When Is an LLM Code Audit Done? Estimating Audit Completeness with Capture-Recapture over Diverse LLM Lenses

Reproduction artefacts for the paper "When Is an LLM Code Audit Done? Estimating Audit Completeness with Capture-Recapture over Diverse LLM Lenses" (submitted to the Journal of Systems and Software). VSAT runs several deliberately diverse LLM audit lenses over one codebase, treats each as a capture occasion, and reports an incidence-based Chao2 completeness estimate C_hat with its 95% confidence interval and deduplication sensitivity, together with a structural coverage term over an OWASP ASVS ledger. C_hat is reported as an estimate with stated sensitivity, not as a calibrated bound, and the saturation signal is a decision-support indicator, not a stopping rule. The package contains the merged incidence matrices of the main study and of all 26 injection-study runs, computed metrics with confidence intervals, the estimator and analysis scripts, a self-contained recompute.py that regenerates every estimator-derived table without network access, the ASVS ledgers that determine the structural coverage term, run provenance (which corpus each study audited), the injection answer keys and matcher, and the current manuscript PDF. v3.1 (2026-09-24): single-pass and union counts placed in the same merged unit; ASVS ledgers added; manuscript PDF replaced by the revised version; superseded Japanese PDF removed. v3 (2026-09-24): canonical Chao2 with the (T-1)/T factor and 95% log-normal confidence intervals; per-run incidence matrices; provenance record; recompute.py. v3.2 (2026-09-24): manuscript retitled and reformatted for submission to the Journal of Systems and Software (JSS Open Science Initiative); data and scripts unchanged from v3.1; record-level README replaced.