Release 0.34.1

One change over 0.34.0: the Microsoft badge's provenance relaxation (0.7),
measured on the OCR-censused Microsoft-C2PA cohort -- 257 badge-less uploads
max 0.251, the relaxed band holds three faint badges and zero false fills.

.claude/rules/development.md

@@ -25,6 +25,16 @@ Boundary modules for cv2, Torch, and Diffusers may carry narrow per-file relaxat
 
 From a worktree, `uv run` imports the package from the MAIN checkout -- that is where the editable install points. A script measuring a worktree's edit must insert that worktree's `src` at `sys.path[0]` and assert `module.__file__` resolves inside it, or it silently compares unmodified code against itself.
 
+## Visible-mark example gallery
+
+Every registered mark carries a committed example: `data/fixtures/visible/<key>/example.png`
+(image marks) and `example.mp4` (video marks), regenerated by
+`scripts/render_visible_examples.py`. `tests/test_visible_examples.py` is the canary: it
+fails when a mark is registered without an example and when an engine stops detecting its
+own example. The examples are synthetic composites of the committed silhouettes -- user
+uploads never enter the repository. When the generator fails after a geometry or gate
+change, fix the generator (and the engine) together; do not hand-edit the binaries.
+
 ## Model-adjacent tests
 
 Do not classify an entire module as untestable because its main path downloads a model. Keep pure behavior covered without downloads, including:
@@ -65,6 +75,15 @@ that is what actually happened.
 
 Use availability checks only for paths that actually load large models.
 
+A verdict branch must be reachable with the dependency stack as shipped. High-confidence
+C2PA attribution required `signingCredential.trusted`, a code the reader emits only when a
+trust anchor list is loaded, and none ships -- so the branch was dead in production for
+every vendor while a hand-built info dict stamping that code kept it green from 0.27.0
+through 0.30.0. Assert reachability against the committed fixtures rather than a synthesized
+status set; `TestIdentifyRealSamples::test_no_committed_fixture_reports_a_trusted_signer`
+is that guard. Read a capability the stack does not have as a missing input, never as a
+negative finding.
+
 ## One measurement, one gate seam
 
 A detector is split into a trust-level-blind scan and a verdict that applies the
@@ -98,6 +117,11 @@ record is byte-identical, and a green test suite does not establish that on its
 change that is meant to FIX detection is the exception that proves the rule: the diff
 must then be exactly the files you intended to change, named in advance.
 
+When the baseline is a published release rather than the previous commit, get it with
+`uv run --isolated --no-project --with 'remove-ai-watermarks[heif]==<version>' python <script>`:
+it resolves that release from PyPI without touching the working tree or the editable
+install. Quote the extra -- bare `pkg[extra]` is a glob in zsh.
+
 Two corollaries in `dwt_dct.py`, where "close enough" has an exact meaning. The bit test
 is `peak % 36 > 18.0` and for uint8 input the exact Haar value is a multiple of 0.5, so it
 lands ON the threshold once per 72 blocks and a 1-ulp difference flips real bits: leave the

.github/workflows/distribute.yml

@@ -4,7 +4,7 @@ name: Distribute on release
 # PyPI is handled by publish.yml. This workflow event-drives the three channels
 # that would otherwise be manual:
 #   - Homebrew tap: rewrite the formula's url + sha256 to the new sdist.
-#   - HF Space: factory-rebuild so it reinstalls the latest sdist from PyPI.
+#   - HF Space: factory-rebuild the version already pinned in the Space repo.
 #   - ComfyUI: sync, test, and publish the node against the exact library release.
 # All wait for the freshly published sdist to appear on PyPI first, since the
 # Release event fires in parallel with publish.yml's upload.

README.md

@@ -2,18 +2,19 @@
 
 Remove AI provenance marks from images and video you generated yourself:
 
-- known visible labels such as the Gemini sparkle and vendor text marks;
+- known visible labels such as the Google Gemini sparkle watermark and vendor text marks;
 - invisible pixel watermarks through diffusion regeneration;
 - C2PA, EXIF, XMP, IPTC, and related AI metadata.
 
 Video support covers provenance identification, complete visible-plus-metadata
-cleaning, directory batches, visible Sora, Veo, Seedance, Dola, Hailuo, and
-Kling mark removal, and oracle-certified VAE regeneration for video SynthID
+cleaning, directory batches, visible Sora, Veo, Seedance, Dola, Hailuo AI, and
+Kling AI mark removal, and oracle-certified VAE regeneration for video SynthID
 removal.
 
 > [raiw.cc](https://raiw.cc) runs this library as a hosted service, with the GPU
-> included and nothing to install. Visible mark and metadata removal are free
-> there; invisible watermark removal is paid.
+> included and nothing to install. Visible mark and metadata removal at Standard
+> output up to 12 MP are free there; original resolution above 12 MP and invisible
+> watermark removal are paid.
 
 [![PyPI](https://img.shields.io/pypi/v/remove-ai-watermarks?logo=pypi&logoColor=white)](https://pypi.org/project/remove-ai-watermarks/)
 [![Python](https://img.shields.io/pypi/pyversions/remove-ai-watermarks?logo=python&logoColor=white)](https://pypi.org/project/remove-ai-watermarks/)
@@ -168,8 +169,8 @@ the specificity order shown below. Pass an explicit mark to restrict detection
 to one provider.
 Sora covers the moving Sora 2 mascot and wordmark. Veo covers both the current
 four-point diamond and the legacy `Veo` text. Seedance covers the fixed boxed
-`AI` label, Dola covers the fixed `Dola AI` text, Hailuo covers the composite
-`MINIMAX | hailuo AI` label, and Kling covers the bottom-right `KLING AI`
+`AI` label, Dola covers the fixed `Dola AI` text, Hailuo AI covers the composite
+`MINIMAX | hailuo AI` label, and Kling AI covers the bottom-right `KLING AI`
 label with its version suffix. A completed encode is published atomically. No
 output is written when no stable mark is found.
 HDR, PQ/HLG, and greater-than-8-bit inputs are rejected before encoding rather
@@ -230,6 +231,13 @@ features, and development setup.
 | --- | --- |
 | ![Image with a visible Gemini watermark](demo_banana_before.png) | ![Image after visible watermark removal](demo_banana_after.png) |
 
+The `after` raster is generated from the tracked `before` raster by the public path:
+
+```bash
+uv run remove-ai-watermarks visible demo_banana_before.png \
+  --backend cv2 -o demo_banana_after.png
+```
+
 ### High quality invisible removal
 
 `qwen-zimage` is the default profile: a Qwen-Image-2512 Lightning pass under Canny
@@ -311,8 +319,9 @@ remove-ai-watermarks batch ./images --mode all
 
 Visible mark support includes:
 
-- Google Gemini and Nano Banana sparkle;
-- Doubao, Jimeng, Qwen, Kling, Yuanbao, Baidu, LibLibAI, and RunningHub labels;
+- Google Gemini and Nano Banana visible sparkle watermark;
+- Doubao, Jimeng, Qwen, Kling AI, Yuanbao, Baidu, LiblibAI, and RunningHub labels;
+- one calibrated Microsoft top-right white AI-badge variant;
 - one calibrated Samsung Galaxy AI label variant.
 
 Metadata and provenance inspection covers C2PA, EXIF, XMP, IPTC, common
@@ -396,7 +405,7 @@ invisible removal.
   detail.
 - Visible video removal recognizes the moving Sora 2 wordmark, the current Veo
   diamond plus legacy `Veo` text, the Seedance boxed `AI` label, and the fixed
-  Dola, Hailuo, and Kling labels. It does not recognize the older Sora Turbo
+  Dola, Hailuo AI, and Kling AI labels. It does not recognize the older Sora Turbo
   corner swirl or unregistered layouts from those providers.
   The classical OpenCV backend can smear structured backgrounds; use MI-GAN or
   LaMa when recovery quality matters.

data/README.md

@@ -7,6 +7,8 @@ data/
   fixtures/
     provenance/   Real format and provenance fixtures used by tests
                   (source records live in fixtures/README.md)
+    visible/      Synthetic per-mark example gallery (one committed example per
+                  registered visible mark; see fixtures/visible/README.md)
   calibration/
     <vendor>/     Minimal controlled inputs needed to rebuild detector assets
   synthid/
@@ -48,16 +50,17 @@ runtime assets.
 video removal profile works, so it is also the source of truth for three shipped
 defaults: `tests/test_video_invisible.py` asserts that `noise_std`, `long_side`,
 and `fps` together match a row this manifest records as certified. Changing one
-of those three without adding the row that certifies it fails the suite. `vae` is
-deliberately outside that check because neither tracked row records one; add it
-to the assertion in the same commit as the first row that does.
+of those three without adding the row that certifies it fails the suite. Both
+historical rows mark `vae` as `unrecorded`: the repository must not infer a model
+identity from the current default. Add it to the assertion in the same commit as
+the first oracle row that records and verifies one.
 
 | Column | Meaning |
 | --- | --- |
 | `date`, `source_url`, `source_sha256` | Identify the carrier. |
 | `source_width`, `source_height`, `source_fps` | Carrier geometry. Without it the actual downscale factor of a row cannot be recovered later. |
 | `duration_seconds`, `source_verdict` | Clip length submitted and the verifier's reading of the untouched carrier. |
-| `vae`, `noise_std`, `long_side`, `fps`, `seed` | The full run configuration. |
+| `vae`, `noise_std`, `long_side`, `fps`, `seed` | The run configuration. `unrecorded` means the historical run did not preserve the VAE identity. |
 | `output_sha256` | Identifies the exact submitted file. |
 | `output_verdict` | One of `detected`, `not_detected`, `indeterminate`, `refused`. |
 | `output_verdict_text` | The verifier's wording, verbatim. |

data/contentseal/README.md

@@ -0,0 +1,101 @@
+# Content Seal oracle corpus
+
+Muse Image (`muse-image-1.0`) generations with externally verified Content Seal
+verdicts, produced through the Meta Model API on 2026-08-26 and checked against
+the public detector at `https://meta.ai/identification` (anonymous session, no
+login). Follows the `data/synthid/originals` pattern: binaries live in
+`originals/`, every derived variant is recorded in `manifest.csv` as a recipe
+plus hash and is not stored.
+
+## What this corpus establishes
+
+- The Meta Model API image endpoint (`POST /v1/images/generations`) stamps the
+  same Content Seal pixel watermark as the consumer Meta AI app: all five
+  generations verified positive with attribution "Muse Image 1 - Meta".
+- The detector response carries a per-generation ID and creation timestamp
+  embedded in the watermark payload. Both survived a 512 px LANCZOS resize and
+  a full-size JPEG q85 re-encode (same ID returned), so the payload is more
+  robust than the detection threshold.
+- Three checked center crops lost the seal: 50% and 33% linear crops of the fox
+  and the 50% crop of the text poster returned "No AI signatures from Meta were
+  found". The text poster's 33% crop was not checked because the daily oracle
+  limit was reached, so its empty verdict is not evidence either way. The checked
+  results are consistent with the Reuters 2026-07-11 analysis (55% missed after
+  cropping).
+- API outputs carry XMP `iptcExt:DigitalSourceType =
+  trainedAlgorithmicMedia`, so local `identify` flags them via the existing
+  Made-with-AI path. Metadata-stripping transforms fall back to unknown, and
+  Content Seal has no local decoder in this project: the oracle is the only
+  reader.
+- Drift finding: the 512 px resize of `gen_fox_forest` triggers a
+  medium-confidence false positive "Tencent Yuanbao (visible 元宝 / AI生成
+  mark)" in this project's `identify`. Recorded here as a reproducible case.
+
+## Oracle limits and wire format
+
+There is no public or documented checking API. Verified against the official
+developer documentation on 2026-08-26 (`https://dev.meta.ai/docs/`): the full
+Meta Model API reference lists only Responses, Chat Completions, Messages,
+Files, Images (`/v1/images/generations`, `/v1/images/edits`), and Models, with
+no identification, detection, or watermark endpoint, and the image-generation,
+Muse Image cookbook, and pricing pages never mention watermark, Content Seal,
+or provenance at all. The API applies the seal (every generation in this corpus
+carries it) while documenting nothing about it. The web tool drives an internal
+REST pair, captured from the browser network log on 2026-08-26:
+
+1. `POST https://rupload.meta.ai/gen_ai_document_gen_ai_tenant/<uuid>` with the
+   raw file bytes, `x-entity-type`, `x-entity-length`, `ai_detector_upload: true`,
+   and an anonymous `authorization: OAuth ecto1:<token>` session token minted by
+   the page.
+2. `POST https://meta.ai/api/ai-detector` with `Bearer ecto1:<token>` and body
+   `{"media_id": "...", "fileName": "...", "mimeType": "..."}`.
+
+The rate limit is enforced at that endpoint, server-side, and keyed beyond the
+browser session: the API itself returns `429 {"errorType": "rate_limited"}`,
+and clearing cookies and storage changed nothing, so driving the internal pair
+directly does not bypass it. The Meta Model API (`api.meta.ai/v1`, where the
+generation key works) has no identification endpoint; plausible paths all
+return 404. Rows with an empty `oracle_verdict` were transformed but not yet
+checkable. Read a verdict only from the settled page text after the
+result-complete state ("Upload another file"): a wait for a verdict string can
+match the previous upload's text, and the fresh-navigation protocol used for
+the calibration rows below is the race-free variant.
+
+## Strength floor calibration (qwen-zimage, seed 0)
+
+The library resolves strength per vendor with measured floors (OpenAI
+0.07675 / Google 0.27 / Microsoft InvisMark 0.15 in
+`_internal/watermark_profiles.py`). Meta Content Seal had no floor before this
+calibration; these rows measure one by the same methodology: independent
+generations, each one's first-clean boundary, floor = worst boundary plus the
+observed cross-source spread.
+
+Measured (2026-08-26/27, oracle `meta.ai/identification`):
+
+- Default pipeline clears Content Seal: tested samples came back clean at the
+  default resolution-adaptive strength (~0.1305 at 2.56 MP), including the
+  worst source.
+- Five independent generations bracketed. First-clean boundaries:
+  lighthouse (0.0525, 0.06], fox (0.03, 0.0375], night_city (0.03, 0.0375],
+  mug <= 0.03, text <= 0.015. Cross-source spread is wide (a factor of four
+  between easiest and hardest).
+- Derived Meta floor by the existing worst-boundary-plus-cross-source-spread
+  method: 0.06 + (0.0525 - 0.015) = 0.0975, rounded to **0.1**.
+- Shipped as `QWEN_ZIMAGE_META_STRENGTH`: auto mode routes standalone-AI-IPTC
+  files onto the cohort, and `--vendor meta` / `InvisibleOptions.vendor`
+  names it explicitly on stripped files (implying the scrub runs).
+## Regeneration
+
+The eight deterministic crop, resize, and JPEG variants can be reproduced and
+hash-checked from the tracked originals:
+
+```bash
+uv run python scripts/contentseal_transforms.py /tmp/contentseal-derived
+```
+
+The Meta API generations and remote GPU outputs are not reproducible from this
+repository alone. Their prompts, exact output hashes, model/profile settings,
+and oracle results are recorded in `manifest.csv`, but the generation API is
+stochastic and the private worker environment is not tracked. `MUSE_API_KEY` and
+the anonymous detector session are deliberately absent. A new calibration must
+therefore create new manifest rows rather than claiming to recreate these bytes.

data/contentseal/manifest.csv

@@ -0,0 +1,44 @@
+name,file,origin,source_url,prompt,requested_size,delivered_size,sha256,xmp_iptc_trainedAlgorithmicMedia,oracle_verdict,oracle_attribution,oracle_generation_id,oracle_created_utc,checked_at_utc,notes
+gen_fox_forest,originals/gen_fox_forest.webp,meta-model-api,,A red fox resting on a mossy log in a misty forest at dawn photorealistic shallow depth of field,1024x1024,1600x1600,6d7cecf322a5ac4b2547e2f32c767b3cb3e8a0e49f274cfd00aa31be6697eed4,yes,detected,Muse Image 1 - Meta,AXZpZGVvc2VhbHY0X2NhX3NjbLlNjYhvPAxD,2026-08-26T19:07Z,2026-08-26T19:11Z,checked twice; ID stable across uploads
+gen_text_poster,originals/gen_text_poster.webp,meta-model-api,,A cheerful flat-design poster that says 'WATERMARK FIELD DAY 2026' in bold rounded letters over a coral and cream striped background,1024x1024,1600x1600,873927662d8198e9c38b4ae71a2919ba5d417dfcd714649db1b0ae231e8cbf9b,yes,detected,Muse Image 1 - Meta,AXZpZGVvc2VhbHY0X2NhX3NjbJuIKXPAYxsd,2026-08-26T19:08Z,2026-08-26T19:08Z,
+gen_lighthouse_watercolor,originals/gen_lighthouse_watercolor.webp,meta-model-api,,A watercolor illustration of a lighthouse on a cliff at golden hour seagulls in the distance soft loose washes white paper texture,1024x1024,1600x1600,69bee7c376608568361085602c5c7406900885849bd94c5279c3924cf793b27c,yes,detected,Muse Image 1 - Meta,AXZpZGVvc2VhbHY0X2NhX3NjbB5uWbAmWmwp,2026-08-26T19:08Z,2026-08-26T19:08Z,
+gen_night_city,originals/gen_night_city.webp,meta-model-api,,A night city skyline in the rain neon reflections on wet asphalt cinematic wide shot moody,1536x1024,1920x1280,345adf6b9f777b15ef7ce7bbdfb3b355a1d9e882740809e966e9f6caafd94d48,yes,detected,Muse Image 1 - Meta,AXZpZGVvc2VhbHY0X2NhX3NjbH5uWbAmWmwp,2026-08-26T19:08Z,2026-08-26T19:08Z,
+gen_studio_mug,originals/gen_studio_mug.webp,meta-model-api,,A minimalist studio photo of a single matte ceramic mug on a pastel blue background soft shadow clean commercial look,1024x1024,1600x1600,2b7bc7fd56fa2250c66ef74f8b3e49d9666fe147d894d5baf9461b5e36077a07,yes,detected,Muse Image 1 - Meta,AXZpZGVvc2VhbHY0X2NhX3NjbAsSozV2XCzw,2026-08-26T19:08Z,2026-08-26T19:08Z,
+fox_crop50,,derived:gen_fox_forest,,center crop 0.5 linear each side then WEBP q95,,800x800,80b91995560a7c4b08596a26b3401a29afb82691fad193502697a49785eab7be,no_stripped_by_reencode,not_detected,,,,2026-08-26T19:13Z,seal lost; PIL re-encode strips XMP
+fox_crop33,,derived:gen_fox_forest,,center crop 0.33 linear each side then WEBP q95,,528x528,3b3aded8f4fcb98d0599431abccb73b9581854ae34c6bc869724cd5c86a1e35e,no_stripped_by_reencode,not_detected,,,,2026-08-26T19:13Z,seal lost
+fox_res512,,derived:gen_fox_forest,,resize long side 512 LANCZOS then WEBP q95,,512x512,19b85f615d56f5e9f55cd97bae0ee343f4f432e6bfa0a6fc7acb07dec2cc1d81,no_stripped_by_reencode,detected,Muse Image 1 - Meta,AXZpZGVvc2VhbHY0X2NhX3NjbLlNjYhvPAxD,2026-08-26T19:07Z,2026-08-26T19:13Z,generation ID and creation time identical to the original generation: watermark payload survives the resize
+fox_jpeg85,,derived:gen_fox_forest,,full-size JPEG q85 re-encode,,1600x1600,3bc7dc11bf3c16c83814df1e6485cdb6e49e21141511dda56d210cc920a8c5e3,no_stripped_by_reencode,detected,Muse Image 1 - Meta,AXZpZGVvc2VhbHY0X2NhX3NjbLlNjYhvPAxD,2026-08-26T19:07Z,2026-08-26T19:13Z,payload survives JPEG recompression; local identify returns unknown (metadata stripped)
+text_crop50,,derived:gen_text_poster,,center crop 0.5 linear each side then WEBP q95,,800x800,3f0d4075012ee4fec820209c5c1c32bb739998813325f49b1124f379162f9837,no_stripped_by_reencode,not_detected,,,,2026-08-26T19:13Z,seal lost
+text_crop33,,derived:gen_text_poster,,center crop 0.33 linear each side then WEBP q95,,528x528,95cef87002961831b21f6f47cd9a0824a67e2ee6f8503356fd5db6a3fcfcc998,no_stripped_by_reencode,,,,,,daily oracle limit reached before this row could be checked
+text_res512,,derived:gen_text_poster,,resize long side 512 LANCZOS then WEBP q95,,512x512,b319727d02e908f22e59f148050e6b4686cbd1a622bd69db51fe4072a6f66b34,no_stripped_by_reencode,,,,,,daily oracle limit reached; also the fox twin of this transform triggered the Yuanbao false positive below
+text_jpeg85,,derived:gen_text_poster,,full-size JPEG q85 re-encode,,1600x1600,76f00fcde1e974549afa5d90e1879c705e3c3631ef1f35cab901fc912cd15fa4,no_stripped_by_reencode,,,,,,daily oracle limit reached before this row could be checked
+blog_qr_manhwa,,meta-blog-cdn,https://lookaside.fbsbx.com/elementpath/media/?media_id=1807972953501959&version=1783318590&transcode_extension=webp,,,1920x1280,8ee7700dff59f21d7de393a619664a0b9360f148d18df289364ecea939b3dea9,yes,detected,Muse Image 1 - Meta,,,2026-08-26T18:59Z,not stored; re-downloadable from source_url
+blog_fractal_poster,,meta-blog-cdn,https://lookaside.fbsbx.com/elementpath/media/?media_id=1499727434782014&version=1783727678&transcode_extension=webp,,,2096x992,2a96168db026444b47ac37807fd99a88c8b7fa6866e1c93a54ab427fbe581f76,no,detected,Muse Image 1 - Meta,,,2026-08-26T18:59Z,seal survived CDN transcode without any metadata
+blog_flipbook_punch,,meta-blog-cdn,https://lookaside.fbsbx.com/elementpath/media/?media_id=2521328538303639&version=1783396590&transcode_extension=webp,,,1920x1280,35f28dc2cbdf44aed190bc8efaa0fe7bfa288a2196638712dd83bc941cc294d5,yes,detected,Muse Image 1 - Meta,,,2026-08-26T19:00Z,
+blog_teen_cat,,meta-blog-cdn,https://lookaside.fbsbx.com/elementpath/media/?media_id=1325391919706734&version=1783319609&transcode_extension=webp,,,1600x1600,c2e7df000ffa6520589d8efc5f0bcbeb759175cdaa0c827189c28a64f75d3dd7,yes,detected,Muse Image 1 - Meta,,,2026-08-26T19:00Z,
+blog_hero_1,,meta-blog-cdn,https://lookaside.fbsbx.com/elementpath/media/?media_id=2140990336800598&version=1783727678,,,1344x1792,7655639acb9f826cdb864d869530153efc1e1467ff414b5a63e80aa7b39b2fb7,no,detected,Muse Image 1 - Meta,,,2026-08-26T19:00Z,seal survived CDN transcode without any metadata
+control_synth_gradient,,synthetic-local,,PIL gradient with rectangle JPEG q90; never touched any AI pipeline,,1024x768,25f29c0b993ed1a8e41060ed50de778d875a6d94847ced180aafc5a6ad429f82,no,not_detected,,,,2026-08-26T19:01Z,negative control: No AI signatures from Meta were found
+fox_nometa,,derived:gen_fox_forest,,metadata --remove only (no pixel change),,1600x1600,685d3a5c5d74e653ec7615fc7a347a0584c277fc7fb59594d388ac619ffe3985,no_stripped,detected,Muse Image 1 - Meta,AXZpZGVvc2VhbHY0X2NhX3NjbLlNjYhvPAxD,2026-08-26T19:07Z,2026-08-26T22:19Z,metadata stripping does NOT remove Content Seal; seal lives in pixels; same generation ID as original
+fox_modal_invisible,,derived:gen_fox_forest,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=default-adaptive(approx 0.1305 at 1600x1600),,1600x1600,6daa3e9b5dde5cb443d8071c5294262742f001c02b694243764a50345769d8b8,no_stripped,not_detected,,,,2026-08-26T22:21Z,current default pipeline clears Content Seal
+text_modal_invisible,,derived:gen_text_poster,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=default-adaptive(approx 0.1305 at 1600x1600),,1600x1600,8530a82fb856b0a00651076ac1ad8a7544b5d8873cac9bd5780704fbe10f53f8,no_stripped,not_detected,,,,2026-08-26T22:22Z,current default pipeline clears Content Seal
+fox_str0.06000,,derived:gen_fox_forest,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.06,,1600x1600,7b5e5ae75ca20f2a3cdfcfa7666104752d9557b08ac236db6f1548434940a1f3,no_stripped,not_detected,,,,2026-08-26T22:28Z,strength calibration ladder
+fox_str0.04500,,derived:gen_fox_forest,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.045,,1600x1600,26da15694b3096e2f1717154db213e814cdd27f2fc40e5f924db2324213cf960,no_stripped,not_detected,,,,2026-08-27T02:28Z,strength calibration ladder; re-confirmed clean at 0.045
+fox_str0.03750,,derived:gen_fox_forest,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.0375,,1600x1600,b7eb0616d10042933edf22cfc30aff4df915384828289b409f6cfa4cdf2807d4,no_stripped,not_detected,,,,2026-08-26T22:30Z,fresh-page protocol; fox first-clean boundary is in (0.03 0.0375]
+fox_str0.03000,,derived:gen_fox_forest,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.03,,1600x1600,cff80d18d9d00000f47e0f97c419a37c13a13831795768aee8727aa9516d1401,no_stripped,detected,Muse Image 1 - Meta,,,2026-08-26T22:31Z,fresh-page protocol; seal survives 0.03
+fox_str0.02000,,derived:gen_fox_forest,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.02,,1600x1600,b19183ec60b63a5b73d3e1c723e7943584912857d51a4b5f85259c5c77da0e53,no_stripped,detected,Muse Image 1 - Meta,,,2026-08-26T22:28Z,settled-read protocol; monotonic below the 0.03 boundary
+text_str0.03750,,derived:gen_text_poster,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.0375,,1600x1600,bacfd4eca7b13616502f74497cbe4f02ef6893918870f13f9e76fdb93b43107f,no_stripped,not_detected,,,,2026-08-26T22:33Z,fresh-page protocol
+text_str0.03000,,derived:gen_text_poster,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.03,,1600x1600,d5c6cffbf471ef8bb74ee8c0d22cc17d9da2c446b83e46c4be67e6ea4cdd09de,no_stripped,not_detected,,,,2026-08-26T22:33Z,fresh-page protocol; text first-clean boundary is at or below 0.03 - cross-source spread vs fox confirmed
+lh_str0.03750,,derived:gen_lighthouse_watercolor,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.0375,,1600x1600,f5169debc5fd2792399c0ea3fa88cb1d05f523d95004bec240c73db0e9aaee51,no_stripped,detected,Muse Image 1 - Meta,,,2026-08-27T02:28Z,seal survives 0.0375 where fox is already clean
+lh_str0.03000,,derived:gen_lighthouse_watercolor,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.03,,1600x1600,110d2112d91dd53df5ccd1839e0e2b41c44aa1832adb0090032660e071fb1fd4,no_stripped,detected,Muse Image 1 - Meta,,,2026-08-27T02:28Z,fresh-page protocol; lighthouse holds its seal below the fox boundary: cross-source spread is wide
+text_str0.02500,,derived:gen_text_poster,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.025,,1600x1600,f46a6c53b4f3d39fccb1d62cca82ced2e163e4424d13c98e6468a8e083c0fa54,no_stripped,not_detected,,,,2026-08-27T02:28Z,mid rung inside the clean zone
+text_str0.02000,,derived:gen_text_poster,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.02,,1600x1600,a19cbe22313e0f19768c98567ea89f2d9dc30827691fc7ec2971c52f3e7c6cc6,no_stripped,not_detected,,,,2026-08-27T02:28Z,text clean at 0.02: boundary <= 0.02 - the easiest source measured
+text_str0.01500,,derived:gen_text_poster,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.015,,1600x1600,aa3816c75e38f3ab5afc378d349caafad56f2bb6da859a5ee68fdea57ad00d73,no_stripped,not_detected,,,,2026-08-27T02:41Z,text clean at 0.015: boundary <= 0.015 - the easiest source measured
+lh_str0.02500,,derived:gen_lighthouse_watercolor,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.025,,1600x1600,989c4a7a804bc8420ec4d86b9445bc3a37382c1834782a7f8842f781d69b05e2,no_stripped,,,,,,below the measured detected boundary (0.03) for this source; not individually checked
+lh_str0.02000,,derived:gen_lighthouse_watercolor,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.02,,1600x1600,6a4a4ec94292a145e7d73e6900b8ec6d0eede17137f2b91fba7757ec0bdba5ec,no_stripped,,,,,,below the measured detected boundary (0.03) for this source; not individually checked
+nc_str0.03750,,derived:gen_night_city,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.0375,,1920x1280,46f322335f801ee54427eb39275216465f9a7cfa3d918c698e4d90a2439a0815,no_stripped,not_detected,,,,2026-08-27T02:28Z,boundary (0.03; 0.0375]
+nc_str0.03000,,derived:gen_night_city,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.03,,1920x1280,3f42632319248ad1a91ef2457c7e0b13ed17e1d2569decbbaab67c2072e9a305,no_stripped,detected,Muse Image 1 - Meta,,,2026-08-27T02:28Z,night_city holds seal at 0.03
+mug_str0.03750,,derived:gen_studio_mug,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.0375,,1600x1600,3b6109ae7e86b8ea74ce33315e3f2a7eda1cadb724d429f0951f13c3ead34b0f,no_stripped,not_detected,,,,2026-08-27T02:28Z,upper rung for the mug bracket
+mug_str0.03000,,derived:gen_studio_mug,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.03,,1600x1600,1c24c984677e1528da83003ac40594f6e5ef1fa9351f1368b6d31a0101308583,no_stripped,not_detected,,,,2026-08-27T02:28Z,mug clean at 0.03: boundary <= 0.03
+lh_str0.05250,,derived:gen_lighthouse_watercolor,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.0525,,1600x1600,8912ba1ff4a26790f69224c49dd649e46835e277c375276ac9604f5339775b2a,no_stripped,detected,Muse Image 1 - Meta,,,2026-08-27T02:41Z,bisection: lighthouse first-clean boundary bracketed to (0.0525; 0.06]
+lh_str0.04500,,derived:gen_lighthouse_watercolor,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.045,,1600x1600,cfdcf7bbb27c740846a1de4edffee3b25a624c2a8e1aba2362feaa25b682e3ae,no_stripped,detected,Muse Image 1 - Meta,,,2026-08-27T02:28Z,seal survives 0.045: lighthouse is the worst source measured
+lh_str0.06000,,derived:gen_lighthouse_watercolor,,modal raiw-worker qwen-zimage mode=invisible seed=0 strength=0.06,,1600x1600,4e214be00a89dc9f1f32ec39483c5e9668a1ec7f38b15e5794942479c839fcca,no_stripped,not_detected,,,,2026-08-27T02:28Z,lighthouse first-clean boundary bracketed to (0.045 0.06]

data/evaluations/fidelity/anytext2-restoration-2026-08-13.csv

@@ -1,4 +1,4 @@
 date,source_commit,fixture,variant,model,model_revision,model_sha256,ocr_route,text_cer,img_lpips,ssim,psnr_db,output_sha256,provider_oracle,notes
-2026-08-13,2d03a00,Gemini_Generated_Image_633uuy633uuy633u.png,qwen-zimage,,,,"Paddle ch",0.074,0.289,0.696,23.3,4b05489c7a79f993d35d32528de792baad5a3e33ee950afa147caf5d3e0621,not_run,Exact Qwen baseline reused from text-restoration benchmark
+2026-08-13,2d03a00,Gemini_Generated_Image_633uuy633uuy633u.png,qwen-zimage,,,,"Paddle ch",0.074,0.289,0.696,23.3,4b05489c7a79f993d35d32528de792baad5a3e33ee950afa147caf5d3e0621a6,not_run,Exact Qwen baseline reused from text-restoration benchmark
 2026-08-13,2d03a00,Gemini_Generated_Image_633uuy633uuy633u.png,qwen-zimage-anytext2-default,AnyText2-SD1.5,b06c583a583818f3679665ef67b51363f107853c,7d5d593928d842500e0da101ab6a1ae28a8d21403441ca62c813c4f92529ace8,"Paddle ch",0.185,0.338,0.642,18.2,87729fe7e0482d2cead6d3b7c7dd386ecc75ab3d8658131c54e67528b8f9feeb,not_run,Fidelity gate failed; padded crop recognition CER 0.074 still shows two substituted characters; locally composited three-line edit; 20 DDIM steps; seed 0
 2026-08-13,2d03a00,Gemini_Generated_Image_633uuy633uuy633u.png,qwen-zimage-anytext2-mimic,AnyText2-SD1.5,b06c583a583818f3679665ef67b51363f107853c,7d5d593928d842500e0da101ab6a1ae28a8d21403441ca62c813c4f92529ace8,"Paddle ch",0.222,0.345,0.644,17.9,f5198d8f2365b79880aba8ea6b0c3885142b9de21c9f7f4f6712ac4a0db8dd85,not_run,Fidelity gate failed; source glyph masks supplied as font hints; 20 DDIM steps; seed 0

data/evaluations/video-synthid-oracle.csv

@@ -1,3 +1,3 @@
 date,source_url,source_sha256,source_width,source_height,source_fps,duration_seconds,source_verdict,vae,noise_std,long_side,fps,seed,output_sha256,output_verdict,output_verdict_text,output_detected_range,track,session_id,stratum,psnr_db,temporal_residual_ratio
-2026-07-31,https://storage.googleapis.com/gdm-deepmind-com-prod-public/media/media/veo__veo-3__off-road.mp4,79a552b9406a079682440c31f14d33a10ba8e1b8b2e96425f5de70f63350299d,1920,1080,24,8,detected_all_frames,,0.10,512,12,0,079165105d4c56e1612091987c08c2627049423025f74c0d4e245fb47c2ff0e3,detected,,,,,,26.2932,1.0072
-2026-07-31,https://storage.googleapis.com/gdm-deepmind-com-prod-public/media/media/veo__veo-3__off-road.mp4,79a552b9406a079682440c31f14d33a10ba8e1b8b2e96425f5de70f63350299d,1920,1080,24,8,detected_all_frames,,0.15,512,12,0,1c4046bcfdead138353b4e2a73339ba227bb5e544878d80c5bc6cd8427c7b00e,not_detected,,,,,,25.3911,1.0578
+2026-07-31,https://storage.googleapis.com/gdm-deepmind-com-prod-public/media/media/veo__veo-3__off-road.mp4,79a552b9406a079682440c31f14d33a10ba8e1b8b2e96425f5de70f63350299d,1920,1080,24,8,detected_all_frames,unrecorded,0.10,512,12,0,079165105d4c56e1612091987c08c2627049423025f74c0d4e245fb47c2ff0e3,detected,,,,,,26.2932,1.0072
+2026-07-31,https://storage.googleapis.com/gdm-deepmind-com-prod-public/media/media/veo__veo-3__off-road.mp4,79a552b9406a079682440c31f14d33a10ba8e1b8b2e96425f5de70f63350299d,1920,1080,24,8,detected_all_frames,unrecorded,0.15,512,12,0,1c4046bcfdead138353b4e2a73339ba227bb5e544878d80c5bc6cd8427c7b00e,not_detected,,,,,,25.3911,1.0578

data/fixtures/visible/README.md

@@ -0,0 +1,41 @@
+# Visible-mark example gallery
+
+One committed example per registered visible mark, so the repository carries a
+working sample of everything it supports. `tests/test_visible_examples.py` holds
+both sides to it: a mark registered without an example fails the suite, and so
+does an engine that stops detecting its own example.
+
+## What these files are
+
+Every example is SYNTHETIC: `scripts/render_visible_examples.py` composites the
+mark's committed silhouette (the same font-rendered asset the detector matches)
+onto a deterministic generated base photo at the engine's measured geometry.
+No user upload and no vendor asset enters the repository: corpus files under
+`data/spaces/` are user content and stay out of git by policy, and the
+silhouettes themselves are our own renders (`scripts/render_vendor_silhouettes.py`).
+
+The examples demonstrate DETECTION geometry and house style, not vendor raster
+fidelity; real-world variants (fonts, opacities, sizes) are covered by the
+engines' calibration cohorts, which are local-only.
+
+## Regeneration
+
+    uv run python scripts/render_visible_examples.py
+
+The generator self-verifies: it fails (exit 1) if any registered mark does not
+detect on its own example, so regeneration is the fix point for drift.
+
+## Layout
+
+    <mark-key>/example.png   1536x2048..2048x2048 PNG, one per image mark
+    <mark-key>/example.mp4   960x540 90-frame clip, one per video mark
+                            (kling carries both: it is registered in both registries)
+
+Special cases: `gemini` composites the sparkle alpha map at the provider's
+configured position; `jimeng_pill` is the capture-less pill at the measured
+3:4 portrait geometry; `microsoft` is the opaque white pill with dark text
+holes (the discriminator its detector keys on). Video examples composite the
+detector's own synthetic template on every frame; where two marks share a
+shape family the example carries the discriminative variant (`veo` the legacy
+text form, `kling` the logo-plus-wordmark pair flush to the edge), because the
+temporal selection resolves cross-template ties by table order.

data/synthid/README.md

@@ -160,7 +160,7 @@ sparkle; the SynthID *pixel* itself has no local detector (oracle only).
 
