Three AI models agree that your code is safe. That looks like three confirmations; it may be one mistake, counted three times. This plain-language guide explains why models from different vendors can still fail alike, when agreement between them counts as evidence, and what to check instead.
Companion to Agentic Stemmatics: Collation, Provenance, and Conservation for an Emerging Machine Textual Tradition (Soons, 2026, web text v1.43; doi:10.5281/zenodo.22030516 (the concept DOI: a DOI that always resolves to the latest deposited version); latest deposit v1.41, deposited 18 Oct 2026, version DOI 10.5281/zenodo.23458161)
This guide explains the paper's argument; it is not independent evidence for it, and wherever the two differ, the paper governs. It follows one rule: it says nothing the paper does not say, apart from three declared exceptions, each labelled where it appears, and the explicitly labelled musical teaching comparison in Section 1. That comparison illustrates a distinction; it supplies no evidence for the paper. Where a sentence here is stronger than the paper, that is a defect in this guide; what is claimed and what is refused can be checked against the paper's own §13.
Commissioning a review? Start with Section 7, on what a client may, and may not, infer; the other sections give the reasoning behind it.
Three AI models review your code. All three say it is safe. That looks like three confirmations; it may be one mistake, repeated three times.
Different company names do not settle the matter. The models may have learned from overlapping material, and one may have been trained on another's outputs. Their agreement could therefore have a shared cause. Before counting it as separate confirmation, we need to understand how their errors are related.
Manuscript scholars face a similar problem. If three copies descend from the same flawed manuscript, all three may repeat its mistake. Counting the copies will not tell us whether their shared wording is right. Scholars must also investigate how the copies are related. That study of textual relationships is called stemmatics.
Agentic stemmatics asks whether lessons from this discipline can help us study AI models and judge their outputs. The paper develops three connected lines of work:
These are proposals whose effectiveness still needs to be tested.
Music offers a simple distinction. Hearing Bach in Sweelinck prompts a question about inheritance; resemblance alone does not answer it. Wollny and Maul identify Bach’s handwritten copy of Reincken’s An Wasserflüssen Babylon, dated 1700. That is evidence of contact with a particular work, not a pedigree for everything Bach later wrote.
In software review, a transcript showing that one reviewer received another’s answer similarly establishes exposure, not which conclusions it caused. Two similar answers alone do not establish model ancestry. The paper’s witness is a model lineage characterised through repeated samples; one answer is a sample. This comparison illustrates the question; it does not validate the proposed AI method.
Why music belongs in our research →
An AI verdict is a claim that needs support. Engineers can sometimes establish whether such a claim is right by executing code, running a test or consulting a specification. When an appropriate check settles the question, it takes priority over the reviewers' opinions. Consulting a specification settles only what the specification says, not whether the specification itself is correct, or whether the verdict's underlying claim about the world holds. A decisive check is not always available.
Where no such check can settle the question, the harder problem remains: can carefully examined agreement between models provide sufficient grounds for trusting a verdict? The paper has not established that it can. It proposes ways to investigate the question, including measurements of reviewer dependence that have not yet been built.
The practice referred to in this guide is CounterProof, which sells adversarial reviews using the paper's method; the paper discloses its author's financial interest. The paper does not claim that the method produces better code, and it says plainly that nothing in it measures whether the amount of adversarial review the practice sells is proportionate to the generators' actual error rates (the error rates of the models whose output is reviewed). Those limits matter to the argument as well as to prospective clients.
CounterProof Research asks a broader question: how can people and AI systems produce, preserve and improve knowledge while remaining open to evidence and criticism? Agentic stemmatics is one part of that work.
Historical source criticism helps us examine where an account came from, how credible it is and whether it depends on other accounts. The philosopher Frank Ankersmit raises a further question: what understanding emerges when statements are selected and arranged into a larger account? Proposed work on agentic representation would examine the accounts constructed from evidence.
A separate proposed programme on agentic institutions would investigate how useful learning can survive changes of people, tools and models, and whether institutional arrangements help expose and correct mistakes. These programmes may share libraries and tools, but each must establish its own value. The paper places them alongside stemmatics in Section 10. They express a research ambition, not a demonstrated capability.
A normal computer program can, in principle, be read line by line. Its behaviour follows from its text, so a patient enough reader can trace cause to effect. A language model's output is different. The difficulty is not that the system is complicated, as a large codebase is complicated. Its answer is not a step-by-step derivation. It is a claim: this code is correct, no vulnerability exists here, these tests pass. Confidence, fluency and internal consistency do not reliably show whether that claim is warranted.
Everything that follows begins with one structural fact: the same mechanism produces well-grounded answers and baseless ones. Researchers are investigating whether internal signals could in principle distinguish the two. Early results also suggest that a model's written account of its reasoning can diverge from the computation that produced its answer. That gives us another reason for caution. But the research on internal signals is not a test available to someone using the model day to day. The answer's fluency and its account of itself cannot reliably distinguish the two cases, yet a decision still has to be made.
Treat an AI output as a court or a historian treats witness testimony: weigh it, cross-check it and identify its source. Neither a confident delivery nor agreement with other witnesses settles whether it is true.
Ask the same model the same question twice and it may give different answers. This practice has observed that instability informally; it offers no measured rate here. The point is that each answer is one draw from a distribution: the range of answers that model tends to produce. Assessing one output is therefore not enough. We also need to assess the tendencies of the model that produced it.
This applies equally to alarming answers. A finding that flags a serious problem is still one draw from that distribution. It remains a claim to check against the actual code, however persuasive it sounds. Checking it has a cost, and that cost must be counted.
The paper makes no claim that code written by a model is detectably different, or worse, in itself. Its one benchmark of agent-generated code is cited for a narrower point: in tasks built from real commits in which a human had introduced a vulnerability that was later fixed, in each of its twelve agent setups most solutions that passed the functional tests failed the security test for that flaw, and because the study does not ask whether the models had seen those projects' histories in training, copying and independent re-invention cannot be told apart (the paper's §11.8).
Code from a model is still a program: its behaviour follows from its text, and it can be read and run like any other. What differs is the model's account of it. That account is a claim (the paper's §1), made by a mechanism that produces well-grounded and baseless claims alike (above), and the model's explanation of why it wrote what it wrote is another output of that mechanism, which early results suggest can diverge from the computation behind it (above). Nor is a single answer the witness: ask again and you may get different code, each version one draw from the same distribution (above; the paper's §3).
The difference that matters most for review is what agreement means. In a manuscript tradition, two copies that share a mistake so particular that independent copyists would be unlikely to make it are evidence of a common source, to the extent that copying reproduces the error of the manuscript being copied far more often than independent copying produces it (the paper's §2; Section 4 gives the two conditions). Among today's models, two systems that share an error can be alike for another reason: trained on overlapping material towards similar objectives, they can approximate similar distributions and return the same most probable mistake without either copying the other (Section 4; the paper's §4). Shared errors are common, and the available measurements do not show what share arose without copying. That is why the paper replaced its first argument: the manuscript inference from a shared peculiar error does not transfer wholesale to shared model errors, and transfers with full force only where independent origin is improbable and descent would make the agreement substantially more probable (the paper's §3; Section 4).
A person writing with a model does not stand outside this. Human writing influenced by models is one of the four channels by which model output returns to training data (the paper's §6), and the paper reports a measured share of recent biomedical abstracts that show signs of AI-assisted writing (Section 5; the paper's §4). The paper's thesis is that through these channels a machine textual tradition is emerging: as outputs return to later corpora, descent may become reconstructible, while earlier, largely human-written material becomes harder to recover. It claims, without having measured it, that the inherited fraction is small now and growing, and it states how that prediction could fail (Section 5; the paper's §§6 and 11).
So the question this guide keeps returning to is not whether a model's code looks different, but what can be established about it, and by what: a mechanical check where one exists, and, where none does, agreement whose independence has been measured rather than assumed (Sections 3 and 6).
Some questions about code have a mechanical answer available. We can run the code, type-check it, test it, prove it, or consult the specification. We call these decidable questions, using the word in a practical sense: some mechanical check can settle the question. This is not the strict meaning used in computability theory. For such questions, the next step is to perform the check.
Other questions have no mechanical check available. Is this design sound? Is an unreproducible finding a real defect? How severe is it? What does this contract clause mean? These are judgement questions. No execution settles them; a verdict has to be built from testimony.
The distinction matters. A decidable question has a fact of the matter that the mechanical check can reach. A judgement question may have no single right answer. Code quality often depends on the specification being applied. Two reviewers may disagree because they are answering different, equally legitimate questions, rather than because one has gone wrong.
The research programme asks:
How can you get a trustworthy verdict out of several witnesses, when none of them is individually trustworthy, and you don't know whether they're actually independent of each other or all making the same mistake for the same reason?
