---
slug: the-shape-of-the-rho
passed: 2026-10-14
by: the assay line (research/assay-line/queue-1014c/), Codex fixer directed by claude-assaying-boyle-1014; source record by Codex, checked by Codex
checked: 110
confirmed: 82
wrong: 26
unverifiable: 0
observed: 0
stale: 2
minor: 10
---

This was the directed correction pass for the 28 items in research/assay-line/queue-1014c/the-shape-of-the-rho/triage.json at f5e5f84f34, with each item's evidence reread before editing. It also carries the 82 CONFIRMED claims that checker N2 reread, explicitly attributed below; those are retained checker evidence, not a claim that this fixer independently repeated every source lookup. The fixer reproduced the affected instrument states, independently computed the replacement figures, checked the cited mathematics and public package, and ran the browser verifier, research verifier and claims gate. MINOR lines count toward wrong in this record. The generated placard refresh is left to landing, as the triage directs; this record supplies its new verification date. The report lists the remaining work and exact changes.

Original quoted punctuation U+2014 is represented as the literal escape `\u2014`, and vertical bars inside claims are represented as `|`. Retained evidence references name the checker or pinned commit so they do not imply an unperformed fresh observation.

## Claims

- WRONG | X1: Trace any residue's orbit under x²+c mod n. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :339 ; recreated: node probe-page.mjs; python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | The unchanged page reproduced tail 6001, loop 0 for n=12107, c=0, seed=2. Independent uncapped integer iteration gives tail 1, loop 6052, closure 6053. The tracer now completes the orbit and states the supported range 2 through 100000; the browser verifier asserts the corrected result.
- MINOR | X2: The instant it jumps above 1, it is a factor of N. | https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Handbook Algorithm 3.9 returns success only for 1<d<N and calls d=N failure; Note 3.12 gives a new polynomial as a retry. The HTML and markdown now state that condition. No dated page line for this MINOR precision fix.
- WRONG | X3: Watch where it closes its loop: that early collision, invisible in the full number, is the one the gcd reports. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :484 ; https://cacr.uwaterloo.ca/hac/about/chap3.pdf ; recreated: node probe-page.mjs; python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- WRONG | X4: the reason it strays even further than c = 0. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; recreated: python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Vasiga and Shallit Theorem 13 gives the two group orders and Corollary 18(b) the count, not a universal deviation ranking. Independent enumeration at p=11 gives periodic sets {0,1,3,4,5,9} for c=0 and {2,3,7,10} for c=-2, versus sqrt(11*pi/2)=4.15677273792348. At p=23 the mean rho lengths are 214/23 and 94/23 versus 6.010683448351163, so the alternative mean-length reading also fails. Removed the ranking from HTML, readout, markdown and the proof note.
- MINOR | X5: Everything on this page is recomputed live | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :183 | The inline script computes the interactive readouts, but the sequence and 26/26 total are literal HTML. Narrowed the statement to interactive readouts. MINOR; no page correction line.
- MINOR | X6: each checked both by formula and by building the periodic set from group theory and matching it element-for-element to the graph the walker finds, for every prime p < 2000. | git show f5e5f84f34:research/pollard-rho/special-c.md :152 ; git show f5e5f84f34:research/pollard-rho/verify.mjs | Reread verify.mjs loop headers: formulas at primes 3<=p<2000; c=0 set equality at primes 3<=p<500; c=-2 set equality at primes 5<=p<200. HTML and proof-note table now say these ranges. MINOR; no page correction line.
- MINOR | X7: with Brent's (1980) faster cycle-finding the usual implementation. | https://maths-people.anu.edu.au/~brent/pd/rpb051i.pdf | Reread Brent 1980 abstract: an average speed improvement over Floyd is supported. That comparison does not establish current implementation prevalence. Removed only the prevalence assertion. MINOR; no page correction line.
- MINOR | X8: why real keys (hundreds of digits) stay safe: √p is still astronomically large when p has 150 digits. | https://people.csail.mit.edu/rivest/pubs/RSA78.pdf ; https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Reread Handbook sections 3.2 and 3.2.2 and the RSA paper sizing passage. The Handbook discusses other factoring methods, including the general number field sieve; the RSA paper uses 100-digit prime examples. Retained the illustrative 150-digit square-root cost but limited it to rho, including the relates note. MINOR; no current key-size recommendation or page correction line.
- STALE | X9: Last verified 25 June 2026, when it was written. | git show f5e5f84f34:memory/log.d/2026-06-25T2330Z-pollard-rho-special-c-derived.md ; git show f5e5f84f34:src/content/strata/nowhere-new-to-go.md | The June verification is historical. The retained nowhere-new-to-go record says the constituent suites were rerun 2026-07-27. This pass reruns the mathematics and browser checks and writes passed: 2026-10-14. The shared check-placard generator reads that record; the generated HTML placard remains dated 25 June until landing regenerates it. The triage explicitly exempts this item from an Updated line.
- WRONG | X10: it samples <b>two</b> groups (orders p−1 <em>and</em> p+1), which is why it strays even further. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; recreated: python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Vasiga and Shallit Theorem 13 gives the two group orders and Corollary 18(b) the count, not a universal deviation ranking. Independent enumeration at p=11 gives periodic sets {0,1,3,4,5,9} for c=0 and {2,3,7,10} for c=-2, versus sqrt(11*pi/2)=4.15677273792348. At p=23 the mean rho lengths are 214/23 and 94/23 versus 6.010683448351163, so the alternative mean-length reading also fails. Removed the ranking from HTML, readout, markdown and the proof note.
- WRONG | X11: the orbit mod p closes long before the gcd needs it to. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :515 ; recreated: node probe-page.mjs; python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- WRONG | X12: (still 1 → keep walking) | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :486 ; recreated: node probe-page.mjs ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | The unchanged script reproduces gcd=4 with still 1 after two steps for N=4, and gcd=25 after three for N=25. The readout now branches on the computed gcd and a retry flag; each new c resets histories and the per-attempt step count. Browser checks assert both cases and reset behavior.
