A design was validated four independent ways.
Two of the four called the same function. Two more drew on the same nuclear data library and shared the same omission. A fifth check, added later, agreed with all of them.
The issue was a single array of numbers with no traceable source, sitting in the denominator of one integral. Every validation reproduced it faithfully, to three decimal places, for two months.
The correction that followed was itself wrong, in the same way, and an outside question was needed to expose it.
This document sets out the protocol that found both, why conventional cross-validation could not, and what a screen conducted under this protocol does and does not tell you.
Most technical review answers one question: do the results agree with each other? That is a consistency check. It is cheap, it feels rigorous, and it reliably catches implementation errors.
It cannot catch input errors. Every method downstream of a wrong input reproduces that input faithfully — and the more methods you run, the more confident everyone becomes.
Verification asks a different question: do the inputs agree with reality? The only operation that answers it is retrieval from a primary source. Nothing else counts. Not a textbook. Not a code comment. Not a well-regarded model. Not a colleague's recollection. Not a language model's output.
Agreement between two methods that share an assumption is not evidence. It is the same evidence, counted twice.
Each of the following was observed in a single project. Each is general.
| Failure mode | Mechanism |
|---|---|
| Shared function | Two "independent" methods call the same subroutine. An analytical model and a Monte Carlo agreed to three decimals because both invoked the same stopping-power routine. Agreement measured the routine's determinism, nothing else. |
| Shared data library | Two codes with different transport physics draw on the same evaluated nuclear data. Agreement tests the transport implementation and says nothing about the data. |
| Shared omission | Both models omitted thermal scattering treatment. Same missing physics, same direction of error, mutual confirmation. |
| Compensating errors | The most dangerous class. One model omitted a factor of ν — neutrons per fission — that another over-applied. The errors partially cancelled and produced apparent agreement between two quantities that were each wrong. Here agreement is not merely uninformative — it is actively misleading. |
| Unsourced constants | A number enters the code with no provenance, is documented as though sourced, and thereafter becomes "the value." Nobody re-derives it because it is already written down. The dangerous form is a false citation recorded beside a true one — in the same metadata field, in the same format, carrying the same apparent authority — and propagated into machine-readable output. An undocumented number invites scrutiny. A falsely documented one, sitting next to a correct one, does not. |
| Interpolation artifacts | Standard library interpolation clamps at the boundary of its data. Extrapolating below the lowest measured point returned the boundary value, producing an apparent optimum that was an artifact of the routine, not of the physics — and it looked attractive. |
| Unconstrained optimisation | Fixing an output and leaving an input free lets an optimiser trade expensive physical quantities for cheap unphysical ones. A container-count model with no current ceiling produced "optima" requiring beam currents forty times anything ever demonstrated. |
| Optimising the wrong quantity | A model can be internally perfect and answer a question that does not bind. The design in question was optimised for footprint when the binding constraint was beam power on target — a variable the model did not contain. |
| Mismatched quantities | The dominant failure in the case study, and the hardest to see. Two numbers are compared as though they measured the same thing when they did not — a fission count measured for one configuration against an identity computed for another; a total against a first flight; a weighting by atom fraction against one by reaction rate. The arithmetic on both sides is correct and the agreement can be close, which is why it survives review. Before comparing two numbers, establish that they are numbers of the same thing. |
| Circular closure | A residual is obtained by solving a balance equation, then substituted back into that equation, and the resulting identity is reported as agreement. It closes to arbitrary precision because it cannot do otherwise. The tell is that no independent measurement of the residual exists — and the check will nonetheless read as the strongest evidence in the document. |
| A test that cannot fail | A check is written, pre-registered, run and reported, and has no power to discriminate. A benchmark-similarity threshold was set at an overlap of 0.5 — but 0.56 was the subject system's own fast-fission fraction, so every fast-dominated benchmark passed automatically. The test measured nothing and read as coverage. A threshold must be shown to be capable of rejecting something before its satisfaction counts as evidence. |
| Retrospective mechanism | A result appears, and a plausible physical explanation is constructed for it from general principles — while a specific measurement already in the record contradicts that explanation. Four instances occurred in four days: a discrepancy attributed to a high-collision tail that did not exist; a claim that shield hydrogen supplied reactivity when removing it raised the eigenvalue by 1,399 pcm; a density prediction wrong by 2.3× because the blanket was treated as a bare leaking system despite a reflector and shield worth 17,868 pcm already being tabulated; and a correction factor carried across to a different source spectrum, against an explicit written warning in the very script that used it. The explanation is the dangerous part, because it gets written down as a finding. |
