Companion to Agentic Stemmatics: Collation, Provenance, and Conservation for an Emerging Machine Textual Tradition (Soons, 2026, draft v1.32; doi:10.5281/zenodo.22030516; the concept DOI resolves to the most recent deposit, v1.31 (deposited 22 Sep 2026; version DOI 10.5281/zenodo.22900116). Draft v1.32 is one housekeeping revision past that deposit and exists to record it. v1.31 is a readability revision of the deposited v1.29 text, its claims verified unchanged by three decorrelated seats; the corrections this document mirrors landed in v1.28 and v1.29, inside the deposited text; all listed in its Appendix A.)
The paper this document introduces is not an easy read, and that is on purpose in a way that is worth explaining before anything else. Reviewers told the authors to strip out illustrative language, so what remains is dense: a long declaration of who has a financial interest in the outcome, a detailed version history, and a running account of the paper's own past mistakes and how they were fixed. One appendix (the one recording what went wrong and when) is longer than several of the paper's actual argument sections.
That is not a flaw the paper is apologising for. A paper about not trusting a source just because it sounds confident would be undermining its own point if it hid its own revision history. But it does mean the paper is hard to enter cold. This document is the on-ramp: a shorter, plainer statement of the same argument, written so a reader can get oriented before tackling the paper itself; or instead of tackling it, if what's needed is the shape of the idea rather than its full defence.
What is actually being claimed, stated once, before anything else. Engineers do sometimes come to know, after the fact, whether an AI model's verdict on a piece of code was right: by running the test, executing the code, or checking it against what a specification actually says, which settles what the specification says and not whether the specification itself is correct, or whether the verdict's underlying claim about the world holds. That much is granted as real: as something that does sometimes happen, not as a standing capability anyone can assume on demand. What is in question (what the whole paper is about) is something narrower and harder: whether an AI model's verdict can be trusted on its own word, without running anything, the way a historian treats a document's account of an event nobody living witnessed; not simply believed, but weighed, cross-checked, and attributed. That is the open question. It is not yet answered. Whether any answer to it would be reliable enough to sell is a separate, even harder question that the paper explicitly declines to take on: it says plainly that this is unmeasured, and that the people writing the paper have a financial interest in the answer, which they disclose rather than hide.
Two things to keep in mind while reading what follows:
This is an introduction, not a summary. A summary tries to hand you the conclusions in compressed form. An introduction tries to get you to the point where you could reach the conclusions yourself. Where the two disagree, trust the paper: and if a sentence here ever seems to promise more than the paper does, that is this document's error, not a discovery.
Every borrowed word is on loan and returned the moment it stops helping. The paper reaches for vocabulary from an old, unrelated field: the study of how handwritten manuscripts get copied, miscopied, and eventually reconstructed by scholars centuries later. That borrowing is not decoration. It turns out that the problem of figuring out which of several corrupted copies to trust is a problem with a formal, pre-existing discipline behind it. This document uses that borrowed vocabulary too, but only where it actually earns its place, and every term gets explained plainly the first time it shows up.
A normal computer program can, in principle, be read line by line. Its behaviour follows from its text, and a patient enough reader can trace cause to effect. A language model's output does not work this way: and the reason isn't that it's complicated, the way a large codebase is complicated. The reason is that the output isn't a step-by-step derivation at all. It's a claim: this code is correct, no vulnerability exists here, these tests pass. And nothing about how confident, fluent, or internally consistent that claim sounds tells you whether it's actually warranted.
Here is the structural fact everything else in this document follows from: the same mechanism that produces a well-grounded answer also produces a baseless one. There is ongoing research into whether some internal signal inside the model could in principle distinguish the two; and early results suggest that even a model's own written explanation of its reasoning can diverge from the actual computation that produced its answer, which is itself a reason for caution. But that research question isn't available to someone just using the model day to day. From the outside, nothing tells the two cases apart, and a decision still has to be made anyway.
So: treat an AI output the way a court or a historian treats witness testimony; something to be weighed, cross-checked, and attributed, never trusted because of how it's delivered, and never just averaged together with other testimony as if agreement alone settled anything.
One correction, made early because everything else depends on it: the thing you should distrust isn't a single output; it's the whole tendency of the model that produced it. Ask the same model the same question twice and you can get two different answers. That instability has been observed informally in this practice's own work, but it's not being offered here as a measured rate: no number is being claimed. The qualitative point alone is enough to force a correction: what you're actually dealing with is a distribution of possible answers a given model tends to produce, and any single answer you see is just one draw from it. This has an uncomfortable consequence that the paper accepts fully: even a finding that flags a serious problem is, itself, one draw; a claim still waiting to be checked against the actual code, not a verdict just because it sounds alarming. The cost of checking it has to be priced, not assumed to be free.
Two kinds of questions, and why the difference matters. Some questions about a piece of code have a mechanical answer available: run it, type-check it, test it, prove it, or look up what a specification actually says. Call these decidable questions: not in the strict mathematical sense of computability theory, just in the practical sense that some mechanical check settles it. For these, you don't need a panel of AI opinions. You need to run the thing. A review process that convenes several models to debate something a compiler would have settled in one second has misidentified the tool for the job.
Other questions have no such mechanical check available: is this design sound, is this a real defect if nobody can reproduce it, how severe is this actually, what does this contract clause mean. Call these judgement questions. Here, nothing runs and settles it: a verdict has to be built out of testimony, the same way a historian builds a case out of witnesses.
There is an important asymmetry to notice here, and it matters more than it might first seem. For a decidable question, there is one fact of the matter, and the mechanical check reaches it. For a judgement question, there may be no single right answer to converge on at all: code quality is often genuinely a matter of which specification you're holding, and two reviewers who disagree may simply be answering two different, both-legitimate questions rather than one of them being corrupted. That's not a hard version of "find the true answer." It's a case where "find the true answer" is the wrong description of the task. For judgement questions, what a panel of AI reviewers gives you is a sample of opinion, not a recovery of a lost fact.
The question this whole program exists to answer, in one sentence:
How can you get a trustworthy verdict out of several witnesses, when none of them is individually trustworthy, and you don't know whether they're actually independent of each other or all making the same mistake for the same reason?
That splits into three sub-questions, each answered in its own part below:
The obvious answer, and why it's not stupid. Ask several models the same question; go with what most of them say. This is the first thing every team tries, and it isn't naive: it's the correct procedure under exactly one condition: that the reviewers are making their mistakes independently of each other. Everything hangs on that condition being true, and it is almost never checked.
Two views that are both half-right, and the mistake they share. One camp says: agreement among several reviewers is meaningful evidence; without it, reviewing AI output would be hopeless, since every individual reviewer is admittedly unreliable and there's no better resource available. The other camp says: agreement is worthless; several reviewers converging on the same answer is exactly what you'd expect if they share a common cause (overlapping training data, similar training methods, a small number of underlying model families), so "they agree" just means "they inherited the same blind spot," dressed up to look like confirmation.