- WRONG | X13: N = 413 f(x)=x²+1 mod N step 0 tortoise 2 hare 2 gcd(&#124;tortoise−hare&#124;, N) = 413 \u2014 press step or run secret factor p = 7; the orbit mod p closes long before the gcd needs it to. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :515 ; recreated: node probe-page.mjs; python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- WRONG | X14: N = 413 f(x)=x²+1 mod N step 1 tortoise 5 hare 26 ✓ factor found: 7 → 413 = 7 × 59 secret factor p = 7; the orbit mod p closes long before the gcd needs it to. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :515 ; recreated: node probe-page.mjs; python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- WRONG | X15: N = 8051 f(x)=x²+1 mod N step 3 tortoise 677 hare 871 ✓ factor found: 97 → 8051 = 97 × 83 secret factor p = 83; the orbit mod p closes long before the gcd needs it to. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :515 ; recreated: node probe-page.mjs; python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- WRONG | X16: N = 1234567 f(x)=x²+1 mod N step 8 tortoise 1151867 hare 506834 ✓ factor found: 127 → 1234567 = 127 × 9721 secret factor p = 127; the orbit mod p closes long before the gcd needs it to. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :515 ; recreated: node probe-page.mjs; python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- WRONG | X17: p = 11 √(πp/2) = 4.2 generic c → mean rho length 3.8 (prediction 4.2, ratio 0.92, within 20%: the walk is random-like ✓) periodic points: random map predicts ~ 4, generic c gives 3 c = 0 (x→x²): periodic points = 6 = 1 + oddpart(p−1) = 1 + 5 ✓ \u2014 the odd-order subgroup of F p *, plus 0. c = −2 (Lucas–Lehmer): periodic points = 4 = (oddpart(p−1) + oddpart(p+1))/2 = (5 + 3)/2 ✓ \u2014 it samples two groups (orders p−1 and p+1), which is why it strays even further. Both counts are proven , not just observed \u2014 derivation + element-wise certification in research/pollard-rho/special-c.md . Far from 4: structured, not random. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :629 ; recreated: node probe-page.mjs; python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Vasiga and Shallit Theorem 13 gives the two group orders and Corollary 18(b) the count, not a universal deviation ranking. Independent enumeration at p=11 gives periodic sets {0,1,3,4,5,9} for c=0 and {2,3,7,10} for c=-2, versus sqrt(11*pi/2)=4.15677273792348. At p=23 the mean rho lengths are 214/23 and 94/23 versus 6.010683448351163, so the alternative mean-length reading also fails. Removed the ranking from HTML, readout, markdown and the proof note.
- WRONG | X18: draw the ρ for any modulus | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :335 ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | The unchanged page reproduced tail 6001, loop 0 for n=12107, c=0, seed=2. Independent uncapped integer iteration gives tail 1, loop 6052, closure 6053. The tracer now completes the orbit and states the supported range 2 through 100000; the browser verifier asserts the corrected result.
- MINOR | X19: the two textbook 'avoid' values of c (0 and −2) shown to be exactly the non-random ones | https://cacr.uwaterloo.ca/hac/about/chap3.pdf ; git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :211 | Handbook Note 3.12 excludes c=0 and c=-2; the page itself labels random-map behavior a heuristic. Changed the exhaustive exactly-the-two phrasing in the dek and body to two classical structured exceptions. MINOR; no page correction line.
- MINOR | X20: squaring is the doubling map (periodic points = the odd-order subgroup, count 1+oddpart(p−1)) | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; git show f5e5f84f34:research/pollard-rho/special-c.md | Vasiga and Shallit Theorem 1 and Corollary 3 concern the nonzero multiplicative group. The proof note separately identifies 0 as a fixed point. Added 0 to abbreviated set descriptions in the dek, body and HTML, and restored the missing +1 in the proof-note comparison. The correct formula 1+oddpart(p-1) is retained. MINOR; no page correction line.
- MINOR | X21: There is a way to factor a number that does not divide by anything. | https://cacr.uwaterloo.ca/hac/about/chap3.pdf ; git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :323 | Handbook Algorithm 3.9 uses modular arithmetic and gcd, and the browser gcd uses remainder operations. Changed the markdown opening to without trial division. MINOR; no page correction line.
- MINOR | X22: The instant it leaps above 1, it is a factor. | https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Handbook Algorithm 3.9 returns success only for 1<d<N and calls d=N failure; Note 3.12 gives a new polynomial as a retry. The HTML and markdown now state that condition. No dated page line for this MINOR precision fix.
- WRONG | X23: The page shows that hidden rho closing on its own track while the visible one is still wandering. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :529 ; recreated: node probe-page.mjs ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- MINOR | X24: Squaring `x→x²` is the **doubling map** on the exponent of the cyclic group `F_p*`, so its periodic points are exactly the elements of *odd* order: precisely `1 + oddpart(p−1)` of them. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; git show f5e5f84f34:research/pollard-rho/special-c.md | Vasiga and Shallit Theorem 1 and Corollary 3 concern the nonzero multiplicative group. The proof note separately identifies 0 as a fixed point. Added 0 to abbreviated set descriptions in the dek, body and HTML, and restored the missing +1 in the proof-note comparison. The correct formula 1+oddpart(p-1) is retained. MINOR; no page correction line.
- WRONG | X25: which is exactly why it strays even further than `c=0` | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; recreated: python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | Vasiga and Shallit Theorem 13 gives the two group orders and Corollary 18(b) the count, not a universal deviation ranking. Independent enumeration at p=11 gives periodic sets {0,1,3,4,5,9} for c=0 and {2,3,7,10} for c=-2, versus sqrt(11*pi/2)=4.15677273792348. At p=23 the mean rho lengths are 214/23 and 94/23 versus 6.010683448351163, so the alternative mean-length reading also fails. Removed the ranking from HTML, readout, markdown and the proof note.
- STALE | X26: "dateModified":"2026-06-25" | git show bf6ea455347 -- public/strata/the-shape-of-the-rho/index.html ; git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :221 | The September 28 correction and commit bf6ea455347 demonstrate a substantive revision after June 25. This edit sets JSON-LD dateModified to 2026-10-14 while preserving datePublished. The triage exempts this metadata repair from an Updated line.
- WRONG | X27: (added) orbit of 2 under x²+0 mod 12107 tail 6001 loop 0 → closes after 6001 steps | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :339 ; recreated: node probe-page.mjs; python3 math-checks.py ; verify-the-shape-of-the-rho.mjs ; research/pollard-rho/fix-report-2026-10-14.md | The unchanged page reproduced tail 6001, loop 0 for n=12107, c=0, seed=2. Independent uncapped integer iteration gives tail 1, loop 6052, closure 6053. The tracer now completes the orbit and states the supported range 2 through 100000; the browser verifier asserts the corrected result.
- WRONG | X28: (added) node oversight/oeis/pollard-rho-x2plus1/verify-staged.mjs | https://zenodo.org/records/21943930 ; https://raw.githubusercontent.com/artwasteland/Maths/main/pollard-rho/oversight/oeis/pollard-rho-x2plus1/verify-staged.mjs | Fetched live STAGED.md, the engine verifier and Zenodo record 21943930. The advertised artifact-gate URL returns 404; the engine verifier returns 200. The 38351-byte deposit has MD5 28b9cc0ccd27209ae8e37f7016f94299 and contains identical STAGED.md but no verify-staged.mjs or research/oeis-term-coverage/staged.mjs. Added explicit qualification in the reproducibility account, beside the generated data/code link, and in the mirrored correction. The external repository and deposit were not changed.
- CONFIRMED | Pollard's 1975 method factors a number by walking a simple loop \u2014 square, add one, take the remainder \u2014 until the walk catches its own tail. | https://cr.yp.to/bib/1975/pollard/01.jpg ; https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [001 pollard-1975] Pollard p.331 is headed "BIT 15 (1975), 331-334" and permits "Other polynomials" of degree at least 2. Its example subtracts one. The displayed plus-one variant is explicitly Algorithm 3.9 of the Handbook, p.91. The record excerpt alone does not establish that variant.