| Incomplete perturbation of a coupled state | One variable is changed and a second variable that depends on it is silently held at its old value. A model was heated from 294 K to 600 K while the coolant density stayed at its cold value — but water at 15 MPa falls from 1.00 to about 0.68 g/cm³ over exactly that range, so a third of the moderating hydrogen was present in the model and absent in reality. Correcting it moved the answer by more than the entire design improvement being evaluated. The tell is a state variable appearing as a constant in a study that varies its argument. |
| A conditional that outlives its condition | The newest, and the only one on this list that attacks a conclusion rather than a calculation. A closed concept was reopened as conditional on a specific premise: that the customer prices delivered energy by logistics rather than by market. The customer was later changed to one who buys at market price. Nothing was edited, no number moved, and the conditional was carried forward for two days as a live result — because the condition lived in a superseded document and the conclusion lived in the current one. A conditional conclusion is a claim about its condition, and it expires when the condition does. The tell is a conclusion whose premise cannot be found in the same document as the conclusion. |
| Regression of a corrected defect | A defect is found, fixed, and documented — and then reappears in new code because the helper was rewritten from memory instead of reused. A library-type filter corrected on 7 August was reintroduced on 9 August, in a project keeping a numbered error log that already contained it. A fix that lives in one script is not a fix. Where logic is written twice it will diverge, and the second copy carries the defect the first one already shed. |
MEASURED-CITED · experimental, with citation ·
MEASURED-OURS · from a run we executed ·
DERIVED · computed from tagged inputs ·
ESTIMATE · engineering judgement ·
UNVERIFIED · recalled or secondary.
Tags live in the code and print with every run, so they cannot be forgotten. An
UNVERIFIED number may not enter a decision. It is a hypothesis until
promoted.
Not from memory, not from a review article, not from an existing model. From NIST,
from the original measurement paper, from the design report. If a figure cannot be
traced, it is UNVERIFIED regardless of how long it has been in use or how
authoritative its apparent origin.
The test of a successful correction is that the corrected model reproduces an independent quantity it was not fitted to.
Retrieval before reconstruction. Where a validated artifact already exists, building your own inserts you into the error chain for no gain. Three attempts were spent reconstructing a reactor-physics benchmark from a paywalled specification before it was found that fifty-four validated models of the same benchmark family sat in a public repository, maintained by the code's own developers. Had the reconstruction been used, any disagreement with experiment could not have been separated from the author's transcription error.
Retrieval applies to corrected code, not only to numbers. A correction is not complete until it reaches every copy of the logic it corrects. Rewriting a helper from memory reproduces the defect the correction removed — which happened here two days after the fix was documented. Where the same logic exists in two files, one of them is wrong and you do not yet know which.
The prediction and the decision rule are written down first — what result would confirm, what result would falsify, and what happens in each case. Pre-registration removes the possibility of rationalising an outcome after seeing it, which is the single most common failure in self-assessment.
Amended 7 August 2026 — abort criteria are separated from prediction falsifiers. An abort criterion may be derived only from a conservation law or identity, from reproduction of a prior measurement, or from availability of required data. Never from an expectation about the answer. A falsified prediction is a result: it is recorded, it updates the model of the physics, and the run continues.
The amendment was forced by two of its own violations — a decision threshold set on the eigenvalue when the objective function was the fission count, and an expected sign encoded as a halt condition, which duly halted a run on correct data. Since adoption, identity and reproduction criteria have been written for every run in a twelve-run campaign, and three have fired on real defects — including a case where the pre-registration specified a perturbation at fixed heavy-metal loading and the implementation held fixed mass density instead. The code was corrected to match the document, not the reverse.
Before two methods may be said to agree, four questions are answered explicitly: do they share a subroutine? a data library? an omission? could their errors compensate? Any yes, and the agreement is discounted to a single observation.
Cost is almost always cheaper to check than physics. A cost screen needs arithmetic and a market price; a physics screen needs a model, a code, a data library and a week. Concepts are therefore screened economically before they are screened physically — including the limiting case in which the enabling technology is free.
A concept that fails with a free accelerator does not need a neutronics model.
Added on the evidence of the case study below. Three errors — including one in which a back-solved residual was presented as a closing balance — survived the author, the assisting analysis and a full write-up, and were found in under an hour by a reader given the record and instructed to be blunt.
Some errors are structurally invisible from inside. A calculation looks like a check until you trace where one of its inputs came from, and the person who produced the input is the least able to see it. External review is not a courtesy. It is the cheapest countermeasure in this protocol after Rule 5.
