Heuristic Detail — All 16 Catalog Entries Broken Down

Each heuristic below has a fixed five-part structure: what it is, why it matters, data required, detection (rule statement), and false positives to suppress. Weights match README.md. The catalog total is 38.

The first seven heuristics were derived from Cane-scheme work (2001–2010); heuristics 8, 10, 15, 16 are new, surfaced by 2024–2026 cases; heuristics 9, 12, 13, 14 require body-text scanning.

H1. name_recycling (weight 3)

• What. Two or more corporate-identity changes on a single SEC-registered CIK.
• Why. Public-company name changes are rare, costly, and require board approval; serial use signals that the registrant is a vehicle, not an operating company. Cane reused CIK 878146 through three identities (Tele-Lawyer → Dynamic Associates → LATI) in nine years.
• Data. data.sec.gov/submissions/CIK<n>.json → formerNames[].
• Detection. formerNames.length >= 2. Earliest trip date = formerNames[1].from.
• False positives. Bona-fide M&A name changes following S-4. Suppress when an S-4 or DEFM14A precedes the name change by < 180 days.

H2. shell_reactivation (weight 3)

• What. A dormant CIK comes back to life with a registration-class filing.
• Why. Shell-mill operators buy expired registrants for the CIK number alone — the issuer's clean SEC history is the product. Sedona Software Solutions and SDI shells followed this pattern.
• Data. filings.recent.filingDate[] plus filings.recent.form[].
• Detection. Any filing-date gap > 24 months between consecutive entries, followed by a form in {S-1, 1-A, 1-A/A, 8-K}.
• False positives. Operating companies in distress that go quiet then resume reporting. Suppress when the post-gap form is 10-K or 10-K/A (the registrant simply resumed periodics).

H3. reverse_merger_chain (weight 3)

• What. The classic Item-5.06 → 2.01 → 5.03 cluster: shell-status change, asset acquisition, articles amendment.
• Why. This is the textbook reverse-merger sequence used to launder a shell into a "live" target without going through an S-1 underwritten offering. MW Medical / Davi Skin used this exact pattern.
• Data. filings.recent.form[] and the 8-K item codes (in the primaryDocument or accession header).
• Detection. Within any 90-day window: one 8-K Item 5.06, one 8-K Item 2.01, one 8-K Item 5.03. Also fires on any of 8-K12G3 / S-4 / DEFM14A.
• False positives. Legitimate carve-outs and spin-offs. Suppress when the issuer's pre-event market cap exceeds $100M (large-cap restructurings).

H4. penny_stock_s1_s8 (weight 2)

• What. S-8 employee/consultant benefit-plan registration filed within 12 months of an S-1.
• Why. S-8 is the canonical free-trading-stock vehicle for insiders and consultants. On microcap issuers it is frequently used to compensate (and then dump through) promoters. LVGI and LATI both ran this pattern.
• Data. filings.recent.form[] plus dates.
• Detection. Any S-8 or S-8 POS filed within 365 days after the S-1's effective date.
• False positives. Legitimate equity-comp plans at venture-stage operating companies. Suppress when total S-8 share registration is < 5% of the post-S-1 float.

H5. late_filer_cluster (weight 2)

• What. Three or more notification-of-inability-to-file forms in a 24-month window.
• Why. Chronic late filing precedes accounting fraud, going-dark events, and Section-16 enforcement. LATI's NT 10-K cluster preceded Form-5 backdating.
• Data. filings.recent.form[] + dates.
• Detection. Count of NT 10-K or NT 10-Q in any rolling 24-month window ≥ 3.
• False positives. Single-event filers who file one or two NTs around a real transition (merger, restatement). Suppress on a single NT or NT-pair.

H6. going_dark_blackout (weight 2)

• What. Termination-of-registration form filed within 12 months of the last periodic.
• Why. Issuers go dark to escape SEC reporting just before or just after enforcement attention. LATI and SDI both did this.
• Data. filings.recent.form[] + dates.
• Detection. Any of 15-12G / 15-12B / 15-15D filed where the most recent 10-K or 10-Q is within 12 months.
• False positives. Legitimate going-private transactions (preceded by an SC 13E-3 or DEFM14A). Suppress when SC 13E-3 precedes the 15-series by < 180 days.