- CONFIRMED | The walk always makes the shape of the Greek letter it's named for. | https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf | Checker N2 evidence retained: [002 name-shape] Brent slide 23: "named “rho” because of the shape of the Greek letter"; slide 24 allows tail length zero. Rho is the conventional graph description, including degenerate zero-length tails.
- CONFIRMED | Because every input has exactly one output and there are only finitely many residues, the orbit must eventually revisit a value it has already seen \u2014 and from then on it loops forever. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf | Checker N2 evidence retained: [003 finite-repeat] Vasiga and Shallit p.1 defines the first repeat and "the tail" and "the cycle", with the tail index a "non-negative integer". A tail may be empty. Brent slide 23 independently supplies the name attribution.
- CONFIRMED | So every orbit looks the same: a tail running in, then a cycle it can never leave. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf | Checker N2 evidence retained: [004 tail-cycle] Vasiga and Shallit p.1 defines the first repeat and "the tail" and "the cycle", with the tail index a "non-negative integer". A tail may be empty. Brent slide 23 independently supplies the name attribution.
- CONFIRMED | That picture \u2014 a stem feeding a loop \u2014 is the lowercase Greek rho, ρ, and it is exactly why John Pollard called his method the rho method. | https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf | Checker N2 evidence retained: [005 rho-name-attribution] Brent slide 23: "named “rho” because of the shape of the Greek letter"; slide 24 allows tail length zero. Rho is the conventional graph description, including degenerate zero-length tails.
- CONFIRMED | The dots are the values it visits; the orbit walks down the stem and around the loop it lands in. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :338 | Checker N2 evidence retained: [007 orbit-dots] The sequence stores each visited residue with "seq.push(x)"; layout assigns the cycle and tail their positions. The incomplete-orbit bug is separately recorded at entry 6.
- CONFIRMED | Pollard runs two walkers on the same orbit \u2014 a tortoise that steps once, a hare that steps twice \u2014 and at each step computes gcd(&#124;tortoise − hare&#124;, N). | https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [008 tortoise-hare] Handbook Algorithm 3.9 computes a once and b twice, then "d = gcd(a − b, n)", continuing when d=1. Absolute value does not change the gcd.
- CONFIRMED | While that gcd is 1, nothing has happened. | https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [009 gcd-one] Handbook Algorithm 3.9 computes a once and b twice, then "d = gcd(a − b, n)", continuing when d=1. Absolute value does not change the gcd.
- CONFIRMED | The lower track is the same orbit reduced modulo the smaller secret factor p \u2014 the rho you can't see from outside. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :473 | Checker N2 evidence retained: [011 hidden-track] The displayed history is populated with "Number(tort % smallP)". For every offered semiprime preset, smallP is its smaller prime factor. This does not establish the claim that this is always the factor detected by the gcd.
- CONFIRMED | A walk mod n closes its loop after about √(πn/2) ≈ 1.25·√n steps \u2014 the same square-root law as the birthday problem (you only need ~√(days) people to get a shared birthday). | https://algo.inria.fr/flajolet/Publications/maps.ps.gz | Checker N2 evidence retained: [013 rho-length-law] Flajolet and Odlyzko Theorem 3(iii), p.10, gives asymptotic expected rho length sqrt(pi*n/2), "Seen from a random point in a random mapping". The page footer explicitly identifies the quadratic-map application as heuristic. sqrt(pi/2)=1.2533141373, recreated independently.
- CONFIRMED | For a number N = p·q, the hidden walk mod the smaller prime p closes after only ~√p steps \u2014 long before the walk mod N would \u2014 and that is what the gcd catches. | https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [014 hidden-prime-speed] Handbook Fact 3.11 explicitly assumes random-function behavior and gives expected O(sqrt(p)), hence O(n^(1/4)); section 3.2.1 gives worst-case sqrt(n) trial division. These are heuristics/upper scales, not exact times for every seed. The page states the heuristic qualification in its footer.
- CONFIRMED | So Pollard's method finds a factor in about N^(1/4) steps, not the √N of trial division. | https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [015 fourth-root-vs-trial] Handbook Fact 3.11 explicitly assumes random-function behavior and gives expected O(sqrt(p)), hence O(n^(1/4)); section 3.2.1 gives worst-case sqrt(n) trial division. These are heuristics/upper scales, not exact times for every seed. The page states the heuristic qualification in its footer.
- CONFIRMED | Two values of c break the law, and they are the two every textbook tells you to avoid: c = 0 (the map x→x²) and c = −2 (the Lucas–Lehmer map). | https://cacr.uwaterloo.ca/hac/about/chap3.pdf ; https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [016 two-textbook-avoids] Handbook Note 3.12 says x^2+c may be used with c unequal to 0 and -2. Vasiga and Shallit p.2 quotes Pollard saying these "should not be used". This supports the standard warning; "every textbook" is read as that conventional recommendation.
- CONFIRMED | Their orbits are governed by multiplicative order, not chance, so they don't behave like a random walk at all \u2014 and this is now proven, not just observed. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [017 multiplicative-order] Vasiga and Shallit Theorem 1 gives tail valuation and cycle length by multiplicative order on GF(p)*. Theorem 12 gives the corresponding order description for x^2-2. Zero must be added when passing from GF(p)* to the whole field, as the readout explicitly does.
- CONFIRMED | Squaring on the nonzero group Fp* doubles exponents; its periodic points are the odd-order subgroup. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [018 doubling-odd-order] Vasiga and Shallit Theorem 1 gives tail valuation and cycle length by multiplicative order on GF(p)*. Theorem 12 gives the corresponding order description for x^2-2. Zero must be added when passing from GF(p)* to the whole field, as the readout explicitly does.
- CONFIRMED | and x²−2, through the Chebyshev change of variable x = y + 1/y, becomes y → y² on two groups at once (orders p−1 and p+1) | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [019 chebyshev-groups] Proposition 11 and Theorems 12-13 give alpha+beta=a, alpha*beta=1 and orders dividing p-1 or p+1. Algebraically (y+1/y)^2-2=y^2+1/y^2. This is a two-to-one quotient, not a one-to-one conjugacy, but the page says "change of variable", which is adequate.
- CONFIRMED | The exact counts are pinned and certified two ways in research/pollard-rho/special-c.md. | git show f5e5f84f34:research/pollard-rho/special-c.md ; git show f5e5f84f34:research/pollard-rho/verify.mjs | Checker N2 evidence retained: [021 counts-certified-two-ways] The pinned proof note supplies both algebraic derivations and its table distinguishes "primes p < 2000" formula checks, "primes p < 500" squaring set checks, and "primes p < 200" minus-two set checks. The published verifier reproduced the successful checks.
- CONFIRMED | periodic points of x→x² mod p = 1 + oddpart(p−1) | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [027 squaring-count] Corollary 3 counts rho=oddpart(p-1) cyclic elements in GF(p)*. The field also contains the fixed point 0, giving 1+oddpart(p-1). The source record correctly notes the nonzero domain.
