive-anchor miss rate on 262 byte-identical Big-4 signatures with the conservative-subset caveat; and (8) a nine-tool unsupervised-validation collection (§III-M) that explicitly discloses each tool's untested assumption and positions the system as an anchor-calibrated screening framework with human-in-the-loop review, not as a validated forensic detector.
 
-Future work falls in four directions. *First*, a small-scale human-rated validation set would enable direct ROC optimisation and provide signature-level ground truth that v4.0 fundamentally lacks; without such ground truth, no true error rates can be reported. *Second*, the within-firm collision concentration documented in §III-L.4 (98–100% same-firm partners) invites a separate study to distinguish deliberate template sharing from passive firm-level production artefacts (shared scanners, common form templates, identical report-generation infrastructure) — a question the inter-CPA-anchor analysis alone cannot resolve. *Third*, the descriptive Firm A versus Firms B/C/D contrast (per-document HC$+$MC alarm $0.62$ vs $0.09$–$0.16$) — together with v3.x's byte-level evidence of 145 pixel-identical signatures across $\sim 50$ distinct Firm A partners — invites a companion analysis examining whether such firm-level signing patterns correlate with established audit-quality measures. *Fourth*, generalisation to mid- and small-firm contexts requires extending the anchor-based ICCR framework to scopes where firm-level LOOO folds are not available; the §III-I.4 composition diagnostics already document that the absence of within-population bimodality is corpus-universal, so the v4.0 calibration approach in principle generalises, but a full extension with cluster-robust uncertainty quantification is left as future work.
+Future work falls in four directions. *First*, a small-scale human-rated validation set would enable direct ROC optimisation and provide signature-level ground truth that v4.0 fundamentally lacks; without such ground truth, no true error rates can be reported. *Second*, the within-firm collision concentration documented in §III-L.4 (any-pair $76.7$–$98.8\%$ across Big-4; same-pair joint $97.0$–$99.96\%$) invites a separate study to distinguish deliberate template sharing from passive firm-level production artefacts (shared scanners, common form templates, identical report-generation infrastructure) — a question the inter-CPA-anchor analysis alone cannot resolve. *Third*, the descriptive Firm A versus Firms B/C/D contrast (per-document HC$+$MC alarm $0.62$ vs $0.09$–$0.16$) — together with v3.x's byte-level evidence of 145 pixel-identical signatures across $\sim 50$ distinct Firm A partners — invites a companion analysis examining whether such firm-level signing patterns correlate with established audit-quality measures. *Fourth*, generalisation to mid- and small-firm contexts requires extending the anchor-based ICCR framework to scopes where firm-level LOOO folds are not available; the §III-I.4 composition diagnostics already document that the absence of within-population bimodality is corpus-universal, so the v4.0 calibration approach in principle generalises, but a full extension with cluster-robust uncertainty quantification is left as future work.
 
 ---
 

paper/v4/paper_a_results_v4_section_iv.md

@@ -82,24 +82,24 @@ This section reports the empirical evidence for §III-K's three-score internal-c
 
 | Score pair | Spearman $\rho$ | $p$-value |
 |---|---|---|
-| K=3 P(C1) vs Paper A box-rule hand-leaning rate | $+0.9627$ | $< 10^{-248}$ |
-| Reverse-anchor cosine percentile vs Paper A box-rule hand-leaning rate | $+0.8890$ | $< 10^{-149}$ |
+| K=3 P(C1) vs Paper A box-rule less-replication-dominated rate | $+0.9627$ | $< 10^{-248}$ |
+| Reverse-anchor cosine percentile vs Paper A box-rule less-replication-dominated rate | $+0.8890$ | $< 10^{-149}$ |
 | K=3 P(C1) vs Reverse-anchor cosine percentile | $+0.8794$ | $< 10^{-142}$ |
 
 (Source: Script 38.) Reverse-anchor reference: 2D Gaussian fit by MCD (support fraction 0.85) on $n = 249$ non-Big-4 CPAs; reference centre $\overline{\text{cos}} = 0.935$, $\overline{\text{dHash}} = 9.77$.
 