That question has three parts:
The paper calls the comparison of AI reviewers' answers, to work out which answers to trust, collation (see Glossary: Collation).
The obvious approach is to ask several models and follow the majority. Agreement can strengthen a claim when the reviewers' relevant dependence has been assessed. But the paper does not establish a complete rule for when majority voting is reliable.
A study of more than 350 models on two public leaderboards and a screening task found that models often shared the same wrong answer. When both models in a pair were wrong, they gave the same wrong answer far more often than chance would predict: a mean of 60% of the time on one leaderboard and 42% on the other. More capable models made more correlated mistakes (Kim, Garg, Peng & Garg, ICML 2025).
The study included pairs from different companies, but did not report a separate analysis of those pairs. Its statistical model attributed more of the agreement to capability than to shared vendor on one leaderboard, and the reverse on the other. Most of the agreement was attributed to neither.
The paper draws a conditional inference from this finding. If capability drives correlation across companies as well as within them, a group of more capable models from different companies will make more correlated mistakes than a comparable group of weaker models, whatever the company mix itself contributes. The finding is a snapshot: whether the pattern is changing over time has not been measured.
Consider two opposing views. One says that agreement among several reviewers is meaningful evidence: individual reviewers are unreliable, and without agreement, reviewing AI output would be hopeless. The other says agreement is worthless: it is exactly what we should expect when reviewers share training data, methods or underlying model families. These are deliberately simplified positions, used to expose the problem; they are not a complete account of the debate or a claim that anyone holds either view so neatly.
Both treat independence as something a panel either has or lacks from the moment it is assembled. Independence instead needs to be assessed for each kind of question. Two systems might be nearly independent when reviewing memory-safety bugs and effectively a single witness when reviewing cryptographic protocols. Vendor names alone do not tell us which is the case.
This resolves the shared assumption, not the practical difficulty of measuring dependence. Agreement can strengthen a claim where the relevant dependence has been assessed. Without that assessment, it is a reading from an unchecked instrument.
The proposed instrument would track, for each kind of question, how often reviewers make the same mistake and how much their habits differ. It has not been built. Even if built, it could narrow uncertainty, not eliminate it: a panel's independence cannot be fully verified from inside that panel. The paper treats this as a permanent limit.
The paper's claim is conditional: majority voting is unsafe where reviewer independence is unmeasured or known to be failing. Where agreement is correlated, a vote can count the same mistake several times as if each occurrence confirmed it. A simple vote threshold can also discard a true minority finding when the majority shares a blind spot. This second point is the paper's inference from the first, not a result directly measured by the studies it cites.
Voting can still serve legitimate purposes: reducing false alarms and alert fatigue, providing cheap triage at scale, and producing statistical gains when independence holds. The paper's reviewers raised this case, and the paper acknowledges that it had left it unaddressed.
One preprint, not yet peer-reviewed, found that majority voting beat the single best model in about 10% of three-model groups on MMLU-Pro when the best model was identified after the fact. The figure was about 19% when the best model was chosen using held-out questions. Its author describes the link between more shared error and lower gain as modest and dependent on the setup. Voting can be useful for fast triage. The objection is to treating that triage use of voting as a procedure for establishing truth.
Nor does a dissenting reviewer become right merely by opposing the majority. An earlier draft of the paper made that circular argument and withdrew it. The narrower point remains: when a majority is correlated, a process must preserve and investigate dissent if it is ever to recover a true minority finding. Dissent earns no credibility by itself. Preserving it merely allows the claim to be checked.
If every dissent is discounted, a correlated majority may never be corrected. If every dissent must be pursued without limit, a stubborn or compromised reviewer can gain an effective veto and overwhelm the process.
The proposed response is to route dissent to a mechanical check wherever one exists. A dissenting opinion requests evidence; it does not supply authority. Run the test, read the specification or execute the code. A second vote does not resolve the underlying question.
Where no mechanical check exists, the proposal remains incomplete. The paper supplies no tie-breaking rule for such disputes and no cost model. It requires the cost of investigating dissent to be counted honestly, but a requirement is not an implemented procedure.
Four separately commissioned reviews of the paper's design converged, without prompting, on the same criticisms. Separate commissioning describes how the reviews were obtained; it does not establish that their conclusions were independently reached. The reviewers found that the approach:
The paper therefore says plainly that this approach only works in low-volume, high-stakes review, with small panels and available mechanical checks. It does not scale to high-volume screening. Where true minority findings are rare and noise is high, it becomes a false-positive machine.
The answer has two distinct parts:
Part one: agreement. Agreement between reviewers can strengthen a claim where their dependence on that specific kind of question has actually been assessed. The paper does not offer a complete rule for when voting is reliable.
Part two: reconstructing a single "true" answer. This is a separate and more restricted claim: language about recovering one definitive ground truth only applies to decidable questions, where a mechanical check exists and outranks any panel anyway. For judgement questions, a panel of reviewers samples opinion: it doesn't recover a lost original fact, because for many judgement questions there may be no single fact to recover. Calling that "reconstruction" is the overreach an earlier paper draft made and later withdrew.
Today, the first part's condition is unmet: the proposed assessment of reviewer dependence has not been implemented. The paper therefore currently supports no verdict resting on testimony alone. This does not restrict the potential value of agreement to decidable questions. It means that the paper has not established when testimony alone provides enough warrant to believe a verdict.
Reconstruction offers no alternative route around that limit. Where a mechanical check exists, the warrant comes from the check. Where none exists, the paper withdraws the stronger claim. It neither establishes that some domain permits testimony alone to suffice, nor shows that no such domain exists. That question remains open.
In the meantime, the practice closes verdicts as described in Section 7. Collation is intended to provide cheap, continuous triage across broad areas, directing more careful and expensive checks towards promising findings. This role is proposed; it has not been run or demonstrated at real scale. That is a separate practical limitation, not an additional unmet condition for testimony-alone warrant.
Collation also keeps a record: findings go to mechanical checks where possible, dissent is preserved, and a named human decides the remaining judgement calls. If a planned future experiment produces a verdict warranted by collation alone, that would be the first instance answering the open question. Until then, such a case is a promise, not a result.
The method can consider only findings that some reviewer has raised. It cannot reveal a defect that every reviewer missed. If all models share a blind spot and nobody dissents, the method is blind to it by construction. Addressing that requires a different approach, such as interpretability research into the models or a mechanical check that catches the defect directly. Catching a defect every reviewer missed lies outside this programme.
Section 3 leaves a requirement it cannot satisfy: assess reviewer dependence. Error correlation can be measured directly for each task. Knowing how reviewers are related can help explain that correlation.
Scholars who study handwritten manuscripts faced exactly this problem and developed a method for it. They reconstruct the family tree of the surviving copies, then interpret agreement in light of each copy's place in that tree. Counting how many copies agree is not enough. The tree is a stemma; the method is stemmatics. The paper proposes agentic stemmatics as the name for analogous work with AI models.
The classical method looks for a particular kind of clue: a shared mistake so arbitrary that two independent copyists would be unlikely to make it by coincidence. Their agreement is then better explained by descent from a common, already flawed source.
This improbability condition was part of the method from the beginning, though applying it relied on the scholar's judgement. Simple slips, ordinary modernisations and natural corrections towards familiar phrasing were excluded because independent copyists could readily make them. Only an error unlikely to arise by coincidence carried information about ancestry.
Biology makes the same distinction. Convergence occurs when unrelated species independently develop a similar trait. Shared inheritance occurs when they have the trait because they share an ancestor.
An earlier draft of the paper claimed that shared model errors were evidence of shared training lineage. The reviewers were right to reject that claim. Models trained on overlapping data towards similar goals can reach the same plausible but wrong answer without either copying the other.
The usual explanation is that their training makes the same wrong answer the easiest, most probable mistake. This is a working hypothesis, not a measured cause (see Attractor in the glossary). The paper proposes applying the manuscript scholars' exclusion rule to models: a shared error has genealogical weight only when independent appearance would be improbable and shared ancestry would make it substantially more probable. The error may be assessed alone or alongside other shared features.
Shared model errors are common. The studies considered in the paper do not establish how many are ordinary slips and how many might be telling clues to ancestry.
The correction illustrates the convergence-versus-inheritance problem familiar to textual scholarship and biology. This guide records that parallel only as a sign that the framework is internally consistent, not as evidence that it is correct. Section 5 returns to that caution in its closing discussion of why the framework must remain open to failure.
Models have stable habits of wording, structure and formatting. Sun et al. (ICML 2025) report 97.1% accuracy in distinguishing five systems, together with robustness to paraphrasing.
That measures how well the systems can be distinguished. It does not measure how unlikely a habit is to emerge independently, or how much more likely shared ancestry makes it. An ancestry inference requires both.