Framed as two opposing camps to make the shape of the disagreement vivid (a staging device, not a claim that these are the only two real positions, or that anyone actually holds them this cleanly) both sides turn out to be arguing from the same false assumption. That shared assumption is what actually gets resolved here, not the deeper practical problem underneath it: they both treat "independent" as something a review process either has or doesn't have, decided the moment you assemble the panel. It isn't. Independence has to be treated as something that gets measured, not something assumed: and it has to be measured separately for each kind of question you're asking. Two AI systems might be near-independent of each other on questions about memory-safety bugs, and effectively be one single witness wearing two names on questions about cryptographic protocol design. Nothing about who made them tells you which is true. Once you see that, both camps turn out to be right under a condition: agreement among reviewers whose independence on that specific kind of question has actually been measured is real evidence. Agreement among reviewers whose correlation is unmeasured is a reading off an instrument nobody has checked works.
Two limits sit on top of even this fix, and both come from the paper itself, not from outside criticism. First, the actual instrument that would do this measuring (tracking, per kind of question, how often two reviewers make the same mistake, and how far apart their habits are) has been proposed but not built. Second, independence can never be fully verified from inside the panel that's using it. Measuring it narrows your uncertainty. Nothing closes it completely. That's a standing limit the paper carries permanently, not a caveat that gets resolved later.
Why this isn't a theoretical worry (the actual numbers. Across more than 350 models tested on two public leaderboards and a screening task, when two models both get something wrong, they land on the same wrong answer far more often than chance would predict) a mean of 60% of the time on one leaderboard and 42% on the other. Pairs from different companies are included throughout; the study's model attributes more of the agreement to capability than to shared vendor on one leaderboard, the reverse on the other, and most of it to neither: and it reports no analysis restricted to cross-company pairs. And the finding with the sharpest practical bite: more capable models make more correlated mistakes, not fewer (Kim, Garg, Peng & Garg, ICML 2025). Read that twice, because it means the obvious fix ("we used models from three different companies") buys less protection the more capable the models are. Whether that protection is eroding over time has not been measured: the finding is a snapshot, not a trend.
So, put carefully: majority voting is unsafe specifically where reviewer independence is unmeasured or known to be failing; and this breaks down into two genuinely different problems, which should not be blurred together. First, correlated agreement gets counted as if it were confirmation, when it's really the same mistake showing up multiple times. Second, simple vote thresholds throw away minority opinions exactly in the cases where the correlated majority shares a blind spot: though this second point is the paper's own reasoned inference from the first, not something either underlying study directly measured, and that distinction is worth keeping straight.
One important thing this does not say: it does not follow that whoever disagrees with the majority is right. An earlier draft of the paper made that mistake (reasoning that felt neat but was actually circular) and had to walk it back. What actually follows is only this: under correlated majorities, a process that preserves and investigates dissent is the only kind of process that can ever recover a minority-true finding at all. Whether any particular dissent is one of those true minority findings is exactly what has to be checked against the code or against a mechanical test; dissenting doesn't earn a finding any special credibility on its own. It just keeps the finding alive long enough to be checked.
This is a conditional claim, not a blanket dismissal of voting. There's a real, serious case for voting in the right setting (precision, avoiding false-alarm fatigue, cheap first-pass triage at scale, genuine statistical gains when independence really does hold) and the paper's own reviewers raised exactly this case; the paper concedes it went unaddressed rather than dodging the gap. One preprint study (not yet peer-reviewed, and its own author describes the effect as modest and dependent on setup) found majority vote beating the single best model in under 10% of three-model test groups on one specific benchmark (MMLU-Pro). Where the actual goal is fast triage under alert fatigue rather than reconstructing what is objectively true, voting is a perfectly legitimate tool. What's being objected to is not the arithmetic of voting. It's presenting a triage shortcut as if it were a truth-finding procedure.
On dissent: why a lone objecting reviewer is neither always right nor safely ignorable. One view says a dissenting reviewer must always be investigated, or a correlated majority never gets corrected and the whole point of using multiple reviewers is lost. The other view says a dissenting reviewer must be discounted, or any single stubborn or compromised reviewer gets an effective veto over everything, and the process turns into a denial-of-service attack against itself.
The actual answer sits between both, and it isn't a clean resolution: it has a real gap, and the paper says so. Dissent should be neither automatically believed nor automatically discounted. It should be routed to a mechanical check wherever one exists. A dissenting opinion isn't authority: it's a request for evidence, and the right response is to run the test, read the specification, execute the code, not to hold a second vote.
Where no mechanical check exists, this answer is genuinely incomplete, and the paper says so in plain terms: there is no tie-breaking rule for disputes that can't be settled mechanically, and no cost model; only the requirement that the cost of chasing every dissent be priced honestly rather than assumed to be free. Anyone who reads "route it to evidence" as a finished procedure has mistaken a requirement for an implementation.
This approach costs something real, and the paper states the cost rather than hiding it. Four separately-commissioned reviews of the paper's own design converged, without being prompted to, on the same set of criticisms ("separately-commissioned" because that's a fact about how the reviewers were obtained, not a measured claim that their conclusions were reached independently: it effectively gives a stubborn reviewer veto power; it has no built-in limit on how many false alarms it can generate; it rewards over-flagging, since a finding that can't be voted down will just get raised more often; and it puts final authority in the hands of a single human decision-maker who is themselves unexamined) and, in this practice's case, someone with a declared financial interest in the outcome. Because of all this, the paper states plainly that this approach only works in a narrow setting: low-volume, high-stakes review, where mechanical checks are available, and panels are kept small. It does not scale to high-volume screening, and it is not offered as if it did. Used at low volume where most flagged issues turn out to be false alarms, it becomes a false-positive machine.
So: how is trustworthy collation actually possible? Not "collate instead of voting"; the real answer is conditional, and narrower than it might first sound. It has two separate parts, and an earlier draft of this very document accidentally merged them into one before an outside reviewer caught the mistake: worth naming, because the mistake is an easy one to make:
Part one: agreement. Agreement between reviewers is evidence of likely truth wherever their independence on that specific kind of question has actually been measured. No further restriction beyond that.
Part two: reconstructing a single "true" answer. This is a separate and more restricted claim: language about recovering one definitive ground truth only applies to decidable questions, where a mechanical check exists and outranks any panel anyway. For judgement questions, a panel of reviewers samples opinion: it doesn't recover a lost original fact, because for many judgement questions there may be no single fact to recover. Calling that "reconstruction" is the overreach an earlier paper draft made and later withdrew.
