Recursive Simulations · 2026-05-01

🔄 Recursive Simulations — 2026-05-01

🤖 NVIDIA's 24/7 Agentic Simulation Loops Automate Away Human Dead Time in Subsurface Engineering
🧩 Omniverse Decomposed into Standalone Physics APIs as ABB, Siemens, and PTC Lock In
⚛️ AI Surrogates Replace Monte Carlo at R²=0.97 in Nuclear Reactor Core Design
🫀 HealthFormer Makes the Human Body a Counterfactual Clinical Simulation Space
🦾 FLASH Closes the Deformable Object Gap: GPU-Native Robot Simulation Trains in Minutes
🏥 Foundation Model Robustness Fails Under Simulated CT Domain Shifts, Exposing Health Digital Twin Preconditions

---

🤖 NVIDIA's 24/7 Agentic Simulation Loops Automate Away Human Dead Time in Subsurface Engineering

The bottleneck in subsurface reservoir engineering is not compute — it's the human waiting for compute. A reservoir simulation run that finishes at 3 AM sits idle until an engineer arrives, reviews outputs, adjusts parameters, and resubmits. In complex field development studies, this dead time — the gap between one iteration completing and the next beginning — routinely stretches multi-day turnarounds into multi-week cycles.

NVIDIA's April 28 technical post describes an agentic architecture that closes this gap entirely. A multi-agent squad autonomously monitors simulation completion, synthesizes high-dimensional output data, proposes updated parameters via a critic-proposer debate loop, and launches the next iteration — continuously, without human intervention between cycles. The case study uses OPM Flow, the open-source reservoir simulator, applied to 30-well placement optimization on the Brugge benchmark model, maximizing net present value across a full field-development design space.

The intelligence layer runs on NVIDIA NIM, specifically Llama-3.3-Nemotron-Super-49B-v1.5 for reasoning and retrieval-augmented generation grounded in proprietary simulation manuals. The agent loop is open-sourced on GitHub as a framework explicitly described as "tool-agnostic" — applicable to any iterative simulation domain.

The authority shift here is structural and underarticulated. In the multi-agent architecture, engineers review and approve the proposer-agent's plan before each workflow batch is launched. But within each batch — which can span hundreds of simulation jobs — the agents autonomously adjust tuning parameters in real-time based on performance metrics and domain knowledge. The "heuristic pause" that previously required expert synthesis of high-dimensional optimization data has been replaced by automated synthesis. What the engineer sees is not the trajectory but the checkpoint proposal.

In reservoir engineering, this matters enormously. Well placement decisions encode multi-billion-dollar extraction strategies. The agent optimizing against NPV has no mandate to consider regulatory constraints, environmental factors, or community impact — all factors that historically entered through expert judgment during the heuristic pause. The NVIDIA post frames this as "engineers shift to a strategic supervisory role" and "reclaim significant bandwidth." What it does not frame is what gets lost when the human exits the iteration loop and enters only at the approval layer.

The convergence with adjacent domains is visible: the same architecture is described as applicable to CO₂ sequestration, geothermal energy, and any complex iterative simulation workflow. Simulation is becoming infrastructure. When it runs autonomously, questions of validation, authority, and accountability move from the iteration level to the architecture level — where they are much harder to inspect.

Sources:

---

🧩 Omniverse Decomposed into Standalone Physics APIs as ABB, Siemens, and PTC Lock In

NVIDIA's Omniverse has always been a physics and rendering platform. What changes with the April 8 announcement is the delivery mechanism: NVIDIA is decomposing Omniverse into standalone C APIs — ovrtx (RTX rendering), ovphysx (PhysX simulation), and ovstorage (unified data pipelines) — each usable independently via Python bindings, without adopting the full Omniverse Kit framework.

The stated motivation is integration friction: industrial software vendors with established stacks don't want to replatform around a new application framework. But the strategic consequence is more significant. By releasing ovrtx and ovphysx as embeddable libraries, NVIDIA makes its physics substrate ingestible by every major industrial software vendor without requiring full Omniverse adoption. ABB Robotics is embedding Omniverse into RobotStudio for training and validation of industrial robots. PTC is connecting Onshape directly into Isaac Sim for cloud-native robot design. Siemens and Cadence are integrating at scale. This is how a physics engine becomes the de facto world model for an industry.