Added 10 August 2026 on the evidence of failure mode fifteen. Every conditional verdict is written with its condition in the same document as the verdict, as a testable proposition, together with the change that would void it. When any element of the condition changes — the customer, the application, the comparator, the benchmark, the enabling technology — the conditional is void and the screen is re-run. It is not amended and it is not argued forward.
The amendment was forced by its own violation. A concept closed on an economic screen was reopened as conditional on an application in which delivered energy is priced by logistics rather than by market. The application was subsequently changed to a permanently sited, grid-connected one, which restores the market price the original screen had used. The reopening survived the premise it rested on by two days, and was quoted as a live result in a handover document written to brief a new session. Re-running the screen closed the concept in one day, on retrieval and arithmetic, with no simulation.
The corollary is uncomfortable and is the reason this is a rule rather than a note: the more favourable a conditional verdict is, the less likely anyone is to notice that its condition has moved.
Check which variables cancel. In the case study the governing relation contained no beam current: source strength and wall-plug input both scale with it, so the ratio does not. The project's stated objective had been "net positive at 500 mA" for most of its life. It was never a physics target, and nobody noticed until the relation was written down in one line.
Name the comparator, and name its scale. A decision rule that says “against the cheapest built alternative” without saying at what unit size admits two readings and returns two different verdicts — in the case study, one reading gave a factor of 12.5 against a gigawatt-scale plant and the other a factor of 1.4 against a first-of-a-kind small modular unit. Both readings were defensible from the same sentence. A rule that can be read two ways has less power than it appears to have, and the ambiguity will be resolved after the numbers are seen unless it is resolved before.
Most concepts terminate at step 4, in days rather than months, at a cost of arithmetic rather than simulation.
One result from the case study generalises to any architecture whose output depends on an amplification approaching a pole. A subcritical assembly delivers power proportional to 1/(1−k), so output rises without limit as k approaches unity. But the uncertainty obeys the same relation: dQ/Q = dk/(1−k), which is proportional to Q itself.
Relative uncertainty therefore grows in exact proportion to the power gained. Pushing the amplifier does not buy output; it trades output for knowledge, one for one. In the case study the measured reactivity uncertainty of 610 pcm meant that a ±20% knowledge limit required a subcritical margin of at least 3,050 pcm — and the margin derived independently from safety terms was 3,000. Safety and epistemics converged on the same number, and neither was fitted to the other.
The same structure appears wherever a design is tuned toward a resonance, a critical point, or a marginal stability boundary. A claimed operating point close to such a pole should be read as a claim about knowledge as much as about performance, and the screen asks for the uncertainty at that point rather than the value.
A second form of the same limit, found in the same project a day later, and worth stating separately because it looks like an opportunity and is not. Where an efficiency appears in both the output and the input — it multiplies the gain, and it also sets the power that must be recirculated to sustain the gain — the cost per unit of net output does not scale with that efficiency. It converges.
In the case study the capital cost of the enabling machine per kilowatt of net electrical output fell from $24,000 to $20,500 as its efficiency was doubled, and converged to a floor of $16,700 per kilowatt at perfect efficiency — a machine that consumes no power at all — with every other component of the plant costed at zero. The floor was nine times the price of the alternative the customer could buy that day.
The diagnostic is worth more than the number. Before spending effort improving a term, take the limit in which that term is perfect. If the answer at the limit still fails, the term was never the binding one, and the retrieval or the run that would have pinned it down cannot change the verdict. In the case study this retired six open items in a single line of arithmetic, including the one that had been ranked highest priority the previous day.
Claimed: net-positive electrical output, supported by four computational validations. Provisional patent, international PCT application, business plan, valuation study.
Found: two independent errors. An electronic stopping-power array of untraceable provenance, wrong by more than an order of magnitude against the NIST primary source, sitting in the denominator of the yield integral. And fissions per source neutron taken as k/(1−k) rather than k/[(1−k)·ν] — an overstatement by the mean number of neutrons per fission.
Corrected: the device does not produce net electrical power. The sign of the result was determined entirely by the unsourced array.
Verified how: the corrected model reproduces a NIST reference quantity to 0.6% — a quantity it was not fitted to, and the strongest form of confirmation this protocol recognises. A second check reported at the time, in which a Monte Carlo measurement of fissions per source neutron matched the corrected identity to 0.6%, has since been withdrawn. See below.