Today, part one is unmet: the measurement that would tell you whether independence actually holds hasn't been built yet, and nothing available from inside a panel can fully close that uncertainty. That alone is enough to settle the practical conclusion: no verdict resting on testimony alone is currently licensed by the paper; not because agreement is somehow restricted to only decidable questions (it isn't), but because the one condition agreement is evidence under hasn't itself been checked. And reconstruction was never a second route to the same destination: where a mechanical check exists, the warrant was always coming from that check, not from the panel; where no mechanical check exists, the paper simply withdraws the stronger claim rather than promising a capability it hasn't built. The everyday triage value of collation (the cheap, continuous first-pass screen that tells a more expensive, careful review where to look) also hasn't been run at real scale yet, but that's a separate, practical limitation, not a further unmet condition standing in the way of testimony-alone warrant.
Two consequences follow from this, and it's worth being precise about both, because two earlier attempts at stating this got it wrong in opposite directions. One draft claimed there's a third category of question (no mechanical check, but still a genuine fact of the matter) where testimony alone can be trusted; the paper never says this. The next draft swung the other way and declared that category empty; the paper doesn't say that either. What the paper actually leaves is narrower than both attempts: no domain where testimony alone is sufficient warrant is affirmed to exist, and none is shown to be empty either. The question stays genuinely open, exactly where the unbuilt independence measurement leaves it.
Second: in the meantime, verdicts close the way this practice actually closes them today; by demonstrating the issue against the real code, or by the person who raised the finding withdrawing it. What collation delivers right now is what it was designed to deliver: cheap, continuous, broad-coverage triage that tells a more careful, expensive check where to focus (proposed, and not yet proven at real scale) together with a record: findings routed to mechanical checks where possible, dissent preserved rather than discarded, and the remaining judgement calls decided by a named human. If a planned future experiment ever produces a case where collation itself, on its own, delivers a warranted verdict, that would be the first real instance of the open question above being answered: until then, any such example is only a promise, not a result.
And one hard ceiling sits above all of this, which no amount of careful collation lifts. The whole method can only choose among findings that some reviewer actually raised. It cannot surface a defect that every single reviewer missed. If every model shares the exact same blind spot and none of them dissents, the method is structurally blind to it: by construction, not by bad luck. Fixing that kind of problem belongs to a different toolkit entirely (interpretability research into the models themselves, or a mechanical check that catches it directly), and this program is honest that it doesn't reach there.
Part 2 ended on a requirement (measured independence) that Part 2 itself can't satisfy. To know whether two reviewers are actually independent, you first need to know how they're related to each other. Scholars who study handwritten manuscripts faced exactly this problem and built a formal method for it: reconstruct the family tree of the copies, and interpret agreement between two copies in light of where they sit on that tree, not just by counting how many copies agree.
The engine of that method, and the condition that was always attached to it. The classical method runs on a specific kind of clue: a shared mistake so arbitrary that two independent copyists landing on it by coincidence would be improbable; which means the shared mistake is better explained by both copies descending from a common, already-flawed source.
That condition was never optional, and manuscript scholars enforced it from the start. Not every shared mistake counts. Easy, obvious errors (simple slips, natural "corrections" toward more common phrasing, ordinary modernisations) are explicitly excluded, precisely because independent copyists tend to make those same easy mistakes on their own, with no copying involved. Only a mistake that's genuinely improbable to arise by coincidence carries real information about shared ancestry. Biology has the exact same problem under a different name: convergence, where two unrelated species independently evolve a similar trait, versus genuine shared inheritance, where they share the trait because they share an ancestor.
So the real rule was never "a shared mistake proves common origin." It was: a shared feature proves common origin only where the odds of that feature arising independently, by coincidence, are negligible.
The mistake an earlier draft made, and why the reviewers were right to catch it. An earlier version of the paper claimed that shared errors between AI models are evidence of shared training lineage. This was wrong, and the reviewers who flagged it were correct: two models trained on overlapping data toward similar goals will independently converge on the same plausible-but-wrong answers; not because either copied the other. The usual explanation, that the wrong answer is simply the easiest, most probable mistake given how they were both trained, is the working hypothesis rather than a measured cause (see Attractor in the glossary). Applied honestly to AI models, the manuscript scholars' own exclusion rule throws out most shared model errors as carrying no genealogical information at all: they're the AI equivalent of the "easy slip," not the AI equivalent of the rare, telling error.
That correction is worth pausing on, because of what it says about the framework itself: it's an instance of the exact same convergence-versus-inheritance problem that both source fields (textual scholarship and biology) already treat as their central difficulty. The paper notes the parallel and then declines to treat that as support for itself: because "our critics' objection is itself predicted by our own framework" has the shape of an argument that nothing could ever disprove, which is a warning sign, not a point of pride. It's recorded here as evidence that the framework stays internally consistent, nothing stronger.
Where the real signal does live. Models do carry stable habits specific to each system (word choices, structural tendencies, formatting quirks) reliable enough to correctly identify which of five major AI systems produced a given piece of unlabeled text 97.1% of the time, even when the text has been paraphrased (Sun et al., ICML 2025).
Here's where most casual readings of this whole idea go wrong: that figure measures how well you can tell models apart; it does not measure how improbable any particular habit is to arise by coincidence. Those are different things, and only the second one is what licenses an inference about shared ancestry, for the same reason set out above. In fact, at least one well-known example of a model habit clearly fails that test: several unrelated AI models released after 2022 independently overuse a small set of words (like "delve"); and, separately, that same overrepresentation shows up in unrelated human scientific writing, with a shared training approach as one plausible common cause for both. That's the exact same convergence problem showing up again, this time in a stylistic habit instead of a factual mistake.
So the useful signal splits into two channels that earn trust on different grounds.
Engineered markers are the clean case. A statistical marker deliberately planted in a "teacher" model's outputs, and later found in a "student" model trained on that teacher's outputs with only a fraction of them marked, is improbable to arise independently by design (that's literally what "deliberately planted" means) and this kind of inheritance has actually been demonstrated experimentally (Sander et al., NeurIPS 2024 (detectable when as few as 5% of the teacher-generated fine-tuning instructions carried the marker, the rest being the same teacher's unmarked output, and still at 10% when the rest was human-written text, given access to the student's internals; Pan et al., ACL 2025, then showed that a strongly learned marker survives ordinary paraphrase and is removed by an attacker who has recovered the marking rule, by a neutralising step when the student generates text, or) as prevention rather than removal: by mixing the outputs of enough different teachers). This is the digital equivalent of an old publishing trick: reference books sometimes include a deliberately fake entry with no real meaning, whose only purpose is to prove that a rival publisher copied the book wholesale rather than compiling it independently. The key word is deliberate: an accidental, ordinary error proves nothing about copying, because independent creators make ordinary errors too. Only a planted feature with no innocent explanation works as a real detector.