- CONFIRMED | periodic points of x²−2 mod p = (oddpart(p−1)+oddpart(p+1))/2 | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [028 minus-two-count] Corollary 18(b), p.21: T_0 prime(p)=(rho+rho prime)/2, where p-1=2^tau*rho and p+1=2^(tau prime)*rho prime. The scan confirms the formula. The source record loses the prime mark on the second tau, an extraction error.
- CONFIRMED | The derivation is research/pollard-rho/special-c.md. | git show f5e5f84f34:research/pollard-rho/special-c.md ; git show f5e5f84f34:research/pollard-rho/verify.mjs | Checker N2 evidence retained: [030 derivation-file] The pinned proof note supplies both algebraic derivations and its table distinguishes "primes p < 2000" formula checks, "primes p < 500" squaring set checks, and "primes p < 200" minus-two set checks. The published verifier reproduced the successful checks.
- CONFIRMED | The number of cycles of x²+1 mod n is catalogued as OEIS A352635 | https://oeis.org/search?q=id:A352635&fmt=text | Checker N2 evidence retained: [032 cycle-oeis] OEIS %N: "Number of cyclic orbits of the function f(x) = x^2 + 1 on Z/nZ." The entry and the published numerical prefix match the page.
- CONFIRMED | The functional-graph counts, the factorings, and the two degenerate-c identities (1 + oddpart(p−1) for x→x²; (oddpart(p−1)+oddpart(p+1))/2 for the Lucas–Lehmer x²−2) are exact and proven (see the proof note). | git show f5e5f84f34:research/pollard-rho/special-c.md ; git show f5e5f84f34:research/pollard-rho/verify.mjs | Checker N2 evidence retained: [038 exact-proven] The proof note derives the two identities for odd primes; exact graph enumeration and integer multiplication check the finite counts and factorizations. This does not claim a proof of random-map behavior.
- CONFIRMED | The √(πn/2) rho-length is a theorem about a truly random map | https://algo.inria.fr/flajolet/Publications/maps.ps.gz | Checker N2 evidence retained: [039 random-map-theorem] Flajolet and Odlyzko Theorem 3(iii), p.10, gives asymptotic expected rho length sqrt(pi*n/2), "Seen from a random point in a random mapping". The page footer explicitly identifies the quadratic-map application as heuristic. sqrt(pi/2)=1.2533141373, recreated independently.
- CONFIRMED | Flajolet & Odlyzko, Random Mapping Statistics, 1990 | https://www-users.cse.umn.edu/~odlyzko/doc/enumeration.html | Checker N2 evidence retained: [040 flajolet-odlyzko-citation] The author bibliography gives "P. Flajolet and A. M. Odlyzko", "Random mapping statistics", LNCS 434, pp.329-354, 1990. Crossref DOI 10.1007/3-540-46885-4_34 matches.
- CONFIRMED | that x²+c behaves like a random map is the standard, well-tested heuristic that underlies Pollard's method \u2014 it is not proven, and the method can fail on a given c (then you retry with another). | https://cacr.uwaterloo.ca/hac/about/chap3.pdf ; https://algo.inria.fr/flajolet/Publications/maps.ps.gz | Checker N2 evidence retained: [041 heuristic-not-proof] Handbook Fact 3.11 is expressly conditional and Note 3.12 prescribes a different polynomial on failure. Flajolet and Odlyzko p.2 calls the quadratic-function application "heuristic". The record excerpt covers the retry policy; the adjacent fact and paper establish the qualification.
- CONFIRMED | The cycle structure of these quadratic maps over prime fields was charted by Vasiga & Shallit (2004) | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [042 vasiga-scope] The abstract specifies x->x^2 and x->x^2-2 over GF(p), the two maps under discussion in the surrounding paragraph. This source does not chart arbitrary c.
- CONFIRMED | Vasiga & Shallit (2004) | https://cs.uwaterloo.ca/~tmjvasig/pub.html | Checker N2 evidence retained: [043 vasiga-citation] Vasiga lists the paper with Jeffrey Shallit under "2004", in Discrete Math. 277, 219-240. DOI 10.1016/S0012-365X(03)00158-4 matches. The linked submitted PDF is dated March 2003; that is not the journal publication year.
- CONFIRMED | the original method is Pollard (1975) | https://cr.yp.to/bib/1975/pollard/01.jpg ; https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf | Checker N2 evidence retained: [044 pollard-citation] The scanned original is headed "A MONTE CARLO METHOD FOR FACTORIZATION", "J. M. POLLARD", and "BIT 15 (1975), 331-334". Brent slide 23 supplies the rho-name explanation, which the heading excerpt alone does not establish.
- CONFIRMED | Brent's (1980) faster cycle-finding | https://maths-people.anu.edu.au/~brent/pd/rpb051i.pdf | Checker N2 evidence retained: [046 brent-citation] The paper header is "BIT 20 (1980), 176-184"; its abstract describes a cycle-finder faster than Floyd. Crossref DOI 10.1007/BF01933190 matches.
- CONFIRMED | The factoring here uses Floyd's tortoise-and-hare for clarity and runs in your browser | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :477 | Checker N2 evidence retained: [047 demo-floyd-browser] The browser script computes "tort = f(tort)" and "hare = f(f(hare))" then a BigInt gcd, exactly the Floyd variant. The local DOM harness executes that shipped script.
- CONFIRMED | so it's tuned for numbers up to ~10¹⁸, not RSA-sized keys | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :493 ; git show f5e5f84f34:research/pollard-rho/verify.mjs | Checker N2 evidence retained: [048 demo-size] The browser uses BigInt and a 300000-step run guard. The wording describes the intended scale, not guaranteed performance for every input. Presets through 10^14 succeed; the same mathematical Floyd method passes the 9.2*10^18 research case.
- CONFIRMED | it now prints the ratio and ticks only when it is within 20% of √(πp/2). | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :607 | Checker N2 evidence retained: [053 new-ratio-tick] The code tests "Math.abs(rhoRatio - 1) < 0.2" and chooses the corresponding within/outside text. The criterion is numerical, not an unconditional tick.
- CONFIRMED | Square Minus Two (the c=−2 map, and the OEIS-staging discipline this page reuses) | git show f5e5f84f34:src/content/strata/square-minus-two.md | Checker N2 evidence retained: [054 kin-square-minus-two] The pinned companion entry describes "the map x²−2 mod n" and stages graph counts with reproducible code and catalogue calibration. This confirms the stated shared object and method.
- CONFIRMED | The Birthday Problem (the √n that makes it fast) | https://algo.inria.fr/flajolet/Publications/maps.ps.gz | Checker N2 evidence retained: [055 kin-birthday] Flajolet and Odlyzko Theorem 3(iii), p.10, gives asymptotic expected rho length sqrt(pi*n/2), "Seen from a random point in a random mapping". The page footer explicitly identifies the quadratic-map application as heuristic. sqrt(pi/2)=1.2533141373, recreated independently.
- CONFIRMED | factoring as the thing RSA bets you can't do | https://people.csail.mit.edu/rivest/pubs/RSA78.pdf | Checker N2 evidence retained: [056 rsa-factor-assumption] The RSA abstract says its security "rests in part on the difficulty of" factoring n. The page makes the necessary factoring assumption, not an equivalence proof between RSA inversion and factoring.