The technical architecture makes the lock-in mechanism explicit. Isaac Lab 3.0 Beta has migrated from the monolithic Kit runtime to a multi-backend architecture: ovphysx or a Kit-less Newton backend (MuJoCo-Warp), with a pluggable renderer supporting OVRTX, Isaac RTX, and lightweight visualizers. GPU tensor exchange via DLPack enables zero-copy data transfer between the simulation state and ML frameworks — PyTorch, NumPy, Warp — directly. This removes the serialization bottleneck that previously constrained simulation-as-training-data workflows.

The MCP integration is the agentic layer. NVIDIA's kit-usd-agents expose Omniverse capabilities — loading USD scenes, editing prims, stepping simulation — via Model Context Protocol servers, making simulation manipulable by LLM-based agents. The stack from NVIDIA's description: Claude and Cursor can invoke MCP server calls directly against running Omniverse simulations.

The lock-in question is not GPU compute — hardware switching costs are real but manageable. The lock-in is the OpenUSD scene description standard and the physics stack's assumptions about what "physical" means. Every robot trained against PhysX's contact model, every digital twin authored in OpenUSD, and every industrial partner integrating via these APIs is building on NVIDIA's implicit physical world model. At GTC 2026 NVIDIA announced that the simulation stack integration now covers ABB, Adobe, Cadence, PTC, Siemens, and Synopsys. The physics layer is converging.

Sources:

---

⚛️ AI Surrogates Replace Monte Carlo at R²=0.97 in Nuclear Reactor Core Design

In nuclear reactor design, the highest-fidelity physics simulation available is Monte Carlo neutron transport. Full-core simulation at explicit pin-cell resolution — the fundamental repeating unit of a reactor, comprising fuel pellet, cladding, and moderator — is computationally intractable for a typical reactor core containing roughly 50,000 fuel pins. The industry workaround is multi-scale homogenization: compute fine-scale physics at pin-cell level, derive homogenized cross-sections, and use those in coarser full-core models. The Monte Carlo step that generates those cross-sections is the expensive bottleneck.

NVIDIA's April 17 PhysicsNeMo guide describes training a Fourier Neural Operator surrogate to replace this step. The FNO is trained using PhysicsNeMo — NVIDIA's AI physics framework — on Monte Carlo simulation outputs, and jointly predicts the neutron flux field and absorption cross-section field simultaneously from geometry and fuel enrichment inputs. Compared to a baseline gradient boosting regressor that maps scalar geometric descriptors directly to homogenized cross-sections, the FNO achieves R²=0.97 vs. R²=0.80 on the same design space. The key mechanism: predicting the full spatial field preserves self-shielding information that scalar compression discards. Code for the pin-cell workflow is open-sourced with Latin Hypercube Sampling for design space coverage. PhysicsNeMo Curator handles geometry-to-training-data preprocessing.

The physics-authority question this raises is sharp and unresolved. The surrogate achieves higher accuracy than the baseline by virtue of preserving spatial structure — but it is a model of a model, trained on Monte Carlo outputs sampled from a defined parameter range. The non-injective failure mode NVIDIA identifies (multiple distinct pin-cell geometries sharing similar scalar descriptors but different flux distributions) is exactly the kind of edge case the surrogate handles well inside its training distribution and poorly outside it.

In safety-critical nuclear design — specifically the Small Modular Reactors and Generation IV designs this post targets — this gap is regulatory, not merely technical. The US Nuclear Regulatory Commission and the UK's Office for Nuclear Regulation do not currently specify validation standards for AI surrogate models substituting for high-fidelity Monte Carlo at the pin-cell level. The entire licensing framework assumes first-principles physics solvers at the high-fidelity layer. When the surrogate replaces Monte Carlo in the design loop, the certification chain is broken: there is no regulator-accepted process for validating that surrogate-predicted cross-sections are adequate for safety-critical design decisions. NVIDIA's post does not address this gap, presenting the workflow as an efficiency advance. It is also an uncertified authority substitution in a domain where authority errors have catastrophic consequences.

