Peter, I disagree that the role of the certification pilot is limited by ‘math’.
Modern systems certification involves both man and machine; thus, more than one perspective is required, and neither need dominate.
If the certification is to be done mainly ‘in the head’, then why not use the head of a certification pilot (test pilot, evaluation pilot, and line pilot) who should have the better understanding of the context – the situation in which an anomaly has to evaluated and a judge a plausible crew response. It is the combination of man and machine that has to be resilient.
In essence, this thread asks if modern designs are good enough; but alternativly are humans good enough to operate the human inspired designs?
Furthermore, instead of framing the problem as failures in design or operation, perhaps we should be asking why the certification process (judgement), which promotes safety by regulation of both man and machine, appears to have failed. Has it failed because it is now fundamentally different or because it still needs to change?