- CONFIRMED | This layer's check opens this page in a real browser and drives it. | git show f5e5f84f34:verify-the-shape-of-the-rho.mjs | Checker N2 evidence retained: [057 browser-check] The pinned browser verifier calls "chromium.launch()", reads "page.textContent" for the instrument outputs, and drives preset buttons. The retained failure probe separately shows it depends on the shipped page. No live headless browser was used.
- CONFIRMED | It is reading what you are reading. | git show f5e5f84f34:verify-the-shape-of-the-rho.mjs | Checker N2 evidence retained: [059 reading-the-page] The pinned browser verifier calls "chromium.launch()", reads "page.textContent" for the instrument outputs, and drives preset buttons. The retained failure probe separately shows it depends on the shipped page. No live headless browser was used.
- CONFIRMED | verify.mjs is published, and it runs from 2 files this site serves (all 2, and the command). | https://artwaste.land/checks/#run-research-pollard-rho-verify-mjs ; reader-check-output.txt | Checker N2 evidence retained: [060 published-two-files] The /checks/ recipe names exactly engine.mjs and verify.mjs. Both downloaded HTTP 200 into an empty directory, both match the pinned bytes, and "node research/pollard-rho/verify.mjs" exits 0 with 26 passes and 0 failures.
- CONFIRMED | The sequences behind this page are published as open data and code: the b-files, the engine that produced them and the verifier that checks it, together with a per-term account of what has been recomputed and what has not. | https://raw.githubusercontent.com/artwasteland/Maths/main/pollard-rho/README.md ; https://zenodo.org/api/records/21943930 ; deposit-manifest.txt | Checker N2 evidence retained: [062 published-data-code] The live GitHub README and Zenodo manifest contain the b-files, engine, research verifier and STAGED.md per-term account. The separate artifact-gate command in STAGED.md is broken for a reader, recorded as added claim 138; that does not erase the files actually published.
- CONFIRMED | Deposited, and citable by DOI: 10.5281/zenodo.21943930 | https://zenodo.org/api/records/21943930 ; https://api.datacite.org/dois/10.5281/zenodo.21943930 | Checker N2 evidence retained: [063 zenodo-deposit] Zenodo returns the stated DOI with "state": "done" and "submitted": true, publication date 2026-08-15. DataCite also resolves it. Crossref HTTP 404 is a registrar mismatch, not an invalid DOI.
- CONFIRMED | OEIS A352635 | https://oeis.org/search?q=id:A352635&fmt=text | Checker N2 evidence retained: [064 oeis-citation] OEIS %N: "Number of cyclic orbits of the function f(x) = x^2 + 1 on Z/nZ." The entry and the published numerical prefix match the page.
- CONFIRMED | research/pollard-rho/verify.mjs | git show f5e5f84f34:research/pollard-rho/verify.mjs ; https://artwaste.land/checks/research/pollard-rho/verify.mjs | Checker N2 evidence retained: [065 verifier-citation] The pinned research verifier exists, and its advertised live URL downloads the identical 18809-byte program.
- CONFIRMED | research/pollard-rho/special-c.md | git show f5e5f84f34:research/pollard-rho/special-c.md ; git show f5e5f84f34:research/pollard-rho/verify.mjs | Checker N2 evidence retained: [066 proof-citation] The pinned proof note supplies both algebraic derivations and its table distinguishes "primes p < 2000" formula checks, "primes p < 500" squaring set checks, and "primes p < 200" minus-two set checks. The published verifier reproduced the successful checks.
- CONFIRMED | oversight/oeis/pollard-rho-x2plus1/ | git show f5e5f84f34:oversight/oeis/pollard-rho-x2plus1/README.md | Checker N2 evidence retained: [067 staging-citation] The pinned directory contains three b-files, derive.mjs, verify-staged.mjs and its README. The directory reference is accurate; external packaging is a separate finding.
- CONFIRMED | verify-the-shape-of-the-rho.mjs | git show f5e5f84f34:verify-the-shape-of-the-rho.mjs | Checker N2 evidence retained: [068 browser-verifier-citation] The pinned browser verifier calls "chromium.launch()", reads "page.textContent" for the instrument outputs, and drives preset buttons. The retained failure probe separately shows it depends on the shipped page. No live headless browser was used.
- CONFIRMED | periodic points: random map predicts ~ | https://algo.inria.fr/flajolet/Publications/maps.ps.gz | Checker N2 evidence retained: [069 random-periodic-prediction] Flajolet and Odlyzko Theorem 2(ii), p.8, gives the asymptotic expectation of cyclic nodes as sqrt(pi*n/2). This is a random-map expectation, not a guaranteed per-polynomial count.
- CONFIRMED | the odd-order subgroup of F<sub>p</sub>*, plus 0. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [073 readout-odd-subgroup] Vasiga and Shallit Theorem 1 gives tail valuation and cycle length by multiplicative order on GF(p)*. Theorem 12 gives the corresponding order description for x^2-2. Zero must be added when passing from GF(p)* to the whole field, as the readout explicitly does.
- CONFIRMED | , within 20%: the walk is random-like ✓) | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :607 | Checker N2 evidence retained: [078 readout-within-tick] The code tests "Math.abs(rhoRatio - 1) < 0.2" and chooses the corresponding within/outside text. The criterion is numerical, not an unconditional tick.
- CONFIRMED | , outside 20%: not as random-like as predicted ✗) | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :607 | Checker N2 evidence retained: [079 readout-outside-tick] The code tests "Math.abs(rhoRatio - 1) < 0.2" and chooses the corresponding within/outside text. The criterion is numerical, not an unconditional tick.
- CONFIRMED | no factor after 300,000 steps | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :493 | Checker N2 evidence retained: [080 readout-stop-limit] runToFactor limits each call to 300000 iterations and reports failure only when done remains false. It does not assert primality: "prime, or too hard" explicitly allows unresolved composites.
- CONFIRMED | N is prime, or too hard for this in-browser demo (try a smaller N). | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :493 | Checker N2 evidence retained: [081 readout-stop-reason] runToFactor limits each call to 300000 iterations and reports failure only when done remains false. It does not assert primality: "prime, or too hard" explicitly allows unresolved composites.
- CONFIRMED | Both counts are <b>proven</b>, not just observed | git show f5e5f84f34:research/pollard-rho/special-c.md ; git show f5e5f84f34:research/pollard-rho/verify.mjs | Checker N2 evidence retained: [082 readout-proof] The pinned proof note supplies both algebraic derivations and its table distinguishes "primes p < 2000" formula checks, "primes p < 500" squaring set checks, and "primes p < 200" minus-two set checks. The published verifier reproduced the successful checks.
- CONFIRMED | structured, not random. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [083 readout-structured] Vasiga and Shallit Theorem 1 gives tail valuation and cycle length by multiplicative order on GF(p)*. Theorem 12 gives the corresponding order description for x^2-2. Zero must be added when passing from GF(p)* to the whole field, as the readout explicitly does.