 Key takeaways:
 - The same model differs by *surface*: Gemini app wraps C2PA, AI Studio (API/playground) emits none -- only the pixel + sparkle survive.
-- Microsoft Designer's DALL-E backend inherits OpenAI's C2PA+SynthID (issuer "OpenAI, Microsoft"); Bing now runs Microsoft's own **MAI-Image** and signs C2PA as "Microsoft" (not OpenAI/DALL-E).
+- Microsoft Designer's DALL·E backend inherits OpenAI's C2PA+SynthID (issuer "OpenAI, Microsoft"); Bing now runs Microsoft's own **MAI-Image** and signs C2PA as "Microsoft" (not OpenAI/DALL·E).
 - Meta uses the IPTC `digitalSourceType` marker, not C2PA or SynthID.
 - The open imwatermark fires only on *pristine* output from a pipeline that runs the encoder (diffusers default, official BFL) -- not from re-hosts (Krea, Stability hosted SDXL) or re-encoded design exports (Recraft, Canva). Ideogram's only signal is the EXIF `Make` tag.
 - Bing and Grok web UIs are uncooperative for autonomous capture (no document_idle for screenshots; blob downloads intermittently no-op; low-res in-chat previews). Use their native download button manually if a full-res sample is needed.

docs/cli.md

@@ -41,9 +41,11 @@ remove-ai-watermarks identify image.png
 it also evaluates supported visible and invisible pixel signals. When no signal
 is found, it reports the origin as unknown. It does not claim the image is
 clean. For C2PA files, the text report shows asset integrity, claim-signature,
-signer-trust, and signer-validity results separately. An intact claim from an
-untrusted or expired signer is reported at medium confidence; a failed asset
-binding or signature does not confirm the claimed origin. When a structured
+signer-trust, and signer-validity results separately. Confidence follows the
+binding: an intact asset binding and claim signature is high confidence, and an
+unanchored or expired signer is reported as a caveat rather than a lower score,
+because no trust anchor list ships with the reader. A failed asset binding or
+signature, or a revoked signing credential, does not confirm the claimed origin. When a structured
 C2PA soft binding is present, the report also names its exact algorithm and
 signed value; removing the manifest does not remove the referenced pixel
 watermark or content fingerprint.
@@ -315,7 +317,7 @@ remove-ai-watermarks video visible kling.mp4 --mark kling -o kling_clean.mp4
 
 The command supports the moving Sora mascot and wordmark, two Veo
 corner variants, the Seedance boxed `AI` label, the `Dola AI` text label, the
-composite `MINIMAX | hailuo AI` label, and the bottom-right Kling label. Sora
+composite `MINIMAX | hailuo AI` label, and the bottom-right Kling AI label. Sora
 searches the whole frame at multiple scales. The other detectors search bounded
 lower-frame regions with separate synthetic silhouettes. Kling additionally
 requires its bright low-saturation label near the frame edge. Every mark
@@ -326,7 +328,7 @@ provenance-aware marks; metadata alone never creates a detection.
 
 `--mark auto` is the default. It evaluates all providers in one decode pass and
 selects the first stable match in specificity order: Sora, Veo, Seedance, Dola,
-Hailuo, then Kling. Their confidence scores are independently calibrated and
+Hailuo AI, then Kling AI. Their confidence scores are independently calibrated and
 are not compared across providers. Pass an explicit `--mark` to scan only that
 provider.
 
@@ -385,6 +387,23 @@ detected. Use `--force` when you know the image should be processed:
 remove-ai-watermarks invisible image.png -o clean.png --force
 ```
 
+### Choose a strength cohort
+
+`--vendor` selects the cohort the default strength resolves from. `auto`
+(the default) derives it from provenance: the C2PA issuer for
+OpenAI/Google/Microsoft, and the standalone AI IPTC tag for Meta Content Seal
+(Muse output carries no C2PA; the tag is a standard code, so C2PA evidence
+always wins first). An explicit value both names the cohort for stripped files
+and implies the scrub runs -- naming the cohort asserts the pixel watermark is
+present -- exactly like `--force` plus a measured floor:
+
+```bash
+remove-ai-watermarks invisible muse_output.webp -o clean.png --vendor meta
+```
+
+The same option exists on `all` and `batch`, and as
+`InvisibleOptions(vendor="meta")` in the Python API.
+
 ### Choose a pipeline
 
 | Pipeline | When to use it |
@@ -415,10 +434,10 @@ user can act on rather than after a model load.
 ### Restore operator-verified text
 
 `--text-manifest` enables the experimental `vae-glyphs` post-pass. It reconstructs
-the source with the Qwen VAE, blends 15% of that reconstruction into the normal
-`qwen-zimage` result, erases the annotated candidate glyphs with LaMa, and composites
-only the reconstructed glyph cores through source-derived silhouettes. It does not
-run OCR or choose which strings are correct.
+the source with the Qwen VAE, erases the annotated candidate glyphs with LaMa, and
+composites only the reconstructed glyph cores through source-derived silhouettes. It
+does not run OCR or choose which strings are correct. The optional `--fidelity-anchor`
+described below additionally blends 15% of the reconstruction across the full frame.
 
 Install the combined extra and run only with an operator-verified manifest:
 

docs/controlnet-removal-pipeline-research.md

@@ -521,7 +521,7 @@ held by its masked ArcFace vector -- no original pixel copied.
   drift, NOT a perfect face swap. Set expectations; PuLID/InstantID are the higher-fidelity (heavier)
   paths if needed.
 - **Value scales with strength:** at low strength (OpenAI 0.10) faces barely drift, so FaceID is
-  marginal; at the higher strength a hard vendor (Google 0.30) needs, FaceID earns its keep.
+  marginal; at the higher strength then used for a hard vendor (Google 0.30), FaceID earned its keep.
 
 ### Build plan (staged)
 
@@ -641,7 +641,7 @@ photo only).
 
 **Sources.** https://arxiv.org/abs/2206.11253 (CodeFormer) · https://github.com/sczhou/CodeFormer ·
 https://arxiv.org/pdf/2401.07519 (InstantID) ·
-https://openaccess.thecvf.com/content/WACV2024/papers/Suin_Diffuse_and_Restore... (region-adaptive) ·
+https://openaccess.thecvf.com/content/WACV2024/html/Suin_Diffuse_and_Restore_A_Region-Adaptive_Diffusion_Model_for_Identity-Preserving_Blind_WACV_2024_paper.html (region-adaptive) ·
 https://arxiv.org/pdf/2504.12809 (saliency-aware watermark removal)
 
 ## Provenance

docs/development.md

@@ -1,5 +1,9 @@
 # Development
 
+Standalone evaluation, calibration, and release utilities are catalogued in
+[`scripts/README.md`](../scripts/README.md). They are maintainer tools rather than
+installed commands, and their local data inputs remain outside the repository.
+
 Read this reference for environment setup, dependency recovery, CI behavior, and fixture policy. The always-loaded invariants remain in [`.claude/rules/development.md`](../.claude/rules/development.md).
 
 ## Local environment

docs/installation.md

@@ -114,6 +114,7 @@ application actually uses:
 | `lama` | big-LaMa ONNX fill backend | `visible`, ONNX Runtime | Model download, no Torch |
 | `qwen-zimage` | Invisible image-watermark removal, both CUDA-only profiles | `diffusion`, DiffSynth | Yes |
 | `text-restoration` | Opt-in verified Qwen-VAE glyph restoration | `qwen-zimage`, `lama` | Yes |
+| `text-draft` | Draft OCR proposals for operator verification | PaddleOCR, PaddlePaddle | Model download, no Torch |
 | `all` | Every production feature available on the active Python | All compatible rows above | Yes |
 | `dev` | Tests, linting, typing, and upstream parity checks | `video`, `detect`, upstream invisible-watermark | Yes, for parity tests |
 
@@ -130,12 +131,15 @@ flowchart LR
     qwen["qwen-zimage"] --> diffusion
     text["text-restoration"] --> qwen
     text --> lama
+    draft["text-draft"]
     heif
     trustmark
 ```
 
-`heif` and `trustmark` are independent branches. Combine them explicitly with
-another feature when required. TrustMark requires NumPy 1.x, which has no
+`heif`, `trustmark`, and `text-draft` are independent branches. Combine them
+explicitly with another feature when required. `text-draft` is excluded from
+`all` because it proposes unverified OCR annotations and is not a production
+removal path. TrustMark requires NumPy 1.x, which has no
 CPython 3.13 or 3.14 wheels, so that branch is available only on Python
 3.11-3.12. The `all` bundle contains every production branch compatible with
 the active Python and never includes `dev`.

docs/known-limitations.md

@@ -31,11 +31,14 @@ an unsupported locale, a different position, or a crop may be missed.
 
 Known examples:
 
+- The Microsoft detector covers one calibrated top-right white pill. Microsoft's
+  [documented feature](https://support.microsoft.com/en-us/topic/include-a-watermark-when-content-from-microsoft-365-is-ai-generated-b00a656e-ae61-4692-8086-67d004421030)
+  can instead use a Copilot icon, `AI-Generated` text, or another position.
 - Samsung detection is calibrated for the Italian
   `Contenuti generati dall'AI` text variant.
 - The Jimeng top-left pill has a weak visual detector and is intentionally
   subject to additional product and background checks.
-- Kling support covers the calibrated variants rather than every Kling label.
+- Kling AI support covers the calibrated variants rather than every Kling AI label.
 
 Use `erase --region` when you can see and select an unsupported or missed mark.
 
@@ -111,6 +114,14 @@ For important outputs:
 Provider systems can change, so a result verified on one file, seed, or version
 is not a permanent certification.
 
+Meta Content Seal (Muse Image) is in the same family: no local decoder, presence
+recognizable only through the XMP `trainedAlgorithmicMedia` companion tag while
+that metadata survives, and removal verifiable only through the anonymous
+`meta.ai/identification` oracle, which rate-limits by IP per day. The oracle's
+negative is weaker than its positive: Reuters measured it missing 55% of cropped
+Muse images, so treat a negative on a cropped or heavily edited file as
+inconclusive rather than clean.
+
 ### Video SynthID removal is lossy and content-dependent
 
 The `video invisible` command and `remove_video_invisible` API regenerate video
@@ -177,13 +188,14 @@ path has not yet answered.
 The two profiles resolve an unset strength differently, because different things
 were measured for each.
 
-`qwen-zimage` reads it from image area, through the resolution-adaptive denoise
-curve. The vendor is deliberately ignored for openai/unknown content: the curve,
-not the issuer, is what was calibrated. One measured exception (0.27.2):
-Google-provenance content takes the flat `QWEN_ZIMAGE_GOOGLE_STRENGTH` 0.30 floor
-- the curve's 0.154 top left a 4.33 MP fixture oracle-detected on the full
-production path (2026-08-18), while 0.30 anchors measured clean on two fixtures
-in two accounts.
+`qwen-zimage` reads unknown content from the resolution-adaptive denoise curve.
+Measured provider cohorts instead take flat operating points: OpenAI `0.07675`,
+Google `0.27`, and Microsoft InvisMark `0.15`. OpenAI and Microsoft add one full
+observed cross-source boundary spread to the worst clean source; Microsoft's three
+first-clean boundaries were `0.04125`, `0.055`, and `0.095`, giving `0.14875` before
+rounding up. Google's candidate was separately repeated across three valid sources
+and three accounts. The small corpora make these operating points, not universal
+thresholds.
 
 `sdxl-zimage` reads it from the C2PA issuer, on a flat ladder:
 
@@ -301,11 +313,11 @@ supported AI provenance metadata without transcoding streams.
 
 `video visible` and `remove_video_visible` additionally support the moving
 Sora 2 mascot and wordmark, the current Veo four-point diamond, the legacy
-`Veo` text, the Seedance boxed `AI` label, the fixed `Dola AI` text, the Hailuo
-MINIMAX/Hailuo composite label, and the bottom-right Kling label with its
+`Veo` text, the Seedance boxed `AI` label, the fixed `Dola AI` text, the Hailuo AI
+MINIMAX/Hailuo AI composite label, and the bottom-right Kling AI label with its
 version suffix. Detection requires a recurring visual candidate across
 adjacent frames. Fixed-mark candidates must remain anchored rather than
-drifting with a scene object. Kling also requires a bright low-saturation
+drifting with a scene object. Kling AI also requires a bright low-saturation
 candidate near the expected frame edge. Provider provenance can recover
 low-contrast runs only after visual evidence exists for the marks that define a
 provenance prior, so metadata alone does not erase a clean API export.
@@ -316,7 +328,7 @@ policies and selects the first stable result in specificity order. Use an
 explicit mark when the provider is already known.
 Historical Sora Turbo exports use a small OpenAI swirl in the corner rather
 than the moving mascot-and-wordmark design; that earlier variant is not
-detected by the `sora` video mark. Hailuo and Kling coverage is specific to the
+detected by the `sora` video mark. Hailuo AI and Kling AI coverage is specific to the
 verified lower-edge layouts; a new provider layout needs a separate calibrated
 silhouette. Other provider video labels are not supported yet. Google video
 SynthID has an oracle-certified VAE removal path, while other proprietary
@@ -407,7 +419,7 @@ remain identical because isolated decoder hits can otherwise be content noise.
 It accepts Variant P schemas 0-2. Variant Q requires a different model, and
 schema 3 is rejected at the measured precision threshold. Its NumPy 1.x runtime
 limits the extra to Python 3.11-3.12; the rest of the package remains supported
-through Python 3.14. Through 0.29.0 the extra also resolves lightning 2.6.5
+through Python 3.14. The current TrustMark dependency line also resolves lightning 2.6.5
 (PYSEC-2026-3624, no fixed release yet); the vulnerable `load_from_checkpoint`
 path is unreachable here because TrustMark loads its checksummed checkpoints
 with plain `torch.load`. Bump lightning and cut a patch release when a fix

docs/module-internals.md

@@ -296,13 +296,13 @@ from the gate. The full-clip oracle floor is
 detected while `0.15` did not.
 
 [`video_visible.py`](../src/remove_ai_watermarks/video_visible.py) implements
-the first pixel stages for Sora, Veo, Seedance, Dola, Hailuo, and Kling. The
+the first pixel stages for Sora, Veo, Seedance, Dola, Hailuo AI, and Kling AI. The
 Sora detector searches a normalized frame with a fully synthetic
 mascot-and-text silhouette at several scales. The Veo detector uses separate
 synthetic silhouettes for the current four-point diamond and legacy `Veo`
 text. Seedance uses a synthetic rounded boxed-`AI` silhouette, while Dola uses
-an OpenCV-font `Dola AI` silhouette. Hailuo uses a synthetic waveform,
-MINIMAX/Hailuo text, separator, and ring. Kling combines synthetic font
+an OpenCV-font `Dola AI` silhouette. Hailuo AI uses a synthetic waveform,
+MINIMAX/Hailuo AI text, separator, and ring. Kling AI combines synthetic font
 variants with a ring approximation of its swirl; the logo path rescues
 wordmarks whose version or font differs, while the edge and white-label gates
 reject recurring scene texture. All fixed-mark searches are bounded to the
@@ -323,23 +323,23 @@ Every per-frame result is untrusted. Each provider's floors, minimum-run policy,
 fill padding and mask style are one row in `VISIBLE_MARK_POLICIES`, and every mark
 enters the same `stabilize_localizations` entry point; the recurrence
 implementation underneath knows nothing about providers. That policy row also
-carries `accepts_provenance`, which forces `provenance=False` for Hailuo and Kling
+carries `accepts_provenance`, which forces `provenance=False` for Hailuo AI and Kling AI
 — they have no metadata that could confirm them, and the guarantee used to be
 structural (their wrappers took no `provenance` parameter at all). Provenance can relax a low-contrast run only
 after recurring visual evidence exists. Sora transition frames follow the
 nearest confirmed moving position only with Sora provenance. Seedance, Dola,
-Hailuo, and Kling additionally require candidates to remain anchored to the
+Hailuo AI, and Kling AI additionally require candidates to remain anchored to the
 start of a run. This rejects slowly drifting scene details that still have
-high frame-to-frame overlap. Hailuo and Kling do not infer provenance from
+high frame-to-frame overlap. Hailuo AI and Kling AI do not infer provenance from
 technical encoder tags; their confirmed public samples carried no provider
 metadata.
 
 Removal runs in a second decode pass. Sora, legacy Veo text, Dola text,
-Seedance, Hailuo, and Kling use box masks. Seedance deliberately fills the
+Seedance, Hailuo AI, and Kling AI use box masks. Seedance deliberately fills the
 complete localized box: a synthetic outline mask passed repeat detection but
 left part of the real translucent border visible during visual end-to-end
-review. Hailuo expands beyond the matched core to cover both provider icons.
-Kling expands around the wordmark or swirl to include the version and optional
+review. Hailuo AI expands beyond the matched core to cover both provider icons.
+Kling AI expands around the wordmark or swirl to include the version and optional
 `PRO` suffix. The square Veo diamond uses a synthetic shape mask so transparent
 corners do not erase unrelated pixels. Every mask goes through the shared
 `watermark_registry.fill` backends. ffmpeg encodes the changed video stream and
@@ -379,13 +379,31 @@ Structured extraction is limited to the active manifest and the ingredient
 manifests reachable from it. Validation is preserved as separate dimensions:
 asset binding integrity, claim signature, signer trust, and signer certificate
 validity. A matching asset hash and valid claim signature do not make an
-untrusted or expired signer trusted. `identify` therefore assigns high confidence
-only when all four dimensions validate, medium confidence to an intact but
-untrusted or unvalidated claim, and no origin verdict to a hash/signature failure.
-The failed claim remains in the marker inventory and keeps the removal gate
-fail-safe because a post-signing container edit can invalidate C2PA without
+untrusted or expired signer trusted, so those stay separate fields and separate
+caveats -- but they do not lower confidence. `identify` assigns high confidence
+when the asset binding and the claim signature both validate, medium confidence
+to a claim that validated nothing (fallback parsing, unknown dimensions), and no
+origin verdict to a binding failure, a signature failure, or a revoked signing
+credential. The failed claim remains in the marker inventory and keeps the removal
+gate fail-safe because a post-signing container edit can invalidate C2PA without
 removing a declared pixel watermark.
 
+Revocation reaches the disqualifying branch through `signer_validity`, not through
+binding or signature. A check that read only the latter two returned a confident AI
+verdict off a credential the issuer had disowned, with an empty `integrity_clashes`
+-- quieter than a hash mismatch on the same file. Certificate expiry is deliberately
+not disqualifying: an expired certificate does not imply the signed bytes changed,
+and a signature actually made outside validity already arrives as
+`claimSignature.outsideValidity`.
+
+One rule, one place. `_validation_fields` maps status codes to the four dimensions
+and also emits `c2pa_failed_codes`, the subset of failures that actually drove a
+dimension to invalid; `c2pa_info_has_invalid_credential` maps those dimensions to
+disqualified, and both the ingredient-reachability walk and the report consume that
+single path. The displayed reason comes from `c2pa_failed_codes` rather than a
+substring rescan of the full code list, so what a caller is shown as the cause
+cannot become a looser rule than the verdict it explains.
+
 The structured walk also treats an exact known AI product in a reachable
 `claim_generator` as an AI assertion. This covers update chains where the active
 manifest names only `c2pa-tool` while a validated ingredient names Dreamina, and
@@ -405,8 +423,24 @@ Content-fingerprint soft bindings do not trigger pixel regeneration.
 
 The SDK default enables trust verification but supplies no production trust
 anchors. Consequently, an installation without an explicitly maintained C2PA
-trust bundle reports otherwise valid signer chains as untrusted and keeps their
-attribution at medium confidence. Shipping or fetching an official trust bundle
+trust bundle reports every otherwise valid signer chain as untrusted --
+`signingCredential.trusted` appears in no default installation, from any vendor.
+Confidence therefore must not depend on it. It did from 0.27.0 through 0.30.0, which made
+the high-confidence branch unreachable in production while a hand-built fixture
+stamping `signingCredential.trusted` kept it green in the suite; measured on the
+committed provenance fixtures, every C2PA file from OpenAI, Adobe and Black Forest
+Labs came back untrusted, and an intact manifest scored the same medium as a
+fallback parse that validated nothing. That collapsed the one distinction the
+official reader exists to draw.
+`tests/test_identify.py::TestIdentifyRealSamples::test_no_committed_fixture_reports_a_trusted_signer`
+is the reachability guard: it asserts the fixtures really are untrusted and still
+reach high confidence.
+
+Read `untrusted` here as a missing input, not a finding: nothing was checked,
+because there was nothing to check against. If a maintained trust bundle is ever
+configured, that stops being true and the confidence mapping in
+`_c2pa_credential_level` must be re-read, because only then does a failed trust
+check mean the signer was rejected. Shipping or fetching an official trust bundle
 requires a separate update, provenance, and availability policy; do not silently
 convert `signingCredential.untrusted` into trusted based on a vendor-name match.
 
@@ -417,7 +451,9 @@ For an AI C2PA claim, a recognized product in `claim_generator` takes precedence
 over the certificate issuer: an application can sign through an upstream model
 provider without becoming that provider's product. Only exact product mappings
 receive this precedence; an unknown claim generator still falls back to issuer
-attribution.
+attribution. An unmapped issuer org reads as unknown-signer C2PA with no platform;
+that is how Ideogram was surfaced (4 corpus uploads signed "Ideogram, Inc",
+2026-08-08) before its vendor row was added on 2026-08-27.
 
 ### Metadata scanning and stripping
 
@@ -712,9 +748,9 @@ capture-less pill is too weak to attribute.
 
 The set of marks that veto the pill is DERIVED from the registry rows: every mark
 under the same label regime (`tc260`) belonging to a different product. It used to
-be a hand-written list of keys, and that list drifted -- LibLibAI was registered
-alongside RunningHub and Baidu, both of which were added to it, and LibLibAI was
-not, so a confident LibLibAI detection did not suppress the pill the way its two
+be a hand-written list of keys, and that list drifted -- LiblibAI was registered
+alongside RunningHub and Baidu, both of which were added to it, and LiblibAI was
+not, so a confident LiblibAI detection did not suppress the pill the way its two
 siblings did. Marks outside the TC260 regime (Gemini, Samsung) are deliberately
 not vetoers: neither can put `jimeng` into `provenance`, so neither can enable the
 arm it would be vetoing.
@@ -766,6 +802,33 @@ be represented by the shared base:
 - [`runninghub_engine.py`](../src/remove_ai_watermarks/runninghub_engine.py)
 - [`baidu_engine.py`](../src/remove_ai_watermarks/baidu_engine.py)
 - [`liblib_engine.py`](../src/remove_ai_watermarks/liblib_engine.py)
+- [`microsoft_engine.py`](../src/remove_ai_watermarks/microsoft_engine.py)
+
+The measured Microsoft badge variant (2026-08-27 registration) is the first
+`tr`-corner mark and the first `long`-side scale basis: the pill tracks the
+render dimension, so a
+1024x1536 portrait carries the same pill as 1536x1024, and a width basis
+undersized the template by the aspect ratio (portrait carriers fell to
+0.15-0.32 NCC until the basis was measured). The silhouette is a white pill with
+its synthetic internal shapes knocked out - the holes are what separate it from
+any other bright rounded corner element (a plain white pill scores below the gate
+in the tests). It does not claim coverage of Microsoft's other documented icon,
+wording, or position variants.
+
+The 2026-08-27 rerun used the registered engine through
+`scripts/registered_mark_calibrate.py`, rather than a copied detector
+configuration. The manifest kept three evidence classes separate: 17 visually
+confirmed carriers, 343 Microsoft-provenance files without a visual adjudication,
+and 1200 non-overlapping no-signal controls. At the strict 0.38 gate, 15/17
+confirmed carriers fired (min 0.249, p50 0.519, p90 0.578, max 0.579), while
+0/1200 controls fired (p99 0.200, max 0.293). The provenance cohort produced
+78/343 fires, but that is not a recall measurement because provenance identifies
+the provider, not the presence of this visible layout. That cohort was later
+labeled by an OCR badge census (2026-08-28: 86 badge carriers, 257 badge-less,
+badge-less max 0.251 / p99 0.213), which is what enabled the shipped provenance
+relaxation 0.7: the relaxed band [0.251, 0.38) holds three faint badges and
+zero false fills, re-verified as 3 band detections with 0/257 badge-less fires
+on the provenance path.
 
 The detector and removal mask must use compatible geometry. A detector that
 fires while producing an empty or misplaced mask is a removal failure even if
@@ -784,7 +847,7 @@ were briefly skipped there for exactly that reason.
 A mark whose removable footprint differs from what the detector localizes
 overrides `_footprint_rect` (which policy) and `_extend_match_box` (how far the
 box grows), not the whole `footprint_mask`. Baidu extends right to the corner tag
-and LibLibAI extends left to the triangle logo; both inherit every guard around
+and LiblibAI extends left to the triangle logo; both inherit every guard around
 that arithmetic.
 
 Yuanbao uses the polarity-independent `contrast` front end because its standard
@@ -842,6 +905,11 @@ are CUDA-only. `controlnet`, `sdxl`, `qwen` and `default` were removed rather th
 kept as a CPU path, and are rejected rather than aliased onward. There is no
 content-dependent automatic router.
 
+`qwen-zimage` normally resolves global denoise from image area for unknown content.
+Measured provider cohorts bypass that curve with flat operating points. The values,
+measurement derivations, and corpus limits are canonical in
+[`known-limitations.md`](known-limitations.md#strength-is-content-and-seed-dependent).
+
 For serverless cold starts, `InvisibleEngine.preload(global_only=True)` loads the
 mandatory global stage and YuNet while leaving the optional Z-Image and SAM face
 stack lazy until a face is detected. The default `preload()` still loads every
@@ -981,11 +1049,13 @@ Validation happens before model loading. The library never treats OCR confidence
 verification, and geometry-only operators do not need to invent text or script fields.
 
 When enabled, `QwenZImagePipeline` reconstructs the source once through its already
-loaded Qwen VAE, runs the ordinary global and face stages, blends 15% of the VAE
-reconstruction into that clean result, and calls the shared restoration compositor.
-The compositor derives binary source and candidate silhouettes, groups nearby lines,
-uses LaMa for the initial and residual-glyph erase passes, paints fresh silhouette
-edges, then copies the Qwen-VAE core with a 0.5-pixel feather. The evaluation script
+loaded Qwen VAE, runs the ordinary global and face stages, and calls the shared
+restoration compositor. The optional fidelity anchor first blends 15% of the VAE
+reconstruction into the clean result; it is off by default because the blend returned
+detector-visible OpenAI SynthID in the measured poster fixtures. The compositor derives
+binary source and candidate silhouettes, groups nearby lines, uses LaMa for the initial
+and residual-glyph erase passes, paints fresh silhouette edges, then copies the Qwen-VAE
+core with a 0.5-pixel feather. The evaluation script
 imports these same mask and compositing helpers so the two implementations cannot
 silently drift. Silhouette crops start 12% of line height beyond each horizontal
 side, then expand each side independently while a foreground component anchored
@@ -1110,6 +1180,44 @@ sizes the curve's own values verify clean, which is what a resolution-scaled
 requirement would predict. There is no measured size at which the shipped curve fails,
 so it is left alone.
 