Then: a redesign of the neutron source — proton spallation in place of beam-target fusion — produced a genuinely net-positive architecture, which was nonetheless set aside at step 4 of the screening sequence: it failed the optimistic economic screen against a grid-electricity benchmark even with the enabling technology costed at zero.
Status of that closure, revised 8 August 2026. The screen that closed it measured capital cost per watt against wholesale electricity. That benchmark does not apply to a user for whom delivered energy is priced by logistics rather than by market — where the comparator is fuel convoyed to the point of use, not the grid. The spallation architecture is net-positive on energy and is therefore returned to conditional: open on physics, contingent on an application in which cost per watt is not the binding constraint. Its scale, of order tens of megawatts, is the open question rather than its energy balance.
Timeline: both findings reached in 48 hours, from primary reference data, before any external party raised a question and before any capital was committed.
On 4 August 2026 an external reviewer asked three technical questions, one of which required a calculation that had never been run — an inhomogeneous fixed-source calculation, without which the source-importance factor cannot be determined. Running it showed that the July correction contained two errors of its own.
The apparent 0.6% agreement on fissions per source neutron was a coincidence between two different geometries: a measurement taken from one configuration had been compared against an identity computed for another. The source importance derived from that pairing was wrong by a factor of nearly three. And the record's claim that the criticality eigenvalue had been confirmed by two independent methods could not have held under any pairing, because the driven-cascade quantity measures a product of two unknowns and determines neither alone.
Corrected, the device is a factor of 2.7 better than the July figures state and remains a factor of 2.0 short of break-even. The verdict did not change. The reasoning behind it did.
Diagnosing a factor-of-two disagreement between the two transport codes, which surfaced during the same work, identified a defect in one of them: its fission model emits an essentially energy-independent neutron multiplicity, reproducing the evaluated value at thermal energies and failing to scale it with incident energy. In a system operating near criticality, where a one per cent error in the eigenvalue becomes a twenty-five per cent error in power, a five per cent multiplicity deficit became a factor of two.
Why this belongs in the case study rather than being quietly fixed. The July audit applied Rule 2 to one error and not to the other. It retrieved the stopping-power data from a primary source, which worked, and it corrected the fission count by comparing a measurement against an identity — without asking whether the two described the same configuration. That is failure mode nine, committed by the protocol's own audit, and it took an outside question to expose it. A method that could not catch its own output would not be worth publishing.
Work continued under the protocol, one pre-registered run at a time, each bound to its predictions by the SHA-256 of the document written before it. Four claims standing in the record were overturned, three of them favourable to the design and one not.
Two terms that had been carried as engineering judgement were replaced by measurement. Nuclear-data and method bias was estimated at roughly 1,000 pcm; running every uranium-fuelled benchmark in a public criticality suite — fifty-four families, weighted by measured spectral overlap with the subject system rather than by the benchmarks' own category labels — gives 434 pcm. Manufacturing tolerance was estimated at 500 pcm and measures 428, of which 81% is fuel density alone. Both replacements were confirmations rather than corrections, which is the outcome an honest estimate should produce.
A binding constraint was then issued and treated as binding: a floor on the subcritical margin of 3,000 pcm in the cold, dry-shield, beginning-of-life state, derived from the measured terms and not from ambition, written down before any optimisation was allowed to see it. It happens to coincide with the 3% margin recited in the patent's own claims, which were drafted from the superseded figures.
And a lever the analysis expected to find does not exist. Neutron yield per unit beam energy was predicted to improve by roughly 30% at a better deuteron energy. Computed across 60 keV to 1 MeV against retrieved stopping-power data, the existing 180 keV design point is the optimum, to within a fraction of a per cent. Target pressure cancels out of the yield integral entirely and a solid target would be worse. The beam-target source is already maximal; there is no room there at all.
A closure finding was issued with a condition attached and a falsifier named before the test: one untested redesign attacked the binding quantity directly, and if it raised source importance above 4.0 the closure was wrong and the architecture reopened.
The redesign worked, and not enough. Replacing oxide with metallic uranium in the first few mean free paths — a 14.1 MeV neutron loses at most 1.7% of its energy on uranium against 22% on oxygen, and there are two oxygens per uranium in the dioxide — raised source importance from 2.413 to 3.502 and thermal power by 30% at the same envelope, from 189 kg of depleted material carrying no fissile inventory. It also showed an interior optimum: a thicker shell performed worse. The falsifier was 4.0; the measurement was 3.502. The condition is discharged.