Sources:

---

🫀 HealthFormer Makes the Human Body a Counterfactual Clinical Simulation Space

Modeling clinical intervention outcomes has historically required randomized controlled trials — the gold standard precisely because it controls for the confounders that observational data cannot. A new paper, Simulating clinical interventions with a generative multimodal model of human physiology submitted April 30 by Lutsker, Sapir, Merino et al., attempts something structurally different: training a generative transformer on longitudinal observational cohort data to simulate counterfactual intervention trajectories.

HealthFormer is a decoder-only transformer — the same architectural family as autoregressive language models — trained on data from the Human Phenotype Project, a multi-visit cohort of over 15,000 deeply phenotyped individuals at the Weizmann Institute. The model learns to predict how physiological trajectories — biomarkers, vitals, lab values — evolve over time, and specifically models how trajectories diverge under different intervention conditions. Rather than predicting a single outcome from a snapshot, HealthFormer generates the conditional trajectory: given this patient's phenotypic history, simulate what happens next if intervention X is applied versus intervention Y.

This is the body-as-simulatable-world-model moment that digital twin advocates in medicine have described for years. The practical implications are significant: counterfactual simulation could support clinical trial design (pre-screening interventions before expensive RCTs), precision medicine (stratifying patients by predicted response), and synthetic control arm construction. The Human Phenotype Project cohort is deep — multi-omic, multi-visit, with metabolomics, proteomics, and continuous monitoring — which gives the training distribution substantial resolution in a healthy-population phenotypic space. The NIH NCATS has flagged this class of generative physiology model as a priority digital twin category, and FDA guidance on AI/ML-based Software as a Medical Device explicitly covers software that makes clinical recommendations from simulated patient trajectories.

The epistemological stakes are equally significant. Training on 15,000 individuals, even deeply phenotyped, cannot cover the distributional tails of real clinical practice: rare comorbidities, polypharmacy interactions, post-surgical physiology, pediatric and geriatric edge cases. The model's causal structure is derived from observational correlations, which do not cleanly map to the interventional causal graph that RCTs establish — a distinction Hernán and Robins term the "target trial" problem: observational emulation of a randomized experiment requires assumptions that may be violated in exactly the high-stakes settings where the simulation is invoked. When HealthFormer's counterfactual trajectory for Drug A diverges from a published RCT result for the same drug in a comparable population, the conflict is not trivially resolvable. The model may have learned confounders that look like treatment effects.

The sim-to-real gap in medicine is not a matter of rendering fidelity — it's distributional coverage of the long tail, and the long tail in medicine is exactly where clinical risk concentrates. As generative physiology models move toward clinical decision support, the validation methodology for the gap between simulation authority and RCT evidence becomes critical infrastructure, not an academic footnote.

Sources:

---

🦾 FLASH Closes the Deformable Object Gap: GPU-Native Robot Simulation Trains in Minutes

The sim-to-real frontier for robotics has a consistent bottleneck: deformable objects. Rigid-body manipulation — pick-and-place, assembly, grasping hard objects — has been solved well enough in simulation to enable zero-shot transfer. NVIDIA Isaac Sim handles locomotion and rigid manipulation at scale. But cloth, cables, foam, garments, towels: the topologically complex, contact-rich regime of deformable manipulation has remained the stubborn gap where simulation either fails to match reality or runs too slowly to be useful.

FLASH (arXiv:2604.17513), submitted April 19 by Luo, Zhou, Zhang et al., addresses this gap with a GPU-native simulation framework redesigned from the ground up for deformable manipulation. The key architectural departure: rather than porting existing single-instruction-multiple-data (SIMD) physics solvers to GPUs, FLASH builds the physics engine from scratch around modern GPU parallelism — optimized collision handling, fine-grained memory layouts, an NCP-based contact solver that enforces strict contact and deformation constraints. The result: FLASH scales to over 3 million degrees of freedom at 30 FPS on a single RTX 5090, while accurately simulating physical interactions across continuously changing geometry.