+### Meta Content Seal boundaries for qwen-zimage
+
+Measured 2026-08-26 against the anonymous oracle `meta.ai/identification`
+(verdicts read from the settled page text; corpus and full row-level provenance in
+`data/contentseal/manifest.csv`). Muse Image carries no C2PA, so
+`vendor_for_strength` returns None for it and these images ride the default
+resolution-adaptive curve; there is deliberately no `meta` entry in the flat vendor
+map, because no provenance signal can establish that cohort automatically and an
+unreachable constant would be dead code.
+
+| source (2.56 MP generation) | detected at | clean from |
+|---|---|---|
+| gen_lighthouse_watercolor | 0.0525 | 0.06 |
+| gen_fox_forest | 0.03 | 0.0375 |
+| gen_night_city | 0.03 | 0.0375 |
+| gen_studio_mug | -- | 0.03 |
+| gen_text_poster | -- | 0.015 |
+
+Full spread: worst first-clean boundary (0.0525, 0.06] on lighthouse, easiest
+source already clean at 0.015. Following the same derivation as the OpenAI and
+Microsoft floors (worst clean boundary plus one full observed cross-source
+spread): 0.06 + (0.0525 - 0.015) = 0.0975, rounded up to **0.1**. Shipped as
+`QWEN_ZIMAGE_META_STRENGTH` with two routing paths: auto mode routes a file
+whose only provenance is the standalone AI IPTC tag onto the cohort
+(`vendor_for_strength` checks C2PA issuers first, so Google/OpenAI/Microsoft
+evidence always wins, and the tag's other users ship no invisible watermark
+this profile targets), and `--vendor meta` / `InvisibleOptions.vendor` names the
+cohort explicitly on stripped files, implying the scrub runs (naming the cohort
+asserts the watermark is present). sdxl-zimage has no measured Meta rung and an
+explicit meta vendor there falls to the conservative unknown 0.25. The default
+resolution-adaptive curve (~0.1305 at 2.56 MP) also clears every measured
+source, so default behavior needed no change. Oracle verdicts carry a
+generation ID and creation timestamp embedded in the watermark payload; both
+survived the 512 px resize and JPEG q85 rows, so payload recovery outlives the
+detection threshold. Oracle session limits are per-IP, server-side, and
+sliding-window: clearing cookies and storage does not reset them, and a burst
+exhausts the window minutes after it reopens.
+
 ### Static prompt embeddings
 