A familiar model habit illustrates the problem. Several models released after 2022 overuse a small set of words, such as "delve"; the same overrepresentation appears in human scientific writing. A shared training approach is one possible explanation of the model pattern, not an established cause. The habit alone cannot distinguish coincidence, shared ways of building models and inheritance. On present evidence, it does not establish descent.
The paper therefore separates two kinds of signal.
Engineered markers, usually called watermarks, offer the clearer case. A statistical marker is planted in a teacher model's output, then sought in a student trained on that output. Its independent appearance is made improbable by design, and experimental work has demonstrated its inheritance.
With access to the student's internals, Sander et al. (NeurIPS 2024) detected a marker when only 5% of the teacher-generated fine-tuning instructions carried it and the remainder were the same teacher's unmarked output. Detection still worked at 10% when the remainder was human-written text. Pan et al. (ACL 2025) showed that a strongly learned marker survives ordinary paraphrasing. It can be removed by an attacker who has recovered the marking rule, by diluting the marked text, or by a neutralising step during the student's text generation.
This resembles the deliberate fake entries sometimes placed in reference books to detect copying by another publisher. An ordinary error does not establish copying, since independent authors may make the same mistake. A planted feature whose independent appearance is improbable provides a clearer detector.
Natural habits have not yet earned the same trust. They need the scrutiny required of shared errors: how improbable is a habit, or a combination of habits, under independent training, and how much more probable is it under shared ancestry? None of the studies examined in the paper supplies that measurement tool yet.
A test comparing a student directly with a named candidate teacher comes closer to the question than a test classifying it among many known systems. The paper's proposed validation experiment should draw on that approach because it addresses the relevant improbability question.
Manuscript scholarship uses significant shared mistakes to trace ancestry. The paper proposes doing analogous work with significant shared habits in models. Its rule is a proposal to be tested:
A shared habit, or several habits assessed together with their dependence accounted for, counts as strong evidence of common ancestry only if independent emergence would be improbable and descent would make it substantially more probable.
Not every stable, distinguishing habit meets these conditions. Shared model errors are common, but the studies the paper considers do not establish what share arose without copying. At least one prominent shared habit fails the test on present evidence. The whole method can transfer from manuscripts to models only if these two conditions are met and checked for the features being used; they cannot be assumed to hold for a whole category of evidence.
Even when the conditions are met, they do not identify which model descends from which, or the route of transmission.
The paper's version 0.1 treated shared errors that could arise without descent as evidence of descent. At v1.39 it added the second condition: descent must make the shared feature substantially more probable.
Not yet. It is a research programme with a testable prediction: growing transmission between model generations could make the stemmatic comparison fit better with time. The paper has not measured that growth. Mixing sources and losing rare forms could instead make ancestry harder to reconstruct.
Manuscript scholarship as a field exists only because copied traditions actually corrupt over time. The flow of AI-generated text back into AI training data has begun to show corruption too. This observation underlies the argument; it does not require a model literally to be a manuscript. The prediction concerns how well the comparison fits this developing tradition. It says nothing about how trustworthy a review using it is today. The tests that could disprove the prediction are set out below.
A careful sceptic can grant everything in Sections 2 to 4 and still object: this is only an analogy. Models are not manuscripts. There is a training run, not a copying room or an original text progressively corrupted by hand-to-hand transmission. Reliability engineers have understood shared failure for decades. Borrowing the vocabulary of manuscript scholarship adds new words and no new power to draw inferences.
The paper concedes most of this for roughly 2023 to 2024: for that period, the sceptic is right. Shared model errors were common, and they could arise without copying. The studies considered do not establish what share arose without copying, as Section 4 says.
Transmission itself began earlier. Before 2022, model-generated text already entered training through students trained on a teacher model's output and through machine-translated text, including text in web collections. These examples establish that transmission occurred. They measure neither its extent then nor its growth since, and they do not establish how much ancestry can be reconstructed from model outputs. Shared errors alone do not establish lineage; their significance must be assessed under the proposed rule.
The paper argues that the object being studied is changing. Model output flows back into the data used to train later generations. It argues that this return is growing, without having measured the growth, through four channels with parallels in older copying practices:
Most of the following consequences have a close parallel in manuscript scholarship. Their evidential status differs, and the qualifications matter.
Layering. Each model generation may leave traceable, datable habits for later generations to inherit. In principle, lineage could become easier to trace as this tradition develops. Mixing sources and losing rare forms could instead erase the clues.
The condition from Section 4 still governs. These habits are candidate clues. To count as strong evidence of common ancestry, a clue, or a set assessed together with its dependence accounted for, must be improbable enough under independent origin and substantially more probable under shared ancestry. None of the studies examined supplies that measurement yet.
Model collapse. Under replacement, where synthetic data replaces real data in each round, repeated training on AI-generated output erodes rare patterns. Common, "safe" constructions crowd out unusual ones (Shumailov et al., Nature, 2024). Where synthetic data instead accumulates alongside real data, language-model experiments found collapse avoided in the settings studied (Gerstgrasser et al., 2024). The latter is a preprint and a distinct finding, not part of Shumailov et al.'s claims.
The paper compares the replacement result with the manuscript drift towards a familiar, "easier" reading, lectio facilior; the paper calls that copying drift banalisation. Repeated copying that favours the probable can wear away rare content. The proposed parallel is between these patterns. In models, the preference comes from training; in manuscripts, from copying habits. The paper does not claim that manuscripts and models are identical.
The value of the oldest dated source. Text produced before 2022 offers a uniquely valuable reference layer. The comparison is with pre-nuclear-testing steel: the value comes from a material's date and provenance, rather than an inherent superiority. Pre-2022 text is the oldest large layer available, though it is not free of machine-generated text. What makes it useful as a baseline is its provenance, where that is known.
The paper argues that this layer becomes more valuable as the later tradition develops, provided its provenance is known; the growth of that later tradition has not been measured. Tracking the origins of data becomes, in effect, an archival discipline.
The planted marker. Watermarks and anti-copying fingerprints are deliberately planted clues. Their demonstrated inheritance provides the cleanest existing experimental evidence that transmission between model generations occurs.
An opportunity for conservation. The paper proposes preserving the tradition as it forms, rather than reconstructing it after centuries of loss. Cryptographic hashes, sealed snapshots and records of data origins could support this work.
Code is the best-preserved kind of text in this tradition. Version control can preserve earlier states with hashes and timestamps, and signed records where projects sign them. If the history survives, a codebase's pre-2022 state may be a file to check out, rather than a lost original to reconstruct. If this kind of forward-looking preservation can succeed anywhere, it is here.
The security consequence. A flawed coding pattern can be committed in one year, scraped, and potentially trained into models two years later. Engineered markers demonstrate transmission, and the paper also records evidence from reference-based teacher tests. Whether natural habits support ancestry reconstruction remains unresolved. Extending the transmission argument to security-relevant coding mistakes is a further inference for which the paper reports no direct study. That extension needs careful testing.
A planned study would trace specific defect patterns backwards through time. If the inference holds, vulnerable patterns could be inherited through training data, rather than reinvented independently each time. An attacker could then deliberately seed public repositories with a subtly broken pattern that future models learn to imitate. On this account, the shared training corpus would be both a limit on what review can know and an attack surface through which correlated failure could be engineered.
Two dated sources beyond the paper bear on this security consequence: a late-2025 poisoning study and a May 2026 practitioner's account. Both are declared exceptions to the rule stated in the opening and appear in the Annex.
The prediction about development through time fails if, across successive model generations:
The tests available today are narrower. Existing research offers several candidate methods:
Of the programme's own proposed experiment, the paper says only the planted-marker part can run today. This is a limit on that experiment, not a claim that other tests could never prove reliable.
The more distinctly stemmatic operations (comparing many witnesses and grouping natural, unplanted features into a family tree) need a measurement that is still missing. How unlikely is a natural habit, or a set of habits assessed together, under independent origin? How much more likely is it under shared ancestry? None of the studies examined supplies this measurement, as Section 4 explains.
Trees based on output similarity already exist; §7.1 of the paper discusses the closest, PhyloLM. The paper's searches did not find a tree over many models, built from features scored both for their improbability under coincidence and for their likelihood of inheritance, and then validated against documented lineage. It treats this absence as provisional, following a search in October 2026. The long-term programme is much larger than what can be built and run this year.
There is also evidence pulling in the other direction. On the mistake-making channel, more capable models are more correlated, not less. This is a comparison across models at one time, not across generations (Section 3).
Publication could also weaken the method. If the programme succeeds publicly, future models will end up training on its descriptions and published examples, making its detectors targets for optimisation. Their effectiveness could fall, and planted markers would need continual refreshment. Reliability must therefore be tested over time, even if the tradition becomes more amenable to stemmatic study. The paper predicts that latter development; it has not measured it.
The framework must remain open to failure. Predicting one's own objections does not establish that a theory is correct. Nor does predicting that its subject will increasingly fit it. If every possible outcome appears to confirm a framework, the argument has become impossible to disprove. The paper flags this weakness in its limits section. A prediction of a better fit over time is a reason to test the framework harder, not a reason to believe it in advance.