H7. filer_agent_overlap (weight 3)

• What. Accession-number prefix CIK matches a known shell-mill filer-agent.
• Why. Shell-mill operators concentrate filings through a small set of agent CIKs (Cane Clark LLP, O'Neill Taylor LLC, Loev Law). The agent CIK is the cheapest, highest-confidence cross-issuer signal in the catalog.
• Data. First 10 digits of the accession number; static dictionary lookup.
• Detection. parseInt(accession.split('-')[0]) in known_agent_set.
• False positives. Near zero when the dictionary is curated. The dictionary itself is the maintenance burden — currently Cane-scheme-only, needs a 2017–2025 refresh (see analysis.md §4.5).

H8. form_d_only_issuer (weight 3) — NEW

• What. Lifetime EDGAR footprint is one or a small number of Form D filings with no S-1, no periodics, no 8-K.
• Why. The Reg-D exemption is meant for issuers that will not become public; using a Form D as the entire SEC-facing footprint for a material capital raise abuses the exemption regime as a one-way valve. SGR Energy raised $21.3M this way.
• Data. filings.recent.form[] distribution.
• Detection. count(form == "D" or form == "D/A") >= 1 AND count(form in {S-1, 10-K, 10-Q, 1-A, 8-K}) == 0 AND total filings ≤ 5.
• False positives. Private-equity SPVs that raise via Reg D and never go public. Pair with heuristic 16 and a dollar-amount threshold (≥ $1M offering size) to suppress noise.

H9. reg_s_issuance (weight 2) — body-text tier

• What. Regulation-S offshore tranches issued under Rule 904 to non-U.S. persons.
• Why. Reg S was a recurring Cane-scheme mechanic (LATI, Sedona) for issuing free-trading shares offshore that washed back into U.S. markets after the 40-day distribution-compliance period. The catalog producer flagged/reg_s_issuance.ndjson is 102 MB of candidate hits.
• Data. Primary-document text of S-1, 10-K, 10-Q, 8-K. Body-text tier.
• Detection. Three-layer scoring (per docs/application/heuristics.md): Presence 0.3 (regex Reg(ulation)? S or Rule 904) + Offshore 0.3 (non-U.S. persons or jurisdiction names) + Distribution 0.4 (share-count number within 200 characters). Capped at 1.0.
• False positives. Boilerplate "may include Reg-S offerings" in risk-factor sections. Presence-only hits with no distribution number score 0.3 and should not trip the heuristic alone.

H10. reg_a_offering (weight 2) — NEW

• What. Form 1-A or 1-A/A filed on a long-dormant shell with few prior filings.
• Why. Reg-A+ was designed for emerging companies needing public capital without S-1 cost; appearing on a dormant shell is the inverse of the intended use. GP Solutions filed 1-A after 11.7 years of dormancy.
• Data. filings.recent form + date distribution.
• Detection. form in {1-A, 1-A/A} AND prior gap ≥ 5 years AND prior lifetime filings ≤ 5.
• False positives. Brand-new CIK with 1-A as the first filing (no dormancy, so heuristic does not fire). Issuers using Reg A as a step before listing should have a parallel registration filed within 12 months (S-1 / 8-A); suppress when present.

H11. sic_code_drift (weight 2)

• What. SIC major-group changes (drift) or SIC stays frozen while the offering circular markets an unrelated product line (freeze).
• Why. Cane-scheme name changes were accompanied by SIC reassignment to whatever industry the next pump targeted (drift). GP Solutions kept SIC 0700 Agricultural Services while marketing cannabis pods (freeze). Both directions indicate "SIC inconsistent with current line of business."
• Data. sic + sicDescription compared against the latest offering-circular or 10-K product description.
• Detection. Either (a) SIC first-two-digits change within 24 months, or (b) SIC unchanged while product description in latest 1-A or 10-K does not match sicDescription.
• False positives. Genuine pivots disclosed in proxy (DEF 14A). Suppress when DEF 14A within 90 days of the SIC change explicitly disclosed the new line of business.