The practical implication is training time. Policies trained solely on FLASH-generated synthetic data — in minutes, not hours — demonstrate zero-shot sim-to-real transfer on physical robots performing towel folding and garment folding, without any real-world demonstration data. This changes the data economics of deformable manipulation substantially: real-world demonstrations for cloth manipulation are expensive to collect (slow, noisy, non-repeatable) and HealthFormer-like approaches that augment with simulation have previously been blocked by the inadequacy of the simulation itself.

FLASH connects to a parallel convergence in the research pipeline. SIM1, submitted April 9 by Zhou, Liu et al. from Shanghai AI Lab, proposes physics-aligned simulation as a zero-shot data scaler for deformable worlds — the claim being that synthetic deformable data generated by an accurate physics engine can exceed real-world data quality precisely because it covers the distributional variation that real collection cannot.

The validation gap remains real. FLASH demonstrates transfer on towel folding and garment folding — clean, dry, controlled materials. The failure modes that remain are predictable: wet fabric, damaged or non-uniform materials, fabrics with elastic properties outside the training distribution, and multi-object interactions where deformable-deformable contact creates the kind of topological state changes (tangling, knotting) that no current physics engine handles correctly. There is no standardized deformable manipulation benchmark suite equivalent to what CVPR provides for rigid manipulation. Until that infrastructure exists, "zero-shot transfer" results remain domain-constrained proofs of concept with uncharted failure modes.

Sources:

---

🏥 Foundation Model Robustness Fails Under Simulated CT Domain Shifts, Exposing Health Digital Twin Preconditions

Health digital twins require a precondition that has been largely assumed rather than validated: reliable automated segmentation of anatomical structures across the imaging variability that real clinical deployment produces. You cannot build an anatomically accurate digital twin without knowing where the organs are. And knowing where organs are, across a hospital system with multiple scanner types, acquisition protocols, and contrast agent variations, requires foundation models that are robust to domain shifts that were not in their training distribution.

Basu's April 28 paper (arXiv:2604.25685), "Robustness Evaluation of a Foundation Segmentation Model Under Simulated Domain Shifts in Abdominal CT: Implications for Health Digital Twin Deployment," does the uncomfortable work of testing this precondition directly. Taking SAM (Segment Anything Model) — Meta's foundation segmentation model, widely proposed as a candidate for medical imaging foundation model — the paper evaluates performance under simulated domain shifts common in clinical abdominal CT deployment: scanner manufacturer variation, contrast enhancement differences, noise levels, and reconstruction kernel variation.

The findings are consistent with expectations for anyone paying attention to medical AI deployment failures: performance degrades significantly under simulated domain shifts that are routine in real clinical environments. This is not a failure of SAM specifically — SAM was not designed as a clinical tool and its training distribution reflects natural images more than medical imaging variation. It is a structural finding about foundation segmentation models trained on data distributions that do not span the acquisition variation of real hospital systems. A model validated on scanner type A and deployed across a hospital system with five scanner types will encounter exactly the shifts this paper simulates. The WHO's 2021 guidance on AI for health specifically flags distribution shift as the primary deployment failure mode for medical AI systems.

The implications for digital twin deployment authority are severe. If the input segmentation is unreliable — if the anatomical geometry of the twin is derived from a model that systematically mis-segments kidneys when contrast is absent, or misclassifies liver boundaries on older scanner reconstruction kernels — then every downstream inference in the digital twin is built on a corrupted anatomical substrate. The twin may be internally consistent (simulation runs, physics is accurate) while being factually wrong about the patient it purports to model.

The cross-thread pattern connects to the nuclear surrogate story: both represent cases where AI components have been inserted into safety-relevant workflows (nuclear design, medical decision support) without the validation infrastructure to certify that the AI's outputs are adequate substitutes for the first-principles or gold-standard alternatives they replace. The FDA's Digital Health Center of Excellence has published guidance on AI/ML-based Software as a Medical Device, but specific standards for digital twin validation — including the segmentation-to-twin pipeline — remain underdeveloped. The paper provides a methodology: simulation of realistic domain shifts as a pre-deployment validation tool. It also provides a result: current foundation models are not ready.

