cert-machine · methods note

None by reading code

Every real bug this project has found — 10 of them, cataloged below — was caught by a red control, a calibration, an impossible number, or a byte pin. Not one was found by reading the code. This note is the discipline stated as engineering, with the receipts: every regression named here is held by a battery that executed during this build, and the build refuses if any goes red. §5 is the same discipline under attack: 19 ways to cheat the machine, and the gate that caught each.

tl;dr
  • The finding. Ten real bugs, zero found by reading code: every one was caught by a red control, a calibration, an impossible number, or a byte pin. Verifier engineering — not code review — is what actually catches defects, in this machine and in any evaluation pipeline built on computed ground truth.
  • The mechanism. A check that has never gone red is decorative, so every battery carries deliberate forgeries that must fire; every instrument reproduces a known answer before deciding anything new; and every gate cited on this page executed during the build that produced it.
  • Check it. make test from a clone — every battery, every red control required to fire. For the reward-hacking battery in §5 on its own: node machine/funnel/selftest/battery.js (14 items, 19 red controls, about a second).
bugs cataloged
10
real defects with named catches and living gates
found by reading code
0
the null result the whole method predicts
impossible numbers
3
bounds provably above ceilings, values refuting themselves
calibrations
2
known answers the instrument had to reproduce first
gates run for this page
7 green
executed during this build; a red refuses the page
cheats refused
19
deliberate attacks on the search machine’s reward signal (§5) — every one caught by a named control, this build
the class, in the wild
1 refuted · 1 corrected
a published constant that was a float artifact, refuted; a printed sign slip, corrected — same failure class, audited
§0 · the count

How 10 real defects were actually caught

Every defect below is one this repository shipped and then found. The bar at the bottom is the one the title is about, and it is empty on purpose: not one of them was caught by re-reading the code that contained it.

0 1 2 3 impossible number 3 calibration 2 control 2 outside read 1 outside read → conservation identity 1 byte pin 1 reading the code none defects in this repository surfaced that way
10 defects, each counted once under the mechanism that actually surfaced it. An impossible NUMBER — a value refuted against itself, a count that cannot be that large — did the most work; an outside reader and a red control did the rest. Reading the code found none, which is why the gates in this repository are arranged to produce impossible numbers loudly rather than to encourage careful reading.
§1 · the discipline

Five rules, stated as engineering

  • Screens may prune, never admit. Floating point decides only what is WORTH certifying. Nothing a screen passes is believed; every admission is an exact certificate — interval enclosures with outward rounding, BigInt rationals, Sturm chains. An instrument that cannot decide refuses rather than guesses.
  • Calibrate before you claim. Every instrument first reproduces a case with a known answer — closed-form fixed points, a published table, a textbook algorithm. 2 of the 10 bugs below were caught at exactly this step.
  • Every battery carries red controls. Deliberate forgeries that must FAIL: a perturbed coefficient, a forged pin, a wrong-endpoint bar. A check that has never gone red is decoration — it is consistent with the code being right and equally consistent with the check testing nothing.
  • Conservation identities that throw. Every exhaustion accounts for every case — per shard and globally — and the run refuses to write a record with a hole in it. The one headline this project ever had to deflate (by 30%) is now structurally impossible to inflate: the subtraction must close to zero.
  • Pin the bytes. Every transcribed claim certifies against a held byte sequence (path + sha256), re-hashed at certify time. One bug below — a silently missing row of a published sheet — was caught by nothing else.

The consequence worth a note rather than a slogan: under these rules, bugs are found by RUNNING the machine, and the finding mechanism is itself checkable. What follows is every real bug this project has found, with what caught it.

§2 · the catalog

10 bugs, 6 catch mechanisms

#the bugwherecaught by
1The engine refuted √2 as a closed form of √2oeis-closedformimpossible number
2“Decimal expansion of 2e” certified as a discoveryoeis-closedformoutside read
3Unreduced fractions inflated the refutation count ~30%closed-form vocabulariesoutside read → conservation identity
4The bisection-line zeroholmes-censuscalibration
5The fat-record stallhenon-censuscontrol
6Undamped-Newton blindnesskeller-fiberscalibration
7The missed sheet rowramanujan-auditbyte pin
8Mixed-duration itineraries: h ≥ 0.61, above the ceilingentropyimpossible number
9The lids-only image condition: ln φ from two boxesentropyimpossible number
10The wrong-endpoint bartrigmin sweeps (lesson encoded from the source lab)control

1 · The engine refuted √2 as a closed form of √2

An OEIS audit run reported the closed form √2 REFUTED against the certified enclosure of… the decimal expansion of √2. A refutation of a value against itself is not a subtle wrongness; it is an impossibility, and it surfaced a normalization defect in the closed-form vocabulary.

