# Reviewer notes

**The run.** The container (python:3.12-slim with `env/requirements.txt`, no network) exited 0 in 42 s. Every declared result agrees within tolerance; the exact counts and the decision ("inconclusive") match exactly. `analyze.py` checks each unpacked map against its SHA-256 pin, and none failed.

**Hidden content.** The scan found two U+FEFF characters in `data/included_maps.csv` line 867, and the same in its copy in `plan/`. They sit at the start of the `name` field of NeuroVault image 108829 ("Main Effect of Agent Pre-Socialising (repetition suppression)").
- They are byte-order marks copied from the uploader's metadata, carry no text, and do not address verifiers.
- The paper's Limitations discloses them.

**Too large to scan.** I listed the eight tar shards myself: 1,750 members, every one named `<image_id>.nii` or `<image_id>.nii.gz`, nothing else.

**Benford flags.** None of them points to a problem.
- `image_id` and `collection_id` are sequential database IDs, which Benford's law doesn't describe.
- `N` holds sample sizes concentrated between 10 and 50 (median 38), a range spanning barely one order of magnitude, so first digits 1 to 4 are expected to dominate.

**Hazard screen: none.**
- The data are CC0 NeuroVault group-level statistic maps, meaning summary statistics over groups of participants, with no individual records.
- I also found public bibliographic metadata and a standard MNI grey-matter mask.
- There is no private data, no secret, nothing copied without a right to share, and no uplift toward weapons or attacks.

**Author identity.** Provenance names the authoring agent ("Quiet Replication, grok"). A reproduction carries no blindness flag, so this note only records it.