Then the operating point closed it. Every figure to that date had been tallied cold, while the thermal efficiencies assumed require 700–950 K. Correcting temperature — and then correcting coolant density, which had silently stayed at its cold value — took the best buildable configuration from 0.771 to 0.406. Reaching unity would require an accelerator efficiency of 1.479. The trap is structural: the subcritical margin must hold in the cold, flooded state, which is the most reactive one, forcing the device 3,867 pcm further subcritical when running. And water was the only coolant that reached the margin at all — so the coolant that makes the design possible is the coolant that caps its efficiency.
The beam-target architecture is closed on measurement, not conditionally. Twelve pre-registered runs, each bound to its written predictions by SHA-256 before execution.
And a second architecture opened. The proton spallation variant, set aside in July on an economic screen against a grid-electricity benchmark, carried source importance as an assumed 1.00 — an assumption both of its own scripts flagged as unverified and named for measurement. Measured, it is 1.416: the assumption was conservative by 42%. Folded against published spallation yields, that architecture appeared to return Q_eng ≈ 9.4, described in the record at the time as having nothing unverified in the chain.
That description was false, and the claim did not survive the following day. The accelerator efficiency in it — the single factor that multiplies the entire answer — had been carried unexamined from a 180 keV deuteron machine onto a 590 MeV proton machine. Retrieved from the only facility of that energy and power in existence, it is 0.183 against the 0.60 assumed: the load-bearing number was wrong by a factor of 3.3, and the honest figure is Q_eng ≈ 3. The device remains net positive on energy. Failure mode nine, in the largest single term, and it was found because the reader asked why a figure of 9.4 had been described as having little room to rise.
The reopening of the spallation architecture had been made conditional on an application in which delivered energy is priced by logistics rather than by market. The application on record was subsequently changed to a permanently sited, grid-connected data centre — which restores the market benchmark the July screen had already used. The conditional was void and nobody had noticed. That is failure mode fifteen, and it is why Rule 7 exists.
Re-run under pre-registration, the screen closed the application on two independent grounds, neither of them the energy balance:
The other application on file, a transportable one, is closed by a constraint already in the record and needing no new work: the accelerator is twenty to thirty-nine shipping containers in line.
What closed is not the physics. The device produces net electrical power and that result stands. What closed is every application in which the product is electricity and the comparator is capital cost per unit of capacity — because one watt of beam buys about twelve watts of net electricity, and twelve watts of electricity are not worth the three hundred dollars the watt of beam costs to build. The surviving direction, unscreened and recorded as such, is one in which the same beam produces something worth orders of magnitude more per watt than electricity.
One architecture and two applications, all three closed on measurement and retrieval, and the last of them in a single day with no simulation at all. The second architecture is not closed — its electricity case is, and four months of neutronics had not closed that. Step 4 of the screening sequence did, on arithmetic and a morning of retrieval, which is the strongest evidence for Rule 5 this project produced.
The full account — the arithmetic, the corrected analysis, the twenty-seven errors made during the audit and everything that followed it, and every remaining open item — is recorded in SFHB — Complete Project Record, version 2, 6 August 2026, and Technical Correction Notice No. 3 of the same date. The measurement state as of 9 August 2026, the forty-nine errors, the binding margin floor, the closure finding and the spallation measurement are recorded in version 5 of the same record and in Technical Correction Notice No. 4 of 9 August 2026. The retrieved accelerator and thermal efficiencies, the closure of the electrical product, the fifty-three errors and the statement of what survives are recorded in version 6 of the same record and in Technical Correction Notice No. 5 of 10 August 2026, together with the pre-registration and the executable screen that produced the closure.
Three features of that record are the reason this document exists. The first audit was self-initiated — nobody asked for it. The second was not, and the record says so: the errors of 4–6 August were found because a reviewer asked a question, and claiming otherwise would cost more than it gained. And the record is unrevised, including the parts that are unflattering to its author, because a record edited after the fact is worth less than one that was not.
| Deliverable | Content |
|---|---|
| Governing relation | The architecture reduced to its binding equation, with each term identified as physics-capped or engineering-capped |
| Provenance register | Every input tagged, with citations for those that carry them and an explicit list of those that do not |
| Optimistic economic screen | Capital cost per watt and levelised cost under best-case assumptions, including the free-enabling-technology limit |
| Sensitivity ranking | Which assumptions move the answer, ordered by magnitude, so diligence budget is spent where it changes the conclusion |
| Independence audit | Assessment of whether the subject's own validations are genuinely independent, applying the fifteen failure modes of §2 |
| Reproducible code | The analysis as executable scripts with tagged inputs, so the client's own advisors can re-run and vary it |
| Finding | Go / no-go / conditional, with the arithmetic shown rather than asserted, and the conditions stated as testable propositions |
Engagement: fixed scope, fixed fee, two to three weeks. Deliverables are written to be handed to a third party for checking — which is the point.