 **Table X.** Per-firm summary across the three feature-derived scores, Big-4.
 
-| Firm | $n$ CPAs | mean $P(\text{C1})$ | mean reverse-anchor score | mean Paper A hand-leaning rate |
+| Firm | $n$ CPAs | mean $P(\text{C1})$ | mean reverse-anchor score | mean Paper A less-replication-dominated rate |
 |---|---|---|---|---|
 | Firm A | 171 | 0.0072 | $-0.9726$ | 0.1935 |
 | Firm B | 112 | 0.1410 | $-0.8201$ | 0.6962 |
 | Firm C | 102 | 0.3110 | $-0.7672$ | 0.7896 |
 | Firm D | 52 | 0.2406 | $-0.7125$ | 0.7608 |
 
-(Source: Script 38 per-firm summary; reverse-anchor score is sign-flipped so that *higher* values indicate deeper into the reference left tail = more hand-leaning relative to the non-Big-4 reference.)
+(Source: Script 38 per-firm summary; reverse-anchor score is sign-flipped so that *higher* values indicate deeper into the reference left tail = less replication-dominated relative to the non-Big-4 reference.)
 
-The three scores agree on placing Firm A as the most replication-dominated and the three non-Firm-A firms as more hand-leaning. The K=3 posterior P(C1) and the box-rule hand-leaning rate (Score 1 and Score 3) place Firm C at the most-hand-leaning end of Big-4; the reverse-anchor cosine percentile (Score 2) ranks Firm D fractionally above Firm C. This residual within-Big-4-non-A disagreement is a design feature of the reverse-anchor metric: Score 2 measures only the marginal cosine percentile under the non-Big-4 reference, so a firm with a slightly higher cosine but a markedly different dHash distribution (Firm D vs Firm C) can score higher on Score 2 while scoring lower on Scores 1 and 3, both of which use both descriptors.
+The three scores agree on placing Firm A as the most replication-dominated and the three non-Firm-A firms as less replication-dominated. The K=3 posterior P(C1) and the box-rule less-replication-dominated rate (Score 1 and Score 3) place Firm C at the least-replication-dominated end of Big-4; the reverse-anchor cosine percentile (Score 2) ranks Firm D fractionally above Firm C. This residual within-Big-4-non-A disagreement is a design feature of the reverse-anchor metric: Score 2 measures only the marginal cosine percentile under the non-Big-4 reference, so a firm with a slightly higher cosine but a markedly different dHash distribution (Firm D vs Firm C) can score higher on Score 2 while scoring lower on Scores 1 and 3, both of which use both descriptors.
 
 **Table XI.** Per-signature Cohen $\kappa$ (binary collapse, replicated vs not-replicated), $n = 150{,}442$ Big-4 signatures.
 
@@ -144,10 +144,10 @@ This section reports the only hard-ground-truth subset analysis available in the
 
 **Table XIV.** Positive-anchor miss rate, $n = 262$ Big-4 byte-identical signatures.
 
-| Classifier | Misclassified as hand-leaning | Miss rate | Wilson 95% CI |
+| Classifier | Misclassified as less-replication-dominated | Miss rate | Wilson 95% CI |
 |---|---|---|---|
 | Paper A binary high-confidence box rule (cos $> 0.95$ AND dHash $\leq 5$) | $0 / 262$ | $0\%$ | $[0\%, 1.45\%]$ |
-| K=3 per-CPA hard label (C3 = replicated; descriptive) | $0 / 262$ | $0\%$ | $[0\%, 1.45\%]$ |
+| K=3 per-CPA hard label (C3 = high-cos / low-dHash; descriptive) | $0 / 262$ | $0\%$ | $[0\%, 1.45\%]$ |
 | Reverse-anchor (prevalence-calibrated cut) | $0 / 262$ | $0\%$ | $[0\%, 1.45\%]$ |
 
 (Source: Script 40.) Per-firm breakdown of the byte-identical subset: Firm A 145; Firm B 8; Firm C 107; Firm D 2. All three candidate scores correctly assign every byte-identical signature to the replicated class.
@@ -174,7 +174,7 @@ This section reports the §III-L five-way per-signature + document-level worst-c
 | UN | Uncertain | 35,480 | 23.58% |
 | LH | Likely hand-signed | 238 | 0.16% |
 
-(Source: Script 42; 11 of 150,453 loaded Big-4 signatures lacked one or both descriptors and were excluded.)
+(Source: Script 42; 11 of 150,453 loaded Big-4 signatures lacked one or both descriptors and were excluded. The $150{,}442$ vs $150{,}453$ distinction — descriptor-complete vs vector-complete — recurs across §IV: §IV-D through §IV-J and §IV-M.5 use $n = 150{,}442$; §IV-M.3 Table XXII uses $n = 150{,}453$ because the pool-normalised ICCR analysis loads all vector-complete signatures including those failing the descriptor-complete filter. See §III-G for the sample-size reconciliation.)
 