The practical answer to the question in Section 2 is four working conditions. They apply both to the verdicts this practice is willing to stand behind and to the research programme in Sections 4 and 5. Each identifies something that may be missing in a particular case.
If running the code, checking types or consulting a specification would settle a question, the panel's opinion is subordinate to that check. Testimony covers only the often substantial remainder, where mechanical checks and normative documents do not settle the question. Even there, its role is sampling and triage under a human's final decision. A panel should not adjudicate a question a compiler has already settled.
The proportion of review weight resting on mechanical checks should only increase, especially since reviewer independence is lowest among the most capable models. Here, “mechanical checks” means execution, proofs and tests; reading more specifications does not count. Verification moves trust rather than eliminating it. Trust remains in the human decision-maker, the proposed independence measurement, the controls and the checks themselves. The paper records author-built positive controls, including one documented case of author-tuning. The safeguard failure described below shows why controls also need scrutiny.
The paper calls this the model lineage. A single verdict is one draw from a distribution (Section 2). This applies equally to findings one wants to believe, including an alarming vulnerability report.
Vendor labels and the number of agreeing reviewers do not establish it. Neither does knowing who answered: identity does not reveal how correlated the answers were. The practice has got this measurement wrong twice before (Section 7). Measuring can narrow uncertainty, but cannot eliminate it (Section 3).
Send dissent to a mechanical check wherever one exists. Section 3 explains where this works and what it costs ("Dissent creates work"); Section 7 explains how findings close.
The practice once built a safeguard to reject unproven "nothing found" claims. A reviewer found six ways around it; its own five test cases had caught none. The safeguard had repeated the failure it was designed to prevent. The question "who checks the checkers?" does not disappear at some final layer. It moves up a level.
In August 2026, the practice compared its full review with one inexpensive pass on two codebases. The comparison was pre-registered and blind-scored. The full review did not earn its cost: it lost on one codebase and could not be named the winner on the other.
A later audit found the comparison less clean than first stated. The inexpensive pass's recall figures were retrieval-contaminated, so the direction stands and the margin does not. The published note cited below lists further limits: only two codebases, one with a four-finding answer key; a scorer from the same model vendor as the model running the experiment; unknowable exposure of the full review to the same contamination; and costs counted in model calls, which flatters the inexpensive pass.
This is the account in We measured our own method, and it did not earn its cost (counterproof.io, published 16 September 2026). The paper does not carry this measurement. This account is the third declared exception to the rule, stated in the opening, that this introduction says nothing the paper does not say.
Commercial promises must be answerable to the evidence. The practice therefore describes its commitments as refusals that a client can check.
An earlier introduction claimed that error correlation was measured in every panel before agreement was accepted as meaningful. That was false. The proposed instrument has not been built.
Two earlier attempts failed in different ways. An early statistical test was set up backwards. A later check measured whether reviewers were literally the same system, rather than whether their errors correlated. Reviewers caught the second mistake; the record does not say who caught the first.
Present practice does less than the proposed measurement:
The paper also distinguishes different review procedures. Where it describes separate or blind work, no reviewer saw another's answer. Its v1.37 entry records that the v1.33 and v1.35 confirmation rounds supplied other seats' findings as material. Neither procedure establishes measured independence of errors.
This is a discipline built around independence, not a measurement of it. A practice selling careful evidence-handling cannot advertise an instrument that its methodology lists as unbuilt. This kind of mistake has been made and caught twice. Stating the limitation publicly is part of guarding against the mistake recurring.
The intended product is a record a sceptical reader can examine. Whether it withstands that examination is for the reader to judge. It records:
A score can summarise such a record. This programme already uses one whose formula is fixed in advance, whose exclusions are stated and whose counts come from a script. That is one legitimate instrument; it does not rule out other trustworthy forms of scoring. The problem is a number offered instead of the underlying, re-runnable record, or a fluent summary of unmeasured agreement presented as proof.
Whether the record earns its cost against a strong in-house review team requires an experiment with a client. It cannot be claimed in advance. The practice's August 2026 measurement, described as a declared exception in Section 6, compared the full review with one inexpensive pass, not with an in-house team.
Two further limits matter to this commercial account. First, the framework does not measure whether the caution being sold is proportionate to the frequency of errors in AI-generated output. A seller of adversarial review has an interest in believing it necessary. The question remains open, with that conflict disclosed.
Second, as the paper reports from a check on 23 August 2026, no case records were public: no report or reproducible artifact an outside reader could download and run. That dated check supports an account of how the record was constructed. It does not establish that an outside reader could test it then. The paper supplies no later publication check.
This introduction is an entry point. The paper offers the fuller argument.
The programme does not claim to have built a reliable instrument for judging AI output. It proposes an account of the conditions such an instrument would have to satisfy, and experiments capable of showing that account to be wrong.
The four working conditions in Section 6 are the practical starting point: defer to mechanical checks; treat a model's whole tendency as the witness; measure independence separately for each kind of question; and route disagreement to evidence, not to a vote. The third remains a discipline rather than a measurement. The controlled comparison designed to test whether the method produces better code was cancelled before it ran. The practice's separate August 2026 measurement is reported, as a declared exception, in Section 6.
The proposed work has three parts:
Failure of the first would seriously damage the thesis. That is what makes it a test worth running: the result can count against the proposal.
These two accounts, a late-2025 poisoning study and a May 2026 practitioner's account, are declared exceptions to the rule stated in the opening. They bear on the code-repository scenario in Section 5 (“The security consequence”), but neither establishes the inheritance of defective coding habits between models.
A late-2025 study by a thirteen-author team from the UK AI Security Institute, Anthropic and the Alan Turing Institute, with Oxford and ETH Zurich, tests the closest mechanism this document has encountered to the scenario in Section 5 (Souly, Rando, Chapman et al., arXiv:2510.07192). Its result is narrower than lineage inheritance.
The authors pretrain dense autoregressive transformers from 600M to 13B parameters on Chinchilla-optimal datasets. A near-constant absolute number of poisoned documents, 250, compromises models across all the model and dataset sizes tested. Those documents implant a trigger-conditioned change in behaviour without substantially affecting general capability.
This demonstrates a necessary sub-mechanism for the code-repository scenario: implantation once poisoned examples are already in the training mix. The code-repository scenario asks more: would an always-on coding habit survive an ordinary scrape, including deduplication and filtering? The experimenters controlled the training mix and planted behaviours activated by a trigger. They did not test that harder case.
As described here, the study also does not show whether the implanted feature passes to a second model trained on the first model's output. The paper records transmission evidence from engineered markers and reference-based teacher tests, but reports no direct study of inheritance of defective coding habits.
The study also bears on Section 5's discussion of banalisation. Attack success “decays approximately logarithmically” during continued clean pretraining, although clean pretraining alone does not remove the backdoor. A minority feature eroding under pressure from the majority distribution resembles part of the proposed mechanism. The study does not yet show the drift toward an easier reading that copyists show.
Alignment fine-tuning brings attack success almost to zero in the tested settings. That is a deliberate intervention, with no counterpart in unguided transmission. The study's own limitations flag the backdoor's persistence through realistic post-training as unassessed.
Bjarne Stroustrup, the designer of C++, discusses a related concern in a May 2026 interview on The Peterman Pod, hosted by Ryan Peterman. The quotations below are taken from the host's published transcript and were checked against the recording.
Speaking of AI-generated code, Stroustrup says: “when fed with training data, it has to be trained with old code … I find that LLM-based code is imitating old code and getting old performance and old bugs again” (1:32:09).
Earlier, recalling a study of buffer overflows and hacking and a Herb Sutter talk “with actual numbers”, he says: “More than 90% are from people who don't write modern C++” (46:31). He says 1990s optimisation habits persist “because the techniques carry on in people's heads and some of the code remains” (1:25:58). Explaining why he kept C compatibility, he says he preferred Dennis Ritchie's known mistakes to his own unknown ones: a choice he calls “much more manageable and understandable” (31:21).
Taken together, these remarks describe old techniques persisting through people and code. Stroustrup believes that models trained on old code repeat old bugs. This is testimony, not evidence of transmission: no defect is followed backward and no lineage is shown. His “bugs” are defects he believes a model repeats from older human-written code. The account is not evidence that two models sharing a bug are related.
Nor does it identify a usable lineage marker. The measurement Section 4 calls for remains missing: whether a recurring habit is improbable under independent origin and substantially more probable under shared ancestry. The planned tracing study exists to test such claims.
Adjudication. Deciding each finding, whether reviewers agree or disagree. A mechanical check decides where one exists; otherwise, a named human decides. A finding closes only when whoever raised it withdraws it or the issue is demonstrated against the code, never by counting votes.