Naturally-occurring habits do not earn this trust yet. They need the same case-by-case scrutiny that shared mistakes need (some way of measuring how improbable a given habit actually is to arise under independent training) and that measurement tool does not currently exist. That's simply the honest state of things right now. A closer, more useful version of this test (checking a "student" model directly against one specific, named candidate "teacher" model, rather than trying to classify it among many known systems) is the tool the paper's proposed validation experiment should lean on, because it's aimed at exactly the improbability question that matters.
The corrected rule, which is the paper's central theoretical claim, stated plainly:
In manuscripts, shared ancestry is carried by significant shared mistakes. In AI models, shared ancestry is carried by significant shared habits: where "significant" means exactly what it always meant: a habit only counts as evidence if independent emergence is genuinely improbable, the same bar an error has to clear, and not every stable, distinguishing habit clears that bar. Most shared model mistakes turn out to be coincidental convergence rather than inheritance, and on at least one measured example, so do shared habits. The whole method transfers from manuscripts to models if and only if this improbability condition (which manuscript scholarship always enforced, and which an earlier paper draft dropped) is restored and checked feature by feature, not assumed to hold across an entire category of evidence.
The strongest objection, stated fairly. A careful skeptic can grant everything above and still object: this whole comparison is just an analogy. Models aren't manuscripts. There's no copying room, no lineage of hand-to-hand transmission, no original text being progressively corrupted: there's a training run. Dressing up ordinary engineering failure-analysis (something reliability engineers have understood for decades without borrowing any specialised vocabulary at all) in language borrowed from manuscript scholarship adds new words and no actual new inference power.
The honest response is to concede most of it: for one specific period. As a description of AI models from roughly 2023–2024, the skeptic is right. On the mistake-making channel, coincidental convergence dominates, as the previous section admits outright. In that era, models were reading from the human archive and contributing nothing back to it: leaves at the end of a tree, not branches feeding new growth. Against that snapshot of the ecosystem, there really is no lineage to reconstruct, and the objection lands cleanly.
What actually changed is the object being studied, not the argument about it. AI model output now flows back into the training data used to build the next generation of models, and it does so through four distinct channels: each of which turns out to be an old copying practice under a new name:
Four consequences follow, each with a close parallel in manuscript scholarship.
Layering. Each generation of models leaves behind traceable, datable habits that later generations inherit: meaning that, in principle, tracing lineage should get easier, not harder, as the tradition goes on. The same condition from Part 3 governs here too: the ecosystem is depositing candidate clues constantly, without being asked; whether any specific clue is significant enough (improbable enough to arise by coincidence) to actually prove descent is exactly the measurement that still doesn't exist. The clues are real. Reading them correctly is waiting on the missing tool.
Model collapse (the AI version of manuscripts drifting toward the "easier" reading). Training models repeatedly on AI-generated output erodes the rarer, less common patterns in the data; common, "safe" constructions crowd out unusual ones (Shumailov et al., Nature, 2024) (though the strongest version of this result comes from pure replacement, where synthetic data entirely replaces real data each round; where synthetic data instead accumulates alongside real data rather than replacing it, the effect stays bounded and full collapse doesn't happen (Gerstgrasser et al., 2024) a preprint, and a distinct finding from Shumailov et al.'s own claims, not part of them). With that caveat firmly attached, the parallel is close and genuinely useful: manuscript scholars call the drift toward the more familiar, "easier" reading during copying lectio facilior; and that is the same underlying process as model collapse: a lossy copying step that favours the probable, repeated over and over, gradually destroying exactly the rare, unusual content. Same underlying mechanism, not literally the same thing: the paper doesn't claim manuscripts and models are identical, and neither does this sentence.
The value of the oldest clean source. Text produced before 2022 (before AI-generated text started meaningfully entering training data) becomes a uniquely valuable reference point, for the same reason pre-nuclear-testing steel is valuable to physicists: not because it's inherently better material, but because it's datable and known to be uncontaminated, which is a completely different kind of value and the only one that matters for building a clean baseline. Its value only goes up as everything produced after it gets more contaminated. Keeping track of where data actually came from becomes, in effect, an archival discipline.
The planted marker, seen from the other direction. Watermarking and anti-copying fingerprinting techniques are, in this framework's terms, deliberately planted clues: and the fact that their inheritance has been experimentally demonstrated is the single cleanest existing proof that a transmission channel from one model generation to the next actually exists at all.
The security consequence, stated with exactly as much confidence as it's earned. Code is part of this same archive. A flawed coding pattern written in one year gets committed, scraped, and potentially trained into models two years later. It's worth being precise here, because this is exactly the point where an introduction like this one is most tempted to overstate things. The inheritance channel itself has been demonstrated: but only for deliberately planted markers. Whether it extends to naturally-occurring habits is exactly the open question from Part 3. Extending it further, to actual security-relevant coding mistakes, is an inference by analogy to the same mechanism, presented honestly as an inference: there is no direct study proving it yet, and the way to find out is a planned study tracing specific defect patterns backward through time. If it does hold, vulnerable coding patterns could be inherited through the training data itself rather than simply being reinvented independently each time: and, worse, this channel would be a real target: someone could deliberately seed public code repositories with a subtly broken pattern, poisoning the exact example that a future generation of models will learn to imitate. That's the sharpest version of the risk here: it isn't that an attacker gets some vague general advantage; it's the specific fact that the shared training corpus is simultaneously a limit on what any review can know and a concrete attack surface, and the two combine so that correlated failure becomes something an attacker can deliberately engineer.
New empirical grounding for the poisoning mechanism. A late-2025 study by a thirteen-author team from the UK AI Security Institute, Anthropic, and the Alan Turing Institute, with Oxford and ETH Zurich (Souly, Rando, Chapman et al., arXiv:2510.07192), measures the closest thing this document has encountered to the mechanism this section treats as an unproven inference by analogy; though it demonstrates something narrower than lineage inheritance. Pretraining dense autoregressive transformers from 600M to 13B parameters on Chinchilla-optimal datasets, the authors find that a near-constant absolute number of poisoned documents (250) compromises models across all tested model and dataset sizes, implanting a trigger-conditioned behavioural change without substantially affecting general capability. That demonstrates a necessary sub-mechanism for the code-repository scenario (implantation once poisoned examples are already in the training mix) but not the harder half: the paper plants trigger-conditioned behaviours into a training mix the experimenters control, whereas the scenario imagines an always-on coding habit surviving an organic scrape, deduplication and filtering included. What it also does not show: whether such a feature, once implanted, is inherited by a second model trained on the first's output; that remains the open question this document restricts to watermark-style distillation evidence. And it bears on the banalisation discussion above as a quantitative cousin rather than a counterpart: the paper finds attack success “decays approximately logarithmically” under continued clean pretraining (consistent with a minority feature eroding under frequency pressure from the majority distribution, though not yet the scribal pull toward the easier reading) while noting that clean pretraining alone does not remove the backdoor. Alignment fine-tuning, in the settings tested, brings attack success back almost to zero; but that is a deliberate editorial intervention with no counterpart in unguided transmission, and the paper's own limitations flag backdoor persistence through realistic post-training as unassessed.