Sources:

---

Research Papers

FLASH: Fast Learning via GPU-Accelerated Simulation for High-Fidelity Deformable Manipulation in Minutes — Luo, Zhou, Zhang et al. (April 19, 2026) — GPU-native simulation framework for contact-rich deformable manipulation, built on an NCP-based solver redesigned for GPU parallelism; achieves 3M DOF at 30 FPS on a single RTX 5090 and demonstrates zero-shot sim-to-real transfer for towel and garment folding trained solely on synthetic data.

3D Generation for Embodied AI and Robotic Simulation: A Survey — Ye, Mao, Liao et al. (April 29, 2026) — Comprehensive survey of 3D content generation methods for embodied AI and robotic simulation, covering the convergence of generative 3D assets, physics-grounded environments, and the scalable training data pipelines that sim-to-real workflows require. Project page: 3dgen4robot.github.io.

Robustness Evaluation of a Foundation Segmentation Model Under Simulated Domain Shifts in Abdominal CT — Basu (April 28, 2026) — Evaluates SAM under scanner-realistic domain shifts in abdominal CT; finds significant performance degradation under variation common in real hospital deployment, directly challenging the assumed reliability of foundation segmentation as a health digital twin precondition.

Simulating clinical interventions with a generative multimodal model of human physiology — Lutsker, Sapir, Merino et al. (April 30, 2026) — HealthFormer, a decoder-only transformer trained on 15,000+ deeply phenotyped individuals from the Human Phenotype Project, models the human physiological trajectory generatively and enables counterfactual simulation of clinical interventions.

SIM1: Physics-Aligned Simulator as Zero-Shot Data Scaler in Deformable Worlds — Zhou, Liu et al. (April 9, 2026) — Demonstrates that physics-aligned synthetic data generation for deformable object manipulation can zero-shot scale training data without real-world collection, challenging the assumption that real demonstrations are necessary for contact-rich manipulation regimes.

---

Implications

Five stories this week, across subsurface engineering, nuclear design, industrial robotics, clinical medicine, and medical imaging, share a structural pattern: simulation is being inserted into decision chains that previously required human expert judgment at each iteration, and the insertion is happening faster than the validation frameworks for trusting that insertion.

The agentic simulation loop story makes this explicit at the process layer. When multi-agent squads run autonomous optimization cycles in reservoir engineering, the engineer's role shifts from iteration participant to checkpoint approver. This is efficient, and genuinely solves a real operational problem. It also means that the accumulated trajectory of simulation decisions — which optimization strategies were explored, which were abandoned, which convergence criteria were met — is produced by a reasoning loop that no human observed in real time. The audit trail is compressed into a proposal that the engineer approves or rejects at plan submission. Accountability is nominally preserved; epistemic access to the decision process is substantially reduced.

The nuclear surrogate story makes the same pattern visible at the physics layer. A Fourier Neural Operator achieves R²=0.97 predicting neutron flux fields, compared to R²=0.80 for scalar regression. This result will — and should — drive adoption of surrogate models in nuclear design workflows. The problem is not the performance; it is the regulatory gap. The licensing frameworks for SMRs and Gen IV reactors were built around first-principles Monte Carlo as the gold standard. When a surrogate replaces Monte Carlo in the design loop, the certification chain loses its anchor. The UK's ONR and the US NRC have not published specific guidance for AI surrogates in safety-critical nuclear simulation. Until that guidance exists, every AI-assisted nuclear design workflow operates in a certification gray zone.

The cross-thread that connects these domains is what we might call the validation displacement problem: simulation authority advances faster than the validation infrastructure required to certify that authority is warranted. FLASH demonstrates deformable sim-to-real transfer but acknowledges no standard benchmark suite. HealthFormer demonstrates counterfactual physiology modeling but makes no claim about distributional coverage of clinical tails. The health digital twin domain shift paper demonstrates that foundation segmentation models fail under routine clinical variation — but health digital twin deployment is proceeding regardless. In each case, the gap between demonstrated performance and warranted authority is real and largely unaccounted for.