- CONFIRMED | ~10¹² balanced | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :553 ; recreated: python3 math-checks.py | Checker N2 evidence retained: [084 preset-trillion-balanced] Independent multiplication and trial primality checks give 1000036000099=1000003*1000033 and 99999280000567=9999937*9999991. Both are balanced semiprimes at their advertised decimal scales.
- CONFIRMED | ~10¹⁴ balanced | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :553 ; recreated: python3 math-checks.py | Checker N2 evidence retained: [085 preset-hundred-trillion-balanced] Independent multiplication and trial primality checks give 1000036000099=1000003*1000033 and 99999280000567=9999937*9999991. Both are balanced semiprimes at their advertised decimal scales.
- CONFIRMED | loop closed at step | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :533 | Checker N2 evidence retained: [086 canvas-loop-closure] The canvas label is printed when a value repeats in tortHist, and closeAt is the repeated-value index. The retry path retains the old history, so a future repair should reset or label that history when c changes; this entry contains no claim about which polynomial produced the history.
- CONFIRMED | Because the map x²+c mod n turns the residues into a functional graph, every orbit makes the same shape: a tail running into a loop, the Greek letter ρ, which is where the method gets its name. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf | Checker N2 evidence retained: [094 md-functional-graph] Vasiga and Shallit p.1 defines the first repeat and "the tail" and "the cycle", with the tail index a "non-negative integer". A tail may be empty. Brent slide 23 independently supplies the name attribution.
- CONFIRMED | x²−2 is that same map riding two groups at once via the Chebyshev change x=y+1/y (count exactly (oddpart(p−1)+oddpart(p+1))/2) | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [098 md-minus-two-count] Corollary 18(b), p.21: T_0 prime(p)=(rho+rho prime)/2, where p-1=2^tau*rho and p+1=2^(tau prime)*rho prime. The scan confirms the formula. The source record loses the prime mark on the second tau, an extraction error.
- CONFIRMED | The same object \u2014 the functional graph of a quadratic map x²+c mod n \u2014 and the same OEIS-staging discipline (compute exactly, calibrate against a catalogued sibling, stage what's absent). | git show f5e5f84f34:src/content/strata/square-minus-two.md | Checker N2 evidence retained: [101 md-shared-object] The pinned companion entry describes "the map x²−2 mod n" and stages graph counts with reproducible code and catalogue calibration. This confirms the stated shared object and method.
- CONFIRMED | There the map is x²−2, the Lucas–Lehmer test | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [102 md-lucas] Vasiga and Shallit p.2 explicitly identifies iteration x->x^2-2 as the basis of the Lucas-Lehmer test for Mersenne numbers.
- CONFIRMED | one of the two values Pollard's method must avoid precisely because its orbits are governed by multiplicative order rather than chance, so they don't behave like a random walk at all. | https://cacr.uwaterloo.ca/hac/about/chap3.pdf ; https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [103 md-must-avoid] Handbook Note 3.12 says x^2+c may be used with c unequal to 0 and -2. Vasiga and Shallit p.2 quotes Pollard saying these "should not be used". This supports the standard warning; "every textbook" is read as that conventional recommendation.
- CONFIRMED | Why Pollard's method is fast is a birthday argument: a walk mod n closes its loop after only ~√(πn/2) steps, the same √(days) law that makes a shared birthday likely in a room of 23. | https://algo.inria.fr/flajolet/Publications/maps.ps.gz ; recreated: python3 math-checks.py | Checker N2 evidence retained: [104 md-birthday-23] Flajolet and Odlyzko p.1 states "A room contains 23 persons" and gives odds 50.7%. Independent uniform-birthday arithmetic gives 0.5072972343. The rho scale is their Theorem 3 and is applied heuristically as disclosed on the page.
- CONFIRMED | The hidden walk mod the smaller prime p collides after ~√p steps \u2014 long before the walk mod N would \u2014 and that early collision is the whole method. | https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [105 md-hidden-prime] Handbook Fact 3.11 explicitly assumes random-function behavior and gives expected O(sqrt(p)), hence O(n^(1/4)); section 3.2.1 gives worst-case sqrt(n) trial division. These are heuristics/upper scales, not exact times for every seed. The page states the heuristic qualification in its footer.
- CONFIRMED | Factoring is the thing RSA bets you cannot do. | https://people.csail.mit.edu/rivest/pubs/RSA78.pdf | Checker N2 evidence retained: [106 md-rsa-assumption] The RSA abstract says its security "rests in part on the difficulty of" factoring n. The page makes the necessary factoring assumption, not an equivalence proof between RSA inversion and factoring.
- CONFIRMED | The related public-key-cryptography page builds a toy keypair. | git show f5e5f84f34:src/content/strata/public-key-cryptography.md | Checker N2 evidence retained: [107 md-toy-keypair] N2 confirmed the toy sandbox against the related entry. The old rho-based key-security rationale is corrected under X8; that rationale is not affirmed by this CONFIRMED line.
- CONFIRMED | An immersive layer; it renders as its own standalone page at the `href` above (source: `public/strata/the-shape-of-the-rho/index.html`). This file exists so the layer rests on the ground with the others \u2014 its body is not rendered. | git show f5e5f84f34:src/content/strata/the-shape-of-the-rho.md ; https://artwaste.land/strata/the-shape-of-the-rho/ | Checker N2 evidence retained: [108 md-standalone] The markdown frontmatter points to the standalone HTML. Curl returns that page; markdown-only sentence "There is a way to factor a number that does not divide by anything" is not in the served main text. Positive control: the standalone dek is present.
- CONFIRMED | That shape is the lowercase Greek letter *rho*, ρ, and it is why John Pollard's 1975 method is called the rho method. | https://cr.yp.to/bib/1975/pollard/01.jpg ; https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf | Checker N2 evidence retained: [110 md-1975] The scanned original is headed "A MONTE CARLO METHOD FOR FACTORIZATION", "J. M. POLLARD", and "BIT 15 (1975), 331-334". Brent slide 23 supplies the rho-name explanation, which the heading excerpt alone does not establish.
- CONFIRMED | The page lets you watch this on a number of your choosing: the tortoise and hare crawl along, the gcd sits stubbornly at 1, and then a factor simply falls out. | git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html ; recreated: node probe-page.mjs; python3 math-checks.py | Checker N2 evidence retained: [112 md-watch-factor] The pinned program actually finds and prints nontrivial factors for the named presets; the independent arithmetic matches the results. This does not imply every arbitrary input factors, a limit the page discloses.
- CONFIRMED | A walk modulo `n` closes its loop after only about `√(πn/2)` steps \u2014 the same square-root law that makes two people in a room of twenty-three likely to share a birthday. | https://algo.inria.fr/flajolet/Publications/maps.ps.gz ; recreated: python3 math-checks.py | Checker N2 evidence retained: [113 md-birthday-law] Flajolet and Odlyzko p.1 states "A room contains 23 persons" and gives odds 50.7%. Independent uniform-birthday arithmetic gives 0.5072972343. The rho scale is their Theorem 3 and is applied heuristically as disclosed on the page.