A practitioner's account of the same scenario, weighed as testimony. In a podcast interview published in May 2026 (The Peterman Pod, host Ryan Peterman; quoted from the host's published transcript and checked against the recording), Bjarne Stroustrup, the designer of C++, says of AI-generated code: “when fed with training data, it has to be trained with old code … I find that LLM-based code is imitating old code and getting old performance and old bugs again” (1:32:09). Earlier in the same conversation he describes persistence on the human side. Recalling a study of problems involving buffer overflows and hacking, and a Herb Sutter talk “with actual numbers”, he says: “More than 90% are from people who don't write modern C++” (46:31). He says 1990s optimisation habits persist “because the techniques carry on in people's heads and some of the code remains” (1:25:58). And explaining why he kept C compatibility, he says he preferred Dennis Ritchie's known mistakes to his own unknown ones, a choice he calls “much more manageable and understandable” (31:21). Read together, his remarks resemble the code-repository scenario from two paragraphs above, described from inside the language community it concerns: he reports old techniques persisting through people and code, and he believes that models trained on old code repeat old bugs. That is testimony, not evidence of transmission. No defect is traced backward, no lineage is shown, and the open question from Part 3 does not move; it is exactly the kind of claim the planned tracing study exists to test. In his account, “bugs” means defects he believes a model repeats from older human-written code; it is not evidence that two models sharing a bug are related, which Part 3 set aside. Nor does the account identify a usable lineage marker: whether any recurring coding habit is improbable enough to arise independently remains the unmeasured question from Part 3.
A warning about the temptation to believe your own framework too easily. At this point it's tempting to conclude that a framework which predicts its own objections in advance, and whose subject matter obligingly keeps growing to fit it, must therefore be correct. That reasoning pattern (where every possible outcome seems to confirm the theory) is exactly the shape of an argument that can never actually be wrong, and the paper itself flags this as a known weakness in its own approach, in its own limits section. So it's rejected here too. A framework that fits its subject better and better over time is a reason to go test it harder, not a reason to start believing it.
So: is this a science? Not yet. It's a research program: and an unusual one, because it has a built-in, falsifiable property: the case for the whole framework gets stronger with time, because the very transmission process it describes is actively happening and getting more established as this is written. Manuscript scholarship as a field exists only because copied traditions actually corrupt over time. This tradition (the flow of AI-generated text back into AI training data) has begun to corrupt. That observation, not any claim that a model literally is a manuscript, is the actual argument.
Time matters here in one direction only: it applies to how well the framework's basic comparison fits the world, not to how trustworthy any given review conducted using it is today. On the mistake-making channel specifically, the finding actually runs the other way: more capable models are more correlated with each other, not less; measured across models at one time, not across generations.
One important limit on what can actually be tested right now. Given today's tools, the specific experiment this program has designed has exactly one clean type of test currently available to it: tracing deliberately planted markers, plus checking a model against one specific, named candidate teacher model; a limit on what this one experiment can run today, not a claim that no other kind of test could ever prove reliable. The more distinctively "manuscript scholarship" operations (comparing many witnesses at once, grouping natural (not planted) shared features into a family tree) only become workable once there's an actual measurement of how improbable a natural habit is to arise independently, and Part 3 already established that this measurement doesn't exist yet. The long-term direction of the program is clear; how much of it can actually be built and run this year is much smaller, and both facts need to be held at once.
Time cuts the other way too, and the paper is honest that this counts against itself. If this research program succeeds publicly, future models will end up training on descriptions of its own methods and its own published examples: meaning the detectors this program relies on become targets that future models learn to evade, and any planted markers will need to be continually refreshed to stay effective. The method's own reliability is time-sensitive too, and moving in the opposite direction from its subject matter's growing susceptibility. A framework that only advertised the half of this that flatters it would be committing exactly the failure it exists to catch.
What would actually disprove this, stated plainly: because naming a real way to fail is what separates a real scientific claim from a story that can't lose. The whole thesis fails if, across successive generations of models, any one of the following turns out to be true: identifying lineage from shared habits does not get better as more is learned about known model relationships; or a deliberately planted marker's traceability fades to nothing under ordinary training practice; or it turns out that AI output flowing back into training data barely affects later model behaviour at all. Any one of those three would kill the thesis.
One genuine advantage this tradition has that manuscript scholars never had. Every past manuscript reconstruction was done working backward from a thousand years of loss and guesswork. This "tradition," by contrast, can potentially be tracked from the very beginning: cryptographic hashes, sealed snapshots, formal records of where data came from, starting from day one. And code is actually the best-preserved kind of text in this entire tradition: version control systems already give any serious software project a tamper-evident, timestamped, cryptographically signed copy history of its own. The pre-2022 state of a codebase isn't a lost original that has to be painstakingly reconstructed. It's just a file you can check out. If there is anywhere this kind of careful, forward-looking preservation can actually succeed, it's here.
The question from Part 1 was: how can a trustworthy verdict come out of untrustworthy witnesses of unknown independence? Part 2's answer had two genuinely separate halves that the paper keeps distinct: agreement is evidence wherever independence has actually been measured, full stop; no further restriction beyond that; recovering one single "ground truth" is additionally restricted to questions with a mechanical check available, where the check outranks the panel anyway. The first half is currently unmet (the measurement that agreement's evidential value depends on hasn't itself been built) and that alone is the reason no verdict currently rests on testimony alone. The second half was never a separate path to that same conclusion: where it applies, the real warrant was always coming from the mechanical check, not the panel; where it doesn't apply, the paper simply withdraws the stronger claim instead of promising a capability that doesn't exist yet. In the meantime, verdicts rest on mechanical checks and on a named human's judgement call, and what collation actually delivers is triage: itself not yet proven to work at real scale.
Collected together, the practical answer is four working conditions: on both the verdicts this practice is willing to stand behind, and the larger research program described in Parts 3 and 4. The useful thing about stating it this way is that each condition names something that could actually turn out to be missing in a given case: which is what makes this a working method rather than just a reassuring-sounding stance.
What is not being claimed here, since this is exactly the kind of section where overreach tends to sneak in unnoticed:
A methodology becomes commercially interesting exactly at the point where it starts making promises: and that is exactly the point at which it's most tempting to overstate what it can do. So this section is written as a list of refusals, which can be checked against reality, rather than as a list of guarantees, several of which would currently be false.
What this practice refuses to do:
What a client may not infer: stated here because an earlier draft of this very document got it wrong.