 Both stages prompt with module constants, and at CFG 1.0 DiffSynth's

docs/python-api.md

@@ -112,6 +112,18 @@ raiw.remove_all(
 )
 ```
 
+`vendor="meta"` names a strength cohort explicitly (the measured Content Seal
+floor) for a stripped file whose provenance no longer carries the AI IPTC tag,
+and implies the scrub runs:
+
+```python
+raiw.remove_all(
+    "muse_output.webp",
+    "clean.png",
+    invisible=InvisibleOptions(vendor="meta"),
+)
+```
+
 `InvisibleOptions` carries only what `InvisibleEngine` itself takes, and uses the
 engine's own parameter names and defaults. `force`, which decides whether the
 engine runs at all, is a parameter of `remove_all` and `remove_batch` alongside
@@ -160,9 +172,26 @@ print(report.c2pa_validation)
 
 `c2pa_validation`, when present, reports `integrity`, `signature`,
 `signer_trust`, and `signer_validity` independently, plus the reader status
-codes. A valid hash and signature with an untrusted or expired signer is a
-medium-confidence signed claim. A hash or signature failure does not confirm the
-claimed platform or AI origin. Fallback parsing reports unknown validation
+codes. A valid hash and signature is a high-confidence signed claim; an
+unanchored or expired signer appears in `caveats` and in these fields, not as a
+lower confidence, because the reader ships no trust anchors to check against and
+`signer_trust` is therefore a missing input rather than a finding. A hash or
+signature failure, or a revoked signing credential, does not confirm the claimed
+platform or AI origin.
+
+A consumer must read `integrity_clashes`. When a credential fails validation,
+`is_ai_generated` becomes `None`, because a claim that cannot be tied to these
+bytes cannot establish origin -- the manifest may have been transplanted from a
+real AI image onto anything -- and the failure is reported in
+`integrity_clashes` instead. That is a different question from whether an AI
+watermark is physically present in the pixels, which is what
+`has_invisible_target` answers, and it stays fail-safe `True` on the same file.
+Reading only `is_ai_generated` turns a broken vendor manifest into silence.
+
+`c2pa_validation["state"]` is the reader's own aggregate and is carried for
+diagnostics only; no verdict is derived from it, because it collapses a
+transplanted manifest and a merely expired certificate into one `Invalid`, and
+its `Trusted` level depends on anchors no default installation has. Fallback parsing reports unknown validation
 dimensions, while a raw marker in an unsupported or malformed container can
 leave `c2pa_validation` as `None`.
 
@@ -534,8 +563,8 @@ independently and are not compared across detectors. Pass one of those explicit
 values to restrict the scan to a single provider. The Veo detector recognizes
 the current four-point diamond and the
 legacy `Veo` text. Seedance recognizes the boxed `AI` label, Dola recognizes
-its compact text label, Hailuo recognizes the composite MINIMAX/Hailuo label,
-and Kling recognizes its bottom-right logo, wordmark, and version suffix. Each
+its compact text label, Hailuo AI recognizes the composite MINIMAX/Hailuo AI label,
+and Kling AI recognizes its bottom-right logo, wordmark, and version suffix. Each
 variant has an independent synthetic silhouette and calibrated temporal policy.
 After each accepted frame is filled, `temporal_consistency=True` motion-aligns
 the preceding accepted fill and blends it only when the warped prior mask
@@ -615,10 +644,10 @@ engine.remove_watermark(
 Install `remove-ai-watermarks[text-restoration]`. The manifest schema and safety
 constraints are documented in the CLI guide. The engine verifies its decoded RGB
 hash before loading the diffusion models and rejects SDXL, downscaling, and
-postprocessing combinations that were not evaluated. Tiling is allowed: the VAE
-donor uses the same overlapping tiles as the global pass. `InvisibleOptions` exposes the
-same field for `remove_all`; after a visible-stage edit, the manifest must be built
-against the staged pixels rather than the pristine source.
+postprocessing combinations that were not evaluated. Tiling is also rejected because
+the combined tiled-restoration path has no provider-oracle calibration. `InvisibleOptions`
+exposes the same field for `remove_all`; after a visible-stage edit, the manifest must
+be built against the staged pixels rather than the pristine source.
 
 Use manifest schema 1 for manually reviewed text plus script metadata. Automated
 operators that verify only text-region geometry should emit schema 2 lines with a

docs/release-and-distribution.md

@@ -29,6 +29,10 @@ The package version appears in:
 Update the first two, then refresh the lock file with uv. Do not edit a
 line-number-specific location in `uv.lock`; its package order changes.
 
+Before choosing a version, verify it is absent from git tags, GitHub Releases,
+and PyPI. An unpublished remote tag still reserves that version; never move it,
+publish the next version instead.
+
 ## Publish flow
 
 PyPI publishing is triggered by a published GitHub Release, not by a tag push

docs/supported-signals.md

@@ -10,7 +10,7 @@ The `visible` command registers these mark keys:
 
 | Key | Mark | Expected area | Important limit |
 | --- | --- | --- | --- |
-| `gemini` | Google Gemini sparkle | Usually bottom right | Detection includes a false positive gate. |
+| `gemini` | Google Gemini visible watermark (sparkle) | Usually bottom right | Detection includes a false positive gate. |
 | `doubao` | `豆包AI生成` | Bottom right | Vendor specific text detector. |
 | `jimeng` | `★ 即梦AI` | Bottom right | Vendor specific text detector. |
 | `qwen` | `千问AI生成` | Bottom right | Strict visual gate. |
@@ -19,7 +19,8 @@ The `visible` command registers these mark keys:
 | `samsung` | `✦ Contenuti generati dall'AI` | Bottom left | Calibrated for the Italian text variant. |
 | `runninghub` | `RunningHub AI生成` | Top left | Strict visual and position gates. |
 | `baidu` | `百度 AI生成` | Bottom right | Detector and extended removal footprint. |
-| `liblib` | `LibLibAI` | Bottom center | Includes a minimum image size gate. |
+| `liblib` | `LiblibAI` | Bottom center | Includes a minimum image size gate. |
+| `microsoft` | One Microsoft white AI-badge variant | Top right | Strict gate; other documented icon, text, and position variants are not covered. |
 | `jimeng_pill` | `AI生成` pill | Top left | Weak detector with additional product and background gates. |
 
 `--mark auto` evaluates all registered marks and removes every selected match.
@@ -38,7 +39,7 @@ when you can select the affected area yourself.
 | `seedance` | Boxed `AI` label | Fixed bottom-right corner | Requires an anchored recurring match; the full localized box is filled because a thinner synthetic shape mask leaves the real translucent rim behind. |
 | `dola` | `Dola AI` text | Fixed bottom-right corner | Requires an anchored recurring match; ByteDance or BytePlus provenance can relax only an existing visual run. |
 | `hailuo` | `MINIMAX \| hailuo AI` composite label | Fixed lower edge | Uses a synthetic waveform, text, separator, and ring silhouette; the complete recurring label box is filled. A TC260 label naming MiniMax as producer can relax only an existing stable run. |
-| `kling` | Kling swirl, `KLING AI`, version, and optional `PRO` suffix | Fixed bottom-right edge | Combines a synthetic logo rescue with font variants, an edge gate, a white-label gate, and anchored temporal recurrence. |
+| `kling` | Kling AI swirl, `KLING AI`, version, and optional `PRO` suffix | Fixed bottom-right edge | Combines a synthetic logo rescue with font variants, an edge gate, a white-label gate, and anchored temporal recurrence. |
 
 `video identify`, `video visible`, and `video all` share this registry and the
 same temporal arbiter. It is separate from the image registry because selection
@@ -88,9 +89,11 @@ The inspection and stripping code handles signals in these groups:
 unknown when evidence is absent. It never treats missing metadata as proof that
 an image is human made. C2PA presence alone is not a verified identity: the
 report distinguishes asset binding, claim signature, signer trust, and signer
-validity. High-confidence C2PA attribution requires all four; intact but
-untrusted or fallback claims are medium-confidence, while a failed binding or
-signature contributes no origin verdict.
+validity. High-confidence C2PA attribution requires an intact asset binding and
+claim signature; signer trust and certificate expiry are reported as their own
+dimensions and as caveats, since no trust anchor list ships to evaluate them.
+Fallback claims, which validate nothing, remain medium-confidence, while a failed
+binding or signature or a revoked credential contributes no origin verdict.
 
 ## File and container formats
 
@@ -150,7 +153,47 @@ inspection cannot independently verify the output. Microsoft's official
 [Content Provenance Detection API](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/how-to/how-to-provenance-detection)
 is the external oracle: it reports pixel `Watermark` and embedded `C2PA` results
 separately; a control-positive, output-negative pair is the available per-file
-verification path.
+verification path. The API needs Azure credentials; the page a human can check
+without an account is <https://ai.azure.com/nextgen/validate>. Its verdict is
+weaker than the API's: it collapses watermark and C2PA into one rendered result
+and tops out at `Inconclusive` rather than a watermark-negative, so treat
+`Inconclusive` on a processed file as "not confirmed", not as "detected still".
+
+Meta Muse Image stamps every output with Content Seal, a proprietary invisible
+pixel watermark, and ships no visible mark (the legacy `Imagined with AI`
+corner mark belongs to the pre-2026 Imagine pipeline and is not registered).
+This project has no local Content Seal decoder. Meta Model API outputs and
+Meta CDN copies carry an XMP `iptcExt:DigitalSourceType =
+trainedAlgorithmicMedia` companion tag, which `identify` reports through the
+existing Made-with-AI path; that IPTC code is a standard, not a Meta-exclusive
+signal, so it cannot key a strength cohort the way the C2PA issuer does. Since
+0.33.0 a standalone AI digital-source tag (no C2PA manifest) additionally emits
+the additive `content_seal` signal - the strength router's Meta bet as evidence,
+medium confidence, with the same caveat - so clients select pixel removal from
+the signal list exactly the way InvisMark is additive over `soft_binding`. It
+is an attribution, never a decode. The
+external oracle is `https://meta.ai/identification`: anonymous, no login,
+accepts image, video, and audio, enforces an unspecified daily identification
+limit, and answers with model attribution (`Muse Image 1 - Meta`) plus a
+per-generation ID and creation timestamp read from the watermark payload. No
+identification endpoint exists in the Meta Model API itself (the reference at
+dev.meta.ai documents only generation and edits for images), and the official
+documentation never mentions the seal. The
+default `qwen-zimage` profile clears Content Seal at the default
+resolution-adaptive strength (oracle-verified on 2.56 MP generations); measured
+strength boundaries are recorded in `data/contentseal/manifest.csv` and
+[module internals](module-internals.md#meta-content-seal-boundaries-for-qwen-zimage).
+The derived Meta floor (0.1 by the standard spread method) ships as a measured
+cohort: auto mode routes a file whose only provenance is the standalone AI IPTC
+tag to it (the tag is not Meta-exclusive; other tag users ship no invisible
+watermark this profile targets, and Google/OpenAI/Microsoft C2PA evidence
+always wins first), and `invisible --vendor meta` (also `all` and `batch`, and
+`InvisibleOptions.vendor` in the API) names the cohort explicitly on stripped
+files. An explicit vendor implies the scrub runs: naming the cohort asserts the
+pixel watermark is present.
+The seal survives resizing, JPEG recompression, and metadata stripping; it dies
+to center crops of a third to a half, matching the Reuters 2026-07-11 finding
+that Meta's detector missed 55% of cropped Muse images.
 
 For MP4, MOV, and M4V, `video invisible` or the explicit
 `video all --invisible` option can regenerate the video through a VAE and strip
@@ -172,7 +215,9 @@ not a universal clean verdict.
 | Google Gemini | Sparkle | Diffusion regeneration for SynthID | C2PA and related source signals |
 | Google Veo video | Veo diamond and legacy text | Oracle-certified VAE removal for SynthID | C2PA and related source signals |
 | OpenAI image generators | None registered | Diffusion regeneration for supported invisible signals | C2PA and generator provenance |
+| Meta Muse Image | None on Muse output (legacy `Imagined with AI` unregistered) | Diffusion regeneration for Content Seal, oracle-verified on the default profile | XMP IPTC `trainedAlgorithmicMedia` companion tag; no local Content Seal decoder |
 | Microsoft Paint and Photos | None registered | External Microsoft oracle for InvisMark; no validated local decoder | Paint C2PA soft-binding algorithm and identifier |
+| Microsoft image outputs (measured variant) | One top-right white AI-badge variant | No registered pixel decoder | C2PA attribution |
 | Stable Diffusion and SDXL | None registered | Diffusion regeneration; optional open decoder | Embedded parameters and text metadata |
 | FLUX | None registered | Diffusion regeneration; optional open decoder | C2PA for supported sources |
 | Adobe Firefly | None registered | Optional TrustMark Variant P decoder | C2PA |
@@ -180,10 +225,10 @@ not a universal clean verdict.
 | Luma AI | None registered | No registered pixel decoder | PNG text generator tags (Uni-1) |
 | ByteDance generators | Doubao and Jimeng marks | No registered pixel decoder | TC260 AIGC, supported C2PA, and exact app-export AIGC disclosures |
 | Qwen | Qwen mark | No registered pixel decoder | TC260 AIGC |
-| Kling | Kling image and video marks | No registered pixel decoder | TC260 AIGC |
-| Hailuo / MiniMax video | Hailuo composite video label | No registered pixel decoder | TC260 AIGC where present |
+| Kling AI | Kling AI image and video marks | No registered pixel decoder | TC260 AIGC |
+| Hailuo AI / MiniMax video | Hailuo AI composite video label | No registered pixel decoder | TC260 AIGC where present |
 | Baidu | Baidu mark | No registered pixel decoder | TC260 AIGC |
-| LibLibAI | LibLibAI mark | No registered pixel decoder | TC260 AIGC |
+| LiblibAI | LiblibAI mark | No registered pixel decoder | TC260 AIGC |
 | RunningHub | RunningHub mark | No registered pixel decoder | TC260 AIGC |
 | Samsung Galaxy AI | One locale specific mark | No registered pixel decoder | C2PA and Samsung markers |
 

docs/synthid.md

@@ -537,8 +537,8 @@ study (section 2.2) gives empirical floors:
 > were removed, and `OPENAI_STRENGTH` / `GEMINI_STRENGTH` / `UNKNOWN_STRENGTH` went
 > with them. Everything from here to the end of this section is a record of what was
 > measured on those profiles, kept because the oracle verdicts are still the evidence
-> base. For the strength policy in force now see `module-internals.md`: `qwen-zimage`
-> uses `resolution_adaptive_denoise`, `sdxl-zimage` a flat vendor ladder.
+> base. For the strength policy in force now see
+> [`known-limitations.md`](known-limitations.md#strength-is-content-and-seed-dependent).
 
 The default was **vendor-adaptive** (`watermark_profiles.resolve_strength` +
 `vendor_for_strength`): the tool read the C2PA issuer on the original input and picked
@@ -691,9 +691,9 @@ solid at 0.10 but at 0.15 it is near-threshold noise; (2) for reliable removal p
 a strength with MARGIN above the borderline (controlnet >= 0.20), not exactly on
 it; (3) **historical engineering conclusion:** this dated run argued for a
 higher ControlNet strength than the then-current default. That proposal was
-later superseded. The current resolver intentionally shares the 0.10/0.15
-ladder between SDXL and ControlNet and uses a separate Qwen ladder; see
-`_internal/watermark_profiles.py`.
+later superseded. The resolver of that period shared the 0.10/0.15 ladder between
+SDXL and ControlNet; the current policies are recorded in
+[`known-limitations.md`](known-limitations.md#strength-is-content-and-seed-dependent).
 Source images are private (faces / product shots), not committed; reproduce on any
 photoreal + flat-graphic gpt-image pair, varying the seed, and re-checking the
 oracle.
@@ -770,14 +770,14 @@ reproducible verification requires a fixed seed.
    Watermarking.** arXiv:2505.21620.
    https://arxiv.org/abs/2505.21620
 
-**Google floor on qwen-zimage (0.27.2, 2026-08-19).** The bracket above did not
+**Google floor on qwen-zimage (0.27.2, remeasured 2026-08-25).** The bracket above did not
 survive the full production path: on the 4.33 MP CJK-sign fixture (visible-stage
 sparkle removal -> qwen-zimage seed 0 at the curve's 0.154 top -> resize-back ->
 metadata strip), the Gemini verifier detected SynthID x3 with a valid
 pixel-identical stripped control in the same session. Google-provenance content
-now takes a flat `QWEN_ZIMAGE_GOOGLE_STRENGTH = 0.30` floor instead of the area
-curve - 0.30 anchors measured clean in Gemini on two fixtures (CJK sign +
-18-face) at 3/3 checks across two work accounts, and stayed clean with the
-vae-glyphs donor layer on top; openai/unknown content keeps the resolution
-curve. An explicit strength still wins. Certification artifacts: raiw-app
+initially took a flat `0.30` floor instead of the area curve. The later provider
+remeasurement established a common pass at `0.25` across three valid sources and
+separately repeated `QWEN_ZIMAGE_GOOGLE_STRENGTH = 0.27` across those sources and
+three accounts. OpenAI now has its own measured flat operating point; unknown
+content keeps the resolution curve. An explicit strength still wins. Certification artifacts: raiw-app
 `data/certification/text-restoration-2026-08-18/` (the failing re-baseline).

docs/text-protection-research.md

@@ -20,8 +20,8 @@ filter applied to every candidate below.
 ## Problem recap
 
 The `invisible` pipeline is SDXL base 1.0 img2img to defeat SynthID. The default
-strength has risen over time as Google hardens SynthID (0.05 -> 0.10 -> **~0.30**, the
-current threshold for fresh Gemini output); higher strength deforms text more, which is
+strength rose over time as Google hardened SynthID (0.05 -> 0.10 -> **~0.30** in
+this experiment; the later measured operating point is 0.27); higher strength deforms text more, which is
 exactly why text protection matters. Text is protected via Differential Diffusion with a
 per-pixel change map (`preserve` ~0.9) driven by the PP-OCRv3 DB detector
 (`text_protector.py`). Large text survives; **small text (sub ~8 px strokes) softens or

docs/verification-plan.md

@@ -24,7 +24,7 @@ Performance depends on format, enabled extras, and hardware. Measure it locally
 
 ## Tier A -- self-evident oracles (full corpus, unattended)
 
-Properties that are true or false without anyone labelling anything. These are the
+Properties that are true or false without anyone labeling anything. These are the
 backbone: they scale to large local datasets and catch regressions with zero human cost.
 
 ### A1. Recorded-verdict regression
@@ -128,7 +128,7 @@ which read like twelve broken features. It was one bad harness parameter (`--ste
 sitting on top of one real bug. An error that is IDENTICAL across unrelated rows is
 evidence of a common cause, not of many faults -- check the shared input first.
 
-## Tier B -- constructed ground truth (automatable, no labelling)
+## Tier B -- constructed ground truth (automatable, no labeling)
 
 Where reality gives no answer key, build one. This is the tier that closes the two biggest
 holes: fill quality and detector response at the edge of the operating range.
@@ -169,7 +169,7 @@ Peak RSS and wall time per backend x input size, up to 25 MP. The memory-constra
 tier is a real constraint (MI-GAN must stay ~0.6-0.9 GB by cropping around the mask); a
 regression here is invisible today and would only surface under load.
 
-## Tier C -- human-labelled accuracy (bounded by labelling effort)
+## Tier C -- human-labeled accuracy (bounded by labeling effort)
 
 The machinery exists: `visible_recall_sample.py` -> `visible_sheets.py` ->
 `visible_groundtruth.py` -> `visible_eval.py`.
@@ -291,7 +291,7 @@ on one file. The bar is never "handles it" but **never raises and never silently
 4. **B2 detector curves** -- cheap, and directly guards the geometry class of bug.
 5. **A5 contract sweep over a representative local set**.
 6. **B4 resource ceilings**, **E robustness**.
-7. **C recall expansion** -- gated by labelling appetite.
+7. **C recall expansion** -- gated by labeling appetite.
 8. **D oracles** -- manual, per release.
 
 Every tier writes a versioned snapshot so runs are comparable over time; a run that cannot
@@ -326,7 +326,7 @@ Per mark, what actually goes away when metadata is stripped:
 
 ### Measure before improving
 
-Use Tier B2 detector-response curves before tuning a detector with sparse labelled
+Use Tier B2 detector-response curves before tuning a detector with sparse labeled
 examples. Sweep size, contrast, aspect, and background texture so geometry regressions
 are visible without exposing private evaluation statistics.
 

docs/watermarking-landscape.md

@@ -10,7 +10,7 @@ Who embeds what, and whether it is locally detectable (so we know which gaps are
   **Root cause and external confirmation (deep-research 2026-06-19, adversarially verified).** This is the SCHEME's ceiling, not our usage — there is no better decoder to adopt. The imwatermark maintainers state verbatim (both the ShieldMnt and Stability-AI READMEs) that the algorithm "cannot guarantee to decode the original watermarks 100% accurately even though we don't apply any attack." Independent measurement (WMAdapter, arXiv:2406.08337 Table 2) puts dwtDct at only **~0.79 bit accuracy on CLEAN images (~38/48 bits — already below our 44 gate)**, collapsing to ~0.50 (chance) under crop/JPEG. Two code-verified + locally-reproduced mechanisms drive the content-dependent failures: (1) the decoder reads each bit as the **highest-magnitude DCT coefficient per block**, so any content coefficient exceeding the encoded target flips the bit; (2) the default embed is in the **YUV chroma channel, which 8-bit-clamps on white/bright pixels** (a +36 chroma delta survives a white-fill round-trip as only +4, ~89% loss) — this is the mechanism behind the bright-flat / minimalist failures and the all-ones degenerate decode. No maintained fork or detector decodes this scheme reliably: the WAVES benchmark (arXiv:2401.08573) relegates DWT-DCT to supplementary appendix G.5 and targets Stable Signature / Tree-Ring / StegaStamp instead; learned encoder/decoder schemes reach ~0.98-0.99 clean but are a DIFFERENT watermark class (not what SDXL/FLUX stamp). `dwtDctSvd` does not help (SDXL embeds `dwtDct`; dwtDctSvd cannot decode it, and its clean accuracy ~0.72 is lower). **Authoritative conclusion: the open DWT-DCT mark cannot be turned from positive-only into a reliable real-world detector; keep it positive-only and rely on C2PA.** (Refuted along the way: that the library is unmaintained, and that it is robust to JPEG but only fails on geometric attacks — both did not survive verification.)
 
   Consequence for the FLUX hosted-output question (BFL Playground, FLUX.2 [pro] + FLUX.1 [dev], 2026-06-19): all samples carry the signed C2PA manifest (issuer "Black Forest Labs"); the open DWT-DCT decode returned `None`, but every available FLUX carrier (textured fox AND a minimalist-flat generation) failed the positive control (28/48), so the detector is blind on them and **whether BFL hosted output embeds the open pixel watermark is UNRESOLVED** (an earlier note here wrongly asserted it absent — overstated; a later note blamed "high texture" — also wrong, flat carriers fail too). What IS established: C2PA is the reliable FLUX identifier; the `_BITS_48` pattern is correct (round-trips on chatgpt/firefly/random). Resolving the hosted question needs a hosted FLUX carrier that first passes a >=44/48 positive control, which neither a textured nor a flat prompt produced — low priority (the open mark is only a stripped-metadata fallback).
-- **C2PA / IPTC (covered by the issuer/marker scan):** OpenAI, Google, Adobe Firefly, Microsoft (Copilot + Designer; Bing Image Creator collected 2026-05-24 still signs as "Microsoft" and now runs **MAI-Image**, NOT OpenAI/DALL-E), **Stability AI** (collected from Brand Studio / DreamStudio successor; signs C2PA as "Stability AI Ltd", no SynthID, no imwatermark on its current Stable Image model — issuer added to `C2PA_ISSUERS`), and **Canva** (Magic Media signs C2PA as "Canva" + `trainedAlgorithmicMedia` with a generic `c2pa-rs` claim generator, no SynthID — issuer `b"Canva"` → "Canva (Magic Media)"; verified samples disproved the earlier assumption that Canva downloads always strip C2PA). Still unsampled: Getty, Shutterstock. Midjourney embeds NO C2PA and no invisible watermark (our `mj-*` sample carried only the IPTC tag).
+- **C2PA / IPTC (covered by the issuer/marker scan):** OpenAI, Google, Adobe Firefly, Microsoft (Copilot + Designer; Bing Image Creator collected 2026-05-24 still signs as "Microsoft" and now runs **MAI-Image**, NOT OpenAI/DALL·E), **Stability AI** (collected from Brand Studio / DreamStudio successor; signs C2PA as "Stability AI Ltd", no SynthID, no imwatermark on its current Stable Image model — issuer added to `C2PA_ISSUERS`), and **Canva** (Magic Media signs C2PA as "Canva" + `trainedAlgorithmicMedia` with a generic `c2pa-rs` claim generator, no SynthID — issuer `b"Canva"` → "Canva (Magic Media)"; verified samples disproved the earlier assumption that Canva downloads always strip C2PA). Still unsampled: Getty, Shutterstock. Midjourney embeds NO C2PA and no invisible watermark (our `mj-*` sample carried only the IPTC tag).
 
 **Samsung Galaxy AI** signs supported edits with C2PA and may carry the
 proprietary `genAIType` marker. The registered visible detector covers the
@@ -28,7 +28,7 @@ take precedence over issuer attribution. Supported mappings include Higgsfield
 AI, Topaz Labs Image API, and TikTok Ad Creative Toolbox; an unknown claim
 generator still falls back to the certificate issuer.
 
-**ByteDance Volcano Engine (Volcengine)** — the cloud behind Doubao / Jimeng — signs its AI image output with a cert from `certificate_center@volcengine.com` + `trainedAlgorithmicMedia` (issuer `b"volcengine"` → "ByteDance (Volcano Engine)", platform "ByteDance (Doubao / Jimeng / Dreamina / Volcano Engine)"); note this is the C2PA-signed surface, distinct from the XMP/PNG TC260 `AIGC` label Doubao also uses. ByteDance's **international brand (BytePlus / Seedream / Seededit)** signs the same content as **"Byteplus Pte. Ltd."**. The bare `volcengine` needle missed it, so BytePlus output was mis-attributed to "Adobe Firefly" through an incidental "Adobe XMP" toolkit string. Issuer `b"Byteplus"` now maps directly to "BytePlus (ByteDance)". ByteDance's consumer app **Dreamina** (the international Jimeng brand) signs as **"Bytedance Pte. Ltd."** with a `Dreamina/x.y` claim generator but, unlike the Volcano Engine surface, ships **no `trainedAlgorithmicMedia`**. Issuer `b"Dreamina"` maps to "ByteDance (Dreamina)" with **`asserts_ai=True`**. Registering the broader **issuer** `b"Bytedance Pte"` was deliberately avoided because that same entity also signs non-AI CapCut edits; keying on the `Dreamina` generator token is precise.
+**ByteDance Volcano Engine (Volcengine)** — the cloud behind Doubao / Jimeng — signs its AI image output with a cert from `certificate_center@volcengine.com` + `trainedAlgorithmicMedia` (issuer `b"volcengine"` → "ByteDance (Volcano Engine)", platform "ByteDance Volcano Engine"); note this is the C2PA-signed surface, distinct from the XMP/PNG TC260 `AIGC` label Doubao also uses. ByteDance's **international brand (BytePlus / Seedream / Seededit)** signs the same content as **"Byteplus Pte. Ltd."**. The bare `volcengine` needle missed it, so BytePlus output was mis-attributed to "Adobe Firefly" through an incidental "Adobe XMP" toolkit string. Issuer `b"Byteplus"` maps directly to "BytePlus (ByteDance)". ByteDance's consumer app **Dreamina** (the international Jimeng brand) signs as **"Bytedance Pte. Ltd."** with a `Dreamina/x.y` claim generator but, unlike the Volcano Engine surface, ships **no `trainedAlgorithmicMedia`**. Issuer `b"Dreamina"` maps to "ByteDance Dreamina" with **`asserts_ai=True`**. Registering the broader **issuer** `b"Bytedance Pte"` was deliberately avoided because that same entity also signs non-AI CapCut edits; keying on the `Dreamina` generator token is precise.
 - **EXIF/XMP/PNG-text generator tag (caught by `exif_generator`):** **Ideogram** writes EXIF `Make="Ideogram AI"` (collected 2026-05-24 — no C2PA, no SynthID, no imwatermark; the Make tag is the only signal). Additional verified generator stamps include **NovelAI** (`Software`, `Source`, and `Title` PNG text chunks), **Reve** (`Software` or XMP `CreatorTool` = `reve.com`), and **Aphrodite AI** (`Make` or `Software` = `Aphrodite AI`).
 - **App-export provenance and AIGC JSON:** supported ByteDance-family exports can place a JSON object in EXIF `ImageDescription` or `UserComment`, independently of C2PA or TC260. Exact `product` values for Doubao, Xinghui, and Dreamina are removable product provenance, but do not alone prove that the pixels were generated. Dreamina additionally requires `exportType=generation` for that verdict. A nested Aweme `aigc_type=1` or private ByteDance `aigc_label_type=1` / `2` is an AIGC disclosure; `0` is inconclusive and can occur on a Dreamina generation export. Plain Aweme, retouch, and `lv` exports are preserved. The lower-case private field is deliberately not interpreted as the normative TC260 `Label`, whose values `1` / `2` / `3` mean generated / possibly generated / suspected generated under [GB 45438-2025](https://www.tc260.org.cn/upload/2025-03-15/1742009439794081593.pdf).
 - **xAI / Grok — its own EXIF signature scheme, NOT C2PA (DETECTED by `metadata.xai_signature`, built 2026-05-26).**
@@ -58,7 +58,7 @@ defines two more native serializations. AVI stores an `AIGC` child in
 bounded RIFF and FLV readers validate the JSON field set and skip media
 payloads. Removal remuxes either container through ffmpeg with stream copy.
 
-- **HuggingFace-hosted job (caught by `metadata.huggingface_job`, surfaced by `identify` as the `hf_job` signal, MEDIUM confidence):** HuggingFace Jobs / Spaces can stamp generated PNGs with an `hf-job-id` tEXt chunk holding the job UUID. It marks the *hosting job*, not a model, so it lifts an Unknown verdict to a tentative AI via `hf_only` but never overrides a hard metadata signal. `_HF_JOB_CAVEAT` states the limit. Removal drops the chunk through the PNG metadata whitelist.
+- **Hugging Face-hosted job (caught by `metadata.huggingface_job`, surfaced by `identify` as the `hf_job` signal, MEDIUM confidence):** Hugging Face Jobs / Spaces can stamp generated PNGs with an `hf-job-id` tEXt chunk holding the job UUID. It marks the *hosting job*, not a model, so it lifts an Unknown verdict to a tentative AI via `hf_only` but never overrides a hard metadata signal. `_HF_JOB_CAVEAT` states the limit. Removal drops the chunk through the PNG metadata whitelist.
 - **No detectable signal on some downloads:** Recraft exports and some hosted
   FLUX surfaces can arrive without a supported local signal. Midjourney samples
   may carry IPTC metadata but no registered C2PA or pixel watermark. The open
@@ -66,11 +66,11 @@ payloads. Removal remuxes either container through ffmpeg with stream copy.
   encoder and the carrier remains decodable.
 - **Invisible but NOT locally detectable (proprietary, API/oracle only — same wall as SynthID):** Amazon Titan Image Generator + Nova Canvas (Bedrock `DetectGeneratedContent` API), Kakao (new SynthID image adopter, May 2026), NVIDIA Cosmos (SynthID video). No local detector possible; treat like SynthID.
 - **C2PA 2.4 "Durable Content Credentials" (April 2026; verified against the spec) raise the bar for metadata stripping.** 2.4 defines soft bindings (an invisible watermark or a content fingerprint) plus a server-side manifest repository and a new `c2pa.repository-receipt` assertion. Per the spec: "if a C2PA manifest is removed from an asset, but a copy of that manifest remains in a provenance store elsewhere, the manifest and asset may be matched using available soft bindings." So our local `metadata --remove` deletes the *embedded* manifest, but a fingerprint/watermark soft binding can still re-link the image to its manifest in a repository server-side. Stripping the file is becoming necessary-but-not-sufficient against durable provenance. (Our parsers target the stable embedded-manifest format documented in C2PA 2.1 §11; that format is unchanged in 2.4 -- the new pieces are repository/soft-binding infra, not the on-file box layout, so no parser change is implied.) Spec: https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html We now READ the soft-binding `alg` (`C2PA_SOFT_BINDINGS` / `soft_binding_vendors_in`) to name the forensic-watermark vendor, preserve the structured assertion's signed `value`, and locally DECODE the one open scheme, Adobe TrustMark (`trustmark_detector`); the rest stay name-only unless a compatible decoder is independently verified.
-- **Microsoft Paint and Photos InvisMark (reverse-engineered 2026-08-20):** Paint receives a per-generation GUID from remote prompt moderation, embeds it into locally generated pixels, and records the same value in `c2pa.soft-binding` under `com.microsoft.invismark.1`. The C2PA soft-binding registry independently identifies that algorithm as Microsoft Responsible AI InvisMark for image and video. Paint's 144-bit writer framing does not match the public repository's 100-bit pretrained checkpoint interface, so compatibility is not assumed. The parser reports the signed identifier; there is no validated local pixel decoder. Microsoft's external Content Provenance Detection API is the removal oracle because it reports `Watermark` separately from `C2PA`; a metadata-stripped, pixel-identical control must remain watermark-positive before an output-negative result is attributed to pixel removal. Sources: https://xusheng.dev/posts/reversing/mspaint_invisible_watermark/main/, https://github.com/c2pa-org/softbinding-algorithm-list/blob/main/softbinding-algorithm-list.json, and https://learn.microsoft.com/en-us/azure/ai-services/content-safety/how-to/how-to-provenance-detection
+- **Microsoft Paint and Photos InvisMark (reverse-engineered 2026-08-20):** Paint receives a per-generation GUID from remote prompt moderation, embeds it into locally generated pixels, and records the same value in `c2pa.soft-binding` under `com.microsoft.invismark.1`. The C2PA soft-binding registry independently identifies that algorithm as Microsoft Responsible AI InvisMark for image and video. Paint's 144-bit writer framing does not match the public repository's 100-bit pretrained checkpoint interface, so compatibility is not assumed. The parser reports the signed identifier; there is no validated local pixel decoder. Microsoft's external Content Provenance Detection API is the removal oracle because it reports `Watermark` separately from `C2PA`; a metadata-stripped, pixel-identical control must remain watermark-positive before an output-negative result is attributed to pixel removal. The no-account web page for the same check is <https://ai.azure.com/nextgen/validate> (its `Inconclusive` verdict is weaker than the API's separate watermark result). Sources: https://xusheng.dev/posts/reversing/mspaint_invisible_watermark/main/, https://github.com/c2pa-org/softbinding-algorithm-list/blob/main/softbinding-algorithm-list.json, and https://learn.microsoft.com/en-us/azure/ai-services/content-safety/how-to/how-to-provenance-detection
 - **Built in the dated batch:** soft-binding vendor detection, IPTC Photo
   Metadata AI-disclosure fields, C2PA detection and stripping for supported
   ISOBMFF video, the optional Adobe TrustMark decoder, and temporally stabilized
-  visible Sora, Veo, Seedance, Dola, Hailuo, and Kling removal. Other visible
+  visible Sora, Veo, Seedance, Dola, Hailuo AI, and Kling AI removal. Other visible
   video logos and proprietary audio-watermark detection remain outside the
   package.
   Metadata stripping for supported audio containers is a separate implemented
@@ -116,12 +116,12 @@ every frame, then requires an anchored temporal run. This extra anchor check
 was necessary because a moving clean scene detail could retain enough adjacent
 overlap to pass a recurrence-only gate.
 
-**Hailuo and Kling use larger fixed composite labels.** Verified Hailuo exports
-carry a lower-edge waveform, `MINIMAX`, separator, Hailuo ring, and
-`hailuo AI` text. Verified Kling exports carry a bottom-right swirl,
+**Hailuo AI and Kling AI use larger fixed composite labels.** Verified Hailuo AI exports
+carry a lower-edge waveform, `MINIMAX`, separator, Hailuo AI ring, and
+`hailuo AI` text. Verified Kling AI exports carry a bottom-right swirl,
 `KLING AI`, a changing version suffix, and sometimes `PRO`. The detectors use
-only synthetic primitives and fonts. Hailuo expands the matched core to cover
-the complete composite. Kling combines a version-independent text core with a
+only synthetic primitives and fonts. Hailuo AI expands the matched core to cover
+the complete composite. Kling AI combines a version-independent text core with a
 synthetic ring rescue, then requires the recurring candidate to reach the
 expected frame edge and contain enough bright low-saturation pixels. Those
 extra gates were added after clean Luma and PixVerse scene details passed shape
@@ -131,17 +131,17 @@ instead uses Florence-2 to identify arbitrary watermarks before LaMa
 inpainting. That is broader, but it carries a much heavier model and a less
 auditable detection boundary than the provider-specific synthetic path here.
 
-**The faint-visible-mark precision/recall wall is fundamental, not a heuristic artifact.** The visible-watermark-detection literature has moved to LEARNED segmentation / object-detection (WDNet WACV'21 arXiv:2012.07616; SLBR ACM MM'21, open code+weights; the PRCV'18 large-scale detector; Su et al. survey 2025), but three verified findings bound what a learned detector actually buys: (1) a claim that a confidence threshold "cleanly separates" true from false matches even with a learned CNN front-end was **REFUTED** in verification (arXiv:1705.08593) -- the precision/recall wall persists even with learned features. (2) Learned detectors need a LARGE, pattern-diverse labeled dataset trained on synthetic composites (PRCV'18: 60k images / 80 watermark classes; CLWD: 60k / 160 marks), and off-distribution degradation is a documented real axis (models trained on limited-pattern LVW transfer worse; diversity of training patterns drives generalization). (3) Inference is cheap (WDNet ~8 ms at 256x256) -- the cost is the data pipeline, not runtime. Net: a learned detector shifts the frontier but does NOT remove the wall; for a SINGLE mark the cheapest next step is a small patch classifier (real-sparkle vs false-positive) on top of the existing NCC localizer, not a full segmentation model. SLBR is a ready baseline. The current NCC + false-positive gate (core-ring brightness margin + gradient-NCC crispness + white-core saturation) is a sound operating point, and the residual miss is the information-theoretic wall the literature confirms.