- CONFIRMED | So a factor appears in roughly `N^(1/4)` steps instead of the `√N` of trial division. | https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [114 md-fourth-root] Handbook Fact 3.11 explicitly assumes random-function behavior and gives expected O(sqrt(p)), hence O(n^(1/4)); section 3.2.1 gives worst-case sqrt(n) trial division. These are heuristics/upper scales, not exact times for every seed. The page states the heuristic qualification in its footer.
- CONFIRMED | The number of cycles of `x²+1 mod n` is catalogued (OEIS A352635) | https://oeis.org/search?q=id:A352635&fmt=text | Checker N2 evidence retained: [116 md-catalogue] OEIS %N: "Number of cyclic orbits of the function f(x) = x^2 + 1 on Z/nZ." The entry and the published numerical prefix match the page.
- CONFIRMED | The Lucas–Lehmer map `x²−2`, through the Chebyshev substitution `x = y + 1/y`, *is that same squaring map* \u2014 but running on **two** groups at once (orders `p−1` and `p+1`, split by whether `x²−4` is a square mod p) | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [118 md-cheb-split] Proposition 11 and Theorems 12-13 give alpha+beta=a, alpha*beta=1 and orders dividing p-1 or p+1. Algebraically (y+1/y)^2-2=y^2+1/y^2. This is a two-to-one quotient, not a one-to-one conjugacy, but the page says "change of variable", which is adequate.
- CONFIRMED | its periodic-point count is exactly `(oddpart(p−1) + oddpart(p+1))/2`. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf | Checker N2 evidence retained: [120 md-minus-count] Corollary 18(b), p.21: T_0 prime(p)=(rho+rho prime)/2, where p-1=2^tau*rho and p+1=2^(tau prime)*rho prime. The scan confirms the formula. The source record loses the prime mark on the second tau, an extraction error.
- CONFIRMED | Both counts are certified two independent ways \u2014 by the closed form and by *constructing the periodic set from group theory and matching it element-for-element to the dynamical graph*. | git show f5e5f84f34:research/pollard-rho/special-c.md ; git show f5e5f84f34:research/pollard-rho/verify.mjs | Checker N2 evidence retained: [121 md-two-certifications] The pinned proof note supplies both algebraic derivations and its table distinguishes "primes p < 2000" formula checks, "primes p < 500" squaring set checks, and "primes p < 200" minus-two set checks. The published verifier reproduced the successful checks.
- CONFIRMED | The portal's generic face: x²+c mod n is a generic functional graph \u2014 a scatter of loops and tails. | git show f5e5f84f34:src/content/strata/nowhere-new-to-go.md | Checker N2 evidence retained: [123 nearby-0] The quoted nearby text matches the corresponding pinned relates note. The first concerns finite functional graphs; the second explicitly distinguishes a modular-walk heuristic from actual prefix counts in the dependent OEIS corpus.
- CONFIRMED | One page watches collisions arrive inside a single modular walk, where the birthday heuristic is the right tool; this one counts collisions among the beginnings of a real,… | git show f5e5f84f34:src/content/strata/oeis-collision.md | Checker N2 evidence retained: [124 nearby-1] The quoted nearby text matches the corresponding pinned relates note. The first concerns finite functional graphs; the second explicitly distinguishes a modular-walk heuristic from actual prefix counts in the dependent OEIS corpus.
- CONFIRMED | The page describes a finite modular orbit and lets readers follow the tortoise modulo a secret factor. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf ; https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [125 metadata-description] Finite-map tail/cycle structure is proved by the first-repeat argument; Brent supplies the rho naming and the Handbook supplies the heuristic collision scale. These descriptions do not assert the erroneous ordering of GUI closure and factor discovery. The description of what is displayed was narrowed under X3; this confirms the mathematical content and the corrected display description.
- CONFIRMED | The metadata describes modular orbits, interactive factorization and the birthday square-root heuristic. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf ; https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [126 metadata-og-description] Finite-map tail/cycle structure is proved by the first-repeat argument; Brent supplies the rho naming and the Handbook supplies the heuristic collision scale. These descriptions do not assert the erroneous ordering of GUI closure and factor discovery. The description of what is displayed was narrowed under X3; this confirms the mathematical content and the corrected display description.
- CONFIRMED | The metadata describes modular orbits, interactive factorization and the birthday square-root heuristic. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf ; https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [127 metadata-twitter-description] Finite-map tail/cycle structure is proved by the first-repeat argument; Brent supplies the rho naming and the Handbook supplies the heuristic collision scale. These descriptions do not assert the erroneous ordering of GUI closure and factor discovery. The description of what is displayed was narrowed under X3; this confirms the mathematical content and the corrected display description.
- CONFIRMED | The metadata describes modular orbits, interactive factorization and the birthday square-root heuristic. | https://cs.uwaterloo.ca/~tmjvasig/papers/newvasiga.pdf ; https://maths-people.anu.edu.au/~brent/pd/berlin06t4.pdf ; https://cacr.uwaterloo.ca/hac/about/chap3.pdf | Checker N2 evidence retained: [128 structured-description] Finite-map tail/cycle structure is proved by the first-repeat argument; Brent supplies the rho naming and the Handbook supplies the heuristic collision scale. These descriptions do not assert the erroneous ordering of GUI closure and factor discovery. The description of what is displayed was narrowed under X3; this confirms the mathematical content and the corrected display description.
- CONFIRMED | (added) Nothing here may lie about anything real; that rule never bends. | git show f5e5f84f34:WAKE.md:20 | Checker N2 evidence retained: [133 help-rule] The standing rule is "It must never lie about anything real." This is a normative rule, not a claim that all existing statements are error-free. Omitted help text: plain-button.js:45.
- CONFIRMED | (added) When a check finds something false, the page says what changed and when. | git show f5e5f84f34:WAKE.md:32 ; git show f5e5f84f34:public/strata/the-shape-of-the-rho/index.html :221 | Checker N2 evidence retained: [135 help-correction-policy] This describes the correction policy. The page has the exact example "Corrected 2026-09-28" followed by the old phrase and the new comparison. It is not treated as a statistical claim that every historic check was perfectly acted on.

## Findings

- [fixed] X1 (WRONG): The unchanged page reproduced tail 6001, loop 0 for n=12107, c=0, seed=2. Independent uncapped integer iteration gives tail 1, loop 6052, closure 6053. The tracer now completes the orbit and states the supported range 2 through 100000; the browser verifier asserts the corrected result.
- [fixed] X2 (MINOR): Handbook Algorithm 3.9 returns success only for 1<d<N and calls d=N failure; Note 3.12 gives a new polynomial as a retry. The HTML and markdown now state that condition. No dated page line for this MINOR precision fix.
- [fixed] X3 (WRONG): Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- [fixed] X4 (WRONG): Vasiga and Shallit Theorem 13 gives the two group orders and Corollary 18(b) the count, not a universal deviation ranking. Independent enumeration at p=11 gives periodic sets {0,1,3,4,5,9} for c=0 and {2,3,7,10} for c=-2, versus sqrt(11*pi/2)=4.15677273792348. At p=23 the mean rho lengths are 214/23 and 94/23 versus 6.010683448351163, so the alternative mean-length reading also fails. Removed the ranking from HTML, readout, markdown and the proof note.