An earlier version of this kind of introduction claimed that error correlation between the models in every review panel gets measured before their agreement is accepted as meaningful. That is not true, because the tool to do that measurement does not exist yet. It has been proposed, but not built. Two earlier attempts at building something like it both failed, in different ways: one early statistical test was set up backwards; a later check ended up measuring whether two reviewers were literally the same system, rather than whether their mistakes actually correlated. What this practice does today, honestly described, is weaker than a real measurement: reviewers are sourced from different underlying model families; earlier findings are deliberately withheld from a fresh reviewer so its agreement can't be artificially manufactured by anchoring on what it's told; convergence is weighted less heavily where the way a question was asked may have nudged reviewers toward the same answer; and disagreements that have a mechanical check available get routed to that check instead of to a vote. That is a discipline built around the idea of independence. It is not a measurement of independence.
That correction is the strongest thing in this part, and the reason to include this part at all: a practice whose actual product is careful, disciplined evidence-handling cannot honestly advertise a capability that its own methodology elsewhere lists as not yet built. This exact kind of mistake has now been made and caught twice. A third time would stop being a slip and start being a pattern: and the right response to that risk is to state the limitation publicly, not to quietly resolve to be more careful next time.
Why any of this should matter to a client, stated without inflating it. What this method actually produces is a record built to survive a skeptical reader: whether it actually does is up to that reader to judge, not something this document can certify for itself. Who checked what, using which method (reproduced or read), with which disagreements left unresolved, against which exact version of the code. Not a single score standing in for all of that: what this whole framework distrusts is exactly a fluent-sounding summary of unmeasured agreement, presented as if it were proof. A score whose formula is fixed in advance, whose exclusions are stated, and whose counts come out of a script rather than a person's impression is one legitimate instrument, of the kind this program itself has built: not a claim that no other kind of score could ever be trustworthy, just that this is the one already in use. What should raise suspicion is a number offered instead of the underlying, re-runnable record it's supposed to summarise. Whether this kind of record is actually worth its cost compared to a strong in-house review team is a real experiment worth running with an actual client: not a claim to make in the abstract, in advance, without having run it.
Two honest limits sit on top of all of this, stated plainly because a sales-facing section is exactly where limits like these tend to get quietly dropped. First: nothing in this framework measures whether the amount of institutional caution this practice sells is actually proportionate to how often AI-generated output really contains errors; and a practice that sells adversarial review naturally has a built-in interest in believing adversarial review is necessary. That question should be treated as genuinely open, with a real, disclosed conflict of interest hanging over it. Second: as of this writing, none of the actual case records are public (no report, no reproducible artifact a stranger could download and run themselves) so "built to survive a skeptical reader" is, for now, a claim about how the record is constructed, not a claim that any skeptical outside reader has actually had the chance to test it.
This document is meant to be an entry point, not a replacement for either the paper or the Prolegomena. Three things are worth knowing before deciding what to read next:
This program does not claim to have already built a reliable instrument for judging AI output. It claims something narrower and, if it holds up, more useful: an account of what such an instrument would actually have to satisfy, plus a set of experiments that could prove that account wrong. It replaces blind trust in AI consensus with four working conditions (defer to mechanical checks, treat a model's whole tendency (not one output) as the real witness, measure independence separately for each kind of question rather than assuming it from a label, and route disagreement to evidence rather than to a vote) while being upfront that the third of those is currently a discipline, not yet a real measurement, and that the one experiment designed to test whether any of this produces better code was cancelled before it ran.
The honest short version of what's actually being proposed: build the tracing method (starting from the one kind of test that's clean today) and check it against model relationships that are already a matter of public record; build the independence measurement and publish its own error rate; and seal today's evidence now, while it can still be sealed, for whoever tries to check any of this later. The first of those would seriously damage this whole thesis if it failed; which is exactly the property a real proposal is supposed to have, and the reason it's worth actually running.
Adjudication. The practice of routing a disagreement between reviewers to a mechanical check where one exists, and to a named human decision-maker where none does: rather than settling it by counting votes. Contrasted throughout with averaging or voting.
Adversarial hyparchetype. This document's term for a specific security risk: because AI models now partly learn from a shared pool of past text (including code), that shared pool is both a limit on what any review process can independently know, and a place an attacker could deliberately plant a subtly broken pattern for future models to copy. See Hyparchetype.
Archetype. In manuscript studies, the single original text a family of copies all ultimately descend from. This document argues that, for many AI-review questions, there may be no single archetype at all (no one right answer to reconstruct) because the question is genuinely a matter of judgement, not a lost fact.
Attractor. Used in this paper for an error attractor: a wrong answer that several systems produce independently, without copying each other. The usual explanation (that it is simply the most probable mistake given how they were trained) is a hypothesis about the cause, not part of the definition, and crediting any particular convergence to it needs a comparison against what noisy copying alone would produce, since copying with errors also yields convergence-shaped patterns. Two cautions from the evidence: systems given identical inputs still disagree widely on how often they land on the same reading, and where an answer can be checked against the truth, populations of models tend to converge on the right one. The main reason shared AI errors mostly don't prove shared ancestry. Cultural-evolution research uses attractor more broadly, for any form that is common and stable, wrong or not; the sense here is the narrower one.
Banalisation / model collapse. What happens when AI models are repeatedly, wholesale retrained on AI-generated text with no real data mixed back in: rare, unusual patterns get worn away, and everything drifts toward the most common, "safest" version. Where synthetic data instead accumulates alongside real data rather than replacing it, the effect stays bounded and full collapse does not occur: the strongest evidence for the effect is specifically from the wholesale-replacement case. The AI equivalent of a story getting blander with each retelling, under one particular retelling method.
Cannot emend. A hard limit on the whole method: it can only choose among findings that some reviewer actually raised. It can never surface a real problem that every single reviewer missed. See Emendation.
Collation. The general process of comparing multiple witnesses (whether manuscript copies or AI model outputs) against each other to work out what's likely reliable. In this document, distinct from and more modest than reconstruction: collation samples and cross-checks; it doesn't guarantee recovery of one true answer.
Contamination / contaminatio. In manuscript studies, a copy that mixes readings from more than one earlier source, making its lineage harder to trace cleanly. This document borrows the word for itself: it was written with the paper's own content already in view, so it counts as a "contaminated" source in exactly this sense; useful as a door into the paper, not trustworthy as an independent witness to it.
Decidable question. A question with a mechanical way to settle it: run the code, check the types, run the test, consult a specification. Used here in a practical, everyday sense, not the strict mathematical sense from computer science.
Distillation. Deliberately training a new, usually smaller, AI model to imitate a chosen larger "teacher" model's outputs. One of the four channels by which today's model output re-enters tomorrow's training data.
Draw. A single output from a model is described as "one draw" from that model's underlying tendency to answer a certain way: meaning it's a sample, not a fixed, repeatable fact. Ask the same question again and you might get a different draw.
Emendation. In manuscript studies, a scholar's proposed correction that recovers a reading no surviving copy actually has: essentially, an educated guess at what the lost original must have said. This document argues nothing in the current AI-review method reaches this: it can only work with findings actually raised, never guess at ones nobody raised.