+**Learned detectors change the visible-mark precision/recall tradeoff; they do not establish a universal separator.** The visible-watermark-detection literature has moved to learned segmentation and object detection (WDNet WACV'21 arXiv:2012.07616; SLBR ACM MM'21, open code and weights; the PRCV'18 large-scale detector; Su et al. survey 2025). The cited arXiv:1705.08593 paper reports a method that significantly reduces false matches and eliminates them after rejecting a small fraction of matches on its electron-microscopy task; it does not prove an information-theoretic limit for watermark detection. Learned watermark detectors also rely on large, pattern-diverse labeled datasets built with synthetic composites (PRCV'18: 60k images / 80 watermark classes; CLWD: 60k / 160 marks), and transfer depends on the diversity represented in training. Inference can be cheap (WDNet reports roughly 8 ms at 256x256), while the labeled-data and evaluation pipeline remain the larger project cost. A learned detector is therefore a possible future operating point, not evidence that the current NCC gate is theoretically optimal.
 
-**Visible-mark landscape beyond the registry.** Meta stamps a visible "Imagined with AI" mark (bottom-LEFT, a small symbol) on its OWN Meta AI / "Imagine" output; for third-party images it relies on C2PA / IPTC, not a visible mark. Samsung Galaxy AI additionally uses a **four-star icon** variant in a corner alongside the localized text wordmark `samsung_engine` calibrates (only the Italian text variant is covered) -- the icon is a distinct, uncovered variant. Every source agrees visible + metadata marks are trivially removable (crop / screenshot, ~2 s), which is the tool's premise.
+**Visible-mark landscape beyond the registry.** Since Muse Image (2026-07) Meta's own generation output carries no visible mark, only the invisible proprietary Content Seal; the legacy visible "Imagined with AI" mark belongs to the pre-2026 Meta AI / "Imagine" pipeline and remains unregistered (string verified, position not). For third-party images Meta relies on C2PA / IPTC, not a visible mark. The Samsung detector covers only the measured Italian text wordmark; no separate icon-only variant has been verified. Visible overlays and embedded metadata can usually be removed without changing the underlying generation model, which is the tool's premise.
 
 **Regulatory driver -- China GB 45438-2025 is the strongest VISIBLE-mark mandate.** The CAC / TC260 "Measures for Labeling AI-Generated Synthesized Content" (issued March 2025, **effective 2025-09-01**, technical standard **GB 45438-2025**, building on the TC260 Aug-2023 practice guide) MANDATE a **visible** label for AI images -- a visible textual mark whose height must be **>= 5% of the image's shortest side** -- plus the metadata (implicit) label. Several such CJK text marks are now registered; see [supported signals](supported-signals.md) for the current list. By contrast EU AI Act Article 50 mandates only the MACHINE-READABLE mark (enforceable 2026-08-02, grace to 2026-12-02); a visible label is proposed and modality-specific (visible for images) but is NOT a hard "fixed icon" mandate -- a claim that Art 50 requires a clearly-visible fixed icon for images was refuted in verification. Primary-source dates verified against the article/standard text, not search summaries.
 
 ## Uncovered visible marks: implementation specs (deep-research 2026-07-18)
 
-Compatibility testing showed that TC260-labelled images can still produce no visible-mark
+Compatibility testing showed that TC260-labeled images can still produce no visible-mark
 detection. The main causes were a fixed Doubao localization defect and genuinely
-uncovered vendors. Verification status is labelled per claim; treat (b)/(c) as leads,
+uncovered vendors. Verification status is labeled per claim; treat (b)/(c) as leads,
 not ground truth.
 
 **GB 45438-2025 clause 5.2, the binding constraint for every Chinese mark (VERIFIED (a) -- full standard text extracted from the TC260-hosted PDF).** Verbatim requirements for an image's explicit label:
@@ -153,7 +153,7 @@ not ground truth.
 
 Two consequences we can exploit: (1) the 5% floor is a **scale prior** -- a compliant CN mark's glyphs are large (>= 51 px on a 1024² image), so a CN silhouette ladder can be anchored at ~5-10% of the short side instead of swept broadly, which should cut false fires; (2) every compliant string shares the tail `AI生成` / `AI合成`, so a shared suffix silhouette plus a per-vendor prefix may beat five independent templates. NOT established: whether 文字高度 means cap height, em box, or rendered bounding box (a ~1.3x spread in template scale). Sources: `https://www.tc260.org.cn/upload/2025-03-15/1742009439794081593.pdf`, parent CAC measure `https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm` (the CAC text itself specifies no size or corner).
 
-**Alibaba Qwen -- two surfaces that differ (API tier VERIFIED (a)).** Model Studio docs state verbatim that the API adds a `Qwen-Image` watermark 在图像右下角 and 默认值为 false -- so API output is **unwatermarked by default**, and when enabled the mark is a LATIN wordmark, not CJK, and not GB-compliant in wording. The consumer app's `千问AI生成` (bottom-right) is (b) secondary only -- no Alibaba primary page states it. So Qwen needs TWO templates, and its absence is never evidence of a clean image. Source: `https://help.aliyun.com/zh/model-studio/qwen-image-api`.
+**Alibaba Cloud Qwen -- two surfaces that differ (API tier VERIFIED (a)).** Model Studio docs state verbatim that the API adds a `Qwen-Image` watermark 在图像右下角 and 默认值为 false -- so API output is **unwatermarked by default**, and when enabled the mark is a LATIN wordmark, not CJK, and not GB-compliant in wording. The consumer app's `千问AI生成` (bottom-right) is (b) secondary only -- no Alibaba primary page states it. So Qwen needs TWO templates, and its absence is never evidence of a clean image. Source: `https://help.aliyun.com/zh/model-studio/qwen-image-api`.
 
 **星绘 is ByteDance (VERIFIED (a): Baidu Baike + App Store listing, now branded 豆包旗下, team folded into Doubao April 2025).** So `星绘AI生成` is very likely the Doubao house style -- same typeface, same corner, possibly the same top-left `AI生成` pill. Starting from the Doubao `TextMarkConfig` and swapping the two lead glyphs is the cheap path. String/position themselves are (c) inferred.
 
@@ -161,9 +161,11 @@ Two consequences we can exploit: (1) the 5% floor is a **scale prior** -- a comp
 
 **Tencent Yuanbao: RESOLVED 2026-07-25, registered (`yuanbao_engine.py`).** The standard mark is a compact two-line italic `元宝` over `AI生成` block at bottom-right. It switches between light and dark strokes with the scene, so detection uses polarity-independent local contrast rather than a white top-hat. The separate one-line overlay variant remains evidence-limited to one example.
 
-**Meta `Imagined with AI` (string VERIFIED (a) from Meta's own newsroom; POSITION NOT VERIFIED).** Sources conflict on placement. Do not encode a corner without a verified sample. `identify` reads the supported IPTC disclosure; it does not decode Meta's proprietary invisible watermark. Source: `https://about.fb.com/news/2024/02/labeling-ai-generated-images-on-facebook-instagram-and-threads/`.
+**Meta Muse Image / Content Seal: current state VERIFIED 2026-08-26 against live artifacts.** Muse Image (launched 2026-07-07, first image model from Meta Superintelligence Labs) puts no visible mark on output. Every output carries Content Seal, a proprietary invisible pixel watermark; research lineage is open (`github.com/facebookresearch/content-seal`, Pixel Seal / VideoSeal / Watermark Anything), but the deployed implementation is proprietary and unpublished. API outputs and Meta CDN copies also carry XMP `iptcExt:DigitalSourceType = trainedAlgorithmicMedia` (a standard IPTC code, not Meta-exclusive). The only reader is the anonymous web oracle `meta.ai/identification`, which returns model attribution plus a per-generation ID and timestamp embedded in the payload. Verified robustness (our corpus, `data/contentseal/`): seal survives CDN WebP transcode, 512 px resize, JPEG q85, and full metadata stripping; it is lost to center crops of 33-50% linear size (Reuters measured 55% detector misses on cropped images, 2026-07-11). Removal is fully supported and oracle-verified on the default profile, with a measured Meta strength floor (0.1) shipped behind auto IPTC routing and an explicit `--vendor meta` override; see [supported signals](supported-signals.md) and [module internals](module-internals.md). Legacy paragraph retained below.
 
-**Samsung English/other locales: still not established.** Samsung's own support page says only that "A Galaxy AI watermark will appear on AI-generated images" -- no string, no corner. Every community thread carrying the exact English string returned HTTP 403 to WebFetch, so the search paraphrase (bottom-left) is deliberately NOT recorded as fact. Feature-tier detail (b): the mark is applied by Generative Edit / sketch-to-image but reportedly NOT by Object Eraser, so Samsung absence is feature-dependent. The four-star icon variant: nothing found.
+**Meta `Imagined with AI` (string VERIFIED (a) from Meta's own newsroom; POSITION NOT VERIFIED).** Sources conflict on placement. Do not encode a corner without a verified sample. A dedicated 2026-08-27 sample hunt failed to obtain one: the Feb-2024 newsroom images are UI mockups whose photos carry no in-pixel mark; community posts (Threads `C8_rS_MuEId` titled "lower left corner", a Facebook share) corroborate bottom-LEFT verbally but their files defeat pixel verification; press screenshots predate the mark (Dec 2023); `imagine.meta.com` is dead (redirects to meta.ai) and its Wayback captures are broken SPA error pages. The mark's generator no longer exists (Muse output has no visible mark), so no fresh sample can be made. Removal stays on the generic `erase --region` path until a legacy capture surfaces. Source: `https://about.fb.com/news/2024/02/labeling-ai-generated-images-on-facebook-instagram-and-threads/`.
+
+**Samsung English/other locales: still not established.** Samsung's own support page says only that "A Galaxy AI watermark will appear on AI-generated images" -- no string, no corner. Every community thread carrying the exact English string returned HTTP 403 to WebFetch, so the search paraphrase (bottom-left) is deliberately NOT recorded as fact. Feature-tier detail (b): the mark is applied by Generative Edit / sketch-to-image but reportedly NOT by Object Eraser, so Samsung absence is feature-dependent. No separate icon-only variant was established.
 
 **The one document that would settle ByteDance placement is BLOCKED.** Douyin's 《抖音关于人工智能生成内容标识的水印与元数据规范》 aims to give AI tools a unified watermark style and position, which would cover Doubao / Jimeng / 星绘 at once. Both mirrors return HTTP 403 to WebFetch; a secondary report (b, unconfirmed) says the watermark is `AI生成` + tool name + company name placed **top-left** -- which would explain the Jimeng pill's top-left position but contradicts the GB annex's bottom-right example. Worth one retry through Chrome MCP with a real browser session.
 

pyproject.toml

@@ -4,7 +4,7 @@
 # on it, including the ComfyUI node package. The console script below carries
 # the same weight, since users have it on PATH.
 name = "remove-ai-watermarks"
-version = "0.30.1"
+version = "0.34.1"
 description = "AI watermark remover for visible, invisible, and provenance marks in images and video"
 readme = "README.md"
 requires-python = ">=3.11,<3.15"

scripts/README.md

@@ -0,0 +1,69 @@
+# Maintainer scripts
+
+These scripts are development and evaluation tools, not installed CLI commands. Run
+them from the repository root with `uv run python scripts/<name>.py --help`. Inputs
+under `.local-eval/` and generated reports remain untracked unless a data README
+explicitly names a tracked canonical result.
+
+## Audits and release checks
+
+| Script | Purpose |
+| --- | --- |
+| `corpus_gap_scan.py` | Compare a local image corpus with the library's `identify` results. |
+| `detection_timing.py` | Record per-method metadata and verdict timings. |
+| `detection_timing_report.py` | Aggregate timing records by method and segment. |
+| `fidelity_metrics.py` | Compute objective image-fidelity metrics for paired outputs. |
+| `invisible_quality_audit.py` | Pair originals and invisible-removal outputs for quality review. |
+| `metadata_removal_audit.py` | Check metadata detection/removal parity over a corpus. |
+| `pill_gate_audit.py` | Measure the Jimeng pill detector on the product path. |
+| `real_examples_e2e.py` | Run end-to-end confidence checks over local examples. |
+| `record_parity_audit.py` | Compare record-based and file-based identification. |
+| `resource_ceilings.py` | Measure peak RSS and runtime for fill backends. |
+| `robustness_suite.py` | Exercise CLI failures on adversarial and degenerate inputs. |
+| `sidecar_regression.py` | Compare current identification with recorded sidecars. |
+| `smoke_matrix.py` | Exercise CLI parameter choices on real local data. |
+| `video_fidelity_probe.py` | Compare delivered video fidelity with its source. |
+| `visible_eval.py` | Benchmark registered visible-mark detectors. |
+| `visible_removal_audit.py` | Audit visible-removal results over a local corpus. |
+
+## Calibration and corpus preparation
+
+| Script | Purpose |
+| --- | --- |
+| `contentseal_transforms.py` | Reproduce and hash-check deterministic Content Seal variants. |
+| `detector_response.py` | Measure detector response over mark size, contrast, background, and aspect. |
+| `fill_quality.py` | Measure visible-fill quality against constructed ground truth. |
+| `ladder_headroom.py` | Measure recall cost from the coarse scale ladder. |
+| `registered_mark_calibrate.py` | Measure a registered detector without conflating visual positives, metadata cohorts, adjudicated negatives, and unlabeled controls. |
+| `synthid_corpus.py` | Ingest and inspect the local SynthID reference corpus. |
+| `vendor_cohort_harvest.py` | Partition TC260 carriers by producer code. |
+| `vendor_mark_calibrate.py` | Calibrate a candidate vendor text detector. |
+| `visible_alpha_solve.py` | Rebuild visible-watermark alpha assets from controlled captures. |
+| `visible_groundtruth.py` | Consolidate blinded contact-sheet labels into ground truth. |
+| `visible_positives.py` | List corpus images carrying a registered visible mark. |
+| `visible_recall_sample.py` | Build an unbiased blinded sample for recall measurement. |
+| `visible_sheets.py` | Build blinded contact sheets for relaxation candidates. |
+
+## Research and diagnostic prototypes
+
+| Script | Purpose |
+| --- | --- |
+| `cjk_tail_probe.py` | Test a generic template for otherwise uncovered CJK labels. |
+| `controlnet_sweep.py` | Sweep the historical ControlNet removal prototype. |
+| `infer_text_lines.py` | Draft stable source-text lines without modifying pixels. |
+| `qwen_scrub_prototype.py` | Probe low-strength Qwen regeneration on a GPU. |
+| `selective_text_restoration.py` | Evaluate text restoration over a scrubbed image. |
+| `synthid_pixel_probe.py` | Run the experimental local SynthID carrier probe. |
+| `video_synthid_sweep.py` | Build oracle-gated video regeneration candidates. |
+
+## Generated assets
+
+| Script | Purpose |
+| --- | --- |
+| `render_pill_silhouette.py` | Render the synthetic Jimeng pill silhouette. |
+| `render_vendor_silhouettes.py` | Render synthetic vendor text-mark silhouettes. |
+
+## Shared helpers
+
+`_plain_console.py` provides plain-text fallbacks for Rich output, and
+`_text_eval.py` contains normalization helpers shared by text-evaluation scripts.

scripts/assets/visible-mark-candidates/README.md

@@ -0,0 +1,33 @@
+# Unregistered visible-mark candidates
+
+Synthetic detection silhouettes for marks that are measured but NOT registered:
+none of these separates its positives from clean negatives yet, so shipping them
+would attribute and fill corners on content that carries no mark (a false fill
+is the worse error). Assets are regenerated by
+`scripts/render_vendor_silhouettes.py`; a candidate is deleted from here on the
+day its mark registers (the asset moves to the package `assets/`).
+
+Measurements below are local calibration snapshots. Candidate pools are
+provenance cohorts, not automatically visible-mark positives; comparison controls
+are independently selected no-signal images and are not adjudicated negatives.
+Each needs capture-solved alphas or vendor-accurate font work before it can
+ship; `scripts/vendor_mark_calibrate.py` is the candidate-detector harness.
+
+| Asset | Mark | Evidence | Result |
+| --- | --- | --- | --- |
+| `samsung_en_alpha.png` | Samsung Galaxy AI label, English locale ("AI-generated content", bottom-left) | 5 corpus files | POS 0.11-0.30 vs NEG max 0.40 (binary); tophat/gray tried, no separation. The registered Italian engine scores 0.18-0.31 on the same files -- same layout class, wrong glyph template. |
+| `gemini_text_alpha.png` | "Generated with Gemini" text label (bottom-right; the registered gemini mark is the sparkle icon) | 3 corpus files | POS 0.07-0.22 vs NEG max 0.32; coverage gate finds the blob (0.29-0.35) but the Arial silhouette misses Google's letterforms. |
+| `notebooklm_alpha.png` | NotebookLM wordmark (bottom-right) | 12 corpus files | locate geometry not yet fitted; POS max 0.12. |
+| `dola_alpha.png` | DolaAI on images (the video mark is registered) | 12 corpus files | POS 0.11-0.21 vs NEG max 0.30. |
+| `mindvideo_alpha.png` | MindVideo.AI (top-right) | 11 corpus files | POS 0.29-0.32 vs NEG max 0.30 -- borderline overlap, not shippable. |
+| `higgsfield_alpha.png` | HIGGSFIELD AI wordmark (bottom-right; the boxed `AI` variant shares the cohort) | 5 wordmark files (16 in the boxed-AI OCR cluster) | POS max 0.26 vs NEG max 0.22 -- no separation; the mark may be two-part (wordmark + boxed AI) and needs a composed template. |
+| `jianying_alpha.png` | 剪映AI (CapCut's CN sibling, bottom-right) | 2 corpus files | POS 0.29 vs NEG max 0.35. |
+| `capcut_alpha.png` | CapCut AI pill (top-left; likely pill class, not plain text) | 3 corpus files | POS max 0.15 vs NEG max 0.33 -- locate geometry not yet fitted for the pill form. |
+| `zsky_alpha.png` | MADE WITH zsky.ai (bottom-right) | 2 corpus files | POS 0.10 vs NEG max 0.27. |
+| `chromastudio_alpha.png` | ChromaStudio.ai (bottom-right) | 2 corpus files | POS 0.11 vs NEG max 0.29. |
+| `digenai_alpha.png` | DIGENAI (bottom-right) | 3 corpus files (one 2026-07-24 batch) | POS 0.16 vs NEG max 0.31. |
+| `gendo_alpha.png` | GendoAI (bottom-left) | 3 corpus files | POS 0.08 vs NEG max 0.32. |
+| `xinghui_alpha.png` | 星绘AI生成 (parked before this set) | -- | prior parking, unchanged. |
+| `qingyan_alpha.png` | 清言·AI生成 (parked before this set) | -- | prior parking, unchanged. |
+| `hailuo_alpha.png` | Hailuo AI image wordmark (parked before this set; the VIDEO label is registered) | -- | prior parking, unchanged. |
+| `catlogo_alpha.png` | outline cat-head + AI生成 (parked before this set) | -- | prior parking, unchanged. |

scripts/cjk_tail_probe.py

@@ -1,7 +1,7 @@
 """Can one GENERIC template cover the CJK AI labels no per-vendor detector fires on?
 
 THE OPPORTUNITY
-  Corpus inspection of doubao-provenance misses turned up `千问AI生成` (Alibaba Qwen) and
+  Corpus inspection of doubao-provenance misses turned up `千问AI生成` (Alibaba Cloud Qwen) and
   `百度 AI生成` (Baidu) sitting in the same bottom-right corner as the marks we do cover,
   bold and plainly legible, with no detector able to fire on either. `docs/...landscape`
   puts uncovered vendors at ~6% of sampled images -- larger than any tuning gain left in

scripts/contentseal_transforms.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Reproduce the deterministic Content Seal crop, resize, and JPEG variants."""
+
+from __future__ import annotations
+
+import argparse
+import csv
+import hashlib
+import logging
+from pathlib import Path
+
+from PIL import Image
+
+log = logging.getLogger(__name__)
+
+ROOT = Path(__file__).resolve().parents[1]
+CORPUS = ROOT / "data" / "contentseal"
+MANIFEST = CORPUS / "manifest.csv"
+
+
+def _rows() -> dict[str, dict[str, str]]:
+    with MANIFEST.open(newline="", encoding="utf-8") as stream:
+        return {row["name"]: row for row in csv.DictReader(stream)}
+
+
+def _write_and_verify(image: Image.Image, path: Path, row: dict[str, str], *, format: str, quality: int) -> None:
+    image.save(path, format=format, quality=quality)
+    digest = hashlib.sha256(path.read_bytes()).hexdigest()
+    if digest != row["sha256"]:
+        raise RuntimeError(f"{row['name']} hash mismatch: expected {row['sha256']}, got {digest}")
+    log.info("Verified %s", path)
+
+
+def reproduce_transforms(output_dir: Path) -> list[Path]:
+    """Write and hash-check the eight deterministic manifest variants."""
+    rows = _rows()
+    output_dir.mkdir(parents=True, exist_ok=True)
+    outputs: list[Path] = []
+
+    for prefix, source_name in (("fox", "gen_fox_forest"), ("text", "gen_text_poster")):
+        with Image.open(CORPUS / rows[source_name]["file"]) as opened:
+            source = opened.convert("RGB")
+
+        for fraction in (0.5, 0.33):
+            width = int(source.width * fraction)
+            height = int(source.height * fraction)
+            left = (source.width - width) // 2
+            top = (source.height - height) // 2
+            name = f"{prefix}_crop{int(fraction * 100)}"
+            path = output_dir / f"{name}.webp"
+            crop = source.crop((left, top, left + width, top + height))
+            _write_and_verify(crop, path, rows[name], format="WEBP", quality=95)
+            outputs.append(path)
+
+        scale = 512 / max(source.size)
+        resized = source.resize(
+            (round(source.width * scale), round(source.height * scale)),
+            Image.Resampling.LANCZOS,
+        )
+        name = f"{prefix}_res512"
+        path = output_dir / f"{name}.webp"
+        _write_and_verify(resized, path, rows[name], format="WEBP", quality=95)
+        outputs.append(path)
+
+        name = f"{prefix}_jpeg85"
+        path = output_dir / f"{name}.jpg"
+        _write_and_verify(source, path, rows[name], format="JPEG", quality=85)
+        outputs.append(path)
+
+    return outputs
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("output_dir", type=Path, help="Directory for regenerated variants")
+    args = parser.parse_args()
+    logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
+    reproduce_transforms(args.output_dir)
+
+
+if __name__ == "__main__":
+    main()

scripts/detection_timing_report.py

@@ -39,7 +39,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parent))
 from detection_timing import COMPONENTS as _TIMED
 
 # Taken from the script that WROTE the rows, in its order, so a probe added, removed
-# or reordered there cannot silently leave a column missing or mislabelled here.
+# or reordered there cannot silently leave a column missing or mislabeled here.
 COMPONENTS = tuple(name for name, _ in _TIMED)
 METHODS = (
     ("cold_extract_evidence_ms", "extract_provenance_evidence (cold)"),

scripts/real_examples_e2e.py

@@ -81,7 +81,7 @@ def find_visible_positive(mark: str) -> Path | None:
 
 
 class Results:
-    """Collects one row per checked behaviour.
+    """Collects one row per checked behavior.
 
     A FAIL keeps the command's OUTPUT. That is not cosmetic: the first run of this harness
     discarded it, an `all` invocation failed once with exit 1, and because the output was
@@ -166,7 +166,7 @@ def check_visible(res: Results, tmp: Path) -> None:
     """Real marked images -> the PRODUCT'S DECISION is honoured, and a removed mark clears.
 
     The success criterion is not "the mark is always gone" -- it is "the product did what it
-    decided, and the decision is right". Two designed behaviours make a blind re-detect
+    decided, and the decision is right". Two designed behaviors make a blind re-detect
     misleading:
       * The pill is GATED (`_keep_pill`): a low-confidence pill with no corroboration is
         deliberately NOT removed, so `visible` correctly writes nothing and exits 2. That is

scripts/registered_mark_calibrate.py

@@ -0,0 +1,175 @@
+"""Measure a registered visible-mark detector on independently labeled arms.
+
+The input is a JSONL manifest with exactly two fields per row:
+
+``path``
+    Absolute path, or a path relative to the manifest.
+``arm``
+    ``positive`` for a visually confirmed carrier, ``metadata`` for a
+    provenance-only cohort, ``negative`` for an independently adjudicated
+    no-mark image, or ``control`` for an unlabeled comparison image with no
+    known local signal.
+
+The arms stay separate because metadata names a provider, not the presence of a
+visible mark, and missing local signals do not make an image a true negative. The
+script imports the registered engine and reads its shipped gate, so calibration
+cannot silently use a copied configuration.
+
+Input images and manifests are read-only. Keep private inputs and generated
+manifests outside the repository or in a gitignored evaluation directory.
+
+    uv run python scripts/registered_mark_calibrate.py microsoft manifest.jsonl
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import math
+import sys
+from collections import Counter
+from pathlib import Path
+from typing import Any, Literal, TypedDict, cast
+
+REPO = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / "src"))
+
+from remove_ai_watermarks import watermark_registry  # noqa: E402
+from remove_ai_watermarks.image_io import imread  # noqa: E402
+
+Arm = Literal["positive", "metadata", "negative", "control"]
+_ARMS: tuple[Arm, ...] = ("positive", "metadata", "negative", "control")
+
+
+class ManifestRow(TypedDict):
+    path: str
+    arm: Arm
+
+
+class ArmSummary(TypedDict):
+    n: int
+    unreadable: int
+    min: float | None
+    p50: float | None
+    p90: float | None
+    p99: float | None
+    max: float | None
+    fires: int
+
+
+def _percentile(ordered: list[float], fraction: float) -> float | None:
+    """Return a nearest-rank percentile from values sorted in ascending order."""
+    if not ordered:
+        return None
+    return ordered[max(0, math.ceil(fraction * len(ordered)) - 1)]
+
+
+def summarize(values: list[float], *, unreadable: int, fires: int) -> ArmSummary:
+    """Summarize one independently defined arm without inferring its label."""
+    ordered = sorted(values)
+    return {
+        "n": len(values),
+        "unreadable": unreadable,
+        "min": _percentile(ordered, 0.0),
+        "p50": _percentile(ordered, 0.5),
+        "p90": _percentile(ordered, 0.9),
+        "p99": _percentile(ordered, 0.99),
+        "max": _percentile(ordered, 1.0),
+        "fires": fires,
+    }
+
+
+def load_manifest(path: Path) -> list[ManifestRow]:
+    """Load and validate a manifest, resolving relative paths beside it."""
+    rows: list[ManifestRow] = []
+    seen: set[Path] = set()
+    with path.open(encoding="utf-8") as manifest:
+        for line_number, line in enumerate(manifest, 1):
+            if not line.strip():
+                continue
+            raw = json.loads(line)
+            if not isinstance(raw, dict) or set(raw) != {"path", "arm"}:
+                raise ValueError(f"{path}:{line_number}: expected exactly path and arm")
+            raw_path = raw["path"]
+            raw_arm = raw["arm"]
+            if not isinstance(raw_path, str) or not raw_path:
+                raise ValueError(f"{path}:{line_number}: path must be a non-empty string")
+            if raw_arm not in _ARMS:
+                raise ValueError(f"{path}:{line_number}: arm must be one of {', '.join(_ARMS)}")
+            image_path = Path(raw_path)
+            if not image_path.is_absolute():
+                image_path = path.parent / image_path
+            image_path = image_path.resolve()
+            if image_path in seen:
+                raise ValueError(f"{path}:{line_number}: duplicate image path {image_path}")
+            seen.add(image_path)
+            rows.append({"path": str(image_path), "arm": cast("Arm", raw_arm)})
+    if not rows:
+        raise ValueError(f"{path}: manifest is empty")
+    return rows
+
+
+def measure(mark: str, rows: list[ManifestRow]) -> tuple[float, dict[Arm, ArmSummary]]:
+    """Score every row with the registered engine and its current shipped gate."""
+    registered_mark = watermark_registry.get_mark(mark)
+    # Calibration intentionally resolves the registry's concrete engine so it
+    # cannot drift onto a copied configuration.
+    engine = watermark_registry._engine(mark)
+    config = getattr(engine, "config", None)
+    gate = getattr(config, "detect_ncc_threshold", None)
+    if not isinstance(gate, int | float):
+        raise ValueError(f"registered mark {mark!r} does not expose a text-detector NCC gate")
+
+    scores: dict[Arm, list[float]] = {arm: [] for arm in _ARMS}
+    unreadable: Counter[Arm] = Counter()
+    fires: Counter[Arm] = Counter()
+    for row in rows:
+        image = imread(row["path"])
+        if image is None:
+            unreadable[row["arm"]] += 1
+            continue
+        detection: Any = registered_mark.detect(image)
+        scores[row["arm"]].append(float(detection.confidence))
+        fires[row["arm"]] += bool(detection.detected)
+
+    threshold = float(gate)
+    return threshold, {arm: summarize(scores[arm], unreadable=unreadable[arm], fires=fires[arm]) for arm in _ARMS}
+
+
+def _format_stat(value: float | None) -> str:
+    return "-" if value is None else f"{value:.3f}"
+
+
+def print_report(mark: str, gate: float, summaries: dict[Arm, ArmSummary]) -> None:
+    """Print a compact human-readable calibration report."""
+    print(f"registered mark: {mark}  gate: {gate:.3f}")
+    print(
+        f"{'arm':10s} {'n':>5s} {'bad':>5s} {'min':>7s} {'p50':>7s} {'p90':>7s} {'p99':>7s} {'max':>7s} {'fires':>7s}"
+    )
+    for arm in _ARMS:
+        row = summaries[arm]
+        print(
+            f"{arm:10s} {row['n']:5d} {row['unreadable']:5d} "
+            f"{_format_stat(row['min']):>7s} {_format_stat(row['p50']):>7s} "
+            f"{_format_stat(row['p90']):>7s} {_format_stat(row['p99']):>7s} "
+            f"{_format_stat(row['max']):>7s} {row['fires']:7d}"
+        )
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("mark", choices=watermark_registry.mark_keys())
+    parser.add_argument("manifest", type=Path)
+    parser.add_argument("--json", action="store_true", help="emit machine-readable JSON")
+    args = parser.parse_args()
+
+    rows = load_manifest(args.manifest)
+    gate, summaries = measure(args.mark, rows)
+    if args.json:
+        print(json.dumps({"mark": args.mark, "gate": gate, "arms": summaries}, sort_keys=True))
+    else:
+        print_report(args.mark, gate, summaries)
+
+
+if __name__ == "__main__":
+    main()

scripts/render_vendor_silhouettes.py

@@ -12,11 +12,14 @@ from __future__ import annotations
 
 import sys
 from pathlib import Path
-from typing import Any
+from typing import TYPE_CHECKING, Any
 
 import numpy as np
 from PIL import Image, ImageDraw, ImageFont
 
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
 _ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(_ROOT / "src"))
 
@@ -42,7 +45,7 @@ MARKS = {
     "kling_alpha.png": "可灵AI 3.0",
     # The "cat-logo" candidate stamps an outline cat-head plus bold "AI生成",
     # bottom-right. It remains unregistered pending sufficient calibration coverage.
-    "catlogo_alpha.png": "CATLOGO",  # sentinel: drawn by draw_catlogo(), not font-rendered
+    "catlogo_alpha.png": "cat logo + AI生成",
     # RunningHub top-left text mark.
     "runninghub_alpha.png": "RunningHub AI生成",
     # LibLibAI bottom-center wordmark.
@@ -53,6 +56,28 @@ MARKS = {
     "hailuo_alpha.png": "Hailuo AI",
     # Baidu bottom-right text run.
     "baidu_alpha.png": "百度",
+    # Measured Microsoft top-right white AI-badge variant. Sentinel: drawn by
+    # draw_msbadge(), not font-rendered.
+    "microsoft_alpha.png": "Made with AI",
+    # Samsung Galaxy AI label, English locale (the registered samsung_alpha.png is
+    # the Italian "Contenuti generati dall'AI" silhouette; EN is the literal
+    # translation with the same leading sparkle). Sentinel: draw_samsung_en().
+    "samsung_en_alpha.png": "AI-generated content",
+    # Gemini text-form label (the registered gemini mark is the sparkle icon).
+    "gemini_text_alpha.png": "Generated with Gemini",
+    # Candidate wordmarks measured on a local evaluation corpus (unregistered).
+    "notebooklm_alpha.png": "NotebookLM",
+    "dola_alpha.png": "DolaAI",
+    "mindvideo_alpha.png": "MindVideo.AI",
+    "higgsfield_alpha.png": "HIGGSFIELD AI",
+    "capcut_alpha.png": "CapCut AI",
+    "zsky_alpha.png": "MADE WITH zsky.ai",
+    "chromastudio_alpha.png": "ChromaStudio.ai",
+    "digenai_alpha.png": "DIGENAI",
+    "gendo_alpha.png": "GendoAI",
+    # CapCut's Chinese sibling, JianYing, stamps 剪映AI bottom-right (the
+    # international CapCut pill sits top-left).
+    "jianying_alpha.png": "剪映AI",
 }
 _REGISTERED = {f"{key}_alpha.png" for key in mark_keys()} & MARKS.keys()
 
@@ -74,6 +99,24 @@ MARK_OPTS: dict[str, dict[str, Any]] = {
 }
 
 
+def _fit_font(
+    font_path: str,
+    reaches_target: Callable[[ImageFont.FreeTypeFont], bool],
+    *,
+    index: int = 0,
+) -> ImageFont.FreeTypeFont:
+    """Return the smallest 8-200 px font that reaches a render target."""
+    low, high = 8, 200
+    while low < high:
+        size = (low + high) // 2
+        font = ImageFont.truetype(font_path, size, index=index)
+        if reaches_target(font):
+            high = size
+        else:
+            low = size + 1
+    return ImageFont.truetype(font_path, low, index=index)
+
+
 def render(text: str, width: int = 335, opts: dict[str, Any] | None = None) -> np.ndarray:
     """Binary glyph silhouette (255 = glyph), sized to the doubao asset's convention.
 
@@ -91,13 +134,11 @@ def render(text: str, width: int = 335, opts: dict[str, Any] | None = None) -> n
     probe = Image.new("L", (10, 10))
     d0 = ImageDraw.Draw(probe)
     lines = text.split("\n")
-    size = 8
-    while size < 200:  # grow until the LONGEST line fills the target width
-        f = ImageFont.truetype(font_path, size, index=font_index)
-        if max(d0.textbbox((0, 0), ln, font=f)[2] for ln in lines) >= width * 0.98:
-            break
-        size += 1
-    font = ImageFont.truetype(font_path, size, index=font_index)
+    font = _fit_font(
+        font_path,
+        lambda f: max(d0.textbbox((0, 0), ln, font=f)[2] for ln in lines) >= width * 0.98,
+        index=font_index,
+    )
     boxes = [d0.textbbox((0, 0), ln, font=font) for ln in lines]
     line_h = max(bb[3] - bb[1] for bb in boxes)
     gap = max(1, int(line_h * gap_frac))
@@ -138,13 +179,7 @@ def draw_catlogo(width: int = 335) -> np.ndarray:
     probe = Image.new("L", (10, 10))
     d0 = ImageDraw.Draw(probe)
     text = "AI生成"
-    size = 8
-    while size < 200:
-        f = ImageFont.truetype(_FONT, size)
-        if d0.textbbox((0, 0), text, font=f)[2] >= width * 0.60:
-            break
-        size += 1
-    font = ImageFont.truetype(_FONT, size)
+    font = _fit_font(_FONT, lambda f: d0.textbbox((0, 0), text, font=f)[2] >= width * 0.60)
     bb = d0.textbbox((0, 0), text, font=font)
     tw, th = bb[2] - bb[0], bb[3] - bb[1]
     cs = int(th * 1.08)
@@ -182,10 +217,90 @@ def draw_catlogo(width: int = 335) -> np.ndarray:
     return np.array(im)
 
 
+def _star_pts(cx: float, cy: float, r: float, waist: float) -> list[tuple[float, float]]:
+    return [
+        (cx, cy - r),
+        (cx + r * waist, cy - r * waist),
+        (cx + r, cy),
+        (cx + r * waist, cy + r * waist),
+        (cx, cy + r),
+        (cx - r * waist, cy + r * waist),
+        (cx - r, cy),
+        (cx - r * waist, cy - r * waist),
+    ]
+
+
+def _sparkle(draw: ImageDraw.ImageDraw, cx: float, cy: float, r: float) -> None:
+    """Draw the four-point cutout used by synthetic candidate silhouettes."""
+    draw.polygon(_star_pts(cx, cy, r, 0.22), fill=0)
+
+
+def draw_msbadge(width: int = 335) -> np.ndarray:
+    """Synthetic silhouette for the measured Microsoft top-right white pill.
+
+    The top-hat front-end sees the bright pill with dark-text holes, so the template
+    carries the same holes -- that is what discriminates this pill from any other
+    white rounded element in the top-right corner. The text and four-point cutout
+    approximate the measured internal shape; they do not assert one universal
+    Microsoft icon or wording. Geometry measured on 17 visually confirmed carriers
+    on 2026-08-27: pill 0.152W x 0.040W, margins ~0.010W right / ~0.007W top,
+    glyph height ~0.39 of pill height.
+    """
+    h = round(width / 3.78)
+    im = Image.new("L", (width, h), 0)
+    d = ImageDraw.Draw(im)
+    d.rounded_rectangle([0, 0, width - 1, h - 1], radius=h // 2, fill=255)
+    font_path = "/System/Library/Fonts/Supplemental/Arial Bold.ttf"
+    text = "Made with AI"
+    probe = Image.new("L", (10, 10))
+    d0 = ImageDraw.Draw(probe)
+    font = _fit_font(font_path, lambda f: d0.textbbox((0, 0), text, font=f)[3] >= h * 0.39)
+    bb = d0.textbbox((0, 0), text, font=font)
+    th = bb[3] - bb[1]
+    r = h * 0.20  # sparkle radius, ~half the text height
+    pad_l = h * 0.22
+    cx = pad_l + r
+    cy = h / 2 - 1
+    tx = int(pad_l + 2 * r + h * 0.22)
+    d.text((tx - bb[0], (h - th) // 2 - bb[1]), text, font=font, fill=0)
+    _sparkle(d, cx, cy, r)
+    return np.array(im)
+
+
+def draw_samsung_en(width: int = 335) -> np.ndarray:
+    """Samsung Galaxy AI English label: "AI-generated content" with the leading
+    4-point sparkle, light-gray glyphs (same class as the registered Italian asset)."""
+    text = "AI-generated content"
+    font_path = "/System/Library/Fonts/Supplemental/Arial.ttf"
+    probe = Image.new("L", (10, 10))
+    d0 = ImageDraw.Draw(probe)
+    font = _fit_font(font_path, lambda f: d0.textbbox((0, 0), text, font=f)[2] >= width * 0.80)
+    bb = d0.textbbox((0, 0), text, font=font)
+    tw, th = bb[2] - bb[0], bb[3] - bb[1]
+    r = th * 0.55
+    gap = th * 0.45
+    im = Image.new("L", (int(tw + gap + 2 * r + 8), th + 8), 0)
+    d = ImageDraw.Draw(im)
+    # sparkle as bright glyph (this silhouette is light-glyph class, not a pill)
+    d.polygon(_star_pts(4 + r, 4 + th / 2, r, 0.22), fill=255)
+    d.text((4 + 2 * r + gap - bb[0], 4 - bb[1]), text, font=font, fill=255)
+    arr = np.array(im)
+    ys, xs = np.where(arr > 0)
+    return arr[ys.min() : ys.max() + 1, xs.min() : xs.max() + 1]
+
+
+_CUSTOM_RENDERERS = {
+    "catlogo_alpha.png": draw_catlogo,
+    "microsoft_alpha.png": draw_msbadge,
+    "samsung_en_alpha.png": draw_samsung_en,
+}
+
+
 def main() -> None:
     try:
         for name, text in MARKS.items():
-            sil = draw_catlogo() if text == "CATLOGO" else render(text, opts=MARK_OPTS.get(name))
+            renderer = _CUSTOM_RENDERERS.get(name)
+            sil = renderer() if renderer is not None else render(text, opts=MARK_OPTS.get(name))
             output_dir = _PACKAGE_ASSETS if name in _REGISTERED else _CANDIDATE_ASSETS
             output_dir.mkdir(parents=True, exist_ok=True)
             output = output_dir / name

scripts/render_visible_examples.py

@@ -0,0 +1,275 @@
+"""Render the visible-mark example gallery under data/fixtures/visible/.
+
+One committed example per registered image mark, so the repo carries a working
+sample of everything it supports and a canary test can hold both sides to it
+(mark registered without example; engine regressed on its canonical example).
+
+Every example is SYNTHETIC: a deterministic generated base photo with the mark's
+own committed silhouette composited at the engine's measured geometry. User
+uploads never enter the repository (data/spaces stays out of git), and no vendor
