\section{Conclusion}
\label{sec:conclusion}

We asked whether an autonomous, hypothesis-driven exploration of the mathematics behind Bitcoin's primitives could
find a shortcut past the square-root barrier, and we built the apparatus to answer the question honestly: a verified
literature base, twenty-five falsifiable hypotheses, exact symbolic checks, a native experimental engine with
operation counts and provenance, machine-checked statements, and a classification rubric that does not reward
enthusiasm. The answer is no, with the following specifics.

The algebraic structure of \secp{} is fully accounted for by complex multiplication by $\Z[\omega]$: it yields the
$\sqrt6$ reduction in rho iterations and the halving of doublings in scalar multiplication, it determines the GLV
constants of \libsecp{} in closed form, and it leaves no room for a further endomorphism or for a smaller quotient
group. The generic algorithms behave exactly as the random-mapping theory predicts on $6\,240$ synthetic instances:
$T(n)\propto n^{0.5}$, $1.254\sqrt n$ iterations for rho, $\sqrt6$ from the automorphisms in iterations---though not,
in our engine, in seconds---and the trade-offs of memory, parallelism and preprocessing that the literature describes.
An automated search over iteration-function designs cannot beat the random-mapping floor. ECDSA and Schnorr differ
in proof structure, not in verification cost; batch verification is the one real, consensus-neutral verification
speed-up and it saturates at about $3\times$ for an identifiable reason. Reduced-step SHA-256 behaves as the
published analyses say and our generic solvers reach only the easy regime. The bit-level identities that
implementations rely on are now machine-checked, and so are the two textbook facts about the signature equations.

What the exercise shows about automated discovery is perhaps more useful than any single number. On a problem
where the correct answer is ``nothing new'', an autonomous agent is at risk of producing confident
over-interpretations---a constant mistaken for an exponent, a reproduction mistaken for a discovery, a
compression-function property mistaken for a hash property. The controls that prevented this here were cheap:
operation counts next to timings, two implementations per component, a negative control per family, exact
arithmetic, provenance on every number, formal statements separated from informal ones, and a classifier that
required a literature match before the word ``new'' could be used. The one genuinely clarifying algebraic statement
the pipeline produced---that the \libsecp{} constants are the coordinates of $\bar\pi-1$---came from a bounded
enumeration followed by a human-readable proof, which is the pattern we would expect future automated
mathematical research on cryptographic standards to follow: automation proposes, exact verification disposes, and
the literature has the last word on novelty.