Evidence rung. A label attached to each finding describing how far it was actually checked, and never implying a higher one. Four rungs, weakest to strongest: source trace (the file and path were read at the pinned revision), compile-proof (the build was made to fail and then pass), test (a discriminating test was run), and live reproduction (the defect was reproduced against the pinned revision). A finding that reaches none of them is not given a rung: it is graded plausible-only, which is the other disposition rather than a weaker rung. Corrected 14 September 2026. This entry first described only two rungs (“reproduced” or “read”). A same-day attempt to fix that introduced a second error (it listed five rungs with plausible-only as the weakest) which does not match the practice: a finding is either confirmed and carries one of four rungs, or is graded plausible-only. Both errors were live; this is the corrected form.
Homoplasy. The biology term for two unrelated species independently evolving a similar trait: convergence, not shared ancestry. Used as the closest existing parallel to attractors in AI models.
Hyparchetype. In manuscript studies, an intermediate, now-lost ancestor sitting partway between the original text and the surviving copies: a "sub-original" that several later copies share.
Idiosyncrasy. A stable, distinguishing habit specific to one AI model: word choices, structural tendencies, formatting quirks. Useful for telling models apart; not automatically useful for proving shared ancestry, unless the habit is also shown to be improbable to arise independently.
Judgement question. A question with no mechanical way to settle it: is this design sound, how severe is this issue, what does this clause mean. Contrasted with decidable question throughout.
Lectio difficilior / lectio facilior. Manuscript-studies terms for the "harder, more unusual reading" versus the "easier, more expected reading" a copyist tends to drift toward over repeated copying. This document treats the drift toward lectio facilior as the same underlying process as model collapse.
Leitfehler. German for "guiding error": manuscript studies' term for a shared mistake significant (improbable) enough to actually prove that two copies share a common source, as opposed to an ordinary, easily-repeated slip.
Lineage (as the unit of trust). This document's repeated point that the thing worth trusting or distrusting is a model's whole underlying tendency to answer a certain way, not any single output: because a single output is just one draw from that tendency.
Measured independence / decorrelation. The idea that whether two reviewers are actually answering independently of each other has to be checked with real data, separately for each kind of question, rather than assumed just because they come from different companies or were "convened separately."
Oldest witness. The pre-2022 text archive, treated as uniquely valuable because it predates AI-generated text meaningfully entering the training data: not because it's inherently better, but because it's the one dated stratum known to be uncontaminated.
Oracle. A mechanical way of settling a decidable question: running code, checking types, executing a test, or looking up what a specification actually says (which settles what that text says, not whether the text itself is correct, or whether any real-world claim resting on it holds). Whenever an oracle exists, it outranks any panel of reviewers.
Planted mark / watermark. A statistical signature deliberately embedded in a model's outputs so that its later reappearance in another model proves that the second model was trained (at least partly) on the first model's output. The one form of AI-lineage evidence that has actually been experimentally demonstrated to work.
Polygenetic error. A mistake that arises independently in multiple, unrelated sources simply because it's the natural, easy mistake to make: not because of any copying. The opposite of a Leitfehler.
Reconstruction. Recovering a single, definitive "true" answer. This document restricts this word strictly to decidable questions, where a mechanical check exists; using it for judgement questions is treated as an overreach the underlying paper itself withdrew.
Residue. The (often large) set of judgement questions left over once mechanical checks and reference documents have settled everything they can settle. This is the territory testimony-based review actually operates in: as sampling and triage under a human's final call, not as a self-sufficient verdict.
Sealed vintage / provenance manifest. A snapshot of data or code, cryptographically sealed and timestamped at a known point in time, so its exact state at that moment can later be verified rather than taken on trust.
Stemma / stemmatics. A stemma is the reconstructed family tree of a manuscript tradition: which copies descend from which. Stemmatics is the formal discipline of building one. "Agentic stemmatics" is this program's proposed name for doing the analogous work with AI model lineages.
Stratigraphy. In archaeology and manuscript studies, reading layers in the order they were deposited to establish relative dating. Applied here to the idea that each AI model generation leaves traceable, datable habits that later generations inherit.
Testimony. This document's word for any AI model's output, chosen specifically to mark it as a claim to be weighed, the way a court weighs a witness's account, rather than as a fact to be accepted outright.
Triage. A fast, low-cost first-pass screen used to direct attention toward the findings most worth a closer, more expensive check: distinct from and more modest than a final, standalone verdict.
v0.12, 22 Sep 2026, DRAFT, published while still under revision. Recording only: the v1.31 deposit facts named at v0.11 were confirmed the same day by two decorrelated seats, Kimi (Moonshot) and Grok (xAI), run blind and in parallel on a byte-identical brief, each fetching the Zenodo record and the served file itself, hashing served and local copies itself, and retrieving the concept record's versions listing rather than inferring the latest version from the DOI redirect; both returned CONFIRM-CLOSED on all seven checks with zero discrepancies. One corroboration gap, not a contradiction: the API carries no version label for the oldest record, whose v1.15 identity rests on its filename, record ID and chronology. Logged at the closure log, seq 29 to 31; no argument text changed.
v0.11, 22 Sep 2026, DRAFT, published while still under revision. Recording only: the companion citation moves v1.30 to v1.32 and the deposit line to v1.31 (deposited 22 Sep 2026, version DOI 10.5281/zenodo.22900116, checked over the Zenodo API and by byte-comparing the served file against the local copy by the drafting assistant; not yet confirmed by an independent seat); no argument text changed. v1.31 is a readability revision of the paper whose claims were verified unchanged by three decorrelated seats; nothing in this document needed to change for it, since this document quotes no paper wording verbatim and the paper's section structure is unchanged.
v0.10, 16 Sep 2026, DRAFT, published while still under revision. Recording only: the companion citation moves v1.29 → v1.30 and the deposit line to v1.29 (deposited 16 Sep 2026, version DOI 10.5281/zenodo.22790100, checked over the Zenodo API and by byte-comparing the served file against the local copy); no argument text changed.
v0.9, 15 Sep 2026, DRAFT, published while still under revision. Seated once (Kimi, file access, library PR #164); four named changes applied: the deleted vendor-diversity trend survived at two further sites and is now removed there too; the "partly"/5% pairing was unsupported by Sander's own mixture and is restated; Pan's paraphrase rider and multi-teacher mixing result added; the body's causal gloss aligned with the corrected glossary.
v0.8, 15 Sep 2026, DRAFT, published while still under revision. Four corrections applied from a three-round literature review of the lineage-signal evidence, each seated by at least one non-Anthropic lineage: the correlated-errors figures and the vendor-diversity trend (Part 2); the marker-inheritance citation and the paraphrase claim (Part 3); the Attractor glossary entry. Evidence trail: CVRR-LIT-2026-09-15-003 and CORRECTIONS-OWED-2026-09-15. No conclusion changed.