Attractor. Here, an error attractor: a wrong answer that several systems reach independently, without copying. The usual explanation is that it is the most probable mistake given their training. That explanation is a hypothesis about the cause, not part of the definition. The measurements reported in the paper establish that shared errors are common, but not what share arose without copying. A shared error alone therefore does not establish ancestry. Cultural-evolution research uses attractor more broadly for common, stable forms, whether right or wrong.
Banalisation / model collapse. Banalisation is the manuscript process the paper names: repeated copying that favours easy or familiar forms wears away unusual ones. The paper compares it with model collapse: the loss of rare patterns when models are repeatedly trained on model-generated text that wholly replaces real data, with no real data mixed back in. Common, “safe” patterns increasingly dominate. Where synthetic data instead accumulates alongside real data, language-model experiments found collapse avoided in the settings studied. The distinction between replacement and accumulation matters to the claim.
Collation. Comparing witnesses to judge what is likely reliable. Here, collation samples and cross-checks their answers; it does not guarantee the reconstruction of one true answer.
Contamination / contaminatio. In Section 5 (ambient contamination), contamination means AI-generated text entering training data. In manuscript studies, contaminatio means a copy combines readings from more than one earlier source, making its ancestry harder to trace. Section 8 applies the word, in the paper's sense of a source influenced by material available during its production, to both companions: this introduction and the Prolegomena.
Decidable / judgement question. A decidable question, as the word is used here, has an available mechanical check that settles it: execute code, check types, run a test or consult a specification. This is an everyday use, not the strict mathematical meaning. A judgement question has no such check available: whether a design is sound, how severe an issue is or what a clause means. Section 1 explains the limits of consulting a specification.
Distillation. Training a new, usually smaller model to imitate a chosen larger “teacher” model's outputs. This is one channel by which today's model output enters tomorrow's training data.
Draw. See Lineage.
Judgement question. See Decidable / judgement question.
Lectio difficilior / lectio facilior. The harder, less usual reading and the easier, more expected reading of a text. Copyists tend to drift toward the latter through repeated copying. Following the paper, this introduction compares that drift with model collapse under replacement training.
Lineage. The word has two uses here. In the review argument (Section 6), it denotes a model's answers considered as a distribution, characterised through repeated sampling. Any individual answer is one draw from that distribution. Sections 4 and 5 also use lineage in its usual sense of ancestry: which models descend from, or were trained on, which others.
Measured independence / decorrelation. Whether reviewers' answers are independent must be checked with data, separately for each kind of question. Different company names or separate commissioning do not establish it. In the historical records (this document's Appendix and the paper's changelog), “decorrelated seat” expresses the practice's intent at the time, not a measured property. The paper's v1.37 entry records that confirmation rounds of the v1.33 and v1.35 reviews supplied other seats' findings as material, so the label does not by itself mean that a seat was not shown them. Where the paper says reviewers worked separately or blind, none saw another's answer. That procedure still does not establish measured independence of their errors. See Section 7.
Planted marker / watermark. A statistical signature deliberately embedded in a model's outputs. Its later appearance in another model provides evidence that the second was trained, at least partly, on the first model's output. This form of transmission has been demonstrated.
Reconstruction. Recovery of a single, definitive answer. This introduction restricts the word to decidable questions, where a mechanical check exists. Applying it to judgement questions would repeat an overreach the paper withdrew.
Seat. One position on a review panel: one model, from one lineage, with its own brief and tools. This is the practice's definition.
Stemma / stemmatics. A stemma is a reconstructed family tree showing which manuscripts descend from which others. Stemmatics is the discipline of building one. Agentic stemmatics is the programme's proposed name for analogous work on model lineages.
Testimony. A model's output considered as a claim to be weighed, as a court weighs a witness's account.
Triage. A fast, inexpensive first pass that directs attention toward findings worth a closer, more costly check. It is not a final verdict on its own.
Adversarial hyparchetype. See Hyparchetype.
Archetype. In manuscript studies, the original text from which a family of copies descends. Many AI-review questions may have no single equivalent: no one right answer to reconstruct (Section 2).
Cannot emend. See Emendation.
Emendation. A proposed correction that recovers a reading no surviving manuscript contains: an informed conjecture about the lost original. The current review method cannot do this. It works only with findings a reviewer actually raises (Section 3).
Evidence rung. A label recording how far a finding was checked, without implying a higher level. This is the practice's terminology; the paper uses reproduced and read (Section 7). The four rungs for a confirmed finding, from weakest to strongest, are:
A finding that reaches none of these is graded plausible-only. That is a separate grade, not a weaker rung. This entry was corrected on 14 September 2026; see the Appendix.
Homoplasy. A biological term for a similar trait arising independently in unrelated species: convergence rather than shared ancestry. It is the closest parallel to attractors (Section 4).
Hyparchetype / adversarial hyparchetype. A hyparchetype is a lost intermediate ancestor shared by several surviving manuscripts. The introduction's adversarial hyparchetype names a proposed security risk: the shared pool of past text and code is both a limit on what reviewers can independently know and a place where an attacker could plant a broken pattern for future models to copy. See Section 5, “The security consequence”.
Idiosyncrasy. A stable habit that distinguishes a model: word choice, structure or formatting. It helps identify models. To count as strong evidence of common ancestry, a habit shared by two models, or a group of such habits assessed together, must be unlikely under independent origin and substantially more probable under shared ancestry (Section 4).
Leitfehler. German for “guiding error”: a shared mistake improbable enough to support common ancestry, unlike an easily repeated slip. Section 4 calls it a telling clue to ancestry.
Oldest witness. The pre-2022 archive: the oldest dated layer available at scale, useful as a baseline rather than inherently better text. It is not free of machine-generated material (Section 5).
Oracle. A mechanical check that settles a decidable question: executing code, checking types, running a test or consulting a specification. Section 1 explains what the last of these can and cannot settle. An appropriate oracle outranks a panel's opinion.
Polygenetic error. An easy or natural mistake that arises independently in unrelated sources, without copying. It is the opposite of a Leitfehler: what Section 4 calls an ordinary slip.
Residue. The often substantial set of judgement questions left after mechanical checks and normative documents have settled what they can. Section 6 calls it the remainder.
Sealed vintage / provenance manifest. A snapshot of data or code, cryptographically sealed and timestamped, whose state at that time can later be verified.
Stratigraphy. Reading deposited layers to establish their relative dates. Here, model generations may leave characteristic, datable forms. Whether those forms help reconstruct ancestry remains to be tested. See Section 5, “Layering”.
Current version: v0.27, 29 October 2026, DRAFT, published while still under revision, with no external editorial or peer review; the paper governs wherever the two differ.
Open review items: the revision history records closure as pending for Kimi's four v0.13 items and for the four fixes made in v0.4.
The rule: this guide follows the paper's claims, subject to the declared exceptions below and the labelled musical teaching comparison in Section 1. The comparison illustrates a distinction; it supplies no evidence for the paper.
Three declared exceptions to that rule, each labelled where it appears: the poisoning-study and practitioner's-account paragraphs in the Annex (added to Part 4 at v0.6 and v0.7, moved to the Annex at v0.15) and the practice's August 2026 measurement in Section 6 (added at v0.14, to what was then Part 5). The Glossary's Seat and Evidence rung entries, and the Section 7 sentence pointing to the latter, give the practice's own definitions, from its glossary: they describe the practice, not the paper.
What to expect in the paper. The paper this document introduces is not an easy read, and that is on purpose. It is dense: a long declaration of who has a financial interest in the outcome, a detailed version history, and a running account of the paper's own past mistakes and how they were fixed. One appendix (the one recording what went wrong and when) is longer than several of the paper's argument sections. That is not a flaw the paper is apologising for: a paper about not trusting a source just because it sounds confident would be undermining its own point if it hid its own revision history. But it does mean the paper is hard to enter cold.
How this differs from the Prolegomena. The Prolegomena uses Kant's 1783 Prolegomena to Any Future Metaphysics as a structural frame: his method of starting from something the reader already grants and asking what conditions would have to hold for it to be possible, plus his device of staging a disagreement as two conflicting positions that turn out to share a hidden false assumption. That frame rewards a reader who already has some philosophical background, and is a real obstacle for a reader who doesn't. This document keeps the same underlying argument and the same order of topics but drops the Kantian scaffolding entirely and says everything in plain terms; where the frame did real work (mainly the point that two sides of a debate can both be wrong in the same way) it keeps that point and drops the vocabulary that carried it. The Prolegomena is worth reading if the plain version here raises a question this document didn't have room to chase down, or if the philosophical framing itself is of interest.
