Safeguards against Coincidence and Numerology
The verification discipline — every mechanism that defends a load-bearing claim against chance, fitting and over-reading
A two-input theory that reads out many small integers is, a priori, at risk of being elaborate numerology. This companion answers that risk not with rhetoric but with a layered, machine-checked discipline, stated uniformly in one place. The layers: (1) a four-class status calculus with a single-source ledger and a sync audit that makes it structurally impossible for a conditional [C] claim to be rendered as exact [E]; (2) an anti-fitting rule (no free pattern, v305) plus a reverse audit (E8.REVERSE.AUDIT.01) that publishes how much E₈ structure carries NO readout (3/8 primary, 5/8 hull overhead); (3) an over-determination map (v427) whose framework separates multiplicative evidence from compression and which — applied to TFPT's own arithmetic witnesses (v428) — finds the seven (Gauss, Eisenstein, cyclotomy, Galois, lattice, Pascal, Coxeter) to be facets of one (2,3,5)/E₈ object (compression, not seven independent witnesses), locating the genuine multiplication in an input forced four independent ways (the '8' in c₃) plus a foreign readout (α⁻¹≈137) — which gives a conservative unconditional floor (~10⁻¹⁰, v432) hardened to an assumption-minimal counting floor (1/94,500 ≈ 4.40σ, no subjective probability, with a monotone concession ladder, v436); (4) the F_transfer firewall (v187) and the No-Unit theorem (v153) that makes the absence of an absolute scale a theorem, not a gap; (5) a frozen prediction registry (v84) with a Monte-Carlo null model (v100, conditional ≤10⁻³⁰·⁷) and a live data scorecard (v375); (6) two independent reproduction paths — an independent Wolfram engine (116/116 + 540/540 checks) and a Lean 4 kernel proof; and (7) an adversarial red-team layer. The thesis is deliberately narrow: these safeguards make coincidence an expensive explanation of the discrete core, and keep exact compiler closure from ever being mistaken for closed physics.
- ›The whole TFPT stack as the object of audit: the ledger, the Python/Wolfram/Lean suites, the frozen registry, and the red-team document — read as a single discipline rather than per-result.
- ›Status calculus: the four display markers [E]/[C]/[O]/[X] are read from the single-source status_ledger.csv, not retyped per document, and audit_sync.py enforces (both directions) that the suite, runner, registry and ledger agree and that every script is cited in a paper body — so a [C] claim cannot be silently shown as [E].
- ›Anti-fitting: the forward discipline / generator-economy audit (v305) admits an identity as load-bearing only if it is derivationally necessary, kills alternatives, is ablation-relevant, links modules, or is testable; the reverse audit (E8.REVERSE.AUDIT.01) publishes that only 3 of 8 E₈ Casimir degrees feed a primary readout (5/8 are unused hull overhead) — and those five are not diffuse slack but the forced two-family ladder 6·spine{2,3,4,5} ⊔ det-ladder{8,14,20}, the residue classes {0,2} mod 6 forced by h=30 (v431, exact arithmetic; the functorial flavour reading honestly kept [P]).
- ›Over-determination map (v427) + honest self-correction (v428): the framework counts multiplicative evidence only across genuinely disjoint grammars; applying it to TFPT's own seven arithmetic witnesses (Gauss N(3+2i)=13, Eisenstein N(3+2ω)=7, cyclotomy N(3+2ζ₅)=55, Galois |(Z/5)ˣ|=4, |det Cartan E₈|=1, Pascal C(4,≤2)=11, Coxeter φ(30)=8) shows — by the Brieskorn classification (v236) — that they are facets of one (2,3,5)/E₈ object: compression, like the anchor a=(1,1,2), not seven independent multiplications. The genuine multiplication is the input forced four independent ways (rank E₈, h(D₅), φ(30), Milnor all =8) plus the foreign witness α⁻¹≈137. Multiplying only across those disjoint pieces gives a conservative unconditional floor (~10⁻¹⁰, v432) that survives even if a skeptic rejects the declared grammar — ~20 orders above the v100 conditional 10⁻³⁰·⁷; the gap is exactly the payoff of deriving the α form (ALPHA.QUILLEN.EXACT.01) (v470: level = computed |C| = 1, normalisation = k_Y = 5/3; v472: finite occupied Berry-line Chern response; continuum Quillen connection and ζ-determinant comparison stay [O]), so the floor and the α-derivation are one lever. Hardened to an assumption-minimal counting floor (v436): the pure-counting α census alone is 1/94 500 ≈ 4.40σ with no subjective probability, and a monotone concession ladder shows the verdict never rests on the contestable input-‘8’ independence.
- ›Firewall + No-Unit: the four frontier transfers stay typed interfaces, never compiler outputs (v187/v213), and the No-Unit theorem (v153) makes v_geo theorem-forbidden; the historical residual-certification audit (v384) classifies its then-listed compiler residual only; it does not classify T1–T8, whose shared 3+1D parent and physical completion gates remain open.
- ›Frozen predictions + null model: the registry (v84, REG.FREEZE.01) pre-registers the dimensionless predictions, a Monte-Carlo null model (v100) scores each match against chance, and the live scorecard (v375) records the data — including the pre-registered +2.0σ θ₁₃ tension (FLAV.TH13.PRESSURE.01), the opposite of hiding the worst case.