+asset is copied -- the silhouettes are the same font-rendered templates the
+detectors match against.
+
+Regenerate with:
+    uv run python scripts/render_visible_examples.py
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+from typing import Any
+
+import cv2
+import numpy as np
+
+_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(_ROOT / "src"))
+
+from remove_ai_watermarks import watermark_registry as wr  # noqa: E402
+from remove_ai_watermarks.image_io import imread  # noqa: E402
+
+ASSETS = _ROOT / "src" / "remove_ai_watermarks" / "assets"
+OUT = _ROOT / "data" / "fixtures" / "visible"
+
+# Composite strength per key: glyph target luma for the light-overlay class.
+# Kling is a thin light-gray run (not near-white); Samsung is a faint overlay
+# expressed by SCALING ITS ALPHA to 0.38 toward full white (see below); everything
+# else is the bold near-white house style.
+_STRENGTH: dict[str, int] = {
+    "kling": 208,
+}
+_DEFAULT_STRENGTH = 238
+
+# Base geometry: one canonical size per mark where the engine's size modes
+# matter (qwen's big mode), otherwise a plain 3:2 landscape frame.
+# Samsung keeps the larger base: its overlay is faint (peak alpha ~0.38) and
+# the real marks live on ~2958px phone photos -- at 1536 the example falls to 0.39,
+# just under the engine's 0.40 gate.
+_SIZE: dict[str, tuple[int, int]] = {"qwen": (1536, 1536), "liblib": (1152, 1536), "samsung": (2048, 1536)}
+
+
+def base_photo(w: int, h: int, seed: int = 7) -> np.ndarray:
+    """A deterministic synthetic 'photo': gradient sky, soft blobs, mild noise."""
+    rng = np.random.default_rng(seed)
+    top, bottom = 96, 168
+    grad = np.linspace(top, bottom, h, dtype=np.float32)[:, None]
+    img = np.repeat(grad[:, :, None], w, axis=1)  # (h, w, 1)
+    for _ in range(5):
+        cx, cy = rng.uniform(0, w), rng.uniform(0, h)
+        r = rng.uniform(w * 0.12, w * 0.35)
+        blob = rng.uniform(-52, 52)
+        yy, xx = np.ogrid[:h, :w]
+        gauss = np.exp(-(((xx - cx) ** 2 + (yy - cy) ** 2) / (2 * (r * 0.55) ** 2))).astype(np.float32)
+        img = img + (blob * gauss)[:, :, None]
+    img = img + rng.normal(0, 1.6, img.shape).astype(np.float32)
+    return cv2.merge([np.clip(img, 0, 255).astype(np.uint8)] * 3)
+
+
+def _glyph_asset(name: str) -> np.ndarray:
+    at = imread(str(ASSETS / name), cv2.IMREAD_GRAYSCALE)
+    if at is None:
+        raise RuntimeError(f"missing silhouette asset: {name}")
+    return at.astype(np.float32) / 255.0
+
+
+def _composite_light(base: np.ndarray, alpha: np.ndarray, x: int, y: int, strength: int) -> np.ndarray:
+    out = base.copy()
+    h, w = alpha.shape[:2]
+    roi = out[y : y + h, x : x + w].astype(np.float32)
+    a3 = alpha[:, :, None] if alpha.ndim == 2 else alpha
+    out[y : y + h, x : x + w] = np.clip(roi * (1 - a3) + strength * a3, 0, 255).astype(np.uint8)
+    return out
+
+
+def _text_mark_example(key: str) -> np.ndarray:
+    engine = wr._engine(key)  # the generator drives the engine's own config
+    cfg = engine.config
+    w, h = _SIZE.get(key, (1536, 1152))
+    base = base_photo(w, h)
+    if key == "microsoft":
+        # Opaque white pill with dark text/sparkle holes, at the measured inset.
+        at = _glyph_asset("microsoft_alpha.png")
+        long_side = max(w, h)
+        pw = int(0.152 * long_side)
+        ph = max(4, int(pw / (at.shape[1] / at.shape[0])))
+        pad = int(0.010 * long_side)
+        pill = cv2.resize(at, (pw, ph))
+        x, y = w - pad - pw, pad
+        roi = base[y : y + ph, x : x + pw].astype(np.float32)
+        bright = (pill > 0.6)[:, :, None]
+        roi = np.where(bright, 245.0, 46.0)
+        base[y : y + ph, x : x + pw] = roi.astype(np.uint8)
+        return base
+    base_dim = {"short": min(w, h), "width": w, "long": max(w, h)}[cfg.scale_basis]
+    # Size the glyph ON a ladder rung: the continuous front ends sweep only the
+    # configured rungs, and a glyph sized between rungs collapses the NCC (the
+    # comb-collapse qwen's own two-rung ladder exists to avoid).
+    rung = max(cfg.ladder) if cfg.detect_frontend != "binary" else 1.0
+    gw = int(cfg.alpha_width_frac * base_dim * rung)
+    gh = max(4, int(cfg.alpha_height_frac * base_dim * rung))
+    loc = engine.locate(base)
+    # Corner-hugging placement: the yuanbao/runninghub anchor gates demote a match
+    # that does not hug the corner, and the real marks sit flush on the box's
+    # corner side (never centered).
+    if cfg.corner in ("br", "tr"):
+        x = loc.x + loc.w - gw
+    elif cfg.corner == "bc":
+        x = loc.x + (loc.w - gw) // 2
+    else:  # bl, tl: flush left
+        x = loc.x
+    y = loc.y if cfg.corner in ("tl", "tr") else loc.y + loc.h - gh
+    x, y = max(0, x), max(0, y)
+    at = _glyph_asset(f"{key}_alpha.png")
+    alpha = cv2.resize(at, (gw, gh))
+    if key == "samsung":  # faint overlay: peak alpha 0.38 toward FULL white
+        alpha = alpha * 0.38
+    return _composite_light(base, alpha, x, y, _STRENGTH.get(key, _DEFAULT_STRENGTH))
+
+
+def _gemini_example() -> np.ndarray:
+    from remove_ai_watermarks.gemini_engine import GeminiEngine, get_watermark_config, get_watermark_size
+
+    w, h = 1536, 1152
+    base = base_photo(w, h)
+    eng = GeminiEngine()
+    size = get_watermark_size(w, h)
+    alpha = eng.get_alpha_map(size)
+    cfg = get_watermark_config(w, h)
+    x, y = cfg.get_position(w, h)
+    return _composite_light(base, alpha.astype(np.float32), x, y, 255)
+
+
+def _pill_example() -> np.ndarray:
+    w, h = 1152, 1536  # the measured pill cohort is 3:4 portrait
+    base = base_photo(w, h)
+    at = _glyph_asset("jimeng_pill.png")
+    pw = max(24, int(0.161 * w))
+    ph = max(8, int(pw * at.shape[0] / at.shape[1]))
+    x, y = int(0.03 * w), int(0.03 * h)
+    alpha = cv2.resize(at, (pw, ph))
+    return _composite_light(base, alpha, x, y, 232)
+
+
+_BUILDERS: dict[str, Any] = {"gemini": _gemini_example, "jimeng_pill": _pill_example}
+
+
+def build(key: str) -> np.ndarray:
+    if key in _BUILDERS:
+        return _BUILDERS[key]()
+    return _text_mark_example(key)
+
+
+# ── Video mark examples ──────────────────────────────────────────────────────
+# One short clip per registered video mark: the detector's own synthetic
+# template composited at a scale inside its calibrated search profile, on every
+# frame of a generated base. The canary asserts the SHIPPED selection accepts
+# the clip (identify_video -> visible_mark), not just the per-frame detector.
+
+_VIDEO_FRAMES = 90
+_VIDEO_FPS = 30
+
+
+def _video_mark_frame(key: str, w: int, h: int) -> np.ndarray:
+    from remove_ai_watermarks.video_visible import _template_sources
+
+    base = base_photo(w, h, seed=11)
+    templates = _template_sources()
+    short = min(w, h)
+    if key == "sora":
+        tmpl, scale, x, y = templates["sora-icon"], 0.10, int(w * 0.72), int(h * 0.90)
+    elif key == "veo":
+        # The legacy "Veo" TEXT form: a perfect synthetic diamond also matches the
+        # Sora icon template (both are 4-point stars) and table order hands the
+        # tie to Sora, so the gallery carries the discriminative text variant.
+        tmpl = templates["veo-text"]
+        th = max(6, round(14 * short / 720))
+        tw = max(1, round(tmpl.shape[1] * th / tmpl.shape[0]))
+        x, y = w - tw - int(0.045 * w), h - th - int(0.045 * h)
+        return _composite_light(base, cv2.resize(tmpl, (tw, th)).astype(np.float32) / 255.0, x, y, 250)
+    elif key == "seedance":
+        tmpl, scale, x, y = templates["seedance"], 0.095, int(w * 0.74), int(h * 0.80)
+    elif key == "dola":
+        tmpl, scale, x, y = templates["dola"], 0.036, int(w * 0.70), int(h * 0.88)
+    elif key == "hailuo":
+        tmpl, scale, x, y = templates["hailuo"], 0.052, int(w * 0.34), int(h * 0.82)
+    elif key == "kling":
+        # The FULL mark: swirl logo left of the text run, flush against the
+        # bottom-right EDGE. The font arm is edge-gated (region must reach
+        # >=0.96W / >=0.94H), and a text-only composite away from the edge both
+        # fails that gate and cross-fires the Seedance detector.
+        tmpl = templates["kling-1"]
+        th = max(8, round(short * 0.040))
+        tw = max(1, round(tmpl.shape[1] * th / tmpl.shape[0]))
+        tx, ty = w - tw - 6, h - th - 6
+        out = _composite_light(base, cv2.resize(tmpl, (tw, th)).astype(np.float32) / 255.0, tx, ty, 250)
+        logo = templates["kling-logo"]
+        lh = max(6, round(short * 0.046))
+        lw = max(1, round(logo.shape[1] * lh / logo.shape[0]))
+        lx, ly = tx - lw - round(th * 0.5), h - lh - 6
+        return _composite_light(out, cv2.resize(logo, (lw, lh)).astype(np.float32) / 255.0, lx, ly, 250)
+    else:
+        raise ValueError(key)
+    th = max(8, round(short * scale))
+    tw = max(1, round(tmpl.shape[1] * th / tmpl.shape[0]))
+    alpha = cv2.resize(tmpl, (tw, th)).astype(np.float32) / 255.0
+    return _composite_light(base, alpha, x, y, 250)
+
+
+def build_video(key: str) -> None:
+    w, h = 960, 540
+    out_dir = OUT / key
+    out_dir.mkdir(parents=True, exist_ok=True)
+    path = out_dir / "example.mp4"
+    writer = cv2.VideoWriter(str(path), cv2.VideoWriter_fourcc(*"mp4v"), _VIDEO_FPS, (w, h))
+    if not writer.isOpened():
+        raise RuntimeError("mp4v writer unavailable")
+    frame = _video_mark_frame(key, w, h)
+    for _ in range(_VIDEO_FRAMES):
+        writer.write(frame)
+    writer.release()
+
+
+def verify_video(key: str) -> tuple[float, str | None, int]:
+    from remove_ai_watermarks.video import identify_video
+
+    rep = identify_video(OUT / key / "example.mp4", check_visible=True)
+    return float(rep.visible_detected_frames or 0), rep.visible_mark, rep.total_frames
+
+
+def render_videos() -> list[str]:
+    from remove_ai_watermarks.video import VIDEO_VISIBLE_MARKS
+
+    failures: list[str] = []
+    for key in VIDEO_VISIBLE_MARKS:
+        build_video(key)
+        frames, mark, total = verify_video(key)
+        status = "OK " if mark == key else "MISS"
+        print(f"{status} {key:10s} video: {mark} on {frames}/{total} frames -> data/fixtures/visible/{key}/example.mp4")
+        if mark != key:
+            failures.append(key)
+    return failures
+
+
+def main() -> None:
+    failures: list[str] = []
+    for mark in wr.known_marks():
+        key = mark.key
+        img = build(key)
+        out_dir = OUT / key
+        out_dir.mkdir(parents=True, exist_ok=True)
+        path = out_dir / "example.png"
+        cv2.imwrite(str(path), img)
+        det = wr.get_mark(key).detect(imread(str(path)), provenance=False)
+        status = "OK " if det.detected else "MISS"
+        print(f"{status} {key:12s} conf={det.confidence:.3f} -> {path.relative_to(_ROOT)}")
+        if not det.detected:
+            failures.append(key)
+    failures += render_videos()
+    if failures:
+        print(f"\nNOT DETECTED on their own examples: {failures}", file=sys.stderr)
+        raise SystemExit(1)
+
+
+if __name__ == "__main__":
+    main()

scripts/vendor_cohort_harvest.py

@@ -15,7 +15,7 @@ THE KEY
   ``001191110102MACQD9K64010000`` -> USCC ``91110102MACQD9K640``, which names a
   specific legal entity. So the metadata partitions carriers into per-ENTITY
   cohorts without looking at a single pixel. A cohort is a LABEL: once one frame
-  in it is eyeballed, every frame in it is a labelled example of that vendor's
+  in it is eyeballed, every frame in it is a labeled example of that vendor's
   mark. That is what turns "one confirmed positive" into "30+ per vendor".
 
   CLAUDE.md's "the generic TC260 label names no specific vendor" is about the

scripts/vendor_mark_calibrate.py

@@ -14,7 +14,7 @@ WHERE THE POSITIVES COME FROM
   absence) visible directly.
 
 NEGATIVES
-  The 432 frames hand-labelled `present: []` in the 2026-07-18 round -- already-adjudicated
+  The 432 frames hand-labeled `present: []` in the 2026-07-18 round -- already-adjudicated
   no-visible-mark images, so the false-fire arm rests on human labels rather than on the
   absence of a detection.
 
@@ -115,7 +115,7 @@ def load_sets(cohort: str) -> tuple[list[str], list[str]]:
     # The 2026-07-18 labels are in the vocabulary of the REGISTERED marks only
     # (gemini/doubao/jimeng/jimeng_pill): `present: []` means "no registered mark", NOT
     # "no mark at all" -- 146 of the 432 sit in a TC260 cohort, and qwen-cohort frames
-    # visibly carrying 千问AI生成 are labelled `present: []` there (measured 2026-07-21:
+    # visibly carrying 千问AI生成 are labeled `present: []` there (measured 2026-07-21:
     # they made up the clean arm's whole top tail, clean p99 0.37 -> 0.69). A gate read
     # off that arm is meaningless, so the clean arm excludes every frame in ANY TC260
     # cohort -- cohort membership is the cheap proxy for "may carry a CJK AI label".
@@ -168,7 +168,7 @@ def report(pos: list[dict[str, Any]], neg: list[dict[str, Any]], name: str) -> N
 
     p = np.array([r["score"] for r in pos])
     n = np.array([r["score"] for r in neg])
-    print(f"\n{'=' * 78}\n{name}: candidate-cohort vs hand-labelled clean\n{'=' * 78}")
+    print(f"\n{'=' * 78}\n{name}: candidate-cohort vs hand-labeled clean\n{'=' * 78}")
     print(f"\n{'arm':10s} {'n':>5s} {'p10':>7s} {'p50':>7s} {'p90':>7s} {'p95':>7s} {'p99':>7s} {'max':>7s}")
     for label, arr in (("cohort", p), ("clean", n)):
         if not len(arr):
@@ -602,7 +602,7 @@ def main() -> None:
         crossfire(pools, cand, a.workers, a.gate)
         return
 
-    print(f"cohort {a.cohort}: {len(pos_paths)} candidates | clean: {len(neg_paths)} hand-labelled")
+    print(f"cohort {a.cohort}: {len(pos_paths)} candidates | clean: {len(neg_paths)} hand-labeled")
     print(f"scale_basis={a.scale_basis} overrides={overrides}")
     pos = run(pos_paths, a.asset, name, a.workers, a.scale_basis, overrides)
     neg = run(neg_paths, a.asset, name, a.workers, a.scale_basis, overrides)

scripts/visible_eval.py

@@ -1,7 +1,7 @@
 """Benchmark harness for the visible-mark detectors.
 
 Run this before AND after any detector change. It re-runs perception over the
-hand-labelled ground truth and reports, per mark, how often a fire is correct --
+hand-labeled ground truth and reports, per mark, how often a fire is correct --
 with Wilson intervals, so a change inside the noise is visible as such.
 
     uv run python scripts/visible_eval.py                 # score current code
@@ -10,10 +10,10 @@ with Wilson intervals, so a change inside the noise is visible as such.
 
 WHAT THIS SET CAN AND CANNOT MEASURE -- read before quoting a number:
 
-  * PRECISION: sound. Every labelled crop is centred on the region a detector
+  * PRECISION: sound. Every labeled crop is centered on the region a detector
     pointed at, so "the detector fired mark K here, was K actually there" is
     exactly the question the labels answer.
-  * RECALL: NOT measurable here, and the harness refuses to print it. The labelled
+  * RECALL: NOT measurable here, and the harness refuses to print it. The labeled
     images were SAMPLED WHERE DETECTORS FIRED (relaxation additions plus controls),
     so images carrying a mark that every detector missed are absent by construction.
     Computing recall on this set would divide by a denominator that excludes exactly
@@ -133,7 +133,7 @@ def report(res: dict, prev: dict | None = None) -> None:
         conf = {k: v for k, v in res["confusion"][m].items() if k != m}
         if conf:
             print(f"  {m:12s} {dict(sorted(conf.items(), key=lambda kv: -kv[1]))}")
-    print("\n'scope' = images whose crop could rule on that mark; 'missed' = labelled marks it did not fire on.")
+    print("\n'scope' = images whose crop could rule on that mark; 'missed' = labeled marks it did not fire on.")
     print("NOTE: 'missed' is NOT recall -- this set was sampled where detectors fired, so images")
     print("      every detector missed are absent by construction. Use it only to catch a change")
     print("      LOSING marks it used to find; an unbiased random sample is needed for true recall.")

scripts/visible_groundtruth.py

@@ -1,6 +1,6 @@
-"""Consolidate the hand-labelled contact-sheet rounds into ONE ground-truth file.
+"""Consolidate the hand-labeled contact-sheet rounds into ONE ground-truth file.
 
-Ground truth is `uid -> the set of visible marks actually present`, hand-labelled
+Ground truth is `uid -> the set of visible marks actually present`, hand-labeled
 blind against contact sheets with a two-sided control in every round. Rounds so far:
 
   2026-07-18 text-mark/pill round : 423 cells (doubao / jimeng / jimeng_pill arms)
@@ -10,20 +10,20 @@ DATA SAFETY: treat the input dataset as sensitive. This script reads a gitignore
 dataset and writes a gitignored ground-truth file. Neither the images nor this
 output may be committed; only the harness is. See the repo CLAUDE.md.
 
-The labels record what the LABELLER SAW in the crop, one of:
+The labels record what the labeler saw in the crop, one of:
   doubao | jimeng | pill | sparkle | other_ai_label | none | uncertain
 `other_ai_label` is a real visible AI label from a vendor we do NOT have a mark for
 (千问 / 百度 / 星绘 / 抖音); it is NOT a positive for any registered mark, but it is
 also not "clean" -- it is exactly what the relaxed jimeng detector confuses.
-`uncertain` rows are EXCLUDED from scoring rather than coerced, so a labeller's
+`uncertain` rows are EXCLUDED from scoring rather than coerced, so a labeler's
 honest doubt never becomes a fabricated data point.
 """
 
 from __future__ import annotations
 
+import argparse
 import csv
 import json
-import sys
 from pathlib import Path
 
 SEEN_TO_MARK = {
@@ -32,7 +32,7 @@ SEEN_TO_MARK = {
     "pill": "jimeng_pill",
     "sparkle": "gemini",
 }
-# Which marks a crop centred on `key` lets the labeller rule on (same corner = visible
+# Which marks a crop centered on `key` lets the labeler rule on (same corner = visible
 # in the same crop). Doubao and Jimeng share the bottom-right corner.
 _ADJUDICATES = {
     "doubao": ("doubao", "jimeng"),
@@ -46,6 +46,7 @@ ROUNDS = [
     ("textmark", "labels.csv", "manifest.csv"),
     ("gemini", "gemini_labels.csv", "gemini_manifest.csv"),
 ]
+_HELP_DESCRIPTION = "Consolidate hand-labeled contact-sheet rounds into one ground-truth file."
 
 
 def metadata_provenance(path: str) -> list[str]:
@@ -77,7 +78,15 @@ def metadata_provenance(path: str) -> list[str]:
 
 
 def main() -> None:
-    root = Path(sys.argv[1] if len(sys.argv) > 1 else ".local-eval/textmark-relaxation")
+    parser = argparse.ArgumentParser(description=_HELP_DESCRIPTION)
+    parser.add_argument(
+        "root",
+        type=Path,
+        nargs="?",
+        default=Path(".local-eval/textmark-relaxation"),
+        help="Directory containing the blinded labeling rounds",
+    )
+    root = parser.parse_args().root
     out = root / "groundtruth.jsonl"
     rows: dict[str, dict] = {}
     stats: dict[str, int] = {}
@@ -97,8 +106,8 @@ def main() -> None:
                 m["uid"],
                 {"uid": m["uid"], "path": m["path"], "present": [], "seen": [], "rounds": [], "adjudicated": []},
             )
-            # ADJUDICATION SCOPE -- load-bearing. A crop centred on one mark only lets
-            # the labeller rule on marks visible IN THAT CROP. A pill crop (top-left)
+            # ADJUDICATION SCOPE -- load-bearing. A crop centered on one mark only lets
+            # the labeler rule on marks visible IN THAT CROP. A pill crop (top-left)
             # says nothing about a bottom-right wordmark, so scoring jimeng against a
             # pill-round image would book real detections as false fires (~61% of pills
             # carry a wordmark). Bottom-right marks co-adjudicate each other: one crop

scripts/visible_recall_sample.py

@@ -1,8 +1,8 @@
 """Build an UNBIASED random sample for measuring visible-mark RECALL.
 
-Every earlier labelling round sampled where detectors FIRED, so images that every
+Every earlier labeling round sampled where detectors FIRED, so images that every
 detector missed were absent by construction and recall was unmeasurable. This round
-samples at random within a provenance class and shows the labeller the corners where
+samples at random within a provenance class and shows the labeler the corners where
 a mark can physically be, so a MISSED mark is visible as such.
 
 Design decisions that matter:
@@ -13,19 +13,19 @@ Design decisions that matter:
   recall over all uploads would mostly measure how often each vendor appears.
 * NATIVE RESOLUTION crops, never a downscaled whole image: a 220px preview destroys a
   faint mark (measured in an earlier round), which would inflate the miss count with
-  the labeller's own blindness rather than the detector's.
+  the labeler's own blindness rather than the detector's.
 * BOTH corners per image (top-left pill, bottom-right wordmark/strip/sparkle), so one
   pass adjudicates every registered mark instead of one mark per crop.
 * The detector's verdict is NOT shown and is not in the sheet order -- the manifest
-  holds it and must not be opened until labelling ends.
+  holds it and must not be opened until labeling ends.
 """
 
 from __future__ import annotations
 
+import argparse
 import csv
 import json
 import random
-import sys
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
@@ -35,6 +35,8 @@ import numpy as np
 if TYPE_CHECKING:
     from numpy.typing import NDArray
 
+import sys
+
 sys.path.insert(0, str(Path(__file__).parent.parent / "src"))
 from remove_ai_watermarks.image_io import imread
 
@@ -63,10 +65,16 @@ def corner_strip(img: NDArray[Any]) -> NDArray[Any] | None:
 
 
 def main() -> None:
-    scan = Path(sys.argv[1])
-    out = Path(sys.argv[2])
-    n_tc260 = int(sys.argv[3]) if len(sys.argv) > 3 else 160
-    n_google = int(sys.argv[4]) if len(sys.argv) > 4 else 80
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("scan", type=Path, help="JSONL corpus scan produced by the visible evaluation harness")
+    parser.add_argument("output", type=Path, help="Directory for contact sheets and the blinded manifest")
+    parser.add_argument("--tc260", type=int, default=160, help="Number of TC260 carriers to sample")
+    parser.add_argument("--google", type=int, default=80, help="Number of Google-provenance carriers to sample")
+    args = parser.parse_args()
+    scan = args.scan
+    out = args.output
+    n_tc260 = args.tc260
+    n_google = args.google
     out.mkdir(parents=True, exist_ok=True)
 
     recs = [json.loads(line) for line in scan.open() if '"marks"' in line]

scripts/visible_sheets.py

@@ -1,17 +1,18 @@
-"""Build BLIND contact sheets for hand-labelling relaxation additions.
+"""Build BLIND contact sheets for hand-labeling relaxation additions.
 
 Crops are centered on the DETECTED REGION (not the corner), padded by ~0.9x the mark
 size, and resized to 240px with INTER_NEAREST -- a downscaled preview destroys a faint
 mark, so nothing here may smooth. The manifest is written to a separate file that must
-NOT be read until labelling is finished.
+NOT be read until labeling is finished.
 
 Each sheet mixes three strata in shuffled order:
   add    - the relaxation additions whose precision we are measuring
-  pos    - strict-consistent detections (a mark is really there): labeller sensitivity
-  clean  - verified-clean negatives (no mark can be there): labeller specificity
+  pos    - strict-consistent detections (a mark is really there): labeler sensitivity
+  clean  - verified-clean negatives (no mark can be there): labeler specificity
 The two control strata are what make a low measured precision trustworthy.
 """
 
+import argparse
 import csv
 import json
 import random
@@ -62,9 +63,13 @@ def crop(path: str, region: tuple[int, int, int, int] | None, pad_factor: float
 
 
 def main() -> None:
-    with open(sys.argv[1]) as fh:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("input", type=Path, help="JSON candidate list")
+    parser.add_argument("output", type=Path, help="Directory for blinded contact sheets")
+    args = parser.parse_args()
+    with args.input.open() as fh:
         items = json.load(fh)  # [{uid,path,key,stratum,conf}]
-    outdir = Path(sys.argv[2])
+    outdir = args.output
     outdir.mkdir(parents=True, exist_ok=True)
     random.Random(1234).shuffle(items)  # noqa: S311 -- sheet ordering, not cryptography
 

src/remove_ai_watermarks/__init__.py

@@ -32,7 +32,7 @@ _os.environ.setdefault("TRANSFORMERS_VERBOSITY", "error")
 _warnings.filterwarnings("ignore", message=r".*ImageProcessorFast.*")
 
 
-__version__ = "0.30.1"
+__version__ = "0.34.1"
 
 __all__ = [
     "BatchSummary",

src/remove_ai_watermarks/_internal/c2pa.py

@@ -62,6 +62,16 @@ _SIGNATURE_FAILURES = frozenset(
         "claimSignature.outsideValidity",
     }
 )
+# A credential the issuer itself has disowned, disqualifying like a hash mismatch.
+# ``signingCredential.expired`` is deliberately absent: an expired certificate does not
+# imply the signed bytes changed, and a signature actually made outside validity already
+# arrives as ``claimSignature.outsideValidity`` above.
+_CREDENTIAL_FAILURES = frozenset(
+    {
+        "signingCredential.invalid",
+        "signingCredential.ocsp.revoked",
+    }
+)
 
 
 @dataclass(frozen=True)
@@ -293,16 +303,24 @@ def _status_codes(store: dict[str, Any]) -> tuple[list[str], list[str], list[str
 
 
 def _store_has_invalid_credential(store: dict[str, Any]) -> bool:
-    """Return whether this store's own active credential failed validation."""
-    _, _, failures = _status_codes(store)
-    return any(marker in code for code in failures for marker in _CONTENT_BINDING_FAILURE_MARKERS) or any(
-        code in _SIGNATURE_FAILURES for code in failures
-    )
+    """Return whether this store's own active credential failed validation.
+
+    Deliberately routed through the same codes -> dimensions -> disqualified path the
+    report uses, rather than re-testing the raw codes here. When this walk classified
+    failures on its own, adding one rule meant editing it and
+    :func:`c2pa_info_has_invalid_credential` in lockstep, and the ingredient
+    reachability walk was free to drift away from the verdict it feeds.
+    """
+    return c2pa_info_has_invalid_credential(_validation_fields(store))
 
 
 def c2pa_info_has_invalid_credential(info: dict[str, Any]) -> bool:
-    """Return whether parsed C2PA info reports a failed binding or signature."""
-    return info.get("c2pa_integrity") == "invalid" or info.get("c2pa_signature") == "invalid"
+    """Return whether parsed C2PA info reports a failed binding, signature, or credential."""
+    return (
+        info.get("c2pa_integrity") == "invalid"
+        or info.get("c2pa_signature") == "invalid"
+        or info.get("c2pa_signer_validity") == "invalid"
+    )
 
 
 def c2pa_info_has_invismark(info: dict[str, Any]) -> bool:
@@ -324,9 +342,16 @@ def _validation_fields(store: dict[str, Any]) -> dict[str, Any]:
     successes, informationals, failures = _status_codes(store)
     all_codes = list(dict.fromkeys([*successes, *informationals, *failures]))
 
-    binding_failed = any(marker in code for code in failures for marker in _CONTENT_BINDING_FAILURE_MARKERS)
+    disqualifying = [
+        code
+        for code in failures
+        if any(marker in code for marker in _CONTENT_BINDING_FAILURE_MARKERS)
+        or code in _SIGNATURE_FAILURES
+        or code in _CREDENTIAL_FAILURES
+    ]
+    binding_failed = any(marker in code for code in disqualifying for marker in _CONTENT_BINDING_FAILURE_MARKERS)
     binding_matched = _has_suffix(successes, _CONTENT_BINDING_MATCHES)
-    signature_failed = any(code in _SIGNATURE_FAILURES for code in failures)
+    signature_failed = any(code in _SIGNATURE_FAILURES for code in disqualifying)
     signature_validated = "claimSignature.validated" in successes
 
     if binding_failed:
@@ -349,7 +374,7 @@ def _validation_fields(store: dict[str, Any]) -> dict[str, Any]:
     else:
         signer_trust = "unknown"
 
-    if any(code in failures for code in ("signingCredential.invalid", "signingCredential.ocsp.revoked")):
+    if any(code in _CREDENTIAL_FAILURES for code in disqualifying):
         signer_validity = "invalid"
     elif "signingCredential.expired" in failures:
         signer_validity = "expired"
@@ -367,6 +392,10 @@ def _validation_fields(store: dict[str, Any]) -> dict[str, Any]:
         "c2pa_signer_trust": signer_trust,
         "c2pa_signer_validity": signer_validity,
         "c2pa_validation_codes": all_codes,
+        # The subset of failures that actually drove a dimension to invalid. Callers
+        # rendering "why" must use this rather than re-classifying the full code list,
+        # or the reason shown and the verdict reached stop being the same rule.
+        "c2pa_failed_codes": disqualifying,
     }
 
 
@@ -397,6 +426,11 @@ def _structured_manifest_fields(store: dict[str, Any]) -> dict[str, Any]:
     source_types: list[str] = []
     soft_binding_algorithms: list[str] = []
     soft_binding_values: list[str] = []
+    # Raw signer/generator identity strings, used to scope SynthID evidence to
+    # the vendor that actually asserted the manifest. A vendor token appearing
+    # anywhere else in the chain (e.g. Microsoft Designer's "Azure OpenAI
+    # ImageGen" softwareAgent) is a service name, not that vendor's provenance.
+    identity_strings: list[str] = []
     claim_generator_asserts_ai = False
 
     def add_tool_matches(value: str, *, asserts_ai: bool = False) -> None:
@@ -414,9 +448,11 @@ def _structured_manifest_fields(store: dict[str, Any]) -> dict[str, Any]:
                 value = signature.get(key)
                 if isinstance(value, str):
                     issuers.extend(_ordered_matches(value.encode(), C2PA_ISSUERS))
+                    identity_strings.append(value)
 
         direct_generator = manifest.get("claim_generator")
         if isinstance(direct_generator, str):
+            identity_strings.append(direct_generator)
             add_tool_matches(direct_generator, asserts_ai=True)
 
         candidates = manifest.get("claim_generator_info")
@@ -427,6 +463,7 @@ def _structured_manifest_fields(store: dict[str, Any]) -> dict[str, Any]:
                 name = cast("dict[object, object]", candidate_value).get("name")
                 if isinstance(name, str):
                     add_tool_matches(name, asserts_ai=True)
+                    identity_strings.append(name)
 
         assertions = manifest.get("assertions")
         if not isinstance(assertions, list):
@@ -499,9 +536,14 @@ def _structured_manifest_fields(store: dict[str, Any]) -> dict[str, Any]:
     has_watermark_action = any(action.startswith("watermarked") for action in actions)
     if has_watermark_action:
         info["watermarked"] = True
-    if info.get("ai_source_kind"):
-        selected_bytes = json.dumps(chain, ensure_ascii=False).encode()
-        synthid = synthid_evidence_vendors_in(selected_bytes, has_watermark_action=has_watermark_action)
+    if info.get("ai_source_kind") and not soft_binding_algorithms:
+        # Evidence scope: only the signer/generator identity strings above, never
+        # the whole chain - a vendor named inside another vendor's manifest (the
+        # Designer case) must not turn into that vendor's SynthID provenance. A
+        # manifest that names its own forensic soft-binding algorithm carries
+        # that vendor's mark and is excluded from the generic inference entirely.
+        identity_bytes = json.dumps(identity_strings, ensure_ascii=False).encode()
+        synthid = synthid_evidence_vendors_in(identity_bytes, has_watermark_action=has_watermark_action)
         if synthid:
             info["synthid_vendors"] = synthid
             info["synthid_watermark"] = synthid_verdict(", ".join(synthid))
@@ -582,12 +624,16 @@ def _populate_registry_fields(buffer: bytes, info: dict[str, Any]) -> bool:
 
     if b"c2pa.watermarked" in buffer:
         info["watermarked"] = True
-    synthid = synthid_evidence_vendors_in(buffer, has_watermark_action=info.get("watermarked", False))
+    soft_bindings = soft_binding_vendors_in(buffer)
+    synthid = (
+        []
+        if soft_bindings
+        else synthid_evidence_vendors_in(buffer, has_watermark_action=info.get("watermarked", False))
+    )
     if ai_source and synthid:
         info["synthid_vendors"] = synthid
         info["synthid_watermark"] = synthid_verdict(", ".join(synthid))
 
-    soft_bindings = soft_binding_vendors_in(buffer)
     if soft_bindings:
         info["soft_binding_vendors"] = soft_bindings
         info["soft_binding"] = ", ".join(soft_bindings)
@@ -610,6 +656,7 @@ def _base_info(byte_count: int, *, fallback: bool = False) -> dict[str, Any]:
             c2pa_signer_trust="unknown",
             c2pa_signer_validity="unknown",
             c2pa_validation_codes=[],
+            c2pa_failed_codes=[],
         )
     return info
 

src/remove_ai_watermarks/_internal/constants.py

@@ -70,7 +70,7 @@ C2PA_AI_VENDORS: tuple[C2paAiVendor, ...] = (
     _vendor(
         b"OpenAI",
         "OpenAI",
-        "OpenAI (ChatGPT / gpt-image / DALL-E / Sora)",
+        "OpenAI (ChatGPT / GPT Image / DALL·E / Sora)",
         "OpenAI",
         synthid=True,
         synthid_requires_watermark_action=True,
@@ -81,29 +81,32 @@ C2PA_AI_VENDORS: tuple[C2paAiVendor, ...] = (
     _vendor(
         b"volcengine",
         "ByteDance (Volcano Engine)",
-        "ByteDance (Doubao / Jimeng / Dreamina / Volcano Engine)",
-        "ByteDance",
+        "ByteDance Volcano Engine",
+        "Volcano Engine",
     ),
     _vendor(
         "北京火山引擎科技有限公司",
         "ByteDance (Volcano Engine)",
-        "ByteDance (Doubao / Jimeng / Dreamina / Volcano Engine)",
-        "ByteDance",
-    ),
-    _vendor(
-        b"Byteplus", "BytePlus (ByteDance)", "ByteDance (Doubao / Jimeng / Dreamina / Volcano Engine)", "ByteDance"
+        "ByteDance Volcano Engine",
+        "Volcano Engine",
     ),
+    _vendor(b"Byteplus", "BytePlus (ByteDance)", "BytePlus (ByteDance)", "BytePlus"),
     _vendor(
         b"Dreamina",
         "ByteDance (Dreamina)",
-        "ByteDance (Doubao / Jimeng / Dreamina / Volcano Engine)",
-        "ByteDance",
+        "ByteDance Dreamina",
+        "Dreamina",
         asserts_ai=True,
     ),
     _vendor(b"Canva", "Canva", "Canva (Magic Media)", "Canva"),
     _vendor(b"Eleven Labs", "ElevenLabs", "ElevenLabs", "ElevenLabs"),
     _vendor(b"fal-ai", "fal.ai", "fal.ai", "fal.ai", asserts_ai=True),
     _vendor(b"Bria", "Bria Artificial Intelligence", "Bria AI", "Bria", asserts_ai=True),
+    # Ideogram signs its downloads' Content Credentials with "Ideogram, Inc"; the
+    # issuer token is the org prefix (same substring-match class as "Bria" in
+    # "Bria Artificial Intelligence"). Found as an unmapped signer on 4 corpus
+    # uploads 2026-08-08 that identify reported as unknown-signer C2PA.
+    _vendor(b"Ideogram", "Ideogram", "Ideogram", "Ideogram", asserts_ai=True),
     _vendor(b"Truepic", "Truepic", None, None),
 )
 
@@ -116,7 +119,7 @@ C2PA_IDENTITY_AI_ORGS = frozenset(vendor.org for vendor in C2PA_AI_VENDORS if ve
 C2PA_CLAIM_GENERATOR_PLATFORMS: tuple[tuple[str, str], ...] = (
     ("adobe_firefly", "Adobe Firefly"),
     ("firefly", "Adobe Firefly"),
-    ("dreamina", "ByteDance (Doubao / Jimeng / Dreamina / Volcano Engine)"),
+    ("dreamina", "ByteDance Dreamina"),
     ("higgsfield ai", "Higgsfield AI"),
     ("topaz labs image api", "Topaz Labs"),
     ("tiktok ad creative toolbox", "TikTok Ad Creative Toolbox"),
@@ -128,8 +131,8 @@ C2PA_AI_TOOLS = {
         ("GPT-4o", "GPT-4o"),
         ("ChatGPT", "ChatGPT"),
         ("Sora", "Sora"),
-        ("DALL-E", "DALL-E"),
-        ("DALL", "DALL-E"),
+        ("DALL-E", "DALL·E"),
+        ("DALL", "DALL·E"),
         ("Imagen", "Imagen"),
         ("Firefly", "Firefly"),
         ("Dreamina", "Dreamina"),
@@ -138,16 +141,18 @@ C2PA_AI_TOOLS = {
 
 C2PA_SOFT_BINDINGS = {
     b"com.adobe.trustmark": "Adobe TrustMark",
-    b"com.adobe.icn": "Adobe (content fingerprint)",
-    b"com.digimarc": "Digimarc",
+    b"com.adobe.icn": "Adobe Image Comparator Network",
+    b"com.digimarc": "Digimarc Validate",
     b"com.imatag.lamark": "Imatag (Lamark)",
     b"ai.steg": "Steg.AI",
     b"com.microsoft.invismark": "Microsoft InvisMark",
     b"com.microsoft.wavmark": "Microsoft WavMark",
     b"com.verimatrix": "Verimatrix",
     b"com.nagra.nexguard": "NAGRA NexGuard",
-    b"com.aiwatermark": "AIWatermark (Meta PixelSeal)",
-    b"ai.trufo": "Trufo",
+    b"com.aiwatermark.pixelseal": "AIWatermark PixelSeal",
+    b"com.aiwatermark.videoseal": "AIWatermark VideoSeal",
+    b"com.aiwatermark.audioseal": "AIWatermark AudioSeal",
+    b"ai.trufo": "Trufo PawPrint",
     b"app.overlai": "Overlai",
     b"com.markany": "MarkAny",
     b"com.mentaport": "Mentaport",
@@ -199,7 +204,7 @@ C2PA_ACTIONS = {f"c2pa.{action}".encode(): action for action in _C2PA_ACTION_NAM
 # what stops a newly registered TC260 vendor from silently falling back to ByteDance.
 #
 # What a TC260 label confirms when its producer is absent or unmapped. Historical
-# behaviour, kept as the fallback so an unrecognized producer never regresses to no
+# behavior, kept as the fallback so an unrecognized producer never regresses to no
 # relaxation at all: ByteDance's two products are the ones the relaxed band was
 # calibrated on (see _text_mark_engine._DEFAULT_PROVENANCE_NCC_FACTOR).
 TC260_FALLBACK_VENDORS: frozenset[str] = frozenset({"doubao", "jimeng"})

src/remove_ai_watermarks/_internal/qwen_zimage_pipeline.py

@@ -1074,29 +1074,14 @@ class QwenZImagePipeline:
         fidelity_anchor: bool = False,
     ) -> Image.Image:
         """Execute global regeneration and masked face repair."""
+        if text_manifest is not None and tile:
+            raise ValueError("Verified text restoration is not calibrated with tiled diffusion")
         self._require_cuda()
         seed = resolve_seed(seed)
         donor = None
         if text_manifest is not None:
             self._progress("Reconstructing the verified text donor with the Qwen VAE...")
-            if tile and max(image.size) > tile_size:
-                from remove_ai_watermarks._internal.tiling import run_tiled
-
-                donor = run_tiled(
-                    self._qwen_vae_roundtrip,
-                    image,
-                    tile_size,
-                    tile_overlap,
-                    lambda message: self._progress(
-                        message.replace(
-                            "Tiled diffusion",
-                            "Reconstructing the verified text donor",
-                            1,
-                        )
-                    ),
-                )
-            else:
-                donor = self._qwen_vae_roundtrip(image)
+            donor = self._qwen_vae_roundtrip(image)
         global_strength = (
             resolution_adaptive_denoise(image.width, image.height) if strength is None else float(strength)
         )

src/remove_ai_watermarks/_internal/watermark_profiles.py

@@ -69,17 +69,50 @@ SDXL_ZIMAGE_OPENAI_STRENGTH = 0.15
 SDXL_ZIMAGE_GEMINI_STRENGTH = 0.25
 SDXL_ZIMAGE_UNKNOWN_STRENGTH = SDXL_ZIMAGE_GEMINI_STRENGTH
 
-# qwen-zimage keeps its resolution curve for openai/unknown content, but Google
-# content takes this flat oracle-measured floor instead of the curve (whose top,
-# 0.154, left a 4.33 MP CJK-sign fixture detected x3 on the full production path
-# with a valid pixel control, 2026-08-18). 0.30 anchors measured clean in Gemini
-# across two fixtures and two work accounts (CJK sign + 18-face, 3/3 checks each,
-# 2026-08 research) and stayed clean under the vae-glyphs donor layer on top.
-QWEN_ZIMAGE_GOOGLE_STRENGTH = 0.30