About the companion citation. v1.41, deposited on 18 Oct 2026 (version DOI 10.5281/zenodo.23458161), is now the version of record. Since v1.39 the paper states its central rule with two conditions: a shared feature counts as strong evidence of common ancestry only if it is unlikely to have arisen independently and substantially more probable under descent; v1.41 records the literature search for the restated form of its absence claim. v1.35 was the paper's correction revision, deposited on 25 Sep 2026 (version DOI 10.5281/zenodo.22959463). After two outside reviews of v1.33 it no longer says that shared model errors mostly arise without copying, states its central rule as a proposal to be tested rather than an established result, and corrects several statements to what their sources show. It keeps v1.33's withdrawal of the suggestion that a reconstructed and validated model family tree is an open research problem (PhyloLM, which the paper discusses, builds such trees from output similarity), and names the AI lineage it was drafted with, as this document's byline does; its revisions were checked by AI reviewers from several developers (see Glossary: Seat). It succeeded the v1.31 deposit, a readability revision of the deposited v1.29 text, and was followed by the v1.38 deposit of 16 Oct 2026. The corrections this document mirrors are listed in the paper's Appendix A.
Numbering. The items and entries below that predate v0.24 keep the numbering of their time, Parts 0 to 7. At v0.24 the old Part 0 was folded into a new Section 1, so each earlier Part N is now Section N+1. The section the old #part-6 anchor opened is now Section 7; a link to #part-6 now opens Section 6.
v0.27, 29 Oct 2026, DRAFT, published while still under revision. Section 1 gains one sourced musical teaching comparison and an immediate software counterpart. The opening now explicitly distinguishes this illustrative addition from the three existing declared exceptions; it is not evidence for the paper. The comparison preserves the distinction between a lineage characterised through repeated samples and a single answer, and between exposure and a demonstrated causal contribution. A related essay is linked. Prepared with Codex (OpenAI) assistance; no separate external review is claimed for this addition. The companion paper and its deposit are unchanged.
Key: a seat is one AI reviewer (Glossary: Seat); a row is one finding a seat raised, and its raiser is that seat; capitalised labels such as CONFIRM-CLOSED, PARTIALLY-CLOSED, CHANGES NEEDED, REVISE and MERGE-WITH-EDITS are a seat's verdict on a draft, a diff, a set of checks, or its own earlier rows; the closure log is the repository linked below; the drafting assistant is Claude (Anthropic lineage).
v0.26, 27 Oct 2026, DRAFT, published while still under revision. Section 1 gains "The wider purpose of CounterProof Research", a short explanation of the institutional purpose and neighbouring programmes introduced in the paper's web revision v1.43, §10. It distinguishes stemmatics from proposed work on agentic representation and institutions, while retaining the requirement that each programme establish its own contribution. Prepared with Codex (OpenAI) at L. J. Soons' request and compared with that subsection; it adds no declared exception to this guide's rule. The paper subsection received the Grok review and separate advisory consultation recorded in the paper's Appendix A; this introductory paraphrase was not separately put to an external model seat. The companion citation now identifies web text v1.43 separately from the unchanged v1.41 Zenodo deposit.
v0.25, 24 Oct 2026, DRAFT, published while still under revision. Section 2 gains a subsection, "Is code a model wrote different from code a person wrote?", added at L. J. Soons' request so that a reader finds in one place what the guide had said in parts: that the paper makes no claim that code written by a model is detectably different, or worse, in itself; that such code is still a program, while the model's account of it is a claim; that the difference that matters most for review is what agreement means, since the manuscript inference from a shared peculiar error does not transfer wholesale to shared model errors; and that human writing influenced by models enters the same emerging tradition. The subsection is built from the paper's §§1 to 4, 6 and 11 (including §11.8) and declares no new exception; the three declared exceptions are unchanged. Checked before publication against the paper passages it rests on by Grok (xAI) and DeepSeek, each under its own brief: 8 rows and 5, two of them shared, among them that "more often alike for another reason" stated a frequency the paper leaves unmeasured. All of DeepSeek's rows and six of Grok's were adopted; Grok's other two concerned sections the pack had not shown it (the paper's §3, the guide's Section 6) and were closed by that seat once shown. Confirmation rounds then alternated between the two seats until each had seen the final wording: they closed every row and moved three section pointers to the sentences they support, and the last round, by Grok, found nothing open.
v0.24, 23 Oct 2026, DRAFT, published while still under revision. A readability revision, prepared with Codex (OpenAI) at L. J. Soons' request from v0.23 and checked by the drafting lineage (Claude) against v0.23 and the paper (web text v1.42, which records the v1.41 deposit and changes nothing else). The old Part 0, which asked the reader to take in this document's rules and limits before the problem they apply to, is replaced by a concrete opening: three reviewers can repeat one mistake as three copies of a manuscript can inherit one error. The guide now runs from Section 1 to Section 8 and its cross-references are renumbered; items and entries in this Appendix keep the numbering of their time. Sentences are shortened, crowded paragraphs split under subheadings, qualifications placed after the claims they qualify, and repeated commentary on the text's own caution reduced; the examples, figures, citations, uncertainty and declared exceptions are kept, and the central rule keeps both of its conditions. The editor restored the rule and the pointer to the paper's §13 in the opening, removed the draft's dashes, and corrected two sentences that described this document as a "source introduction". Earlier changes to the Annex, in the numbering of their time: the two accounts moved from Part 4 to the Annex at v0.15; at v0.20 the poisoning-study account was corrected to include reference-based teacher tests alongside engineered markers and to distinguish transmission from inheritance of defective coding habits. Compared with v0.23 before publication by DeepSeek and Grok (xAI), each under its own brief: 6 and 23 findings, five shared; all adopted, restoring v0.23's claim strength wherever the rewrite had shifted it while keeping the new sentence shapes, among them the gate that the whole method transfers only if both conditions are met and checked. A Grok confirmation round on the result found all 29 rows closed and no new defect. Translating the revision into Swedish then exposed further sentences that needed correction: five translators (Claude lineage), each asked to list every English sentence that was ambiguous, inconsistent or wrong, flagged them, and each change was checked against the paper or v0.23 before it was made. Besides the claim-level corrections listed under Corrections this document carries, pronouns and back-references regained the antecedents the rewrite had dropped. These corrections were compared before publication with the text the first round had passed, by Grok (xAI) and DeepSeek, each under its own brief: 7 rows and 1. All of Grok's rows were adopted; its confirmation round found five closed, one the placeholder this sentence replaces, and one wording point, which was then applied in the seat's own words (the paper's "the generators' actual error rates"). DeepSeek's row, on what the paper calls banalisation, was fixed in the direction the paper's own text gives rather than in the wording the seat proposed; a DeepSeek confirmation round, judging from the paper's words, closed it and checked the Grok wording point, finding no new defect. The published revision was then translated into Dutch, French, Spanish and German; those translators (Claude lineage), asked the same question, flagged further English sentences, and each change was checked against the paper or v0.23 before it was made. The doubled horizontal line before this Appendix was removed at the same time. These corrections were compared before publication with the live text by Grok (xAI) and DeepSeek, each under its own brief: 5 rows and 2. Grok's rows were all adopted, four in the seat's own words and the fifth by restoring the published review sentence word for word; DeepSeek's second row was adopted (the paper's word "collation") and its first was not, because the two translator counts describe two different translations, a reason its confirmation round accepted. Two Grok confirmation rounds followed, the second on the last changes from the translators' notes; they closed four rows and left two wording points in this Appendix's own correction item, both then applied in the seat's own words, with no defect found in the argument.
v0.23, 23 Oct 2026, DRAFT, published while still under revision. Corrections found while translating this document into Swedish. Six translators (Claude lineage), each asked to list every English sentence that was ambiguous, inconsistent or wrong, flagged them; each change was checked against the paper before it was made. Parts 3 and 4 and the Glossary's Idiosyncrasy entry now state both conditions of the rule, as the paper has since v1.39 and as the v0.22 correction said this document did; Part 2's testimony-alone sentence now says that the paper neither affirms nor rules out such a domain; Part 4 counts six consequences and spells out its cross-reference; the appendix note on deposits names v1.41. Following this document's own v0.14 rule, entries below that called a commissioned seat "outside" now say "of another lineage"; the v0.18 entry no longer calls the tenth review round of v1.33 its last, the v0.8 entry counts five corrections, and the v0.7 entry no longer says every row was closed while four awaited their raisers. Wording: "reports no direct study" (twice), "neither of the other two seats", "the studies it draws on", "the condition in part one". Checked against the paper by one seat of another lineage (DeepSeek) before publication; it found no defect.