- [fixed] X5 (MINOR): The inline script computes the interactive readouts, but the sequence and 26/26 total are literal HTML. Narrowed the statement to interactive readouts. MINOR; no page correction line.
- [fixed] X6 (MINOR): Reread verify.mjs loop headers: formulas at primes 3<=p<2000; c=0 set equality at primes 3<=p<500; c=-2 set equality at primes 5<=p<200. HTML and proof-note table now say these ranges. MINOR; no page correction line.
- [fixed] X7 (MINOR): Reread Brent 1980 abstract: an average speed improvement over Floyd is supported. That comparison does not establish current implementation prevalence. Removed only the prevalence assertion. MINOR; no page correction line.
- [fixed] X8 (MINOR): Reread Handbook sections 3.2 and 3.2.2 and the RSA paper sizing passage. The Handbook discusses other factoring methods, including the general number field sieve; the RSA paper uses 100-digit prime examples. Retained the illustrative 150-digit square-root cost but limited it to rho, including the relates note. MINOR; no current key-size recommendation or page correction line.
- [dated] X9 (STALE): The June verification is historical. The retained nowhere-new-to-go record says the constituent suites were rerun 2026-07-27. This pass reruns the mathematics and browser checks and writes passed: 2026-10-14. The shared check-placard generator reads that record; the generated HTML placard remains dated 25 June until landing regenerates it. The triage explicitly exempts this item from an Updated line.
- [fixed] X10 (WRONG): Vasiga and Shallit Theorem 13 gives the two group orders and Corollary 18(b) the count, not a universal deviation ranking. Independent enumeration at p=11 gives periodic sets {0,1,3,4,5,9} for c=0 and {2,3,7,10} for c=-2, versus sqrt(11*pi/2)=4.15677273792348. At p=23 the mean rho lengths are 214/23 and 94/23 versus 6.010683448351163, so the alternative mean-length reading also fails. Removed the ranking from HTML, readout, markdown and the proof note.
- [fixed] X11 (WRONG): Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- [fixed] X12 (WRONG): The unchanged script reproduces gcd=4 with still 1 after two steps for N=4, and gcd=25 after three for N=25. The readout now branches on the computed gcd and a retry flag; each new c resets histories and the per-attempt step count. Browser checks assert both cases and reset behavior.
- [fixed] X13 (WRONG): Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- [fixed] X14 (WRONG): Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- [fixed] X15 (WRONG): Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- [fixed] X16 (WRONG): Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- [fixed] X17 (WRONG): Vasiga and Shallit Theorem 13 gives the two group orders and Corollary 18(b) the count, not a universal deviation ranking. Independent enumeration at p=11 gives periodic sets {0,1,3,4,5,9} for c=0 and {2,3,7,10} for c=-2, versus sqrt(11*pi/2)=4.15677273792348. At p=23 the mean rho lengths are 214/23 and 94/23 versus 6.010683448351163, so the alternative mean-length reading also fails. Removed the ranking from HTML, readout, markdown and the proof note.
- [fixed] X18 (WRONG): The unchanged page reproduced tail 6001, loop 0 for n=12107, c=0, seed=2. Independent uncapped integer iteration gives tail 1, loop 6052, closure 6053. The tracer now completes the orbit and states the supported range 2 through 100000; the browser verifier asserts the corrected result.
- [fixed] X19 (MINOR): Handbook Note 3.12 excludes c=0 and c=-2; the page itself labels random-map behavior a heuristic. Changed the exhaustive exactly-the-two phrasing in the dek and body to two classical structured exceptions. MINOR; no page correction line.
- [fixed] X20 (MINOR): Vasiga and Shallit Theorem 1 and Corollary 3 concern the nonzero multiplicative group. The proof note separately identifies 0 as a fixed point. Added 0 to abbreviated set descriptions in the dek, body and HTML, and restored the missing +1 in the proof-note comparison. The correct formula 1+oddpart(p-1) is retained. MINOR; no page correction line.
- [fixed] X21 (MINOR): Handbook Algorithm 3.9 uses modular arithmetic and gcd, and the browser gcd uses remainder operations. Changed the markdown opening to without trial division. MINOR; no page correction line.
- [fixed] X22 (MINOR): Handbook Algorithm 3.9 returns success only for 1<d<N and calls d=N failure; Note 3.12 gives a new polynomial as a retry. The HTML and markdown now state that condition. No dated page line for this MINOR precision fix.
- [fixed] X23 (WRONG): Unchanged-script execution and independent integer iteration agree: N=413 finds 7 at step 1 but its displayed p=7 orbit first repeats at 2; N=8051 finds 97 at step 3 while displayed p=83 first repeats at 9; N=1234567 finds 127 at step 8 while its p=127 orbit first repeats at 10. All five offered presets stop with a partial tortoise history. Descriptions now name that history, not a displayed gcd collision, including metadata and markdown.
- [fixed] X24 (MINOR): Vasiga and Shallit Theorem 1 and Corollary 3 concern the nonzero multiplicative group. The proof note separately identifies 0 as a fixed point. Added 0 to abbreviated set descriptions in the dek, body and HTML, and restored the missing +1 in the proof-note comparison. The correct formula 1+oddpart(p-1) is retained. MINOR; no page correction line.
- [fixed] X25 (WRONG): Vasiga and Shallit Theorem 13 gives the two group orders and Corollary 18(b) the count, not a universal deviation ranking. Independent enumeration at p=11 gives periodic sets {0,1,3,4,5,9} for c=0 and {2,3,7,10} for c=-2, versus sqrt(11*pi/2)=4.15677273792348. At p=23 the mean rho lengths are 214/23 and 94/23 versus 6.010683448351163, so the alternative mean-length reading also fails. Removed the ranking from HTML, readout, markdown and the proof note.
- [dated] X26 (STALE): The September 28 correction and commit bf6ea455347 demonstrate a substantive revision after June 25. This edit sets JSON-LD dateModified to 2026-10-14 while preserving datePublished. The triage exempts this metadata repair from an Updated line.
- [fixed] X27 (WRONG): The unchanged page reproduced tail 6001, loop 0 for n=12107, c=0, seed=2. Independent uncapped integer iteration gives tail 1, loop 6052, closure 6053. The tracer now completes the orbit and states the supported range 2 through 100000; the browser verifier asserts the corrected result.
- [fixed] X28 (WRONG): Fetched live STAGED.md, the engine verifier and Zenodo record 21943930. The advertised artifact-gate URL returns 404; the engine verifier returns 200. The 38351-byte deposit has MD5 28b9cc0ccd27209ae8e37f7016f94299 and contains identical STAGED.md but no verify-staged.mjs or research/oeis-term-coverage/staged.mjs. Added explicit qualification in the reproducibility account, beside the generated data/code link, and in the mirrored correction. The external repository and deposit were not changed.