 **Per-firm five-way breakdown (% within firm).**
 
@@ -185,11 +185,11 @@ This section reports the §III-L five-way per-signature + document-level worst-c
 | Firm C | 23.75% | 41.44% | 0.38% | 34.21% | 0.22% | 38,613 |
 | Firm D | 24.51% | 29.33% | 0.22% | 45.65% | 0.29% | 17,133 |
 
-(Source: Script 42 per-firm cross-tab.) The per-firm pattern qualitatively aligns with the K=3 cluster cross-tab of Table XVI: Firm A's signatures concentrate in the HC band (81.70%) while its CPAs concentrate at the accountant level in the K=3 C3-replicated component (82.46%; Table XVI). These two figures address different units (per-signature classification vs per-CPA hard cluster assignment) and are not directly comparable as a like-for-like consistency check; we report the qualitative alignment but do not infer a numerical equivalence. The three non-Firm-A Big-4 firms have markedly lower HC rates than Firm A and substantially higher Uncertain rates, with Firm D having the highest Uncertain rate (45.65%).
+(Source: Script 42 per-firm cross-tab.) The per-firm pattern qualitatively aligns with the K=3 cluster cross-tab of Table XVI: Firm A's signatures concentrate in the HC band (81.70%) while its CPAs concentrate at the accountant level in the K=3 C3 (high-cos / low-dHash) component (82.46%; Table XVI). These two figures address different units (per-signature classification vs per-CPA hard cluster assignment) and are not directly comparable as a like-for-like consistency check; we report the qualitative alignment but do not infer a numerical equivalence. The three non-Firm-A Big-4 firms have markedly lower HC rates than Firm A and substantially higher Uncertain rates, with Firm D having the highest Uncertain rate (45.65%).
 
 **Document-level worst-case aggregation.** Each audit report typically carries two certifying-CPA signatures. We aggregate signature-level outcomes to document-level labels using the v3.20.0 worst-case rule (HC > MC > HSC > UN > LH; §III-L). v4.0 does not change this aggregation rule; only the population over which it is computed changes (Big-4 subset).
 
-**Table XV-B.** Document-level worst-case category counts, Big-4 sub-corpus, $n = 75{,}233$ unique PDFs.
+**Table XIX.** Document-level worst-case category counts, Big-4 sub-corpus, $n = 75{,}233$ unique PDFs.
 
 | Category | Long name | $n$ documents | % |
 |---|---|---|---|
@@ -212,38 +212,38 @@ This section reports the §III-L five-way per-signature + document-level worst-c
 
 (Source: Script 42; mixed-firm PDFs $n = 379$ excluded from the per-firm rows but included in the overall counts above.)
 
-The five-way **moderate-confidence non-hand-signed** band (cos $> 0.95$ AND $5 < \text{dHash} \leq 15$) inherits its v3.x calibration; it is **not separately validated by Scripts 38–40**, which evaluated only the binary high-confidence rule (cos $> 0.95$ AND dHash $\leq 5$). v4.0 does not re-derive the moderate-band cuts on the Big-4 subset; we report the Table XV per-firm MC proportions (10.76% / 35.88% / 41.44% / 29.33% across Firms A through D) descriptively. The v3.20.0 capture-rate calibration evidence for the moderate band (v3.20.0 Tables IX, XI, XII, XII-B) is carried into v4.0 by reference and not regenerated on the Big-4 subset. We do not claim that the MC-band per-firm ordering above is a separate validation of the §III-K Spearman convergence, since MC occupancy is not a monotone function of the per-CPA hand-leaning ranking (e.g., Firm D's MC fraction is lower than Firm B's while Firm D's reverse-anchor score ranks it as more hand-leaning than Firm B).
+The five-way **moderate-confidence non-hand-signed** band (cos $> 0.95$ AND $5 < \text{dHash} \leq 15$) inherits its v3.x calibration; it is **not separately validated by Scripts 38–40**, which evaluated only the binary high-confidence rule (cos $> 0.95$ AND dHash $\leq 5$). v4.0 does not re-derive the moderate-band cuts on the Big-4 subset; we report the Table XV per-firm MC proportions (10.76% / 35.88% / 41.44% / 29.33% across Firms A through D) descriptively. The v3.20.0 capture-rate calibration evidence for the moderate band (v3.20.0 Tables IX, XI, XII, XII-B) is carried into v4.0 by reference and not regenerated on the Big-4 subset. We do not claim that the MC-band per-firm ordering above is a separate validation of the §III-K Spearman convergence, since MC occupancy is not a monotone function of the per-CPA less-replication-dominated ranking (e.g., Firm D's MC fraction is lower than Firm B's while Firm D's reverse-anchor score ranks it as less replication-dominated than Firm B).
 