v0.21, 26 Sep 2026, DRAFT, published while still under revision. At the author's decision, after the paper's v1.37 entry recorded that confirmation rounds of its review supplied other seats' findings, the glossary's account of "decorrelated seat" no longer says that such a seat was not shown the other seats' findings, or that it is a seat from a different developer; it follows the paper's terminology note that the word records the practice's intent at the time, not a measured property, and the paper's distinction between separate or blind work and confirmation rounds. A Codex seat reviewing that change found that Part 6's account of present practice still said earlier findings are withheld from a fresh reviewer so that its agreement "can't be artificially manufactured by anchoring"; that sentence now uses the seat's replacement text, which makes the same distinction and says that neither procedure establishes measured independence of errors. Both new passages are the seat's text, applied verbatim. Put to a Codex seat in two rounds, with its tool's global instructions file set aside for each run (the author reports; run logs filed with the round records): the first returned CONFIRM-WITH-EDITS with the two replacement texts applied here; the second confirmed both closed and found that this entry had said more than the review established about why the developer-based definition was dropped. That clause is removed, and the removal and this sentence were not put back to the seat.
v0.20, 26 Sep 2026, DRAFT, published while still under revision. The Codex seat's round-2 rows on v0.19 were put back to a Codex seat in a confirmation round: the ten rows that round had left partly closed, and all fifteen of its replacement texts, were confirmed closed. That round found six further points, each answered here by the seat's own replacement text, applied verbatim apart from the page's markup. Part 2 no longer says that nothing about who made the reviewers tells you which is true; Part 5 no longer makes surviving outside scrutiny a condition of earning trust, and no longer says that the team running the process built every part of the trusted foundation; the Annex no longer restricts the evidence to watermark-style distillation; and the appendix paragraph on deposits now names v1.35 and says that its checks concern the earlier deposits. The seat also found that the last sentences of the v0.19 entry below say more than happened; that entry stands as written, and the seat's corrected account reads: "The drafter records two rounds of review by Codex and Kimi before publication. The author reports that the Codex tool’s global instructions file was set aside; the supplied Codex return nevertheless records exposure to developer-supplied skill and agent catalogues and says it cannot establish whether any supplied instruction originated from such a file. The drafter reports that Kimi closed its v0.19 findings. Codex’s second-round return left ten rows partially closed. Its F1–F7 and C1–C8 replacement texts were applied verbatim apart from a lower-case initial after a colon and page markup; its Task D repairs were incorporated through separately drafted revision entries. These changes were not returned to Codex before publication. The companion citation’s move to deposited v1.35 followed the second round and was not reviewed in that round." Put back to a Codex seat, with its tool's global instructions file set aside for the run (the author reports; run log filed with the round records), all six findings were confirmed closed, including B1's correction in this entry. The same seat found that the Annex's opening still said its text was unchanged except for three positional phrases; that paragraph now uses the seat's replacement text, applied verbatim, and was not put back to it. The seat could not check from its packet that nothing else changed, because the packet held no copy of v0.19; the drafter's script comparison of the two pages shows no change beyond those listed in this entry.
v0.19, 25 Sep 2026, DRAFT, published while still under revision. Follows paper v1.35, which corrected claims that two outside reviews of v1.33 found stronger than their sources, and applies this document's own rule to further sentences that said more than the paper. Parts 3 and 4 and the glossary no longer say that most shared model errors arise by coincidental convergence; they say shared errors are common and can arise without copying, and that the studies the paper considers do not establish what share did. The rule in Part 3 is stated as the paper's proposal, to be tested: its "if and only if" becomes a condition that must hold but would not by itself show which model descends from which, and a set of habits assessed together, accounting for their dependence, may also meet it; the claims that manuscript scholarship always enforced it and that a significant error proves descent give way to the paper's wording. Part 1 no longer says nothing outward can tell a supported answer from a mistaken one. Part 2 no longer makes independence the condition under which voting is sound or under which agreement is evidence; it says agreement can strengthen a claim where dependence has been assessed, and gives both rates of the ensemble study. Part 3 no longer says ancestry must be known before independence can be measured, that models will converge independently, that the "delve" words arose independently (Parts 3 and 4), or that an ordinary error or anything but a planted feature says nothing about copying, and it separates the attribution rate from the reported robustness to paraphrase. Part 4 no longer says that models contributed nothing back before 2022, that there was no lineage to reconstruct, that the pre-2022 archive is uncontaminated, that ambient contamination is the default condition, that the case for the framework grows stronger with time, that replacement training is the same process as copying, or that the programme's experiment has four tests available today; it scopes the missing tree to the paper's search and the falsification test to the claim about development through time, marks growth as argued and unmeasured, adds that mixing and the loss of rare forms can erase lineage clues, and reports the accumulation result as collapse avoided in the settings studied; it also restates its falsification criteria as the paper's, records reference-based teacher tests beside planted markers, calls its detectors targets for optimisation rather than evasion, narrows its historical comparison, and makes recovery of earlier code conditional on surviving version history. Part 4's planted-marker passage says "demonstration" where the paper says "proof". Part 5 states which mechanical checks its increasing-weight commitment means, and Part 6 dates the check on public case records and no longer carries it forward. The glossary follows (Attractor, Banalisation, Idiosyncrasy, Lectio, Leitfehler, Oldest witness, Planted marker, Stratigraphy); the Attractor entry drops a clause about noisy copying and two empirical statements that the paper does not carry, and the oldest-source heading says "dated" where it said "clean". The companion citation moves to v1.35, deposited on 25 Sep 2026. Checked against the paper by two seats of other lineages (Codex and Kimi) in two rounds before publication, the Codex seat with its tool's global instructions file set aside at the author's decision. Kimi closed all its findings. Codex's second-round findings were answered by its own replacement text, applied verbatim apart from a lower-case initial after a colon and the page's markup, and not put back to it. The companion citation's move to the deposited v1.35 was made after the second round and was not seated.
v0.18, 25 Sep 2026, DRAFT, published while still under revision. Follows the final v1.33, whose tenth review round reviewed the late addition of a family-attribution method that weighs a family's shared wrong answers against how often other families make them (the paper's §10 and §7.1). Part 4's list of the tests available now gains that fourth item; nothing else changed. Checked against the paper by one seat of another lineage (Kimi) before publication; its one finding, on this entry's wording, was applied in the seat's own words and not put back to it. After that check the companion-citation note was updated for the paper's eleventh review round: five developers rather than four, and the paper now names its drafting lineage; that update was not seated.
v0.17, 24 Sep 2026, DRAFT, published while still under revision. Follows paper v1.33. The companion citation moves to v1.33 and its note is rewritten; the note no longer calls reviewers "decorrelated". Parts 2 and 6 drop the inference that choosing different vendors buys less independence as capability rises, which v1.33 withdrew, and say instead what the paper now says; Parts 3 and 4 scope the missing measurement to the studies the paper examines; Part 4 adds that family trees built from output similarity already exist, as the paper's §7.1 now says, and lists the pairwise wrong-answer screen among the tests available now, as §7.1 does. Checked against the paper by one seat of another lineage (Kimi) before publication; its six findings, among them two wrong part numbers in this entry, were applied and put back to it.
v0.16, 24 Sep 2026, DRAFT, published while still under revision. The opening paragraph and the page description rewritten to be easier to enter; no claim changed. The new opening says only what Parts 1 and 2 already say (agreement between models can count the same evidence more than once; different vendors are not by themselves independent), hedged as the paper hedges. Checked against the paper by a checker and by one seat of another lineage (Kimi) before publication.
v0.15, 24 Sep 2026, DRAFT, published while still under revision. Moves only; no claim changed. The two declared exceptions in Part 4 moved to a new Annex after Part 7, with a pointer left in Part 4; the three phrases that pointed at their old position ("this section", "the banalisation discussion above", "two paragraphs above") now name Part 4. Part 7's "What to expect in the paper" and the longer Prolegomena description moved to this Appendix; Part 7 keeps a one-sentence Prolegomena entry. Body from about 9,300 words to about 8,400. Seated once (Kimi, file access): clean apart from the byline's version stamp, fixed; it also closed its two v0.14 correction rows.
v0.14, 24 Sep 2026, DRAFT, published while still under revision. Cut and reordered for length (body from about 10,200 words to about 9,200): repetition cut to pointers, this document's draft history moved to the corrections list, Part 4 opened with its verdict and its limits gathered under one heading, its two exceptions boxed and collapsed in place, this history collapsed and put newest first; a third declared exception added (Part 5); "program", "skeptic", "skeptical" and "unlabeled" given British spellings. The page description now uses Part 2's own sentence and describes the paper as the argument "without its full defence, version history and correction record", as Part 7 does. No claim was changed except the corrections listed above; the other edits are cuts, moves, merges, pointers, labels and glosses from the paper or, where marked, from the practice's glossary or this site's own pages.