v0.7, 7 Sep 2026, DRAFT, published while still under revision. Every review row raised against this document has been closed by the seat that raised it; the four fixes made in the previous revision await their raisers' next look. It has had no external editorial or peer review, and the paper governs wherever the two differ. Author: Claude (Anthropic lineage), from L. J. Soons' instruction, with the paper and the Prolegomena (v0.16) in context throughout: contamination in the precise sense the paper's own §3 contaminatio row gives the word (a writer working with another document's findings already in view), and the reason this is a door and not a witness. v0.1 had no independent read at all. Three decorrelated, unprimed first reads then ran, none told what any other found: Qwen found no overreach. GLM found twelve instances where the Introduction stated something more strongly, more broadly, or more certainly than the Prolegomena (several re-introducing phrasings the Prolegomena's own review history had already caught and deliberately softened) plus two added claims with no Prolegomena counterpart; v0.2 applied all of them. DeepSeek, working from v0.2, found three further instances none of the other two seats caught; v0.3 applied those. Both raising seats then confirmed their own rows against v0.3. DeepSeek's confirmation round returned CONFIRM-CLOSED on all three of its findings, and its own open-ended scan of the rest of v0.3 surfaced one new, unfiled instance: a discontinued-experiment sentence claiming its criteria were "published in advance" where the Prolegomena's §24 says only "frozen and quotable"; a narrower claim. GLM's confirmation round returned 13 of its 14 rows CONFIRM-CLOSED and one PARTIALLY-CLOSED (an added claim about how long manuscript scholarship has existed, which v0.3 had weakened but not fully retired) and its own open-ended scan of v0.3 found one further instance of that same defect class in a different paragraph, plus flagged (without raising as a row) a genuine editing artifact: a duplicated clause left over from the v0.3 splice fixing DeepSeek's finding. v0.4 applied GLM's remaining item, its same-class sweep catch, DeepSeek's new "published in advance" catch, and the duplicate-clause cleanup. All rows either seat has raised are now closed by that seat's own confirmation, except the four fixes made in v0.4, whose closure is pending each raiser's next look.
Deposit facts, independently confirmed. Until 16 Sep 2026 the companion line above stated that the concept DOI's most recent deposit was v1.25 (24 Aug 2026, version DOI 10.5281/zenodo.22077929); v1.29 was then deposited (16 Sep 2026, version DOI 10.5281/zenodo.22790100), and v1.31 after it (22 Sep 2026, version DOI 10.5281/zenodo.22900116); the line now names v1.31. The v1.31 facts were checked by the drafting assistant over the Zenodo API and by byte-comparing the served file against the local copy, then independently confirmed the same day by two decorrelated seats, Kimi (Moonshot) and Grok (xAI), run blind and in parallel on a byte-identical brief, each fetching the record and hashing the served and local files itself and retrieving the versions listing directly; both returned CONFIRM-CLOSED on every checkable claim with zero discrepancies (closure log seq 31). The v1.25 facts were independently checked by two decorrelated seats: Kimi (Moonshot) and Grok (xAI), run blind and in parallel, each fetching the Zenodo record and hashing the deposited file themselves rather than trusting the drafting assistant's report. Both returned CONFIRM-CLOSED on every checkable claim, with zero discrepancies; Grok additionally queried Zenodo's versions-list endpoint directly, ruling out a newer, silently-skipped deposit. Recorded at the closure log's seq 15 (Kimi) and seq 16 (Grok): https://github.com/clvstra/agentic-stemmatics-closure-log. v0.6 (31 Aug 2026) adds one externally-cited paragraph to Part 4 (“New empirical grounding for the poisoning mechanism”, arXiv:2510.07192) (a declared exception to the rule that this document says nothing the paper does not say) gated before merge by two decorrelated seats (GLM on the initial draft, DeepSeek cold on the corrected text; both MERGE-WITH-EDITS; all edits applied except one of GLM's, superseded by direct PDF verification of the paper's own wording), plus direct source-verification of every cited fact against the study's PDF, and a Codex diff-integrity pass on the merge itself. v0.5 adds this paragraph; no argument text changed.
v0.7 (7 Sep 2026) adds one paragraph to Part 4 (“A practitioner's account of the same scenario, weighed as testimony”), quoting a May 2026 podcast interview with Bjarne Stroustrup: a second declared exception to the rule below that this document says nothing the paper does not say. The paragraph reports practitioner testimony relevant to the code-repository scenario, expressly treats it as testimony rather than evidence, and leaves the natural-habit lineage question open. The quotations were matched character by character to the host's published transcript and checked against the recording by L. J. Soons on 7 Sep 2026. It was gated before merge by one decorrelated seat in two rounds: Codex (OpenAI) reviewed the initial draft cold (REVISE, six findings (four blocking, two edits; two of the blocking rows struck interpretive additions of the drafting assistant's own, one struck categorical wording, and one arose from a defective transcript extraction, disclosed to the seat and re-served) record CODEX-INTRO-STROUSTRUP-PARA-2026-09-07), then confirmed its own rows against the revised text (five of six CONFIRM-CLOSED, open-ended scan clean; the sixth, a line break inside a quotation in the hard-wrapped draft, was closed by a scripted character check rather than by the seat; CODEX-INTRO-STROUSTRUP-PARA-R2-2026-09-07). Codex then reviewed the library PR's diff for splice and changelog integrity (MERGE-AFTER-FIXES, one edit to this changelog entry, applied: CODEX-INTRO-V07-PR115-DIFF-2026-09-07, confirmed against the first-round record in CODEX-INTRO-V07-PR115-DIFF-R2-2026-09-07). No other argument text changed.
The rule this document is under. Same rule the Prolegomena carries: it may not say anything the paper does not say. Where a sentence here is simpler than the paper's, that is the point of writing it. Where a sentence here is stronger (where it claims more than the paper claims) that is a defect in this document, not a discovery about the practice. Anything below that reads like a promise can be checked against the paper's own §13, which states plainly what is claimed and what is refused.
How this differs from the Prolegomena. A longer companion document, the Prolegomena to Any Future Agentic Stemmatics, exists alongside this one. It uses Kant's 1783 Prolegomena to Any Future Metaphysics as a structural frame: his method of starting from something the reader already grants and asking what conditions would have to hold for it to be possible, plus his device of staging a disagreement as two conflicting positions that turn out to share a hidden false assumption. That frame rewards a reader who already has some philosophical background, and is a real obstacle for a reader who doesn't. This document keeps the same underlying argument and the same order of topics, but drops the Kantian scaffolding entirely and says everything in plain terms. Where the frame did real work (mainly the point that two sides of a debate can both be wrong in the same way) this document keeps that point and drops the vocabulary that carried it. A glossary of every specialised term used below is at the end; anywhere a technical word appears for the first time, it is also explained on the spot.