+# qwen-zimage keeps its resolution curve for unknown content, but measured vendor
+# cohorts bypass it. Google remained detectable through 0.24375; 0.25 cleared all
+# three valid sources and 0.27 was separately repeated clean across them and three
+# accounts, so the independently checked 0.27 candidate is the operating floor.
+QWEN_ZIMAGE_GOOGLE_STRENGTH = 0.27
+
+# The two OpenAI sources first cleared at 0.06225 and 0.0695. Add one full observed
+# cross-source spread (0.00725) to the worst clean boundary: 0.0695 + 0.00725.
+QWEN_ZIMAGE_OPENAI_STRENGTH = 0.07675
+
+# Microsoft's public detector (https://ai.azure.com/nextgen/validate) returned
+# Inconclusive rather than an API-level watermark-negative verdict. Three valid
+# Paint sources first cleared at 0.04125,
+# 0.055, and 0.095. Add one full observed cross-source spread to the worst clean
+# boundary: 0.095 + (0.095 - 0.04125) = 0.14875, rounded up to 0.15. This is a
+# measured corpus margin, not a universal InvisMark threshold.
+QWEN_ZIMAGE_MICROSOFT_STRENGTH = 0.15
+
+# Meta Muse Image stamps every output with Content Seal, but no provenance signal
+# survives to route it: the outputs carry no C2PA, and their IPTC
+# trainedAlgorithmicMedia companion tag is a standard code many platforms use, so
+# it cannot key this cohort the way an issuer keys the others. The floor is
+# therefore selected by an explicit --vendor meta override, never by detection.
+# Derivation (oracle meta.ai/identification, 2026-08-26/27, corpus in
+# data/contentseal/): five independent 2.56 MP generations bracketed at
+# lighthouse (0.0525, 0.06], fox (0.03, 0.0375], night_city (0.03, 0.0375],
+# mug <= 0.03, text <= 0.015. Worst clean boundary plus one full observed
+# cross-source spread: 0.06 + (0.0525 - 0.015) = 0.0975, rounded up to 0.1.
+# sdxl-zimage has no measured Meta floor; its vendor map stays without a meta
+# entry so an explicit --vendor meta there falls to the unknown 0.25, which is
+# above this floor and therefore conservative.
+QWEN_ZIMAGE_META_STRENGTH = 0.1
+
+_QWEN_ZIMAGE_FLAT_STRENGTH_BY_VENDOR: dict[str, float] = {
+    "google": QWEN_ZIMAGE_GOOGLE_STRENGTH,
+    "openai": QWEN_ZIMAGE_OPENAI_STRENGTH,
+    "microsoft": QWEN_ZIMAGE_MICROSOFT_STRENGTH,
+    "meta": QWEN_ZIMAGE_META_STRENGTH,
+}
 
 
-# sdxl-zimage picks its strength from the VENDOR (unlike qwen-zimage, which derives it
-# from image area). An unlisted or unknown vendor falls back to the Gemini value.
+# sdxl-zimage always picks its strength from the vendor. qwen-zimage instead uses
+# the vendor only for measured cohorts and image area for unknown content. An
+# unlisted or unknown SDXL vendor falls back to the Gemini value.
 _SDXL_ZIMAGE_STRENGTH_BY_VENDOR: dict[str, float] = {
     "openai": SDXL_ZIMAGE_OPENAI_STRENGTH,
     "google": SDXL_ZIMAGE_GEMINI_STRENGTH,
@@ -112,7 +145,9 @@ def strength_default_help() -> str:
     """Describe the live default policy without duplicating its values."""
     return (
         "profile-adaptive (qwen-zimage uses resolution-adaptive denoise, with a "
-        f"flat oracle-measured Google floor of {QWEN_ZIMAGE_GOOGLE_STRENGTH}; sdxl-zimage "
+        f"flat OpenAI {QWEN_ZIMAGE_OPENAI_STRENGTH} / Google {QWEN_ZIMAGE_GOOGLE_STRENGTH} / "
+        f"Microsoft InvisMark {QWEN_ZIMAGE_MICROSOFT_STRENGTH} / Meta Content Seal "
+        f"{QWEN_ZIMAGE_META_STRENGTH} floors; sdxl-zimage "
         f"uses OpenAI {SDXL_ZIMAGE_OPENAI_STRENGTH} / Google {SDXL_ZIMAGE_GEMINI_STRENGTH} / "
         f"unknown {SDXL_ZIMAGE_UNKNOWN_STRENGTH}, from the C2PA issuer)"
     )
@@ -131,10 +166,10 @@ def resolve_strength(
     from the vendor, so it needs ``size``; returning ``None`` for it instead would push that
     branch onto every caller and move one of the two strength policies outside this
     module. ``size`` is required for qwen-zimage without an explicit strength.
-    One measured exception since 0.27.2: Google-provenance content on qwen-zimage
-    takes the flat ``QWEN_ZIMAGE_GOOGLE_STRENGTH`` floor instead of the area curve
-    (the curve's 0.154 top left a 4.33 MP fixture oracle-detected on the full
-    production path; see the constant's comment).
+    Measured vendor exceptions bypass the area curve: OpenAI and Microsoft use one
+    additional observed cross-source spread over their worst clean boundaries, while
+    Google uses a separately repeated cross-source candidate. See the constants'
+    comments for the exact derivations.
     """
     if strength is not None:
         return strength
@@ -142,23 +177,63 @@ def resolve_strength(
         return _SDXL_ZIMAGE_STRENGTH_BY_VENDOR.get((vendor or "").casefold(), SDXL_ZIMAGE_UNKNOWN_STRENGTH)
     if size is None:
         raise ValueError("qwen-zimage resolves strength from image area, so size is required")
-    if (vendor or "").casefold() == "google":
-        return QWEN_ZIMAGE_GOOGLE_STRENGTH
+    vendor_strength = _QWEN_ZIMAGE_FLAT_STRENGTH_BY_VENDOR.get((vendor or "").casefold())
+    if vendor_strength is not None:
+        return vendor_strength
     from remove_ai_watermarks._internal.qwen_zimage_pipeline import resolution_adaptive_denoise
 
     return resolution_adaptive_denoise(*size)
 
 
-def vendor_for_strength(image_path: Path) -> Literal["openai", "google"] | None:
-    """Select the strength cohort using the input's SynthID provenance evidence."""
+def vendor_for_strength(image_path: Path) -> Literal["openai", "google", "microsoft", "meta"] | None:
+    """Select the strength cohort from non-invalid pixel-watermark provenance.
+
+    OpenAI / Google / Microsoft come from their C2PA issuers. Meta is the
+    fallback cohort: Muse Image carries no C2PA at all, and its only readable
+    companion is the IPTC ``trainedAlgorithmicMedia`` XMP tag -- a standard code
+    other platforms also use. Attributing that tag to Meta is a measured bet,
+    not an identification: the other tag users in this project's model (ByteDance
+    products, X) ship no invisible pixel watermark this profile targets, so the
+    worst misroute spends the Meta floor (0.1) where the resolution curve would
+    have spent a similar amount, and Google/OpenAI files never reach this arm
+    because their C2PA matched first."""
     try:
+        from remove_ai_watermarks._internal.c2pa import (
+            c2pa_info_has_invalid_credential,
+            c2pa_info_has_invismark,
+            extract_c2pa_info,
+        )
         from remove_ai_watermarks.metadata import synthid_source
 
-        evidence = (synthid_source(image_path) or "").casefold()
+        info = extract_c2pa_info(image_path)
+        evidence = (synthid_source(image_path, c2pa_info=info) or "").casefold()
     except Exception:
         return None
     if "google" in evidence:
         return "google"
     if "openai" in evidence:
         return "openai"
+    if not c2pa_info_has_invalid_credential(info) and c2pa_info_has_invismark(info):
+        return "microsoft"
+    if _standalone_iptc_ai_tag(image_path):
+        return "meta"
     return None
+
+
+def _standalone_iptc_ai_tag(image_path: Path) -> bool:
+    """True when the file carries an AI IPTC marker with no C2PA around it.
+
+    Mirrors identify's ``standalone_iptc`` condition (the tag is only
+    trustworthy as platform evidence when no manifest supersedes it) without
+    importing the heavy identify module: the shared chunk-aware
+    :func:`metadata.scan_head` window -- Muse WebP outputs place their XMP
+    packet in a tail chunk up to hundreds of KB past a plain head read, which
+    is exactly what scan_head's extensions exist to catch.
+    """
+    try:
+        from remove_ai_watermarks.metadata import IPTC_AI_MARKERS, c2pa_marker_in, scan_head
+
+        scan = scan_head(image_path)
+    except Exception:
+        return False
+    return any(marker in scan for marker in IPTC_AI_MARKERS) and not c2pa_marker_in(scan)

src/remove_ai_watermarks/_text_mark_engine.py

@@ -52,8 +52,8 @@ _MIN_DETECT_SHORT_SIDE = 200
 # This used to be ONE shared 0.7 for every text mark. Measured 2026-07-18 on the
 # `auto` path (the default -- no flag, driven by TC260 metadata), it turned out to
 # mean two completely different things per mark. Blind hand-label of the ADDITIONS
-# (accepted with provenance, rejected without) over a labelled TC260 evaluation set,
-# two-sided control (labeller sensitivity 100%/96%, specificity 100%/100%):
+# (accepted with provenance, rejected without) over a labeled TC260 evaluation set,
+# two-sided control (labeler sensitivity 100%/96%, specificity 100%/100%):
 #
 #   mark     band            precision   95% CI     n
 #   doubao   whole arm             76%    61-87%    42
@@ -89,8 +89,8 @@ class TextMarkConfig:
     name: str  # short label for log lines (e.g. "Doubao")
     asset_name: str  # bundled alpha PNG under assets/ (e.g. "doubao_alpha.png")
     corner: Literal[
-        "br", "bl", "tl", "bc"
-    ]  # bottom-right (Doubao/Jimeng), bottom-left (Samsung), top-left (RunningHub), bottom-center (LibLibAI)
+        "br", "bl", "tl", "tr", "bc"
+    ]  # br (Doubao/Jimeng), bl (Samsung), tl (RunningHub), tr (Microsoft), bc (LiblibAI)
     margin_floor: int  # min margin in px for locate (4 for br marks, 2 for Samsung)
     # locate geometry (fraction of scale_base -- see scale_base())
     width_frac: float
@@ -131,7 +131,7 @@ class TextMarkConfig:
     template_blur: float = 0.0
     # Which image dimension the mark's size and margins scale with. VENDOR-SPECIFIC,
     # measured, not assumed -- see TextMarkEngine.scale_base. "short" = min(h, w), "width" = w.
-    scale_basis: Literal["short", "width"] = "width"
+    scale_basis: Literal["short", "width", "long"] = "width"
     # Scale rungs ``_ladder_best`` sweeps (the detection comb). PER-MARK: a vendor
     # whose stamp sizes do not land on the shared 3-rung comb carries its own ladder
     # (measured for 千问, whose marks sit in two size modes ~1.6x apart -- one fraction
@@ -309,7 +309,7 @@ class TextMarkEngine:
         provenance relaxation it stopped trying because many Jimeng false additions
         were actually Doubao marks.
 
-        Measured separability on hand-labelled examples, scoring BOTH templates
+        Measured separability on hand-labeled examples, scoring BOTH templates
         against the same glyph blob:
 
             feature                       separability   (0.5 = useless, 1.0 = perfect)
@@ -480,10 +480,19 @@ class TextMarkEngine:
 
         China's GB 45438-2025 clause 5.2(e) mandates glyph height >= 5% of "the
         shortest side" for CN marks, which is why a short-side basis is the natural
-        prior -- but Jimeng's measured behaviour overrides the prior, and measurement
+        prior -- but Jimeng's measured behavior overrides the prior, and measurement
         wins over the standard's wording.
+
+        "long" (max of the two sides) is the Microsoft badge's measured basis: the
+        pill tracks the RENDER dimension, so on a 1024x1536 portrait it scales with
+        the 1536 (a width basis undersized the template by the aspect ratio and the
+        portrait carriers fell to 0.15-0.32 NCC; measured 2026-08-27).
         """
-        return min(image.shape[:2]) if self.config.scale_basis == "short" else image.shape[1]
+        if self.config.scale_basis == "short":
+            return min(image.shape[:2])
+        if self.config.scale_basis == "long":
+            return max(image.shape[:2])
+        return image.shape[1]
 
     def locate(self, image: NDArray[Any]) -> TextMarkLocation:
         """Anchor the watermark box in the configured corner, scaled by ``scale_basis``.
@@ -499,14 +508,14 @@ class TextMarkEngine:
         wm_h = max(16, int(base * c.height_frac))
         margin_x = max(c.margin_floor, int(base * c.margin_x_frac))
         margin_b = max(c.margin_floor, int(base * c.margin_bottom_frac))
-        if c.corner == "br":
+        if c.corner == "br" or c.corner == "tr":
             x = max(0, w - margin_x - wm_w)
         elif c.corner == "bc":  # bottom-center: horizontally centered, margin_x unused
             x = max(0, (w - wm_w) // 2)
         else:
             x = min(margin_x, max(0, w - wm_w))
-        # "tl" anchors at the top instead: margin_bottom_frac is then the TOP margin.
-        y = min(margin_b, max(0, h - wm_h)) if c.corner == "tl" else max(0, h - margin_b - wm_h)
+        # "tl"/"tr" anchor at the top instead: margin_bottom_frac is then the TOP margin.
+        y = min(margin_b, max(0, h - wm_h)) if c.corner in ("tl", "tr") else max(0, h - margin_b - wm_h)
         wm_w = min(wm_w, w - x)
         wm_h = min(wm_h, h - y)
         return TextMarkLocation(x=x, y=y, w=wm_w, h=wm_h)
@@ -695,7 +704,7 @@ class TextMarkEngine:
 
         OVERRIDABLE, and the override contract is specifically the DETECTOR'S MATCH BOX:
         a mark whose removable footprint reaches beyond what the NCC localizes -- Baidu's
-        flat white tag right of the text run, LibLibAI's triangle logo left of the
+        flat white tag right of the text run, LiblibAI's triangle logo left of the
         wordmark -- supplies its own extension here and inherits the rest of the
         footprint path. The blob-bbox branch never routes through an override.
         """
@@ -771,7 +780,7 @@ class TextMarkEngine:
         """Footprint policy for a mark whose fill must be bounded by the DETECTOR's match
         box and never by the binary glyph blob.
 
-        Baidu's white tag has a flat interior a top-hat cannot answer, and LibLibAI's
+        Baidu's white tag has a flat interior a top-hat cannot answer, and LiblibAI's
         blob bleeds up into background structure; in both cases the blob bbox is
         measurably wrong and the NCC match box is right. ``force`` takes priority here,
         unlike the default policy: a ``--no-detect`` caller named the mark, so the whole

src/remove_ai_watermarks/api.py

@@ -73,7 +73,7 @@ def _tc260_vendors(path: Path) -> frozenset[str]:
 
     An absent, unreadable or unmapped producer falls back to the historical pair rather
     than to nothing: the caller has already established that the AIGC signal fired, so
-    the image IS China-AIGC labelled, and dropping to no relaxation would lose the
+    the image IS China-AIGC labeled, and dropping to no relaxation would lose the
     detections the fallback recovers today. The re-read is deliberately isolated -- a
     failure here must narrow the answer, never discard the rest of the provenance.
     """
@@ -156,9 +156,10 @@ def remove_visible(
 ) -> tuple[NDArray[Any], list[str]]:
     """Remove every detected known visible AI mark through localize then fill.
 
-    The registry currently covers the Gemini sparkle; Doubao, Jimeng, Qwen, Kling,
-    Yuanbao, Samsung, RunningHub, Baidu, and LibLibAI text marks; and the Jimeng
-    pill. Returns ``(result_bgr, [labels removed])``.
+    The registry currently covers the Gemini visible watermark; Doubao, Jimeng,
+    Qwen, Kling AI, Yuanbao, Samsung, RunningHub, Baidu, and LiblibAI text marks;
+    one Microsoft top-right AI-badge variant; and the Jimeng pill. Returns
+    ``(result_bgr, [labels removed])``.
 
     ``source`` is a file path OR a BGR ndarray. For a PATH, metadata provenance is read
     automatically (so ``sensitivity="auto"`` recovers a moved/faint mark whenever the
@@ -184,7 +185,7 @@ def remove_visible(
     from remove_ai_watermarks import watermark_registry
 
     # Reject a removed sensitivity loudly; `Sensitivity` is a Literal and not enforced
-    # at runtime, so a 0.15 caller would otherwise get `auto` behaviour in silence.
+    # at runtime, so a 0.15 caller would otherwise get `auto` behavior in silence.
     watermark_registry.validate_sensitivity(sensitivity)
     loaded = _load_visible_input(source)
     result, removed = watermark_registry.remove_auto_marks(
@@ -232,6 +233,7 @@ class InvisibleOptions:
 
     strength: float | None = None
     pipeline: str = "qwen-zimage"
+    vendor: str | None = None
     seed: int | None = None
     hf_token: str | None = None
     humanize: float = 0.0
@@ -487,13 +489,17 @@ def _run_invisible(
     if not is_available():
         say("invisible", "unavailable")
         return "unavailable"
-    if not (force or evidence.has_invisible_target()):
+    if not (force or opts.vendor is not None or evidence.has_invisible_target()):
         say("invisible", "no-signal")
         return "no-signal"
 
     from remove_ai_watermarks._internal.watermark_profiles import resolve_strength, vendor_for_strength
 
-    vendor = vendor_for_strength(vendor_source)
+    # An explicit vendor override wins over detection and implies the scrub runs:
+    # naming the cohort (e.g. "meta" for Muse Image Content Seal, which carries no
+    # provenance to detect) asserts the pixel watermark is present, so the no-signal
+    # gate must not skip it.
+    vendor = opts.vendor or vendor_for_strength(vendor_source)
     # Report the strength the engine will actually execute, resolved the same way it
     # resolves it, so the reported value cannot drift from the executed one.
     with suppress(Exception):

src/remove_ai_watermarks/cli.py

@@ -274,6 +274,32 @@ _strength_option = click.option(
     default=None,
     help=f"Denoising strength (0.0-1.0). Default: {strength_default_help()}.",
 )
+# Explicit strength-cohort override. Auto-detection reads the C2PA issuer, so it
+# covers OpenAI / Google / Microsoft; Meta Content Seal has no provenance signal
+# (no C2PA; the IPTC tag is a standard code), and an unknown or stripped manifest
+# also leaves the resolution-adaptive curve in charge -- this flag is the way to
+# name the cohort when the user knows what the file does not say.
+_vendor_option = click.option(
+    "--vendor",
+    type=click.Choice(["auto", "openai", "google", "microsoft", "meta"]),
+    default="auto",
+    help=(
+        "Strength cohort for the invisible-removal default, and it implies the scrub "
+        "runs even without a local signal: naming the cohort asserts the pixel "
+        "watermark is present. auto: derive from C2PA provenance, else "
+        "resolution-adaptive. Set explicitly when the source is known but unreadable "
+        "(e.g. meta for Muse Image Content Seal, which never carries C2PA)."
+    ),
+)
+
+
+def _explicit_vendor(vendor: str | None) -> str | None:
+    """Normalize --vendor's ``auto`` default to None for the engine/API seam.
+
+    One helper so the three diffusion commands cannot drift on the spelling."""
+    return None if vendor in (None, "auto") else vendor
+
+
 _seed_option = click.option(
     "--seed",
     type=int,
@@ -281,7 +307,7 @@ _seed_option = click.option(
     help="Random seed for reproducibility. Default 0: both profiles are certified "
     "at a fixed seed, because SynthID removal near the strength floor is seed-dependent.",
 )
-_hf_token_option = click.option("--hf-token", type=str, default=None, help="HuggingFace API token.")
+_hf_token_option = click.option("--hf-token", type=str, default=None, help="Hugging Face API token.")
 _humanize_option = click.option(
     "--humanize", type=float, default=0.0, help="Analog Humanizer film grain intensity (0 = off, typical: 2.0-6.0)."
 )
@@ -515,7 +541,7 @@ def _should_skip_invisible_scrub(force: bool, image_path: Path) -> bool:
 @click.option("-v", "--verbose", is_flag=True, help="Enable verbose logging.")
 @click.pass_context
 def main(ctx: click.Context, verbose: bool) -> None:
-    """Remove visible and invisible AI watermarks from images, plus provenance metadata from video."""
+    """Remove visible and invisible AI watermarks, plus metadata provenance marks, from images and video."""
     from dotenv import load_dotenv
 
     load_dotenv()  # Load .env (e.g. HF_TOKEN)
@@ -796,6 +822,7 @@ def cmd_erase(
 @click.argument("source", type=click.Path(exists=True, dir_okay=False, path_type=Path))
 @_output_option
 @_strength_option
+@_vendor_option
 @_pipeline_option
 @_seed_option
 @_hf_token_option
@@ -815,6 +842,7 @@ def cmd_invisible(
     source: Path,
     output: Path | None,
     strength: float | None,
+    vendor: str | None,
     pipeline: str,
     seed: int | None,
     hf_token: str | None,
@@ -831,7 +859,7 @@ def cmd_invisible(
     text_manifest: Path | None,
     fidelity_anchor: bool,
 ) -> None:
-    """Remove invisible AI watermarks (SynthID, StableSignature, TreeRing).
+    """Attempt to disrupt invisible AI watermarks through pixel regeneration.
 
     Regenerates the pixels with the two-stage diffusion profile. CUDA-only:
     pip install 'remove-ai-watermarks[qwen-zimage]'
@@ -851,11 +879,17 @@ def cmd_invisible(
     if output is None:
         output = source.with_stem(source.stem + "_clean")
 
+    # An explicit --vendor wins over detection (see the option help) and implies the
+    # scrub runs: naming the cohort asserts the pixel watermark is present, so the
+    # no-signal gate must not skip it. Resolved BEFORE the gate for the same reason.
+    resolved_vendor = _explicit_vendor(vendor)
+
     # Gate BEFORE building the engine: skip the destructive regeneration when no
     # invisible AI watermark is locally detectable (it would only degrade a clean
     # image -- dominant paid score-0 cause), so the common skip path pays nothing for
-    # engine construction. A skip never claims the image is clean; --force overrides.
-    if _should_skip_invisible_scrub(force, source):
+    # engine construction. A skip never claims the image is clean; --force and an
+    # explicit --vendor override.
+    if _should_skip_invisible_scrub(force or resolved_vendor is not None, source):
         _no_invisible_signal_exit(source)
 
     def progress_cb(msg: str) -> None:
@@ -870,11 +904,18 @@ def cmd_invisible(
     )
 
     # Detect the SynthID vendor from the ORIGINAL (before processing strips C2PA) so the
-    # displayed and executed strength agree on the vendor-adaptive default.
-    vendor = vendor_for_strength(source)
+    # displayed and executed strength agree on the vendor-adaptive default. An explicit
+    # --vendor override wins over detection: it names a cohort the file cannot prove
+    # (Meta Content Seal never carries C2PA; a stripped manifest proves nothing).
+    detected_vendor = vendor_for_strength(source) if resolved_vendor is None else None
+    vendor_label = resolved_vendor or detected_vendor
+    vendor_note = " (override)" if resolved_vendor else ""
     console.print(f"  Input:    {source.name}")
     console.print(f"  Pipeline: {pipeline}")
-    console.print(f"  Strength: {_resolved_strength_for_display(source, strength, vendor, pipeline)}")
+    console.print(
+        f"  Strength: {_resolved_strength_for_display(source, strength, vendor_label, pipeline)}"
+        + (f"  [vendor: {vendor_label}{vendor_note}]" if vendor_label else "")
+    )
 
     t0 = time.monotonic()
     try:
@@ -887,7 +928,7 @@ def cmd_invisible(
             unsharp=unsharp,
             adaptive_polish=adaptive_polish,
             max_resolution=max_resolution,
-            vendor=vendor,
+            vendor=vendor_label,
             tile=tile,
             tile_size=tile_size,
             tile_overlap=tile_overlap,
@@ -960,8 +1001,8 @@ def cmd_metadata(
     Strips EXIF AI tags, PNG text chunks, C2PA provenance manifests, and the
     China TC260 AIGC label. Beyond images (PNG/JPEG/WebP/AVIF/HEIF/JXL) it also
     strips provenance metadata from MP4/MOV/M4V/M4A containers and, via ffmpeg,
-    from WebM/MKV/AVI/FLV/MP3/WAV/FLAC/OGG. The coded image, audio, and video
-    data are left untouched.
+    from WebM/MKV/MKA/AVI/FLV/MP3/WAV/FLAC/OGG/OGA/Opus/AAC. The coded image,
+    audio, and video data are left untouched.
     """
     from remove_ai_watermarks.metadata import get_ai_metadata, has_ai_metadata, strip_and_verify
 
@@ -1448,6 +1489,7 @@ def cmd_identify(ctx: click.Context, source: Path, no_visible: bool, as_json: bo
 @_visible_backend_option
 @_visible_sensitivity_option
 @_strength_option
+@_vendor_option
 @_pipeline_option
 @_seed_option
 @_hf_token_option
@@ -1469,6 +1511,7 @@ def cmd_all(
     backend: str,
     sensitivity: str,
     strength: float | None,
+    vendor: str | None,
     pipeline: str,
     seed: int | None,
     hf_token: str | None,
@@ -1549,6 +1592,7 @@ def cmd_all(
             sensitivity=_parse_sensitivity(sensitivity),
             invisible=InvisibleOptions(
                 strength=strength,
+                vendor=_explicit_vendor(vendor),
                 pipeline=pipeline,
                 seed=seed,
                 hf_token=hf_token,
@@ -1643,6 +1687,7 @@ def _batch_engine(mode: str, options: InvisibleOptions) -> object | None:
 @_visible_backend_option
 @_visible_sensitivity_option
 @_humanize_option
+@_vendor_option
 @_pipeline_option
 @_seed_option
 @_hf_token_option
@@ -1660,6 +1705,7 @@ def cmd_batch(
     mode: str,
     output_dir: Path | None,
     strength: float | None,
+    vendor: str | None,
     pipeline: str,
     seed: int | None,
     hf_token: str | None,
@@ -1697,6 +1743,7 @@ def cmd_batch(
 
     invisible_options = InvisibleOptions(
         strength=strength,
+        vendor=_explicit_vendor(vendor),
         pipeline=pipeline,
         seed=seed,
         hf_token=hf_token,

src/remove_ai_watermarks/dwt_dct.py

@@ -97,7 +97,7 @@ class _DecodeMaxDct:
         return decoded
 
     def _plane_bits(self, trimmed: NDArray[Any], channel: int, scale: int) -> NDArray[Any]:
-        """Block bits for one colour plane, a strip of block-rows at a time.
+        """Block bits for one color plane, a strip of block-rows at a time.
 
         ``dwt2`` is ``dwtn``: it transforms along axis 0, then along axis 1 over
         both halves, and three of the four bands it returns are discarded here.

src/remove_ai_watermarks/identify.py

@@ -118,8 +118,13 @@ _SYNTHID_CAVEAT = (
     "decoded (proprietary decoder). Confirm via the Gemini app or openai.com/verify."
 )
 _C2PA_UNTRUSTED_CAVEAT = (
-    "The C2PA claim signature and asset binding validate, but the signer identity is not anchored "
-    "to a trusted credential here; treat the named platform as a signed claim, not a verified identity."
+    "The C2PA claim signature and asset binding validate, but no trust anchor list is configured here, "
+    "so the signer identity was never checked against one; treat the named platform as a signed claim, "
+    "not a verified identity."
+)
+_C2PA_EXPIRED_CAVEAT = (
+    "The C2PA signing certificate has expired and no trusted timestamp establishes when the claim was "
+    "signed. The binding to these bytes still holds; only the signing time is unproven."
 )
 _C2PA_UNVALIDATED_CAVEAT = (
     "The C2PA marker was parsed without cryptographic validation; treat its origin and watermark "
@@ -130,12 +135,17 @@ _C2PA_INVALID_CAVEAT = (
     "are retained only as removal hints, not as verified provenance."
 )
 _IPTC_ONLY_CAVEAT = "The IPTC 'Made with AI' tag flags AI provenance but does not identify the specific platform."
+_CONTENT_SEAL_CAVEAT = (
+    "Meta Muse Image outputs carry the invisible Content Seal pixel watermark, which has no "
+    "local decoder; `invisible` removes it (auto when this tag is present, or `--vendor meta` "
+    "on stripped files) and meta.ai/identification verifies it."
+)
 _INVISIBLE_WM_CAVEAT = (
     "The open invisible watermark is fragile: it does not survive JPEG re-encoding "
     "or resizing, so it confirms origin only on a pristine (un-re-encoded) file."
 )
 _HF_JOB_CAVEAT = (
-    "The hf-job-id tag marks a HuggingFace-hosted job (commonly diffusion "
+    "The hf-job-id tag marks a Hugging Face-hosted job (commonly diffusion "
     "generation) but names neither the model nor the content type, so it is a "
     "medium-confidence signal, not proof the pixels are AI-generated."
 )
@@ -435,7 +445,7 @@ def evidence_from_metadata_record(
     if iptc_system:
         ai_metadata.setdefault("ai_system", f"IPTC 2025.1 AI disclosure ({iptc_system})")
     if hf_job:
-        ai_metadata.setdefault("huggingface_job", f"HuggingFace-hosted job ({hf_job})")
+        ai_metadata.setdefault("huggingface_job", f"Hugging Face-hosted job ({hf_job})")
     if samsung is not None:
         ai_metadata.setdefault("samsung_genai", f"Samsung Galaxy AI editing marker (genAIType={samsung})")
 
@@ -474,17 +484,20 @@ class ProvenanceReport:
     # an open DWT-DCT decode) -- as opposed to a visible mark, provenance-only
     # TrustMark, or a weak medium-confidence hint (hf-job, Samsung genAIType). This
     # is the set of signals an invisible/diffusion scrub targets: a visible-only
-    # or no-signal image has it False. An intact C2PA AI claim from an untrusted
-    # signer is deliberately medium-confidence while this remains True; callers
-    # should gate on intent, not on the confidence string.
+    # or no-signal image has it False. Callers should gate on intent, not on the
+    # confidence string.
     ai_from_metadata: bool = False
     watermarks: list[str] = field(default_factory=list[str])
     signals: list[Signal] = field(default_factory=list["Signal"])
     caveats: list[str] = field(default_factory=list[str])
     # Contradictions between independent provenance signals (e.g. two different
     # AI vendors both claiming the image, or camera-capture credentials next to
-    # AI-generation markers). Non-empty means the provenance is internally
-    # inconsistent -- a strong tell of spoofed, transplanted, or laundered metadata.
+    # AI-generation markers), and credentials that failed validation. Non-empty means
+    # the provenance is internally inconsistent -- a strong tell of spoofed,
+    # transplanted, or laundered metadata. A failed credential sends
+    # ``is_ai_generated`` to None and lands here instead, so a consumer that reads
+    # only the verdict field turns a broken AI manifest into silence; see the
+    # ``integrity_clashes`` note in docs/python-api.md.
     integrity_clashes: list[str] = field(default_factory=list[str])
     # Orthogonal C2PA checks. A valid content binding does not make an untrusted
     # signer identity trusted, and an expired credential does not by itself mean the
@@ -547,15 +560,16 @@ def _c2pa_validation(info: dict[str, Any]) -> dict[str, Any] | None:
 
 
 def _c2pa_credential_level(info: dict[str, Any]) -> str:
-    """Return invalid, verified, or unverified for provenance attribution."""
+    """Return invalid, verified, or unverified for provenance attribution.
+
+    ``verified`` means the reader tied this manifest to these bytes: the hard binding
+    matched and the claim signature validated. Signer trust is deliberately NOT a
+    condition -- no trust anchors ship, so gating on it made this branch unreachable.
+    Read the trust-anchor paragraph in docs/module-internals.md before changing this.
+    """
     if c2pa_info_has_invalid_credential(info):
         return "invalid"
-    if (
-        info.get("c2pa_integrity") == "valid"
-        and info.get("c2pa_signature") == "valid"
-        and info.get("c2pa_signer_trust") == "trusted"
-        and info.get("c2pa_signer_validity") == "valid"
-    ):
+    if info.get("c2pa_integrity") == "valid" and info.get("c2pa_signature") == "valid":
         return "verified"
     return "unverified"
 
@@ -939,7 +953,7 @@ def _visible_sparkle(image_path: Path, *, image: NDArray[Any] | None = None) ->
 # metadata label); the per-engine detection thresholds live in the registry.
 # Text mark -> the platform sentence this report prints when that mark is the strongest
 # evidence, DERIVED from the registry rows so registering a mark is one edit. It was a
-# hand-maintained copy, and that class of copy is how LibLibAI ended up registered but
+# hand-maintained copy, and that class of copy is how LiblibAI ended up registered but
 # missing from the pill veto. Insertion order is the registry's, which is what fixes the
 # scan order below. The Gemini sparkle and the capture-less pill carry no platform of
 # their own (`KnownMark.platform is None`) and are excluded here: the sparkle has its
@@ -1091,7 +1105,7 @@ def _collect_visible_signals(
     sparkle_conf = _visible_sparkle(image_path, image=image)
     if sparkle_conf is not None and sparkle_conf >= _SPARKLE_THRESHOLD:
         signals.append(Signal("visible_sparkle", f"NCC confidence {sparkle_conf:.2f}", "medium"))
-        watermarks.append(f"Visible Gemini sparkle (confidence {sparkle_conf:.2f})")
+        watermarks.append(f"Google Gemini visible watermark (sparkle; confidence {sparkle_conf:.2f})")
         if platform is None:
             platform = "Google Gemini family (visible sparkle detected)"
 
@@ -1148,11 +1162,9 @@ def _identify_from_evidence(
     c2pa_validation = _c2pa_validation(info)
     c2pa_level = _c2pa_credential_level(info)
     c2pa_usable = c2pa_level != "invalid"
-    failed_c2pa_codes = [
-        str(code)
-        for code in cast("list[object]", info.get("c2pa_validation_codes", []))
-        if "mismatch" in str(code) or "invalid" in str(code)
-    ]
+    # The reader already named which failures moved a dimension; re-deriving that here
+    # by substring made the displayed reason a second, looser rule than the verdict.
+    failed_c2pa_codes = [str(code) for code in cast("list[object]", info.get("c2pa_failed_codes", []))]
     issuers = [info["issuer"]] if info.get("issuer") else _issuers_in(region)
     # Full AI generation (trainedAlgorithmicMedia) vs an AI-enhanced real photo
     # (compositeWithTrainedAlgorithmicMedia). The structured kind is parsed once in
@@ -1208,12 +1220,14 @@ def _identify_from_evidence(
                 Signal("c2pa", detail or "C2PA manifest present", "high" if c2pa_level == "verified" else "medium")
             )
             watermarks.append(f"C2PA Content Credentials ({', '.join(issuers) or 'unknown signer'})")
-            if c2pa_level == "unverified":
-                caveats.append(
-                    _C2PA_UNTRUSTED_CAVEAT
-                    if info.get("c2pa_integrity") == "valid" and info.get("c2pa_signature") == "valid"
-                    else _C2PA_UNVALIDATED_CAVEAT
-                )
+            if c2pa_level == "verified":
+                # A missing trust bundle is not a signer that failed against one.
+                if info.get("c2pa_signer_trust") != "trusted":
+                    caveats.append(_C2PA_UNTRUSTED_CAVEAT)
+                if info.get("c2pa_signer_validity") == "expired":
+                    caveats.append(_C2PA_EXPIRED_CAVEAT)
+            else:
+                caveats.append(_C2PA_UNVALIDATED_CAVEAT)
         # Record the AI-origin vendor for clash detection only when the source is
         # actually AI -- classify the issuer attribution / generator, NOT the
         # resolved `platform` (which may be a camera device token whose label,
@@ -1259,7 +1273,19 @@ def _identify_from_evidence(
     # reusing the derived `has_c2pa` / `source_kind` above, which are broader:
     # the file path's answer must not move.
     trained_source = b"trainedAlgorithmicMedia" in head or b"TrainedAlgorithmicMedia" in head
-    if not synthid and trained_source and c2pa_marker_in(head) and (vendors := synthid_evidence_vendors_in(region)):
+    # Same suppression as every other inference site: bytes that name their own
+    # forensic soft-binding algorithm carry that vendor's mark, and the generic
+    # vendor-token inference must not add a second, differently-attributed
+    # invisible watermark (Microsoft Designer: "Azure OpenAI ImageGen" agent +
+    # the InvisMark watermarked action read as "SynthID per OpenAI").
+    soft_binding_vendors = soft_binding_vendors_in(region)
+    if (
+        not synthid
+        and trained_source
+        and c2pa_marker_in(head)
+        and not soft_binding_vendors
+        and (vendors := synthid_evidence_vendors_in(region))
+    ):
         synthid = synthid_verdict(", ".join(vendors))
     if synthid:
         watermarks.append(
@@ -1274,7 +1300,7 @@ def _identify_from_evidence(
     # ── C2PA soft-binding: a named forensic/third-party watermark vendor ─
     # (Adobe TrustMark, Digimarc, Imatag, ...). Present in the manifest even when
     # the watermark itself can't be decoded; names whose watermark stamped the pixels.
-    soft_binding = meta.get("soft_binding") or (", ".join(v) if (v := soft_binding_vendors_in(region)) else None)
+    soft_binding = meta.get("soft_binding") or (", ".join(soft_binding_vendors) if soft_binding_vendors else None)
     if soft_binding:
         soft_binding_algorithm = meta.get("soft_binding_algorithm") or info.get("soft_binding_algorithm")
         soft_binding_value = meta.get("soft_binding_value") or info.get("soft_binding_value")
@@ -1308,17 +1334,38 @@ def _identify_from_evidence(
     if standalone_iptc:
         signals.append(Signal("iptc", "digitalSourceType (Made with AI)", "high"))
         watermarks.append("IPTC digitalSourceType (Made with AI)")
+        # Muse Image stamps every output with the invisible Content Seal, and this
+        # tag is the only provenance such a file carries - the same measured bet
+        # the strength router makes (vendor_for_strength -> "meta"). Emit the seal
+        # as its own stable signal, the way InvisMark is additive over
+        # soft_binding, so clients select pixel removal from the signal list
+        # instead of parsing caveats. It is an attribution, not a decode: no
+        # public Content Seal decoder exists, hence "medium".
+        signals.append(
+            Signal(
+                "content_seal",
+                "Meta Muse Content Seal pixel watermark (attributed by the standalone AI digital-source tag)",
+                "medium",
+            )
+        )
+        watermarks.append("Invisible Content Seal watermark (Meta Muse attribution)")
         caveats.append(_IPTC_ONLY_CAVEAT)
+        caveats.append(_CONTENT_SEAL_CAVEAT)
         if platform is None:
             # Apple Photos Clean Up (Apple Intelligence object removal) marks
             # the edit with photoshop:Credit / IPTC "Apple Photos Clean Up"
             # next to compositeWithTrainedAlgorithmicMedia. It was detected but
             # previously never attributed.
-            platform = (
-                "Apple Photos (Clean Up AI edit)"
-                if b"Apple Photos Clean Up" in head
-                else "Made-with-AI tag (e.g. Meta AI); platform not specified"
-            )
+            if b"Apple Photos Clean Up" in head:
+                platform = "Apple Photos (Clean Up AI edit)"
+            else:
+                # The platform line follows the same measured bet the seal signal
+                # and the strength router make: Muse Image is the tag writer whose
+                # outputs this profile targets, so a hedged Muse attribution is
+                # more useful than "platform not specified" while the panel below
+                # already prices the Content Seal removal. The hedge stays in the
+                # wording - it names the attribution basis, not a detection.
+                platform = "Meta Muse Image (attributed by the standalone AI digital-source tag)"
 
     # ── IPTC 2025.1 AI-disclosure fields (Iptc4xmpExt:AISystemUsed etc.) ─
     iptc_ai = any(m in head for m in IPTC_AI_FIELD_MARKERS)
@@ -1379,17 +1426,17 @@ def _identify_from_evidence(
             platform = "xAI (Grok / Aurora)"
         ai_vendor_claims["xai"] = "xAI"
 
-    # ── HuggingFace-hosted job marker (hf-job-id PNG text chunk) ─────
+    # ── Hugging Face-hosted job marker (hf-job-id PNG text chunk) ─────
     # Marks the hosting job, not a model -- medium confidence (commonly diffusion
     # output). Like the visible sparkle, it lifts an otherwise-Unknown verdict to
     # a tentative AI, but never overrides a high-confidence metadata signal.
     hf_job = evidence.huggingface_job
     if hf_job:
-        signals.append(Signal("hf_job", f"HuggingFace job {hf_job}", "medium"))