v0.13, 23 Sep 2026, DRAFT, published while still under revision. Structure only; no claim changed. The companion citation's deposit bookkeeping moved to this Appendix; two moved sentences carry small pointer repairs so they still read correctly where they now sit ("before you open it", "the v1.31 deposit"), and the moved rule paragraph gained a pointer to Part 7; Part 0's account of the paper's difficulty moved to Part 7; a pointer to Part 6 for readers commissioning a review; stemmatics and collation explained at first use and seat defined in the Glossary; the rule this document is under moved into Part 0 and the Prolegomena note into Part 7, which now says the Prolegomena is not yet published; broken brackets and stale pointers repaired; the Glossary split into the words this introduction uses and further terms, mostly the paper's vocabulary. Seated once (Kimi, file access) before publication, verdict CHANGES NEEDED on four items: three were the pointer repairs and headings recorded here, kept as deliberate; the fourth, a new sentence saying manuscript scholars call this comparison collation, went beyond the paper and was narrowed to what the paper says. Closure pending Kimi's next look.
v0.12, 22 Sep 2026, DRAFT, published while still under revision. Recording only: the v1.31 deposit facts named at v0.11 were confirmed the same day by two decorrelated seats, Kimi (Moonshot) and Grok (xAI), run blind and in parallel on a byte-identical brief, each fetching the Zenodo record and the served file itself, hashing served and local copies itself, and retrieving the concept record's versions listing rather than inferring the latest version from the DOI redirect; both returned CONFIRM-CLOSED on all seven checks with zero discrepancies. One corroboration gap, not a contradiction: the API carries no version label for the oldest record, whose v1.15 identity rests on its filename, record ID and chronology. Logged at the closure log, seq 29 to 31; no argument text changed.
v0.11, 22 Sep 2026, DRAFT, published while still under revision. Recording only: the companion citation moves v1.30 to v1.32 and the deposit line to v1.31 (deposited 22 Sep 2026, version DOI 10.5281/zenodo.22900116, checked over the Zenodo API and by byte-comparing the served file against the local copy by the drafting assistant; not yet confirmed by an independent seat); no argument text changed. v1.31 is a readability revision of the paper whose claims were verified unchanged by three decorrelated seats; nothing in this document needed to change for it, since this document quotes no paper wording verbatim and the paper's section structure is unchanged.
v0.10, 16 Sep 2026, DRAFT, published while still under revision. Recording only: the companion citation moves v1.29 → v1.30 and the deposit line to v1.29 (deposited 16 Sep 2026, version DOI 10.5281/zenodo.22790100, checked over the Zenodo API and by byte-comparing the served file against the local copy); no argument text changed.
v0.9, 15 Sep 2026, DRAFT, published while still under revision. Seated once (Kimi, file access, library PR #164); four named changes applied: the deleted vendor-diversity trend survived at two further sites and is now removed there too; the "partly"/5% pairing was unsupported by Sander's own mixture and is restated; Pan's paraphrase rider and multi-teacher mixing result added; the body's causal gloss aligned with the corrected glossary.
v0.8, 15 Sep 2026, DRAFT, published while still under revision. Five corrections applied from a three-round literature review of the lineage-signal evidence, each seated by at least one non-Anthropic lineage: the correlated-errors figures and the vendor-diversity trend (Part 2); the marker-inheritance citation and the paraphrase claim (Part 3); the Attractor glossary entry. Evidence trail: CVRR-LIT-2026-09-15-003 and CORRECTIONS-OWED-2026-09-15. No conclusion changed.
v0.7, 7 Sep 2026, DRAFT, published while still under revision. Every review row raised against this document has been closed by the seat that raised it, except the four fixed in the previous revision, which await their raisers' next look. It has had no external editorial or peer review, and the paper governs wherever the two differ. Author: Claude (Anthropic lineage), from L. J. Soons' instruction, with the paper and the Prolegomena (v0.16) in context throughout: contamination in the precise sense the paper's own §3 contaminatio row gives the word (a writer working with another document's findings already in view), and the reason this is a door and not a witness. v0.1 had no independent read at all. Three decorrelated, unprimed first reads then ran, none told what any other found: Qwen found no overreach. GLM found twelve instances where the Introduction stated something more strongly, more broadly, or more certainly than the Prolegomena (several re-introducing phrasings the Prolegomena's own review history had already caught and deliberately softened) plus two added claims with no Prolegomena counterpart; v0.2 applied all of them. DeepSeek, working from v0.2, found three further instances neither of the other two seats caught; v0.3 applied those. Both raising seats then confirmed their own rows against v0.3. DeepSeek's confirmation round returned CONFIRM-CLOSED on all three of its findings, and its own open-ended scan of the rest of v0.3 surfaced one new, unfiled instance: a discontinued-experiment sentence claiming its criteria were "published in advance" where the Prolegomena's §24 says only "frozen and quotable"; a narrower claim. GLM's confirmation round returned 13 of its 14 rows CONFIRM-CLOSED and one PARTIALLY-CLOSED (an added claim about how long manuscript scholarship has existed, which v0.3 had weakened but not fully retired) and its own open-ended scan of v0.3 found one further instance of that same defect class in a different paragraph, plus flagged (without raising as a row) a genuine editing artifact: a duplicated clause left over from the v0.3 splice fixing DeepSeek's finding. v0.4 applied GLM's remaining item, its same-class sweep catch, DeepSeek's new "published in advance" catch, and the duplicate-clause cleanup. All rows either seat has raised are now closed by that seat's own confirmation, except the four fixes made in v0.4, whose closure is pending each raiser's next look.
v0.7 (7 Sep 2026) adds one paragraph to Part 4 (“A practitioner's account of the same scenario, weighed as testimony”), quoting a May 2026 podcast interview with Bjarne Stroustrup: a second declared exception to the rule in Part 0 that this document says nothing the paper does not say. The paragraph reports practitioner testimony relevant to the code-repository scenario, expressly treats it as testimony rather than evidence, and leaves the natural-habit lineage question open. The quotations were matched character by character to the host's published transcript and checked against the recording by L. J. Soons on 7 Sep 2026. It was gated before merge by one decorrelated seat in two rounds: Codex (OpenAI) reviewed the initial draft cold (REVISE, six findings (four blocking, two edits; two of the blocking rows struck interpretive additions of the drafting assistant's own, one struck categorical wording, and one arose from a defective transcript extraction, disclosed to the seat and re-served) record CODEX-INTRO-STROUSTRUP-PARA-2026-09-07), then confirmed its own rows against the revised text (five of six CONFIRM-CLOSED, open-ended scan clean; the sixth, a line break inside a quotation in the hard-wrapped draft, was closed by a scripted character check rather than by the seat; CODEX-INTRO-STROUSTRUP-PARA-R2-2026-09-07). Codex then reviewed the library PR's diff for splice and changelog integrity (MERGE-AFTER-FIXES, one edit to this changelog entry, applied: CODEX-INTRO-V07-PR115-DIFF-2026-09-07, confirmed against the first-round record in CODEX-INTRO-V07-PR115-DIFF-R2-2026-09-07). No other argument text changed.
Deposit history and the scope of earlier checks. Until 16 Sep 2026 the companion citation at the top of this page stated that the concept DOI's most recent deposit was v1.25 (24 Aug 2026, version DOI 10.5281/zenodo.22077929); v1.29 was then deposited (16 Sep 2026, version DOI 10.5281/zenodo.22790100), and v1.31 after it (22 Sep 2026, version DOI 10.5281/zenodo.22900116); the companion citation now names v1.41, deposited on 18 Oct 2026 as version DOI 10.5281/zenodo.23458161 (see the note on the companion citation above). The checks described below concern the earlier v1.25 and v1.31 deposits. The v1.31 facts were checked by the drafting assistant over the Zenodo API and by byte-comparing the served file against the local copy, then independently confirmed the same day by two decorrelated seats, Kimi (Moonshot) and Grok (xAI), run blind and in parallel on a byte-identical brief, each fetching the record and hashing the served and local files itself and retrieving the versions listing directly; both returned CONFIRM-CLOSED on every checkable claim with zero discrepancies (closure log seq 31). The v1.25 facts were independently checked by two decorrelated seats: Kimi (Moonshot) and Grok (xAI), run blind and in parallel, each fetching the Zenodo record and hashing the deposited file themselves rather than trusting the drafting assistant's report. Both returned CONFIRM-CLOSED on every checkable claim, with zero discrepancies; Grok additionally queried Zenodo's versions-list endpoint directly, ruling out a newer, silently-skipped deposit. Recorded at the closure log's seq 15 (Kimi) and seq 16 (Grok): https://github.com/clvstra/agentic-stemmatics-closure-log. v0.6 (31 Aug 2026) adds one externally-cited paragraph to Part 4 (“New empirical grounding for the poisoning mechanism”, arXiv:2510.07192) (a declared exception to the rule that this document says nothing the paper does not say) gated before merge by two decorrelated seats (GLM on the initial draft, DeepSeek cold on the corrected text; both MERGE-WITH-EDITS; all edits applied except one of GLM's, superseded by direct PDF verification of the paper's own wording), plus direct source-verification of every cited fact against the study's PDF, and a Codex diff-integrity pass on the merge itself. v0.5 adds this paragraph; no argument text changed.