- ›Two independent paths + red team: an independent Wolfram engine (116/116 + 603/603) and a Lean 4 kernel proof (hypercharge, anomaly, Pascal ladder, seam chain) re-derive the exact core, and the red-team companion attacks the theory and publishes what survives each attack.
- ›These safeguards do not establish physics: they make coincidence expensive for the discrete core and keep the typing honest, but the seam/anchor/transfer bridges remain the open research problem.
- ›The over-determination map is not a Bayesian proof, and we apply it to ourselves: the seven arithmetic witnesses compress one (2,3,5)/E₈ object (v428), so the honest multiplicative evidence is the multiply-forced input plus the foreign α⁻¹, not seven independent grammars.
- ›The discipline fails if any claim marked [E] does not in fact machine-check, if the null model is mis-specified so a chance hit is scored as signal, or if a frozen prediction is quietly retuned after data — each is itself an auditable defect.
Key formulas
- Seven readouts → one objectFacets of one (2,3,5)/E₈ object ⇒ compression, not multiplication (v428)
- What genuinely multipliesThe '8' in c₃ forced four independent ways, plus the foreign α⁻¹≈137 (v428)
- Reverse auditHow much E₈ structure carries NO readout — published, not hidden; the 5/8 is forced two-family structure, not diffuse overhead (v431)
- No-Unit theoremA dimensionless compiler cannot output an absolute scale (v153)
Layer 1 — the status calculus (no [C] dressed as [E])
Every claim carries [E] exact/proven, [C] conditional, [O] open/axiom, or [X] kill test; the finer per-claim type lives in the single source of truth, status_ledger.csv, and the papers and website only mirror it. The sync audit (audit_sync.py) enforces in both directions that the suite, runner, registry and ledger agree, that every script is cited in a paper body, and that no generated surface is stale — so it is structurally impossible to render a conditional claim as exact.
Layer 2 — no free pattern, and the reverse audit
The forward discipline (v305) admits an identity as load-bearing only under named anti-fitting conditions; the reverse audit (E8.REVERSE.AUDIT.01) asks the honest opposite — of the eight E₈ Casimir degrees, exactly three feed a primary readout (degree 2 the metric, 8 the rank → c₃, 30 the Coxeter number → g_car), and five carry none. Publishing the 5/8 unused overhead is the anti-cherry-picking signal — and those five are not diffuse slack: they are the forced two-family decomposition deg(E₈) = 6·spine{2,3,4,5} ⊔ ({2}∪det-ladder{8,14,20}), the {0,2} mod 6 classes forced by h=30=2·3·5 (v431). Exact arithmetic; the functorial flavour identification stays [P].
Layer 3 — the over-determination map (multiply vs. compress)
The framework is the right axis (v427): evidence multiplies only across genuinely disjoint grammars, while many readouts from one generator compress. Applied to TFPT's own seven arithmetic witnesses (v428), it forces a self-correction: by the Brieskorn classification (v236) the (2,3,5) singularity is the one generator behind the order-30 clock (Milnor 8 = rank E₈, 30 = 2·3·5 = h(E₈)), so the seven are facets of that same object — they compress, like the anchor a=(1,1,2). What genuinely multiplies is the input forced four independent ways (rank E₈, h(D₅)=8, φ(30), Milnor) plus the foreign witness α⁻¹≈137. Multiplying only across those disjoint pieces yields a conservative unconditional floor (~10⁻¹⁰, v432) that holds even without the declared grammar — ~20 orders above the v100 conditional 10⁻³⁰·⁷; that gap is the payoff of deriving the α form (ALPHA.QUILLEN.EXACT.01), so the floor and the α-derivation are one lever. Hardened (v436): even stripped of every subjective chance assignment, a pure-counting census — of 94 500 complexity-matched α-equations only the TFPT one hits the CODATA window (v100) — gives 1/94 500 ≈ 4.40σ; a monotone concession ladder (30.7 → 25.8 → 4.98 dex) keeps the “not chance” verdict at the most adversarial rung, so it does not rest on the contestable input-‘8’ independence, and the only honest gap to 5σ is one further independent confirmation (a factor ≤ 0.054).
Layer 4 — the firewall and the No-Unit theorem
The four frontier transfers (F_pole, F_Boltzmann, F_relic, F_QCD) are typed interfaces, never compiler outputs; a machine guard (v187) enforces it, and the recent single-flow reduction (v425) makes their dynamics the one native seam recovery semigroup, leaving only named anchors external. The No-Unit theorem (v153) makes v_geo forbidden by theorem, and the historical residual-certification audit (v384) applies only to its then-listed compiler residual and does not classify the open physical TOE gates T1–T8.
Layers 5–7 — frozen predictions, independent paths, the red team
Predictions are pre-registered (v84, REG.FREEZE.01) and scored against a Monte-Carlo null model (v100) with a live scorecard (v375); the exact core is re-derived twice more independently (an independent Wolfram engine, 116+470 checks, and a Lean 4 kernel proof with no sorry); and the red-team companion attacks the theory and states what survives — including its own honesty that c=8 alone does not select (E₈)₁ (holomorphy, |det K|=1, is the load-bearing extra).