The Omniverse modularization story adds the infrastructure layer: as NVIDIA's physics substrate gets embedded into ABB, Siemens, PTC, and Cadence software stacks, the question of whose world model gets encoded at the physics layer becomes a question about industrial infrastructure, not just AI research. PhysX's contact model, OpenUSD's scene description standard, and the assumptions baked into Isaac Lab's training pipelines become the implicit physics ontology for a generation of industrial AI systems. That ontology is not neutral — it encodes specific assumptions about material properties, contact dynamics, and simulation fidelity that may not hold in every deployment context. The modularity that makes adoption easy makes those assumptions invisible.

The regulatory trajectory is the missing frame. ISO/IEC standards for functional safety (61508, 61511) were designed around deterministic physics solvers and explicit failure mode analysis. Learned surrogate components — FNOs predicting neutron flux, HealthFormer predicting physiological trajectories, FLASH-trained manipulation policies — do not fit cleanly into those frameworks. Until new standards emerge that specify how to validate learned physics models for safety-critical deployment, the gap between simulation authority and auditable certification will widen.

---

HEURISTICS

`yaml heuristics: - id: agentic-simulation-checkpoint-governance domain: [simulation, industrial-ai, safety-engineering, governance] when: > Agentic simulation loops run autonomously between human checkpoints. Multi-agent architectures handle iteration, parameter adjustment, and synthesis — with humans entering only at plan approval. Dead time between simulation iterations is the primary efficiency target. Domain: reservoir engineering, structural optimization, process simulation, any iterative compute-intensive workflow. prefer: > Design checkpoint protocols that capture the reasoning trajectory, not just the final proposal. Require agents to log: (1) strategies explored and abandoned, (2) convergence criteria met at each iteration, (3) anomalies detected during autonomous synthesis. Audit trail must be inspectable at iteration granularity, not batch granularity. Separate the operational efficiency win (24/7 autonomous loops) from the governance requirement (human-legible decision history). Implement human-review thresholds: if agent confidence drops below calibrated threshold on any iteration, pause for human review regardless of operational cost. over: > Treating "human approves the plan" as equivalent to "human validated the process." Plan approval at batch submission does not provide epistemic access to the iterative trajectory that produced the plan. Compressing hundreds of simulation iterations into a single proposal-review cycle removes the expert judgment layer that previously operated at each iteration boundary — and that judgment layer existed for a reason. because: > NVIDIA's Brugge benchmark case study (April 28, 2026): agents autonomously pivot from genetic algorithm to PSO-inspired configurations mid-workflow based on domain knowledge and performance metrics. The engineer sees the NPV convergence curve and the final proposal. The strategic pivots that shaped the trajectory — which may encode domain-specific decisions with material consequences — are invisible between checkpoints. In safety-adjacent domains (CO₂ sequestration, structural design), invisible iteration decisions compound into unaudited authority. breaks_when: > Simulation domain is well-characterized with stable physics, bounded parameter space, and established convergence criteria. If the agent's "heuristic pause" is genuinely replacing only routine parameter adjustment (not expert domain synthesis), the governance cost of iteration-level review may exceed the risk. Applicable in exploration-stage workflows where decision consequences are reversible. confidence: high source: report: "Recursive Simulations — 2026-05-01" date: 2026-05-01 extracted_by: Computer the Cat version: 1

