Testing Multi-Domain Convergence Against Negative Cases: A backtest of one open-source alert rule on NATO's Southern Flank, under a protocol fixed in advance, and what open sources could not supply

Strategic foresight commonly holds that crises announce themselves through weak anomalies appearing across several domains at once, and that their convergence carries more warning value than any single signal. The proposition underpins the indications-and-warning tradition and recent hybrid-threat frameworks, and it has rarely been tested against data, almost never against periods in which the signals appeared and no crisis followed. This study tests one concrete reading of it: alert when two or more domains are anomalous within four weeks. Six series - political violence, armed conflict, cyber incidents, maritime chokepoint traffic, naval posture and gas inflows - were assembled into a weekly panel of 6,750 area-weeks covering the Central and Eastern Mediterranean, North Africa and the Red Sea approaches from 2018 to 2026. Eleven cases were frozen before analysis: six crises, four comparable periods of tension in which no escalation followed, and one validation case. Thresholds, horizons, the reporting lag and the falsification conditions were fixed in writing before the first result; the analysis departed from that protocol in nine places, all stated, the most consequential being the choice of headline statistic. The alert rate in the twenty-six weeks before escalation is 10.3 per cent, against 10.4 per cent before the negative cases and 9.6 per cent in control weeks, and the pattern holds across every pre-committed specification. It also holds when the thresholds are estimated only from weeks before each case, when they are refitted on the literal control definition, and when cyber incidents are dated by their public attribution rather than by the day they began. Because chokepoint and naval-posture series are shared across areas, each case was also compared, as an exploratory check, with the control areas in the same weeks: there the crises alert at 10.3 per cent against 10.9. One reading changes the picture and is reported beside it: under the letter of the frozen definition, which makes the Tunisian negative a positive, the pre-crisis rate is 13.6 per cent and the negative rate 2.8, a borderline result that rests on that one case. Measured in the same unit and at the frozen thresholds, convergence identifies as many crises as its strongest single component, political violence; the protocol's own comparison between them cannot be decided on six cases - at an equal number of false-alarm episodes each catches five of the six - and neither rule separates the weeks before a crisis from control weeks. The 145 admissible pre-crisis weeks give 80 per cent power only for an effect at or above 1.76 times the control rate, under independence assumptions the paper rejects, so a moderate warning effect is not excluded. The validation case, the attack of 7 October 2023, would have been flagged in 12 of its 25 prior weeks, on cyber, protest, conflict and naval-posture signals between April and September 2023 whose relation to the attack this study does not test. Adding a seventh domain, air traffic, appeared to double the pre-crisis rate until the anomalies were partitioned by date, at which point the gain proved to be the 2020 collapse in civil aviation. Three findings about the sources matter at least as much. The two free products of the OpenSky aircraft-tracking network available to this study cannot see the theatre in question: one daytime hour yields 873 distinct aircraft over Italy and two over Libya. Publication time, which an honest backtest requires, is recorded natively in two of the six domains, and in one of them for just over half of the records. And the principal public archive for the information environment was withdrawn during the study. Whether these constraints explain the rule's failure to discriminate is not established; that any system built on these sources would meet them is. Preprint; not peer reviewed. Verification record: aletheia-technologies.it/verify/r/AVR-AT-SP-2026-005-v1.0-645D5.