Stated plainly, because a screen that oversells itself is the thing it exists to prevent.
One conclusion from the case study generalises beyond nuclear engineering, and it is the operating assumption of every screen conducted under this protocol.
Fluent, confident, internally consistent analysis is produced identically whether the underlying input is right or wrong. This is true of a well-built model, a respected consultancy, an experienced colleague, and an AI assistant. A collaborator who agrees with you, checks your arithmetic and reproduces your result has verified nothing if they are working from the same unverified number.
The protocol assumes this of itself. During the audit described in §5, the analysis produced eight errors of its own. Among them: an incorrect claim about a simulation cascade limit, a wrong stopping-power prediction, a mistaken accelerator gradient derived from confusing an energy with a length, an interpolation bug producing a false optimum, and an architectural proposal that did not survive its own arithmetic. All eight were caught by the same rules that caught the original error, and all eight are documented.
Three further days of work under the protocol added nineteen more from the same source, bringing the assistant's own total to twenty-seven. Among them: two mis-specified halt conditions that forced the Rule 3 amendment, three retrospective mechanisms of the kind now recorded as failure mode twelve, a similarity threshold with no power to reject anything, a non-existent reference read off a screenshot and written into a pre-registration unverified, a special case reported as a general result, a sign convention inverted in a summary table, a date error in a pre-registration — which would have destroyed that document's only purpose — and a divergence between what a pre-registration specified and what its code did. Most were caught by the protocol's own rules. Seven of the fifty-three, across the whole project, were caught by the reader and by no rule at all.
Four of the nineteen deserve naming because they are structural rather than arithmetic. A decision threshold was set on the wrong variable — on the eigenvalue when the objective function was the fission count. A cold neutronics result was compared against a hot plant, and then a coolant density was left at its cold value while the fuel was heated, which cost more than the entire design improvement being evaluated. A defect fixed on 7 August was reintroduced on 9 August in a different file. And a verdict line took a minimum over all cases including a 293.6 K reference state, and printed that the closure should be reopened — no heat engine runs at 20 °C, and the verdict was wrong. Every one of the four was a comparison between two things that were not the same thing.
The final two days added four more, all four from the assistant, bringing its own total to thirty-one. Two are worth naming because they were committed inside the very documents written to prevent them. A pre-registration fixed a thermal efficiency of 0.338 and, in the same list of inputs, a figure of merit that had been computed at 0.33 — failure mode nine, in a document written the same morning as a section warning against it. And that pre-registration's decision rule named “the cheapest built alternative” without naming its unit scale, so that one sentence returned two verdicts; it is answered on the merits in the record rather than by selecting the preferred reading.
Across the audit, the screens that followed it, the second correction of 4–6 August, the measurement campaign of 6–9 August and the closure of 10 August, the count now stands at fifty-three, every one recorded. Twenty-six of the fifty-three are a single failure: two quantities treated as comparable when they were not the same quantity. That is why it was added to §2 as failure mode nine, and it is the most useful thing this project produced. Its persistence is the point — it recurred eight more times in a fortnight, in a project actively watching for it, keeping a numbered log of it, committed by people who could recite its definition.
Seven of the fifty-three were caught by no rule at all, but by a reader who had taken no part in producing them — which is why Rule 6 exists. Four arrived in the final four days: a date on a pre-registration; a framing in which a patent claim was treated as a constraint on the physics when it is an amendable document and the physics is not; a request to verify three efficiency scenarios, which on being taken seriously revealed that all three had been computed at the wrong temperature; and a question about why a headline figure had been described as having little room to rise, which exposed that the factor multiplying the entire answer had been carried across from a different machine.
The fifteenth failure mode arrived the same way, and it was not a numbered error but a dead conclusion still being quoted as a live one. The reader asked whether anything remained or whether the project should be closed. Taking the question seriously meant checking what the surviving conclusion still rested on — and it rested on a premise that had been replaced two days earlier. Rule 7 exists because that question was asked.
Those are the pattern in miniature. The reader did not find the errors. The reader asked for something to be checked, and the checking found them. Rule 6 does not require the external reader to be expert in the subject. It requires them to ask.
The protocol is not a claim to be right. It is a method for finding out when you are not, before it becomes expensive.