 **Table XVI.** Firm × K=3 cluster cross-tabulation, Big-4 sub-corpus.
 
-| Firm | $n$ | C1 (hand-leaning) | C2 (mixed) | C3 (replicated) | C1 % | C3 % |
+| Firm | $n$ | C1 (low-cos / high-dHash) | C2 (central) | C3 (high-cos / low-dHash) | C1 % | C3 % |
 |---|---|---|---|---|---|---|
 | Firm A | 171 | 0 | 30 | 141 | $0.00\%$ | $82.46\%$ |
 | Firm B | 112 | 10 | 102 | 0 | $8.93\%$ | $0.00\%$ |
 | Firm C | 102 | 24 | 77 | 1 | $23.53\%$ | $0.98\%$ |
 | Firm D | 52 | 6 | 45 | 1 | $11.54\%$ | $1.92\%$ |
 
-(Source: Script 35.) The cross-tab is the accountant-level descriptive output of the K=3 mixture (§III-J / §IV-E). It is reported here as a complement to the five-way per-signature classifier (Table XV), not as an operational classifier output. Reading: Firm A's CPAs are concentrated in the C3 replicated component (no Firm A CPAs in C1); Firm C has the highest hand-leaning concentration of the Big-4 (C1 fraction $23.5\%$); Firms B and D sit between A and C on the K=3 hard-label ordering, broadly consistent with the per-firm Spearman ordering of Table X (with the within-Big-4-non-A reverse-anchor disagreement noted there).
+(Source: Script 35.) The cross-tab is the accountant-level descriptive output of the K=3 mixture (§III-J / §IV-E). It is reported here as a complement to the five-way per-signature classifier (Table XV), not as an operational classifier output. Reading: Firm A's CPAs are concentrated in the C3 (high-cos / low-dHash) component (no Firm A CPAs in C1); Firm C has the highest C1 (low-cos / high-dHash) concentration of the Big-4 (C1 fraction $23.5\%$); Firms B and D sit between A and C on the K=3 hard-label ordering, broadly consistent with the per-firm Spearman ordering of Table X (with the within-Big-4-non-A reverse-anchor disagreement noted there).
 
-**Document-level worst-case aggregation outputs are reported in Table XV-B above.**
+**Document-level worst-case aggregation outputs are reported in Table XIX above.**
 
 ## K. Full-Dataset Robustness (light scope)
 
-This section reports the v4.0 reproducibility cross-check at the full accountant scope ($n = 686$ CPAs, Big-4 plus mid/small firms). The scope of §IV-K is deliberately narrow: we re-run only the K=3 mixture + Paper A operational-rule per-CPA hand-leaning rate analysis, sufficient to demonstrate that the v4.0 K=3 + Paper A convergence reproduces at the wider scope. The §III-L five-way classifier and the §IV-G LOOO analyses are not re-run at the full scope. The five-way moderate-confidence band is documented as inherited from v3.x calibration in §IV-J.
+This section reports the v4.0 reproducibility cross-check at the full accountant scope ($n = 686$ CPAs, Big-4 plus mid/small firms). The scope of §IV-K is deliberately narrow: we re-run only the K=3 mixture + Paper A operational-rule per-CPA less-replication-dominated rate analysis, sufficient to demonstrate that the v4.0 K=3 + Paper A convergence reproduces at the wider scope. The §III-L five-way classifier and the §IV-G LOOO analyses are not re-run at the full scope. The five-way moderate-confidence band is documented as inherited from v3.x calibration in §IV-J.
 