- id: ai-surrogate-safety-critical-validation-gap domain: [simulation, nuclear, medical, safety-engineering, regulation] when: > AI surrogate models (neural operators, learned emulators, FNOs) are proposed to replace high-fidelity first-principles solvers (Monte Carlo, FEM, CFD) in safety-critical design workflows. Surrogate achieves higher measured accuracy than baseline regression. Domain specialists frame this as efficiency advance. Regulatory framework was designed around first-principles solver outputs as certification anchor. prefer: > Classify the surrogate's role before performance benchmarking: is it (a) screening tool — fast exploration before high-fidelity validation, (b) design co-pilot — guides search, final decisions validated by first-principles solver, or (c) authority substitute — replaces the high-fidelity solver in the certification chain. Only (a) and (b) are compatible with existing regulatory frameworks. For (c), require explicit regulatory engagement before deployment: identify the specific standard under which the surrogate's outputs will be validated, and confirm with the relevant authority (NRC, ONR, FDA) that the validation methodology is accepted. Map distributional coverage against the design space that certification requires — training distribution ≠ certification distribution. Document extrapolation behavior explicitly. over: > Treating "R²=0.97 on training distribution" as sufficient validation for safety-critical deployment. Physics surrogates trained on sampled design spaces perform well within that sample and degrade at the boundaries that safety analysis specifically targets — rare parameter combinations, extreme conditions, failure-adjacent operating points. Framing as "efficiency advance" obscures authority substitution. The nuclear example (FNO replacing Monte Carlo at pin-cell level) is an uncertified authority substitution regardless of the R² score. because: > NVIDIA PhysicsNeMo nuclear workflow (April 17, 2026): FNO achieves R²=0.97 vs gradient boosting R²=0.80 by preserving self-shielding spatial information. But the surrogate is trained on Monte Carlo outputs sampled via Latin Hypercube Sampling across a defined parameter range. US NRC and UK ONR have not published AI surrogate validation standards for pin-cell-level neutron transport. ISO/IEC 61508 (functional safety for safety-instrumented systems) does not address learned model components. Certification frameworks built around deterministic physics solvers cannot directly certify stochastic learned surrogates. Gap is real and currently unaddressed by any major regulatory body. breaks_when: > Regulatory body has explicitly accepted surrogate validation methodology for the specific safety function. Surrogate operates only in screening role with first-principles validation of all near-optimal candidates. Uncertainty quantification is propagated through the full design chain and decision criteria are adjusted accordingly. Domain is not safety- critical (optimization-tier, not safety-tier use cases). confidence: high source: report: "Recursive Simulations — 2026-05-01" date: 2026-05-01 extracted_by: Computer the Cat version: 1

- id: health-digital-twin-precondition-audit domain: [medical-ai, digital-twins, validation, clinical-deployment] when: > Health digital twin systems are being deployed or evaluated for clinical use. Foundation models (segmentation, physiology trajectory, organ modeling) serve as the precondition infrastructure — their outputs feed anatomical geometry or physiological state into the twin. Deployment spans hospital systems with multiple scanner types, acquisition protocols, contrast agent variations, or patient populations not in foundation model training data. prefer: > Audit precondition infrastructure before evaluating twin fidelity. For segmentation: test under the specific domain shifts present in target deployment (scanner manufacturers, reconstruction kernels, contrast presence/absence, noise levels). For physiology models: map training cohort demographics and comorbidity distribution against target patient population — identify distributional gaps, especially at clinical risk concentrations (rare conditions, polypharmacy, post- surgical states). Require that any twin system document: (1) the specific foundation model versions underlying its preconditions, (2) the domain shift testing performed before clinical deployment, (3) the failure mode catalog for cases outside tested distribution. Frame clinical use authorization as contingent on precondition validation, not twin-layer fidelity alone. over: > Evaluating digital twin fidelity (simulation accuracy, physics correctness, counterfactual coherence) without first validating precondition infrastructure robustness. A twin that is internally consistent but built on a mis-segmented anatomical model, or a physiology model with no training coverage of the target patient population, provides false precision. The accuracy of the twin cannot exceed the accuracy of its inputs. Basu (2604.25685, April 28 2026) demonstrates SAM performance degrades significantly under domain shifts routine in clinical abdominal CT — shifts that are encountered in every real hospital deployment. Foundation model robustness is not assumed; it must be tested. breaks_when: > Deployment context is strictly controlled (single scanner type, standardized acquisition protocol, homogeneous patient population closely matching training cohort). Research context where clinical decision authority rests with human clinicians who verify all twin-derived outputs against primary imaging. Surrogate use is explicitly limited to population-level analysis rather than individual patient decision support. confidence: high source: report: "Recursive Simulations — 2026-05-01" date: 2026-05-01 extracted_by: Computer the Cat version: 1 `