-        watermarks.append("HuggingFace-hosted job (hf-job-id)")
+        signals.append(Signal("hf_job", f"Hugging Face job {hf_job}", "medium"))
+        watermarks.append("Hugging Face-hosted job (hf-job-id)")
         caveats.append(_HF_JOB_CAVEAT)
         if platform is None:
-            platform = "HuggingFace-hosted job (model not identified)"
+            platform = "Hugging Face-hosted job (model not identified)"
 
     # ── Samsung Galaxy AI editing marker (genAIType) ─────────────────
     # Galaxy AI tools stamp a proprietary genAIType in PhotoEditor_Re_Edit_Data.

src/remove_ai_watermarks/invisible_engine.py

@@ -33,7 +33,7 @@ warnings.filterwarnings("ignore", category=UserWarning, module="huggingface_hub"
 warnings.filterwarnings("ignore", category=UserWarning, module="diffusers")
 warnings.filterwarnings("ignore", module="transformers")
 
-# Suppress HuggingFace internal logging
+# Suppress Hugging Face internal logging
 os.environ["TRANSFORMERS_VERBOSITY"] = "error"
 os.environ["DIFFUSERS_VERBOSITY"] = "error"
 
@@ -104,7 +104,7 @@ class InvisibleEngine:
                 global pass, vendor-adaptive strength because an SDXL global stage
                 needs more of it). BOTH ARE CUDA-ONLY -- there is no CPU or MPS path
                 for invisible-watermark removal.
-            hf_token: HuggingFace API token.
+            hf_token: Hugging Face API token.
             progress_callback: Optional callback for progress messages.
             controlnet_conditioning_scale: Canny ControlNet structure-preservation
                 strength on the global stage of both profiles.
@@ -187,9 +187,8 @@ class InvisibleEngine:
                 pixels. Enables the experimental Qwen-VAE ``vae-glyphs`` post-pass.
                 Requires the ``text-restoration`` extra and the ``qwen-zimage``
                 profile. Incompatible with downscaling, humanize, unsharp, and
-                adaptive polish. Tiling is supported: the VAE donor uses the same
-                overlapping tiles as the global pass, then glyph restore runs on
-                the blended full frame.
+                adaptive polish. Tiling is rejected because that combination has
+                no provider-oracle calibration.
             fidelity_anchor: Blend 15% of the Qwen-VAE donor across the whole frame
                 before glyph restoration. OFF by default since 0.27.1: that global
                 blend was measured to return detector-visible OpenAI SynthID on
@@ -211,6 +210,8 @@ class InvisibleEngine:
         if text_manifest is not None:
             if self._remover.model_profile != QWEN_ZIMAGE_PROFILE:
                 raise ValueError("--text-manifest is supported only by the qwen-zimage profile")
+            if tile:
+                raise ValueError("--text-manifest is not calibrated with --tile")
             if max_resolution != 0:
                 raise ValueError("--text-manifest requires --max-resolution 0")
             if humanize > 0.0 or unsharp > 0.0 or adaptive_polish:

src/remove_ai_watermarks/invisible_watermark.py

@@ -99,7 +99,7 @@ def detect_invisible_watermark(image_path: Path, *, image: NDArray[Any] | None =
 
     # ``image`` lets a caller that has already decoded these pixels hand them in
     # (mirrors gemini_engine.detect_sparkle_confidence). The decoder only reads the
-    # array -- it converts colour spaces into fresh buffers -- so no copy is needed.
+    # array -- it converts color spaces into fresh buffers -- so no copy is needed.
     img = image if image is not None else image_io.imread(image_path)
     if img is None:
         return None

src/remove_ai_watermarks/kling_engine.py

@@ -1,6 +1,6 @@
-"""Kling (可灵, Kuaishou) visible watermark detector/localizer.
+"""Kling AI (可灵AI, Kuaishou) visible watermark detector/localizer.
 
-Kling stamps its generations with a thin, light-gray "可灵AI 3.0" text strip in the
+Kling AI stamps its generations with a thin, light-gray "可灵AI 3.0" text strip in the
 bottom-right corner, preceded by the vendor's spiral logo (not part of the detection
 silhouette -- logos vary between releases, the text run is what discriminates).
 Known variants: an "Omni" suffix release, a latin "KlingAI 3.0" release, and a
@@ -9,7 +9,7 @@ suffix variants are only caught when the core run is bold enough (measured below
 
 Detection matches the bundled glyph silhouette against the corner; removal is the
 shared **localize -> fill** (the glyph-bbox :meth:`footprint_mask` feeds
-``region_eraser``), NOT reverse-alpha. This module supplies only Kling's tuned
+``region_eraser``), NOT reverse-alpha. This module supplies only Kling AI's tuned
 :class:`TextMarkConfig` (``assets/kling_alpha.png`` -- a font-rendered synthetic
 silhouette from ``scripts/render_vendor_silhouettes.py``, never cut from an
 upload). It also feeds ``identify`` as the medium-confidence ``visible_kling``
@@ -26,7 +26,7 @@ producer USCC 91110108335469089C names the entity, 2026-07-21; harness
   * ``alpha_height_frac`` comes from the silhouette aspect (0.239) at the fitted
     width, matching the aspect the fit converged on (0.25).
   * Gate 0.35, one step above the clean arm's max: on the cohort-vs-clean run
-    (cohort-contamination-guarded, 286 hand-labelled clean frames) the clean arm
+    (cohort-contamination-guarded, 286 hand-labeled clean frames) the clean arm
     scored p99 0.304 / max 0.320, and every cohort frame >= 0.35 carries a visible
     可灵AI 3.0 mark (9 of ~19 eyeballed visible marks fire = ~47% recall of visible
     marks; the misses are the faint "Omni"-suffix release, the latin "KlingAI"
@@ -38,7 +38,7 @@ producer USCC 91110108335469089C names the entity, 2026-07-21; harness
     provenance relaxation exists for this mark.
   * No rival margin: at the shipped gate the template fires on 1 of 400
     Doubao-marked frames (0.2%, a 豆包 frame sitting INSIDE the Kling cohort, still
-    below the gate), 0 of 298 Jimeng-marked frames and 0 of 286 hand-labelled clean
+    below the gate), 0 of 298 Jimeng-marked frames and 0 of 286 hand-labeled clean
     frames, and a 0.10 rival margin costs zero genuine Kling detections -- so it is
     simply unnecessary (same conclusion shape as Qwen).
 """
@@ -74,7 +74,7 @@ LOGO_MIN_LUMA = 150
 TOPHAT_DELTA = 12
 
 DETECT_MIN_COVERAGE = 0.04  # unused by the tophat front-end (kept for config parity)
-# Calibrated 2026-07-21 on the vendor cohort vs 286 hand-labelled clean frames
+# Calibrated 2026-07-21 on the vendor cohort vs 286 hand-labeled clean frames
 # (cohort-contamination-guarded): clean p99 0.304 / max 0.320, and every cohort
 # frame scoring >= 0.35 carries a visible 可灵AI 3.0 mark. 0.35 was picked over
 # 0.33 (also zero clean fires) for margin against unseen clean content at a cost
@@ -87,7 +87,7 @@ _ALPHA_WIDTH_FRAC = 0.12
 _ALPHA_HEIGHT_FRAC = 0.0287
 
 _CONFIG = TextMarkConfig(
-    name="Kling",
+    name="Kling AI",
     asset_name="kling_alpha.png",
     corner="br",
     margin_floor=4,
@@ -114,7 +114,7 @@ _CONFIG = TextMarkConfig(
 
 
 def _alpha_template() -> NDArray[Any] | None:
-    """The bundled Kling alpha template (float [0,1]), or None."""
+    """The bundled Kling AI alpha template (float [0,1]), or None."""
     return _text_mark_engine.load_alpha_template(_CONFIG.asset_name)
 
 
@@ -124,7 +124,7 @@ def _glyph_silhouette() -> NDArray[Any] | None:
 
 
 class KlingEngine(TextMarkEngine):
-    """Detect/localize the visible Kling "可灵AI 3.0" watermark (locate -> mask; mask feeds the fill)."""
+    """Detect/localize the visible Kling AI "可灵AI 3.0" watermark (locate -> mask; mask feeds the fill)."""
 
     def __init__(self) -> None:
         super().__init__(_CONFIG)

src/remove_ai_watermarks/liblib_engine.py

@@ -1,13 +1,13 @@
-"""LibLibAI visible watermark detector/localizer.
+"""LiblibAI visible watermark detector/localizer.
 
-LibLibAI (哩布哩布AI, USCC 91110105MACJ6K1C8A) stamps its generations with a
-white triangle logo + "LibLibAI" latin wordmark at **bottom-center** (not a
+LiblibAI (哩布哩布AI, USCC 91110105MACJ6K1C8A) stamps its generations with a
+white triangle logo + "LiblibAI" Latin wordmark at **bottom-center** (not a
 corner -- the locate box is horizontally centered). Detection matches the
-bundled font-rendered "LibLibAI" silhouette (the triangle logo is NOT rendered
+bundled font-rendered "LiblibAI" silhouette (the triangle logo is NOT rendered
 -- logos vary, the wordmark discriminates); removal is the shared **localize ->
 fill** (the glyph blob covers logo + wordmark, both bright).
 
-This module supplies only LibLibAI's tuned :class:`TextMarkConfig`
+This module supplies only LiblibAI's tuned :class:`TextMarkConfig`
 (``assets/liblib_alpha.png`` from ``scripts/render_vendor_silhouettes.py``,
 never cut from an upload).
 
@@ -64,7 +64,7 @@ _ALPHA_HEIGHT_FRAC = 0.026
 _LADDER = (0.9, 1.0, 1.1)
 
 _CONFIG = TextMarkConfig(
-    name="LibLibAI",
+    name="LiblibAI",
     asset_name="liblib_alpha.png",
     corner="bc",
     margin_floor=4,
@@ -90,12 +90,12 @@ _CONFIG = TextMarkConfig(
 
 
 def _alpha_template() -> NDArray[Any] | None:
-    """The bundled LibLibAI alpha template (float [0,1]), or None."""
+    """The bundled LiblibAI alpha template (float [0,1]), or None."""
     return _text_mark_engine.load_alpha_template(_CONFIG.asset_name)
 
 
 class LibLibEngine(TextMarkEngine):
-    """Detect/localize the visible LibLibAI wordmark (bottom-center; localize -> fill)."""
+    """Detect/localize the visible LiblibAI wordmark (bottom-center; localize -> fill)."""
 
     # Per-mark size floor prevents small generic icons from matching the wordmark.
     _MIN_SHORT_SIDE = 480

src/remove_ai_watermarks/metadata.py

@@ -199,7 +199,7 @@ def parse_tc260_aigc_json(value: bytes) -> dict[str, str] | None:
     return fields if TC260_AIGC_FIELDS & fields.keys() else None
 
 
-# HuggingFace-hosted GPU jobs (Jobs / Spaces) stamp generated PNGs with this
+# Hugging Face-hosted GPU jobs (Jobs / Spaces) stamp generated PNGs with this
 # ``tEXt`` chunk key holding the job UUID. It marks the hosting job, not a
 # specific model -- a medium-confidence AI signal (commonly diffusion output).
 _HF_JOB_KEY: str = "hf-job-id"
@@ -413,7 +413,7 @@ def _scan_head_impl(image_path: Path, size: int) -> bytes:
 # packet larger than this is not a provenance label.
 _DECODED_TEXT_LIMIT = 512 * 1024
 # Decoder values that are binary payloads with their own readers, not metadata text.
-# An ICC profile is colour data and can run to hundreds of kilobytes; appending it
+# An ICC profile is color data and can run to hundreds of kilobytes; appending it
 # would bloat the buffer every later detector re-scans, for no signal.
 _DECODER_BINARY_KEYS = frozenset({"icc_profile"})
 
@@ -510,7 +510,7 @@ def has_ai_metadata(image_path: Path) -> bool:
     # only the XMP form; the raw-JSON tEXt chunk needs the PIL-based parse).
     if aigc_label(image_path) is not None:
         return True
-    # HuggingFace-hosted job marker (hf-job-id PNG text chunk).
+    # Hugging Face-hosted job marker (hf-job-id PNG text chunk).
     if huggingface_job(image_path):
         return True
     # xAI / Grok: no C2PA/IPTC/XMP -- only the EXIF Signature + UUID-Artist pair.
@@ -682,10 +682,10 @@ def c2pa_cloud_manifest(image_path: Path) -> str | None:
 
 
 def _huggingface_job_impl(image_path: Path) -> str | None:
-    """Return the HuggingFace job id if the image carries an ``hf-job-id`` PNG
+    """Return the Hugging Face job id if the image carries an ``hf-job-id`` PNG
     text chunk, else None.
 
-    HuggingFace-hosted GPU jobs (Jobs / Spaces) stamp generated PNGs with an
+    Hugging Face-hosted GPU jobs (Jobs / Spaces) stamp generated PNGs with an
     ``hf-job-id`` ``tEXt`` chunk holding the job's UUID. It identifies the
     *hosting job*, not a specific model, and is most commonly seen on diffusion-
     generation output -- a medium-confidence AI signal, not proof of AI pixels
@@ -792,7 +792,7 @@ def _iptc_ai_system_impl(image_path: Path) -> str | None:
     return iptc_ai_system_in(scan_head(image_path))
 
 
-def synthid_source(image_path: Path) -> str | None:
+def synthid_source(image_path: Path, *, c2pa_info: dict[str, Any] | None = None) -> str | None:
     """Return the vendor name(s) when provenance establishes SynthID.
 
     This is provenance-based, not a local pixel decode. Google states that all
@@ -808,6 +808,8 @@ def synthid_source(image_path: Path) -> str | None:
 
     Args:
         image_path: Path to the image (PNG, JPEG, WebP, or ISOBMFF container).
+        c2pa_info: Already extracted normalized C2PA info, for callers that also need
+            another claim from the same manifest.
 
     Returns:
         Comma-joined vendor name(s) (e.g. ``"OpenAI"``) or None.
@@ -821,7 +823,7 @@ def synthid_source(image_path: Path) -> str | None:
     # Prefer the official reader's structured result. A failed asset binding or
     # signature cannot establish the claim, and the raw fallback below must not
     # resurrect it from the same damaged manifest bytes.
-    c2pa = extract_c2pa_info(image_path)
+    c2pa = extract_c2pa_info(image_path) if c2pa_info is None else c2pa_info
     if c2pa_info_has_invalid_credential(c2pa):
         return None
     vendors = c2pa.get("synthid_vendors")
@@ -837,6 +839,13 @@ def synthid_source(image_path: Path) -> str | None:
     ai_source = b"trainedAlgorithmicMedia" in data or b"TrainedAlgorithmicMedia" in data
     if not (has_c2pa and ai_source):
         return None
+    from remove_ai_watermarks._internal.c2pa import soft_binding_vendors_in
+
+    # A scan that names its own forensic soft-binding algorithm carries that
+    # vendor's mark; the generic vendor-token inference must not add a second,
+    # differently-attributed invisible watermark from the same bytes.
+    if soft_binding_vendors_in(data):
+        return None
     matched = synthid_evidence_vendors_in(data)
     return ", ".join(matched) if matched else None
 
@@ -1207,9 +1216,9 @@ def get_ai_metadata(image_path: Path) -> dict[str, str]:
     if system := iptc_ai_system(image_path):
         result.setdefault("ai_system", f"IPTC 2025.1 AI disclosure ({system})")
 
-    # HuggingFace-hosted job marker (hf-job-id PNG text chunk).
+    # Hugging Face-hosted job marker (hf-job-id PNG text chunk).
     if job := huggingface_job(image_path):
-        result.setdefault("huggingface_job", f"HuggingFace-hosted job ({job})")
+        result.setdefault("huggingface_job", f"Hugging Face-hosted job ({job})")
     # Samsung Galaxy AI editing marker (genAIType in PhotoEditor_Re_Edit_Data).
     if (genai := samsung_genai(image_path)) is not None:
         result.setdefault("samsung_genai", f"Samsung Galaxy AI editing marker (genAIType={genai})")

src/remove_ai_watermarks/microsoft_engine.py

@@ -0,0 +1,108 @@
+"""Microsoft top-right AI-badge detector/localizer.
+
+This engine covers one measured Microsoft output variant: a white pill with dark
+internal shapes in the top-right corner. The evaluated files used both "Made with
+AI" and "AI-Generated" wording. This is narrower than Microsoft's documented
+watermark feature, which can use a Copilot icon or text and can place the mark in
+other positions. A Microsoft provenance signal therefore does not establish that
+this exact visible variant is present.
+
+Detection matches a synthetic pill silhouette (white pill with the sparkle and
+text KNOCKED OUT) against the top-hat blob of the located box: the holes are what
+discriminate this pill from any other bright rounded element in the corner.
+Removal is the shared **localize -> fill**; the glyph-bbox :meth:`footprint_mask`
+covers the whole pill including its text.
+
+The tuned numbers below were remeasured on 2026-08-27 with the registered engine
+and ``scripts/registered_mark_calibrate.py``. The arms were kept distinct: 17
+visually confirmed carriers, 343 Microsoft-provenance files whose visible-mark
+status was not adjudicated, and 1200 non-overlapping no-signal controls:
+
+  * Geometry is single-mode and tight: pill 0.152 x 0.040 of the LONG side
+    (aspect 3.73-3.89 over 720..1536 px), margins ~0.010/0.007 of the same basis. One size
+    mode, so the shared 3-rung ladder is untouched and the locate box simply
+    wraps the pill with NCC slack.
+  * Provenance relaxation 0.7 (relaxed gate 0.266), enabled 2026-08-28 when the
+    cohort the strict-only note was waiting for became available: an OCR badge
+    census split the 343 Microsoft-C2PA uploads into 86 badge carriers and 257
+    true badge-less files (the watermark is a per-user opt-in, so 75% of MS
+    uploads carry none). Badge-less max 0.251 / p99 0.213, so the relaxed band
+    [0.251, 0.38) holds three genuine faint badges and zero false fills
+    (measured 3/3; doubao ships 0.7 on a 58%-precision band). Strict controls
+    max 0.293 / p99 0.200 vs the 0.38 gate.
+  * Front-end "binary": the pill is a bold opaque overlay; the tophat blob is
+    solid with dark-text holes, exactly the template's shape.
+"""
+
+# pyright: reportUnusedFunction=false
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from remove_ai_watermarks import _text_mark_engine
+from remove_ai_watermarks._text_mark_engine import TextMarkConfig, TextMarkEngine
+
+if TYPE_CHECKING:
+    from numpy.typing import NDArray
+
+# Locate geometry as a fraction of the image LONG side (measured; scale_basis="long":
+# on 1024x1536 portraits the pill tracks the 1536, and a width basis undersized
+# the template until the portrait carriers fell to 0.15-0.32 NCC).
+# The box wraps the measured pill rect (0.152W x 0.040W) with NCC slack; margins
+# sit inside the pill's own ~0.010W-right / ~0.007W-top insets.
+WM_WIDTH_FRAC = 0.170
+WM_HEIGHT_FRAC = 0.055
+MARGIN_RIGHT_FRAC = 0.004
+MARGIN_TOP_FRAC = 0.003
+
+# Glyph appearance: a bright near-white pill (luma ~245), gray-scale (sat < 60).
+MAX_SATURATION = 60
+LOGO_MIN_LUMA = 170
+TOPHAT_DELTA = 10
+
+# Calibrated 2026-08-27: non-overlapping no-signal controls (n=1200) max 0.293 /
+# p99 0.200; visually confirmed carriers (n=17) p50 0.519 / p90 0.578 / max
+# 0.579, with 15/17 above the 0.38 gate. The two misses score 0.249 and 0.315.
+DETECT_MIN_COVERAGE = 0.30  # the pill fills most of its box; content corners do not
+DETECT_NCC_THRESHOLD = 0.38
+
+# Pill silhouette geometry (fraction of width): 0.152W x 0.040W, aspect ~3.78.
+_ALPHA_NATIVE_WIDTH = 335
+_ALPHA_WIDTH_FRAC = 0.152
+_ALPHA_HEIGHT_FRAC = 0.040
+
+_CONFIG = TextMarkConfig(
+    name="Microsoft top-right AI badge",
+    asset_name="microsoft_alpha.png",
+    corner="tr",
+    margin_floor=2,
+    width_frac=WM_WIDTH_FRAC,
+    height_frac=WM_HEIGHT_FRAC,
+    margin_x_frac=MARGIN_RIGHT_FRAC,
+    margin_bottom_frac=MARGIN_TOP_FRAC,
+    max_saturation=MAX_SATURATION,
+    logo_min_luma=LOGO_MIN_LUMA,
+    tophat_delta=TOPHAT_DELTA,
+    morph_open_size=5,
+    detect_min_coverage=DETECT_MIN_COVERAGE,
+    detect_ncc_threshold=DETECT_NCC_THRESHOLD,
+    alpha_width_frac=_ALPHA_WIDTH_FRAC,
+    alpha_height_frac=_ALPHA_HEIGHT_FRAC,
+    min_gw=24,
+    detect_frontend="binary",
+    scale_basis="long",
+    provenance_ncc_factor=0.7,
+)
+
+
+def _alpha_template() -> NDArray[Any] | None:
+    """The bundled Microsoft pill template (float [0,1]), or None."""
+    return _text_mark_engine.load_alpha_template(_CONFIG.asset_name)
+
+
+class MicrosoftEngine(TextMarkEngine):
+    """Detect/localize the measured Microsoft top-right AI badge."""
+
+    def __init__(self) -> None:
+        super().__init__(_CONFIG)

src/remove_ai_watermarks/pill_engine.py

@@ -64,7 +64,7 @@ _MASK_W, _MASK_H = 0.205, 0.115  # width of W, height of W
 #
 # Measured through the PRODUCT path (the `_keep_pill` gate), not the raw detector, by
 # ``scripts/pill_gate_audit.py`` -- the raw path bypasses the gate and reads as a
-# disaster that the shipped behaviour does not have. Re-run it when the gate changes.
+# disaster that the shipped behavior does not have. Re-run it when the gate changes.
 _FLAT_TEXTURE_MAX = 6.0
 
 _silhouette: NDArray[Any] | None = None

src/remove_ai_watermarks/qwen_engine.py

@@ -23,7 +23,7 @@ whose producer USCC 91440101MA9Y9T4H7A names the entity, 2026-07-21; harness
     ratio 1.64 -- wider than the shared 3-rung ladder's 1.5625 span), so a single
     fraction on the shared ladder covers ~75% of marks and the rest land in the
     comb's collapse zone. Qwen therefore carries its OWN 2-rung ladder
-    (``TextMarkConfig.ladder``), one rung centred on each mode; the shared
+    (``TextMarkConfig.ladder``), one rung centered on each mode; the shared
     default is untouched for every other mark.
   * The mark also sits FARTHER off the corner than Doubao's box assumes (right
     margin ~0.025 vs 0.004 of the short side), so Doubao's locate box clipped the
@@ -38,7 +38,7 @@ whose producer USCC 91440101MA9Y9T4H7A names the entity, 2026-07-21; harness
     arm would be mostly false fills. No provenance relaxation exists for this
     mark.
   * No rival margin: at the shipped gate the template fires on 0 of 400
-    Doubao-marked frames, 0 of 298 Jimeng-marked frames and 0 of 286 hand-labelled
+    Doubao-marked frames, 0 of 298 Jimeng-marked frames and 0 of 286 hand-labeled
     clean frames (the shared tail correlates at ~0.22, far below the gate), while
     a 0.10 rival margin would have suppressed ~10% of genuine Qwen detections.
 """
@@ -74,7 +74,7 @@ LOGO_MIN_LUMA = 150
 TOPHAT_DELTA = 12
 
 DETECT_MIN_COVERAGE = 0.04  # unused by the tophat front-end (kept for config parity)
-# Calibrated 2026-07-21 on the vendor cohort vs 286 hand-labelled clean frames
+# Calibrated 2026-07-21 on the vendor cohort vs 286 hand-labeled clean frames
 # (cohort-contamination-guarded): clean p99 0.301 / max 0.316, and every cohort
 # frame scoring >= 0.45 carries a visible 千问AI生成 mark (86% of the eyeballed
 # visible marks fire, the misses being white-on-near-white contrast losses).

src/remove_ai_watermarks/runninghub_engine.py

@@ -32,7 +32,7 @@ whose producer USCC names the entity, harvested 2026-07-22 by
   * STRICT ONLY (``provenance_ncc_factor`` 1.0): raw gray NCC is
     contrast-DEPENDENT and the sub-gate band of a corner-anchored gray match is
     unmeasured beyond the clean arm, so no provenance relaxation exists.
-  * Gate 0.34: on 283 hand-labelled clean frames (cohort-contamination-guarded)
+  * Gate 0.34: on 283 hand-labeled clean frames (cohort-contamination-guarded)
     corner-anchored gray NCC p99 is 0.264 / max 0.304, while the 4 positives
     score 0.38-0.54. 0.34 sits above the clean max with a small margin; the
     positives are few, so the margin is deliberately thin on the recall side.
@@ -75,14 +75,14 @@ LOGO_MIN_LUMA = 150
 TOPHAT_DELTA = 12
 
 DETECT_MIN_COVERAGE = 0.04  # unused by the gray front-end (kept for config parity)
-# Calibrated 2026-07-22 on the vendor cohort vs 283 hand-labelled clean frames:
+# Calibrated 2026-07-22 on the vendor cohort vs 283 hand-labeled clean frames:
 # corner-anchored gray NCC, clean p99 0.264 / max 0.304; positives 0.38-0.54.
 DETECT_NCC_THRESHOLD = 0.34
 
 # Detection-silhouette geometry (fraction of the image width), measured on the
 # positives: mark width is ~0.320 of width on all three frame sizes (266px at 832,
 # 345px at 1080, 491px at 1536), and the NCC is razor-sharp in size (0.537 on-size,
-# 0.223 at +5.6% -- the same comb behaviour Qwen measured), so the nominal sits
+# 0.223 at +5.6% -- the same comb behavior Qwen measured), so the nominal sits
 # exactly on the measured size with a TIGHT ladder around it, not the shared 3 rungs
 # (whose nearest rung landed 5.6% off and collapsed the match to 0.22).
 _ALPHA_WIDTH_FRAC = 0.32

src/remove_ai_watermarks/video.py

@@ -1,8 +1,8 @@
 """High-level video processing API.
 
 The product path covers provenance identification, container-level AI metadata
-removal, temporally stabilized visible Sora, Veo, Seedance, Dola, Hailuo, and
-Kling removal, and an oracle-certified opt-in VAE profile for video SynthID.
+removal, temporally stabilized visible Sora, Veo, Seedance, Dola, Hailuo AI, and
+Kling AI removal, and an oracle-certified opt-in VAE profile for video SynthID.
 The visible pixel path reuses the image package's shared fill backends.
 """
 
@@ -179,8 +179,8 @@ _VISIBLE_PLATFORM = {
     "veo": "Google Veo",
     "seedance": "ByteDance Seedance",
     "dola": "ByteDance Dola",
-    "hailuo": "MiniMax Hailuo",
-    "kling": "Kuaishou Kling",
+    "hailuo": "MiniMax Hailuo AI",
+    "kling": "Kuaishou Kling AI",
 }
 
 

src/remove_ai_watermarks/video_visible.py

@@ -4,8 +4,8 @@ Supported marks use fully synthetic silhouettes made from geometric primitives,
 OpenCV's built-in font, and Pillow's bundled font. Sora detection searches the
 full frame because the wordmark moves. Veo detection covers both the current
 four-point diamond and legacy ``Veo`` text. Seedance detects the boxed ``AI``
-label, Dola detects its compact text label, Hailuo detects the composite
-MINIMAX/Hailuo label, and Kling detects its version-independent wordmark core.
+label, Dola detects its compact text label, Hailuo AI detects the composite
+MINIMAX/Hailuo AI label, and Kling AI detects its version-independent wordmark core.
 A single frame is never enough to authorize removal: the temporal arbiter
 requires the candidate to recur at the same location across adjacent frames.
 This keeps isolated lookalikes in clean videos from becoming removal masks.

src/remove_ai_watermarks/watermark_registry.py

@@ -17,17 +17,18 @@ localizer stays cheap (cv2/numpy, CPU) so a memory-tight caller can run it on a
 small worker; the heavy fill (MI-GAN / LaMa) is opt-in and chosen by the caller.
 
 Entries:
-  - ``gemini`` -- Google Gemini / Nano Banana sparkle, bottom-right.
+  - ``gemini`` -- Google Gemini / Nano Banana visible watermark (sparkle), bottom-right.
   - ``doubao`` -- ByteDance Doubao "豆包AI生成" text strip, bottom-right.
   - ``jimeng`` -- ByteDance Jimeng / Dreamina "★ 即梦AI" wordmark, bottom-right.
-  - ``qwen`` -- Alibaba Qwen "千问AI生成" text strip, bottom-right.
-  - ``kling`` -- Kuaishou Kling "可灵AI 3.0" text strip, bottom-right.
+  - ``qwen`` -- Alibaba Cloud Qwen "千问AI生成" text strip, bottom-right.
+  - ``kling`` -- Kuaishou Kling AI "可灵AI 3.0" text strip, bottom-right.
   - ``yuanbao`` -- Tencent Yuanbao "元宝 / AI生成" two-line mark, bottom-right.
   - ``samsung`` -- Samsung Galaxy AI "Contenuti generati dall'AI" strip, bottom-left.
   - ``jimeng_pill`` -- Jimeng-basic "AI生成" pill, top-left (capture-less).
   - ``runninghub`` -- RunningHub "RunningHub AI生成" text, top-left (gray front-end).
   - ``baidu`` -- Baidu "百度 AI生成" text + white tag, bottom-right.
-  - ``liblib`` -- LibLibAI "LibLibAI" wordmark, bottom-center.
+  - ``liblib`` -- LiblibAI "LiblibAI" wordmark, bottom-center.
+  - ``microsoft`` -- one measured Microsoft white AI-badge variant, top-right.
 """
 
 from __future__ import annotations
@@ -147,7 +148,7 @@ _REMOVED_SENSITIVITIES = {
         "vendor made it or where the mark is. If you can see a mark the detector missed, "
         "act on what you see: erase(image, region=(x, y, w, h)), or the CLI "
         "`--mark <name> --no-detect` for a known text mark. Use sensitivity='auto' for "
-        "the default evidence-driven behaviour."
+        "the default evidence-driven behavior."
     )
 }
 
@@ -156,7 +157,7 @@ def validate_sensitivity(value: str) -> Sensitivity:
     """Reject a removed sensitivity LOUDLY instead of silently falling back to ``auto``.
 
     ``Sensitivity`` is a ``Literal``, which is not enforced at runtime, so a caller
-    upgrading from 0.15 would pass ``"assume_ai"`` and quietly get ``auto`` behaviour --
+    upgrading from 0.15 would pass ``"assume_ai"`` and quietly get ``auto`` behavior --
     a silent semantic change on the one release where they most need to be told.
     """
     if value in _REMOVED_SENSITIVITIES:
@@ -368,7 +369,7 @@ _GEMINI_AUTO_MIN_CONF = GEMINI_SPARKLE_TRUST_CONF
 # that never had a mark rather than on moved ones.
 #
 # Measured blind on 954 unique Google-metadata uploads (detector never saw the
-# metadata), hand-labelled against a two-sided control (labeller sensitivity ~88%,
+# metadata), hand-labeled against a two-sided control (labeler sensitivity ~88%,
 # specificity 100%). "Additions" = accepted with provenance but not without:
 #
 #   band         precision   95% CI    population
@@ -409,6 +410,7 @@ _ENGINE_CLASS: dict[str, tuple[str, str]] = {
     "runninghub": ("runninghub_engine", "RunningHubEngine"),
     "baidu": ("baidu_engine", "BaiduEngine"),
     "liblib": ("liblib_engine", "LibLibEngine"),
+    "microsoft": ("microsoft_engine", "MicrosoftEngine"),
 }
 
 
@@ -485,7 +487,14 @@ def fill(image: NDArray[Any], mask: NDArray[Any], *, backend: Backend = "auto")
 def _gemini_wrap(d: Any, *, provenance: bool) -> MarkDetection:
     gate = _GEMINI_PROVENANCE_MIN_CONF if provenance else _GEMINI_AUTO_MIN_CONF
     detected = bool(d.detected) and d.confidence >= gate
-    return MarkDetection("gemini", "Google Gemini sparkle", "bottom-right", detected, d.confidence, d.region)
+    return MarkDetection(
+        "gemini",
+        "Google Gemini visible watermark (sparkle)",
+        "bottom-right",
+        detected,
+        d.confidence,
+        d.region,
+    )
 
 
 def _gemini_detect(image: NDArray[Any], *, provenance: bool = False) -> MarkDetection:
@@ -561,12 +570,14 @@ def _text_mark(
     label_regime: str | None = "tc260",
     provenance_signals: tuple[str, ...] = ("aigc",),
     tc260_producer_codes: tuple[str, ...] = (),
+    provenance_platform_tokens: tuple[str, ...] = (),
 ) -> KnownMark:
     """Build a text-mark registry row from its shared detector and mask adapters.
 
     ``product`` defaults to the key (one mark, one product); pass it only when two
     marks share a product. ``label_regime`` and ``provenance_signals`` default to the
-    China-AIGC label because every text mark registered so far except Samsung uses it.
+    China-AIGC label because every text mark registered so far except Samsung and
+    Microsoft uses it.
     """
     return KnownMark(
         key,
@@ -580,6 +591,7 @@ def _text_mark(
         _text_mark_mask(key),
         provenance_signals=provenance_signals,
         tc260_producer_codes=tc260_producer_codes,
+        provenance_platform_tokens=provenance_platform_tokens,
         _detect_both=_text_mark_detect_both(key, label, location),
     )
 
@@ -616,11 +628,11 @@ def _pill_features(image: NDArray[Any]) -> dict[str, float]:
 
 
 _REGISTRY: tuple[KnownMark, ...] = (
-    # Gemini is a Google C2PA/SynthID product, not a China-AIGC labeller: label_regime
+    # Gemini is a Google C2PA/SynthID product, not a China-AIGC labeler: label_regime
     # is None so it can never act as a TC260 sibling in _keep_pill.
     KnownMark(
         "gemini",
-        "Google Gemini sparkle",
+        "Google Gemini visible watermark (sparkle)",
         "bottom-right",
         True,
         "gemini",
@@ -651,14 +663,14 @@ _REGISTRY: tuple[KnownMark, ...] = (
         "qwen",
         "Qwen 千问AI生成 text",
         "bottom-right",
-        platform="Alibaba Qwen (visible 千问AI生成 mark detected)",
+        platform="Alibaba Cloud Qwen (visible 千问AI生成 mark detected)",
         tc260_producer_codes=("91440101MA9Y9T4H7A",),
     ),
     _text_mark(
         "kling",
-        "Kling 可灵AI 3.0 text",
+        "Kling AI 可灵AI 3.0 text",
         "bottom-right",
-        platform="Kuaishou Kling (visible 可灵AI 3.0 mark detected)",
+        platform="Kuaishou Kling AI (visible 可灵AI 3.0 mark detected)",
         tc260_producer_codes=("91110108335469089C",),
     ),
     _text_mark(
@@ -693,11 +705,23 @@ _REGISTRY: tuple[KnownMark, ...] = (
     ),
     _text_mark(
         "liblib",
-        "LibLibAI wordmark",
+        "LiblibAI wordmark",
         "bottom-center",
-        platform="LibLibAI (visible LibLibAI mark detected)",
+        platform="LiblibAI (visible LiblibAI mark detected)",
         tc260_producer_codes=("91110105MACJ6K1C8A",),
     ),
+    # One measured Microsoft visible-mark variant: a white top-right pill with
+    # dark internal shapes. Microsoft's documented feature also permits other
+    # icon, text, and placement variants, which this detector does not cover.
+    _text_mark(
+        "microsoft",
+        "Microsoft top-right AI badge",
+        "top-right",
+        label_regime=None,
+        provenance_signals=(),
+        platform="Microsoft (visible top-right AI badge detected)",
+        provenance_platform_tokens=("microsoft",),
+    ),
     # Same product as the Jimeng wordmark -- the one pair that cross-relaxes.
     KnownMark(
         "jimeng_pill",
@@ -794,7 +818,7 @@ def tc260_producer_vendors() -> dict[str, str]:
 def _pill_suppressors() -> set[str]:
     """Marks whose detection vetoes the capture-less pill: same label regime as the
     pill, different product. Derived so a newly registered TC260 mark cannot be
-    forgotten here -- which is exactly how LibLibAI ended up missing."""
+    forgotten here -- which is exactly how LiblibAI ended up missing."""
     pill = get_mark("jimeng_pill")
     return {
         m.key
@@ -822,9 +846,9 @@ def _keep_pill(keys: set[str], *, provenance: frozenset[str], footprint_flat: bo
     No confirmation at all -> never remove (blocks false fires on non-Jimeng content).
 
     The suppressor set is DERIVED from the registry (same label regime, different
-    product), not hand-listed. The hand-written list had drifted: LibLibAI was
+    product), not hand-listed. The hand-written list had drifted: LiblibAI was
     registered alongside RunningHub and Baidu but never added to it, so a confident
-    LibLibAI detection did not veto the pill the way its two siblings did. Marks
+    LiblibAI detection did not veto the pill the way its two siblings did. Marks
     outside the TC260 regime (Gemini, Samsung) are deliberately NOT suppressors --
     neither can put ``"jimeng"`` into ``provenance``, so neither can enable the arm
     they would be vetoing."""

tests/test_cli.py

@@ -228,8 +228,8 @@ class TestVisibleCommand:
         # The transparent corners must remain transparent.
         assert out[0, 0, 3] == 0
         assert out[199, 199, 3] == 0
-        # The opaque centre remains opaque (the watermark region default is bottom-right,
-        # which doesn't overlap the centre square at 200x200).
+        # The opaque center remains opaque (the watermark region default is bottom-right,
+        # which doesn't overlap the center square at 200x200).
         assert out[100, 100, 3] == 255
 
     def test_visible_keeps_alpha_opaque_in_watermark_region(self, runner, tmp_path):
@@ -426,6 +426,39 @@ class TestInvisibleCommand:
         assert result.exit_code == 0, result.output
         mock_engine.remove_watermark.assert_called_once()
 
+    def test_invisible_explicit_vendor_implies_force_and_sets_cohort(self, runner, sample_png, tmp_path):
+        """--vendor meta names a cohort the file cannot prove (Content Seal carries
+        no C2PA), so it must both bypass the no-signal skip and arrive at the engine
+        as the vendor, where it resolves to the measured Meta floor (not the
+        area-curve value the same size would otherwise get)."""
+        mock_cls, mock_engine = _mock_invisible_engine()
+        output = tmp_path / "clean.png"
+        with (
+            patch("remove_ai_watermarks.invisible_engine.is_available", return_value=True),
+            patch("remove_ai_watermarks.cli.InvisibleEngine", mock_cls, create=True),
+            patch("remove_ai_watermarks.invisible_engine.InvisibleEngine", mock_cls),
+        ):
+            result = runner.invoke(main, ["invisible", str(sample_png), "-o", str(output), "--vendor", "meta"])
+        assert result.exit_code == 0, result.output
+        kwargs = mock_engine.remove_watermark.call_args.kwargs
+        assert kwargs["vendor"] == "meta"
+        assert "0.1" in result.output  # the resolved Meta floor, printed
+        assert "0.094" not in result.output  # not the sample's area-curve value (200x200 -> ~0.0944)
+
+    def test_invisible_vendor_auto_keeps_detection_semantics(self, runner, sample_png, tmp_path):
+        """--vendor auto is the default spelled out: detection still runs and a
+        no-signal file still skips."""
+        mock_cls, mock_engine = _mock_invisible_engine()
+        output = tmp_path / "clean.png"
+        with (
+            patch("remove_ai_watermarks.invisible_engine.is_available", return_value=True),
+            patch("remove_ai_watermarks.cli.InvisibleEngine", mock_cls, create=True),
+            patch("remove_ai_watermarks.invisible_engine.InvisibleEngine", mock_cls),
+        ):
+            result = runner.invoke(main, ["invisible", str(sample_png), "-o", str(output), "--vendor", "auto"])
+        assert result.exit_code == 2, result.output
+        mock_engine.remove_watermark.assert_not_called()
+
     def test_invisible_runs_without_force_when_signal_present(self, runner, tmp_path):
         """An image carrying an AI metadata signal IS a scrub target, so the run
         proceeds with no --force needed."""

tests/test_contentseal_corpus.py

@@ -0,0 +1,69 @@
+"""Tests for the Content Seal oracle corpus layout.
+
+Mirrors the synthid corpus guard: the manifest is the source of truth for
+which binaries exist, and every recorded hash must match the file it names.
+Derived rows are recipes, not stored files, so only originals are checked
+against disk.
+"""
+
+from __future__ import annotations
+
+import csv
+import hashlib
+import re
+from pathlib import Path
+
+CORPUS_DIR = Path(__file__).resolve().parent.parent / "data" / "contentseal"
+MANIFEST = CORPUS_DIR / "manifest.csv"
+ORIGINALS = CORPUS_DIR / "originals"
+
+_SHA256 = re.compile(r"^[0-9a-f]{64}$")
+_VALID_VERDICTS = {"detected", "not_detected", ""}
+_VALID_ORIGINS = {"meta-model-api", "derived", "meta-blog-cdn", "synthetic-local"}
+
+
+def _manifest_rows() -> list[dict[str, str]]:
+    with open(MANIFEST, newline="") as f:
+        return list(csv.DictReader(f))
+
+
+def test_manifest_original_rows_match_binaries_and_hashes() -> None:
+    rows = [r for r in _manifest_rows() if r["file"]]
+    stored = {path.name for path in ORIGINALS.iterdir() if path.is_file()}
+    assert {r["file"].removeprefix("originals/") for r in rows} == stored
+
+    for row in rows:
+        digest = hashlib.sha256((CORPUS_DIR / row["file"]).read_bytes()).hexdigest()
+        assert digest == row["sha256"], row["file"]
+
+
+def test_manifest_rows_are_well_formed() -> None:
+    rows = _manifest_rows()
+    assert len({row["sha256"] for row in rows}) == len(rows), "duplicate sha256"
+
+    for row in rows:
+        assert _SHA256.match(row["sha256"]), row["name"]
+        assert row["origin"].split(":")[0] in _VALID_ORIGINS, row["name"]
+        assert row["oracle_verdict"] in _VALID_VERDICTS, row["name"]
+        # Every oracle verdict must carry its check timestamp.
+        if row["oracle_verdict"]:
+            assert row["checked_at_utc"], row["name"]
+        # Detection rows must name the oracle attribution.
+        if row["oracle_verdict"] == "detected":
+            assert "Muse Image 1" in row["oracle_attribution"], row["name"]
+
+
+def test_default_pipeline_clearance_is_recorded() -> None:
+    """The verified claim that the default profile clears Content Seal must stay."""
+    rows = {row["name"]: row for row in _manifest_rows()}
+    for name in ("fox_modal_invisible", "text_modal_invisible"):
+        assert rows[name]["oracle_verdict"] == "not_detected", name
+
+
+def test_deterministic_transforms_reproduce_recorded_hashes(tmp_path: Path) -> None:
+    from scripts.contentseal_transforms import reproduce_transforms
+
+    outputs = reproduce_transforms(tmp_path)
+
+    assert len(outputs) == 8
+    assert all(path.is_file() for path in outputs)