 **Table XVII.** K=3 component comparison, Big-4 sub-corpus vs full dataset.
 
 | K=3 component | Big-4 (n=437) cos / dHash / weight | Full (n=686) cos / dHash / weight | Drift Big-4 → Full |
 |---|---|---|---|
-| C1 hand-leaning | 0.9457 / 9.17 / 0.143 | 0.9278 / 11.17 / 0.284 | $\lvert\Delta\rvert$ cos 0.018, dHash 1.99, wt 0.141 |
-| C2 mixed | 0.9558 / 6.66 / 0.536 | 0.9535 / 6.99 / 0.512 | $\lvert\Delta\rvert$ cos 0.002, dHash 0.33, wt 0.024 |
-| C3 replicated | 0.9826 / 2.41 / 0.321 | 0.9826 / 2.40 / 0.205 | $\lvert\Delta\rvert$ cos 0.000, dHash 0.01, wt 0.117 |
+| C1 (low-cos / high-dHash) | 0.9457 / 9.17 / 0.143 | 0.9278 / 11.17 / 0.284 | $\lvert\Delta\rvert$ cos 0.018, dHash 1.99, wt 0.141 |
+| C2 (central) | 0.9558 / 6.66 / 0.536 | 0.9535 / 6.99 / 0.512 | $\lvert\Delta\rvert$ cos 0.002, dHash 0.33, wt 0.024 |
+| C3 (high-cos / low-dHash) | 0.9826 / 2.41 / 0.321 | 0.9826 / 2.40 / 0.205 | $\lvert\Delta\rvert$ cos 0.000, dHash 0.01, wt 0.117 |
 
 (Source: Script 41; full-dataset $\text{BIC}(K{=}3) = -792.31$ vs Big-4 $\text{BIC}(K{=}3) = -1111.93$; BIC values are not directly comparable across different $n$ and are reported only for completeness.)
 
-**Table XVIII.** Spearman rank correlation between K=3 P(C1) and Paper A operational hand-leaning rate, Big-4 sub-corpus vs full dataset.
+**Table XVIII.** Spearman rank correlation between K=3 P(C1) and Paper A operational less-replication-dominated rate, Big-4 sub-corpus vs full dataset.
 
-| Scope | $n$ CPAs | Spearman $\rho$ (P(C1) vs Paper A hand-leaning rate) | $p$-value |
+| Scope | $n$ CPAs | Spearman $\rho$ (P(C1) vs Paper A less-replication-dominated rate) | $p$-value |
 |---|---|---|---|
 | Big-4 (primary) | 437 | $+0.9627$ | $< 10^{-248}$ |
 | Full dataset | 686 | $+0.9558$ | $< 10^{-300}$ |
@@ -251,7 +251,7 @@ This section reports the v4.0 reproducibility cross-check at the full accountant
 
 (Source: Script 41.)
 
-**Reading.** The K=3 component ordering and the strong Spearman convergence between K=3 P(C1) and the Paper A box-rule hand-leaning rate are preserved at the full scope. Component centres shift modestly: C3 (replicated) is essentially unchanged in centre but loses weight $0.117$ as the full population includes more non-templated CPAs (mid/small firms); C1 (hand-leaning) gains weight $0.141$ and shifts to lower cosine and higher dHash (centre $(0.928, 11.17)$ vs Big-4 $(0.946, 9.17)$) as the broader population includes mid/small-firm hand-leaning CPAs that the Big-4-primary scope deliberately excludes. We read this as evidence that the Big-4-primary K=3 + Paper A convergence is not a Big-4-specific artefact; we do **not** read it as an endorsement of using full-dataset K=3 component centres or operational thresholds in place of the Big-4-primary analysis. Mid/small-firm composition shifts the component centres meaningfully and the v4.0 primary methodology is restricted to Big-4 by design (§III-G item 4).
+**Reading.** The K=3 component ordering and the strong Spearman convergence between K=3 P(C1) and the Paper A box-rule less-replication-dominated rate are preserved at the full scope. Component centres shift modestly: C3 (high-cos / low-dHash) is essentially unchanged in centre but loses weight $0.117$ as the full population includes more non-templated CPAs (mid/small firms); C1 (low-cos / high-dHash) gains weight $0.141$ and shifts to lower cosine and higher dHash (centre $(0.928, 11.17)$ vs Big-4 $(0.946, 9.17)$) as the broader population includes mid/small-firm CPAs landing toward the low-cos / high-dHash region that the Big-4-primary scope deliberately excludes. We read this as evidence that the Big-4-primary K=3 + Paper A convergence is not a Big-4-specific artefact; we do **not** read it as an endorsement of using full-dataset K=3 component centres or operational thresholds in place of the Big-4-primary analysis. Mid/small-firm composition shifts the component centres meaningfully and the v4.0 primary methodology is restricted to Big-4 by design (§III-G item 4).
 