The gate now standing: the engine battery (closed-form calibration rows).

2 · “Decimal expansion of 2e” certified as a discovery

The family read only the OEIS entry NAME, so a constant whose own record states its closed form was announced as a surviving discovery. The claim was impossible on its face to any reader of the record. The fix made the engine conclude what the hand-check knew: full records are fetched and fed back into certify, a survivor with a form on record is REJECT, and OEIS “hits” went 38 → 0.

The gate now standing: A019762 pinned in the battery as a regression control.

3 · Unreduced fractions inflated the refutation count ~30%

The vocabularies emitted unreduced spellings — (2/1)·e and (4/2)·e counted as two refuted forms — and one surviving value showed as four candidates: an impossible multiplicity an outside reviewer saw in under a minute. The headline DEFLATED from 77.6M to 54.6M (history, quoted). The durable fix is structural: the ledger now carries the full decomposition and the engine refuses to write one whose subtraction does not close.

The gate now standing: run-engine refuses a non-closing ledger; recomputed above: 54,629,173 tested decomposes exactly.

4 · The bisection-line zero

The Holmes cubic has a fixed point AT x = 0 — the exact midpoint of the symmetric root box. A zero lying ON a bisection line can never satisfy strict interior containment, so the census dove to its depth cap around a point it could never resolve. Caught the day the instrument was calibrated against the map's closed-form fixed points ±√(d+b−1). Fix: the root box is asymmetric by M/1024, and 2049 is odd, so no dyadic subdivision endpoint ever equals 0.

The gate now standing: census battery: closed-form calibration on both maps.

5 · The fat-record stall

At a = 0.96, p = 4 a stalled cell produced a fat record. The defect was caught by the shift classification — the census decides minimal periods by certified shift-links, and the classification refused to cohere — not by anyone reading the search loop.

The gate now standing: census battery red controls.

6 · Undamped-Newton blindness

Plain Newton from the multistart grid could not reach the published preimages of the Alpöge map; the hunter reported fewer fibers than the record it was calibrated against. Damped steps over a scale ladder found them, and every candidate is certified in a Krawczyk box on the exact map — the calibration target (3 preimages, rediscovered blind) is what exposed the blindness.

The gate now standing: keller battery; the fiber counts are re-certified.

7 · The missed sheet row

The first transcription of the Ramanujan Machine ζ(3) sheet MISSED its second row — 5/(2ζ(3)), a positive continued fraction hiding in the minus table. It surfaced only because the pin instrument (R3) forces every transcription to re-hash and be re-read against held source bytes; the re-read against rm_zeta3.pdf exposed the gap, and the row is now audited with the rest.

The gate now standing: pins re-hashed at certify time; forged-pin red control.

8 · Mixed-duration itineraries: h ≥ 0.61, above the ceiling

Counting mixed-duration covering-relation paths as distinct itineraries produced h ≥ 0.61 (history, quoted) — above 0.4648, the exact census ceiling ln(1696)/16 recomputed from the period-16 record during this build. A duration-2 relation constrains nothing at its intermediate time, so different visit-time sets can realize the SAME orbit. Fix: compose to a uniform power as BINARY relations; a semantic red control now demands the exact-ln 2 horseshoe stay at ln 2 = 0.6931 under mixed durations.

The gate now standing: entropy battery, semantic ln 2 red.

9 · The lids-only image condition: ln φ from two boxes

A lids-only image condition certified a golden-mean 2-box graph converging to ln φ = 0.4812 — again above the census ceiling. An image part hovering in the slab above the target's interior lets a finger poke in and retract. An interim commit recorded 0.356403 under this condition (history; TAINTED and superseded). Fix: forbid the full slabs; the sound theorem is h ≥ 0.301680, re-read from the certificate during this build.

The gate now standing: entropy battery re-proves the detached certificate in full.

10 · The wrong-endpoint bar

A certification bar taken from the wrong endpoint of an enclosure silently kills true champions — the source lab paid for this lesson in a lost run. Here it is not prose: the lambda battery constructs the wrong-endpoint bar, REFUSES it by name, and demonstrates the disaster it would cause, every run.

The gate now standing: lambda battery: the wrong-endpoint red control.

§3 · the near-misses

Where the method forced trouble into the open early

Two entries deserve a place beside the bugs because they never became bugs — the discipline surfaced them before a wrong number existed.

The exact spurious branch. One Ramanujan Machine continued fraction (the ζ(3) inverse row) has sₙ = n³ as an EXACT spurious solution of its tail recursion, adjacent to the true branch — the double root of c² − 2c + 1. A tail band proved by shift-and-check positivity must EXCLUDE it (L = n³ + 2n² is sharp), and that CF genuinely converges slowly. Digit-matching at any fixed depth cannot see this; a band that must be PROVED cannot avoid it. The spurious-solution lemma is re-proved as an exact polynomial identity by the cf battery, which ran for this page.

