A related-work pass for October 2026: what is new, what is taken, and what the design adds¶

Four independent searches (RQ1's neighbours, RQ2's attacks and defences, methodology, and the federated-agents framing), each reading what this log, the intake file and the bibliography already hold, verifying every identifier and reading the closest works in full.

RQ1. Nothing found pre-empts the decomposition (own half against sibling half against a foreign organization, on review-driven refinement, over repeated partitions). One sentence of the Stage 1 background is false: Giagnorio, Martin-Lopez and Bavota (TOSEM 35(1), 2025, doi 10.1145/3725732, read in full) fine-tune per organization for code completion (Apache, Spring, 136 developers). The organization-tuned model beats the generic one by 7.84 and 2.84 exact-match points on average, and in a separate comparison organization data beats generic data of equal size, with developer data finer still. They hold no project out and test no foreign organization. An in-house model resolves more review comments than a general one (MetaMateCR, arXiv:2507.13499: 67.96% against GPT-4o's 59.22% exact match on 206 examples), without separating conventions from ability; Google's deployed resolver (Frömmgen et al., ICSE-SEIP 2024) is cited for deployment, not for that comparison. Rules files are measured on task success and instruction following (Gloaguen et al., arXiv:2602.11988v3: developer-written files +2.4%, not significant; generated ones slightly negative), not on whether code follows a team's conventions.

RQ2. Nothing pre-empts the claim that a split design's transmitted half identifies its source. The nearest are user inference on the final model (Kandpal et al., EMNLP 2024; AUROC 0.88 with users as Enron senders, 0.66 as news domains), update re-linking by clustering (Xu et al., ECAI 2023), and a theorem that source inference falls to chance once only sums are released (Athanasiou et al., ICLR 2026). This log's aggregate results fall outside its assumptions, since there the server knows which clients took part in each round. FedRand attacks its own shared half at the record level, so the claim is narrowed to source.

Methodology. The LLM-in-SE guidelines (Baltes et al., arXiv:2508.15503, accepted at EMSE) ask for model versions, configuration, prompts and run dates to be reported; the Stage 1 report gains them, with the training budget. About one exact-match failure in six is a correct rewrite (15.7% and 17.4% of non-matching predictions, Tufano et al., TSE 2024), which could differ by arm, so "conservative for a difference" is withdrawn and a Stage 2 audit is registered. The crossed interval is Owen's pigeonhole bootstrap (Annals of Applied Statistics 2007), and the three verdicts are conditional equivalence testing (Campbell and Gustafson, PLOS ONE 2018); both are now cited by name. Campbell and Gustafson set the margin at the smallest effect of interest; this design's margin is each cell's detectable effect, a choice the report states. The label audit has a single human rater, where the guidelines' example procedure uses two or three; reported as a limitation.

Framing. A shared-and-private split of agent knowledge is no longer new: Federated Agent Optimization (Yang et al., arXiv:2610.01195, 2026-10-01) defines the field, and FedWorld (arXiv:2608.01561), ShareMem and FederatedSkill each split rules, memories or skills into shared and private, by server evidence or an LLM's judgment, not declared by the owner from provenance. What remains unclaimed, after reading the closest in full: the boundary declared by the data owner before training, by each example's provenance; tacit review conventions as what is learned, with a measured test of where learning stops transferring; and attributing the shared part to its source as the privacy audit.

Added to the design, all exploratory and before the seal: a rules-file comparator and retrieval at k = 1 and 3 (registered decisions), the Stage 2 exact-match audit, a renamed-identifier exposure check, and for RQ2 a direct test of the aggregation theorem, user inference as the final-model baseline and stronger learned attackers (ROADMAP).