H12. promissory_note_clauses (weight 2) — body-text tier

• What. Advance-fee and death-spiral language in convertible debt clauses.
• Why. Toxic-financier convertible-debt cycles were central to the Cane scheme. Producer pipeline is in fraud-heuristics/src/pipelines/extractors/promissory.ts (58 MB hits).
• Data. 10-K / 10-Q primary documents.
• Detection. Regex set for death-spiral clauses (variable-conversion ratios tied to lowest VWAP, no floor, redeemable-at-issuer's-option clauses). Specific patterns in promissory.ts.
• False positives. Standard convertible notes from reputable financiers. Discriminate by counterparty (the extractor maintains a known-toxic-financier list).

H13. opinion_letter_presence (weight 3) — body-text tier

• What. S-1 Exhibit-5 attorney consent signed by a known shell-network counsel.
• Why. Rule-144 opinion letters from Loev Law or Cane Clark are themselves admissible markers of the shell-mill network. The producer is the highest-quality signal in the body-text tier (1.5 MB hits per docs/application/heuristics.md).
• Data. S-1 Exhibit-5 attorney-consent block.
• Detection. Signature block contains a name from the known-counsel dictionary.
• False positives. Near zero — the named counsel are themselves the markers. Updates to the dictionary are the maintenance burden.

H14. form_144_outlier (weight 2)

• What. Insider sale notification (Form 144) within 30 days of a material 8-K.
• Why. Cane backdated Form-5 disclosures to obscure insider sales timed to material events. The Form 144 / 8-K coincidence is the live-fire pattern (Form 5 backdating is the cover-up).
• Data. Form 144 filed under the insider's CIK; cross-walk to issuer CIK via holdsSecuritiesOf; compare against issuer 8-K dates and Item codes.
• Detection. Form 144 filed within 30 days of issuer 8-K Item 1.01 / 2.01 / 5.02 / 8.01.
• False positives. Pre-scheduled 10b5-1 plan sales. Suppress when 10b5-1 plan adoption date (in the Form 144 narrative) precedes the 8-K event by ≥ 90 days.

H15. sec_staff_action (weight 3) — NEW

• What. A SEC STAFF ACTION form-type accession on the CIK's submissions JSON.
• Why. Once SEC staff posts a public staff action, the CIK is under active examination; historical norm is charging within 24 months. GP Solutions had a staff-action accession 3.6 years before complaint.
• Data. filings.recent.form[].
• Detection. Any entry where form == "SEC STAFF ACTION". Accession prefix is canonically 9999999997.
• False positives. None observed in our sample; the staff-action form-type is itself a dispositive escalator.

H16. self_filer_for_material_capital (weight 2) — NEW

• What. Form D accession where the accession-prefix CIK equals the issuer's CIK, on a material-amount raise.
• Why. Self-filing on a $20M+ Form D suggests no securities counsel review and is structurally adjacent to the Cane-scheme agent-bypass pattern. SGR Energy's sole accession was self-filed.
• Data. Parse accession prefix; compare to sub.cik. Read Form D Item 13 for totalOfferingAmount.
• Detection. accession.startsWith(issuer_cik_padded) AND form in {D, D/A} AND totalOfferingAmount >= $1M.
• False positives. Family-office SPVs that legitimately self-file small Reg-D raises. Suppress below $1M threshold.

Quick-reference summary

Heuristics 1–8, 10, 11, 15, 16 are implementable today with the submissions JSON alone — that is the structural pass the reproducibility script score-cik.ts executes. Heuristics 9, 12, 13, 14 require the body-text augmentation pipeline that already exists in fraud-heuristics/src/pipelines/extractors/; wiring them into the same scoring record is straightforward.