The crowding artifact. The first Newman min-modulus table read as if the maxima dipped at n = 10. Box maxima are lower bounds; the “dip” was the box crowding, and widening the box raised every floor and killed the reading — three rungs for three. The published convention now says brackets over named boxes, never “the value”, so the artifact class cannot recur in prose.

§4 · the same class, in the wild

Why this is also an audit instrument

The bugs above are the failure class of numerical mathematics done without exact gates — and that class publishes. The GPT-produced constant on Erdős #852 was the naive IEEE-754 double product of its own defining formula, published to thirteen digits of false confidence and refuted here at digit 12, mechanism reproduced digit for digit. A printed row of the Ramanujan Machine's mixed-zeta sheet carries a sign slip; the audit refuted the row as printed and certified its correction on the same enclosure. The discipline that catches your own bugs and the instrument that audits published claims are the same object.

§5 · reward hacking

19 ways to cheat this machine

The catalog above is about honest code that turned out to be wrong. This section is about the other failure, the one that gets worse as the machinery gets more capable: code that is optimizing. Anything that proposes candidates and scores them has a reward signal, and a reward signal that can be gamed eventually is gamed — by an evolutionary loop that finds the gap, by a language model that finds the shortcut, or by a maintainer who nudges a threshold until the number looks right. So the campaign runner in this repository ships with a battery whose whole job is to cheat it: 19 attacks, each one written to work, each one caught by a named control.

What that demonstrates, and what it does not. The battery runs the full machine against a synthetic target whose answer is completely known — 441 integer vectors, exactly 4 hits, the property decided exactly in BigInt, one provably empty sub-box — because a gate’s teeth cannot be measured on a problem whose answer nobody has. Each row below therefore proves one thing precisely: that this control fires on this attack, with nothing written and no claim minted. It is not a proof that no attack exists. The honest claim is that these 19 do not work, and that this table is where the next one gets added the day somebody finds it.

Each row is one way to cheat this machine and the gate that caught it. The last column is not a description of what should happen — it is the line the battery printed during this build.

#the cheatrefused bywhat fired, this build
aReplace the certifier with one that stamps HIT on everything.CERTIFIER-INTEGRITYrefused to start: independent recompute rejected the forged certificate for knownBad; nothing written
bRaise the score by inflating the candidate instead of improving it.SCORE-BATTERYrefused to start: SCORE-BATTERY caught scaleInflate raising the score
cEdit a result line after it was written.CHAIN-BROKENchain hash mismatch detected at line 2; resume refused (CHAIN-BROKEN)
dLet the proposer reach outside its return value and write to disk.FENCE-VIOLATIONvm fence: require is not defined; run aborted FENCE-VIOLATION and no file was written
eAnnounce “the best one found so far” without saying what was searched.claim guardclaim guard threw on free-text superlative; RECORD without a certificate carries the literal downgrade
fRecord a metric with no run attached to it.MEMO-UNPROVENANCEDmemoAppend refused the write (MEMO-UNPROVENANCED); nothing appended
gAppend a number to the stats log by hand, going around the writer.MEMO-REFUSEDstrict read refused naming line 3; tolerant read returned the violation by name and 2 provenanced records
hMint a new metric without defining it, so its meaning can drift later.MEMO-METRIC-UNDEFINEDfirst use of a metric without metricDefinition refused (MEMO-METRIC-UNDEFINED)
iReport the flattering counter and drop the other one.checkSessionSummarycheckSessionSummary refused the mutated summary both ways (counter gone; definitions gone)
jRewrite the prompt in the log after seeing which answer worked.promptShaverifyLlmLog caught the rewritten request at line 4 (promptSha mismatch)
kBoard one object twice under a different ordering to double the count.canonical-duplicatesame multiset under a different order refused as canonical-duplicate; board unchanged
lFlood one corner of the space with weak hits to run the board up.refused-region-floorweaker hit refused at the full region; stronger hit displaced the champion INTO the mute archive (nothing deleted); other region unaffected
mStop early enough to hide what was never searched — or never stop at all.bingo, both waysdry streak 100 halted early with all 4 hits already boarded; streak bar 400 never fired and the box completed
nAdd a cheap pre-filter that quietly drops the hard cases.RECALL, by stage namerecall refused the run and NAMED stage "tight" as the stage that rejected the planted hit; nothing written
oHave the evolved search program allocate a million-element candidate.DSL step + size capsrange(0,999999) produced 64 elements, not a million — the step/size caps are load-bearing
pChange the statement of what is being searched so the result matches it.STATEMENT-MISMATCHstatement.json disagreeing with the target on candidateSchema refused (STATEMENT-MISMATCH, field named); nothing written
qEdit one window’s certificate inside a finished exhaustion record.window sha re-hashverifyShardedExhaust caught the rewritten certificate at window 1 (sha mismatch)
rLeave a one-integer gap between windows — or overlap them — and call the box covered.tiling geometrya one-integer gap and a one-integer overlap between windows each refused, named as such
sPublish the cover when one window came back with a hit still in it.SHARD-INCOMPLETEa window whose sub-box contains a certified hit refused the WHOLE record, window 0 named; no record written