 ## L. Feature Backbone Ablation (inherited from v3.20.0 §IV-I)
 
@@ -263,7 +263,7 @@ This section consolidates the v4-new empirical results that support the §III-L
 
 ### M.1 Composition decomposition (Scripts 39b–39e)
 
-**Table XIX.** Within-firm and between-firm decomposition of the Big-4 accountant-level dip-test rejection.
+**Table XX.** Within-firm and between-firm decomposition of the Big-4 accountant-level dip-test rejection.
 
 | Diagnostic | Scope | Statistic | Implication |
 |---|---|---|---|
@@ -277,7 +277,7 @@ This section consolidates the v4-new empirical results that support the §III-L
 
 ### M.2 Anchor-based inter-CPA pair-level ICCR (Script 40b)
 
-**Table XX.** Big-4 inter-CPA per-comparison ICCR sweep, $n = 5 \times 10^5$ pairs (Big-4 scope; v4 new).
+**Table XXI.** Big-4 inter-CPA per-comparison ICCR sweep, $n = 5 \times 10^5$ pairs (Big-4 scope; v4 new).
 
 | Threshold | Per-comparison ICCR | 95% Wilson CI |
 |---|---|---|
@@ -297,7 +297,7 @@ The cos $> 0.95$ row replicates v3.20.0 §IV-F.1 Table X (v3 reported $0.0005$ u
 
 ### M.3 Pool-normalised per-signature ICCR (Script 43)
 
-**Table XXI.** Pool-normalised per-signature ICCR under the deployed any-pair HC rule (cos $> 0.95$ AND dHash $\leq 5$); $n_{\text{sig}} = 150{,}453$ (vector-complete Big-4); CPA-block bootstrap $n_{\text{boot}} = 1000$.
+**Table XXII.** Pool-normalised per-signature ICCR under the deployed any-pair HC rule (cos $> 0.95$ AND dHash $\leq 5$); $n_{\text{sig}} = 150{,}453$ (vector-complete Big-4); CPA-block bootstrap $n_{\text{boot}} = 1000$.
 
 | Scope | Per-signature ICCR | Wilson 95% CI | CPA-bootstrap 95% CI |
 |---|---|---|---|
@@ -314,7 +314,7 @@ Decile trend is broadly monotone in pool size with two minor reversals (decile 5
 
 ### M.4 Document-level ICCR under three alarm definitions (Script 45)
 
-**Table XXII.** Document-level inter-CPA ICCR by alarm definition; $n_{\text{docs}} = 75{,}233$.
+**Table XXIII.** Document-level inter-CPA ICCR by alarm definition; $n_{\text{docs}} = 75{,}233$.
 
 | Alarm definition | Alarm set | Document-level ICCR | Wilson 95% CI |
 |---|---|---|---|
@@ -326,7 +326,7 @@ Per-firm D2 document-level ICCR: Firm A $0.6201$ ($n = 30{,}226$); Firm B $0.160
 
 ### M.5 Firm heterogeneity logistic regression and cross-firm hit matrix (Script 44)
 
-**Table XXIII.** Logistic regression of per-signature any-pair HC hit indicator on firm dummies and centred log pool size (Firm A reference).
+**Table XXIV.** Logistic regression of per-signature any-pair HC hit indicator on firm dummies and centred log pool size (Firm A reference).
 
 | Term | Odds ratio (vs Firm A) | Direction |
 |---|---|---|
@@ -337,7 +337,7 @@ Per-firm D2 document-level ICCR: Firm A $0.6201$ ($n = 30{,}226$); Firm B $0.160
 
 Per-decile per-firm rates (Table not duplicated here; Script 44 decile table available in the supplementary report): within every pool-size decile, Firms B/C/D show rates of $0.0006$–$0.0358$ while Firm A ranges $0.0541$–$0.5958$. The firm gap survives within matched pool sizes.
 
-**Table XXIV.** Cross-firm hit matrix among Big-4 source signatures with any-pair HC hit; max-cosine partner firm (counts).
+**Table XXV.** Cross-firm hit matrix among Big-4 source signatures with any-pair HC hit; max-cosine partner firm (counts).
 
 | Source firm | Firm A cand. | Firm B | Firm C | Firm D | non-Big-4 | n hits |
 |---|---|---|---|---|---|---|
@@ -350,7 +350,7 @@ Same-pair joint hits (single candidate satisfying both cos $> 0.95$ AND dHash $\
 
 ### M.6 Alert-rate sensitivity around inherited HC threshold (Script 46)
 
-**Table XXV.** Local-gradient / median-gradient ratio at inherited thresholds (descriptive plateau diagnostic).
+**Table XXVI.** Local-gradient / median-gradient ratio at inherited thresholds (descriptive plateau diagnostic).
 
 | Threshold | Local / median gradient ratio | Interpretation |
 |---|---|---|