And what passes when nothing is cheating. A battery of refusals proves only that the machine says no; these are the same run saying yes, with the numbers read from the same output.

  • Planted recall. Enumerating the whole box: 441/441 candidates enumerated, 4/4 known hits found and certified, recall 100%. A screen may prune and may never admit, so the run refuses to start until the known answers have survived it.
  • A certified-empty box. 42/42 elements certified REJECT, one RECORD claim carrying an exhaustion certificate, zero hit-shaped claims. “We looked and there is nothing there” is a claim with a certificate behind it here, not an absence of output.
  • The cover, tiled. The same box exhausted in 3 windows, each window carrying its own certificate and the record their mechanical conjunction — 42/42 checked, conservation exact. A third party re-verifies one window without trusting the other two.
  • A pre-filter that is allowed to exist. The staged screens satisfy in = rejected + passed at every stage, checked when the record is written and re-derived afterwards by the battery, with all 4 hits still admitted.
  • Kill it and resume. Killed after 3 batches with a torn half-written line left on the end, then resumed: the run file and the leaderboard came back byte-identical to the uninterrupted run.
  • Two counters, never one. On one run the machine certified 100 hits and added 1 to the board. Those count different things — decided this run, versus new to the board — and a summary printing only the flattering one is refused by name.
the 159x line, credited

One row above is not this lab’s discovery and should not read like one. RED (b), the gamed score, exists because a published LLM-for-science project reported in its own paper that its early runs scored around 60 by feeding in initial conditions carrying 159x the background power — the metric was rewarding amplitude rather than physics — and that the same runs scored 3 to 8 once the harness normalized the input away. That number reaches this page second-hand, through an internal audit note dated 2026-08-20, and has not been re-verified at source here: it is quoted as history, exactly like the wrong bounds in the catalog above. What is ours is the gate. Before any campaign starts, the score function is handed a deliberately scale-inflated candidate and must not reward it, or the run refuses to start — their incident, self-reported; our permanent control, run every build. This page claims nothing about anyone else’s system beyond what that system published about itself.

The battery is machine/funnel/selftest/battery.js: 14 items, 19 red controls, no dependencies, about a second, deterministic enough that two runs produce byte-identical output. It runs inside make test and it ran during this build — every count and every quoted line above was read out of that run rather than typed here. If an item goes red, if a red control stops firing, or if the battery grows a control this page does not describe, the build refuses and this page is not written.

§6 · the invitation

Replication is the good outcome

The moat here is not the code — it is the discipline and the dated public record, and others replicating both after publication is the outcome this note exists to cause. Every claim above is a battery in a public MIT repository with no dependencies; every battery carries forgeries that must fail; the headline results detach into certificates a standard-library Python script re-verifies in seconds.

If you run rigorous numerics and want to co-sign, refute, or extend any of this — an independent rerun in whatever you already trust is the most valuable thing you can send: carlos@carlostoledo.co. A refutation gets published like any other result, with your name on it if you want it there.

§7 · the gates, this build

What ran to let this page exist

batterywhat it holds for this catalog
census (henon + holmes)holds the bisection-line fix and the shift classification
entropy coveringholds the semantic ln 2 red and the slab condition
lambda sweeprefuses the wrong-endpoint bar by name
cf auditre-proves the spurious-solution lemma
keller audit + fibersholds the pin-drift and forged-pin reds
engine + familiespins A019762 and the decomposition closure
funnel anti-hackingruns every reward-hacking red control in §5 — sabotaged certifier, gamed score, forged record, eaten hit, broken cover

All 7 executed by tools/build-report-methods.js during this build; any red refuses the page. The last one is also READ rather than only run: §5 is built out of its 14 item lines and 19 red-control lines, so a control that stops firing — or one this page has no description for — refuses the build by name. Recomputed from records on the way: the closed-form decomposition closes (54,629,173 tested), the census ceiling ln(1696)/16 = 0.4648, the entropy bound h ≥ 0.301680 read from its certificate and confirmed below the ceiling. Wrong historical numbers quoted above (0.61, 0.4812, 0.356403, 77.6M) are quoted AS history — the point of the catalog is that the machine refuses to reproduce them.