Digital twins & sim-to-real

Real sensor: disparity noise σ = 0.25 px on a 700 px, 0.12 m rig (matches only above 1 px, so 84 m), depth = reciprocal of disparity; twin: Gaussian depth noise with the linearised sd. The median is exact, but the (gated) mean is biased by about s² (+1.5% at 40 m) and over-estimates of distance are far more common than the twin says: at 40 m P(depth > 1.5Z) is 0.0026 vs 10⁻⁵ (191×), and a twin mean + 3σ margin is exceeded 10× as often as designed. Matching the variance leaves 41× on that tail. Averaging 1024 frames of depth floors at 1.5% error where the twin predicts 0.4%, whereas averaging disparity converges; at 60 m the range floor loses 5.5% of looks and flips or removes these effects (reported as a negative result). Stylised: Gaussian i.i.d. disparity noise, no outliers or calibration error.

Real cart: 80 kg body with a damped spring-mass slosh mode (20 kg liquid, 0.5 Hz at full fill); twin: one rigid mass. The twin gets the centre of mass exactly (RK4 error ~10⁻¹⁴ m) but predicts zero slosh; for a bang-bang rest-to-rest move the real residual is 4μa₀sin²(ωT/4)/ω², matched by exact propagation and RK4. The twin’s minimum-time move (3 m, 4.90 s) leaves 10.7 cm of slosh, 10× a 1 cm tolerance; the fastest move meeting it takes 7.60 s (55% slower) because zero-residual times are whole multiples of two slosh periods. Calibrating ω at a full tank is harmless down to half fill (−5% frequency, 9.5 mm) but at 25% fill the smallest safe null-tuned move takes 28 s vs 8.7 s recalibrated, worse than the tuning-free bound 24.7 s; at fixed acceleration the first unsafe null order is exactly ⌊asin(√ρ)/(π|ε|)⌋+1. Stylised: one linear slosh mode, bang-bang force, no shaper optimisation, no nonlinear slosh.

Follow-up to slosh-twin. Convolving the twin’s bang-bang acceleration with a ZV or ZVD shaper multiplies the undamped residual exactly by V(ε) = |sin(πε/2)| or sin²(πε/2), ε the frequency error (verified against exact propagation to 10 digits), while distance and the acceleration cap are preserved. Designed at a full tank, both shapers keep the 1 cm tolerance at every fill from 100% to 10% (ε down to −9.5%; worst residual 4.8 mm ZV, 0.6 mm ZVD) in 5.90 s and 6.90 s, where the null-tuned move needs 8 s at half fill and 28 s at 25% and below. Closed forms give the largest tolerated |ε| (e.g. 10.7% for ZV at half fill). Searching the design frequency for a fill band [0.1, 1] yields a 5.85 s ZV move, but only by detuning to spend the whole tolerance (worst residual 9.88 mm, no margin). Stylised: one linear slosh mode, ideal actuator, no nonlinear slosh.

In a scalar linear-quadratic plant the twin-trained gain has exact deployment regret, asymmetric with a stability cliff: underestimating actuation to 0.21× is infinitely costly while 2× over costs 0.22. A twin can score perfectly on passive logs (log-score gap exactly 0) yet mistrain the controller, and closed-loop logs are blind along Δa = kΔb, so validation needs designed probing. Used as a ridge prior, a twin with bias δ is worth exactly σ²/(vδ²) real probe steps at every accuracy target (22 steps at δ=0.3), and removes small-sample divergence (3.1% to 0 at n=10). Matched to simulation within 1–4%. Stylised.

Randomizing the twin's input gain over ±ε trains a more conservative gain (monotone in ε; small-width law k_ε−k* = −(εb)²J_kbb/(6J_kk)) at a quartic price when the twin was right, and moves the deployment stability cliff out by about 15%. At 2.3× the twin's gain the nominal controller has regret 84 versus 1.4 at ε=0.9. But uniform-average training is not minimax: its worst-case regret exceeds the nominal gain's for ε ≤ 0.7, and the best width equals the prior's half-width, paying off only when the prior reaches the cliff. Stylised.

A Kalman twin tracks a drifting actuator gain from the closed-loop data the controller already produces. Its steady-state predictive variance is a closed-form quadratic root (m = q/2 + √(q²/4 + qσ²/v) for a random walk), matching closed-loop simulation to 1–3%, and control regret is ½J_kk(dk*/db)²m (0.00447 predicted vs 0.00466 simulated). A calibrate-and-freeze twin loses half its edge over the population mean after ln 2/(2(1−ρ)) = 34.5 steps. For one drifting parameter a dedicated probing budget never pays (information price 0.70 vs marginal value ≤ 0.04); for two, the closed-loop blind direction makes a fixed-gain twin unobservable and the mean-field optimal dither scales exactly as q^1/6, yet simulation shows the controller’s own gain jitter supplies most of that excitation, so the mean-field law is an upper bound. Stylised.

For a twin refitted from dedicated experiments rather than filtered from operating data, the second-order-optimal schedule is closed-form: interval T* = (4cσ²/(vρq_d²))^1/3, with experiment downtime, estimation noise and drift regret exactly equal at the optimum, so excess cost scales as q_d^1/3 (fitted slope 0.333) and 10× cheaper experiments lower it only 2.2×. Misjudging the drift rate by 4× costs at most 26%. But the second-order optimum is unsafe: 0.7–15% of its cycles destabilise the loop, and a schedule with failure probability ≤ 10⁻³ costs 1.2–16× more and is 37–200× worse than an always-on Kalman twin. Stylised.

A provider paid Brier score on the twin’s parameter reports its posterior mean; one paid the deployed control cost reports the Bayes gain, which is more conservative (0.778 vs 0.823 at posterior sd 0.3, mean 1) and equals domain randomization under the provider’s own uncertainty. Certainty equivalence costs a quartic in spread (16× per doubling); reports with equal squared error have regret ratios of 1.3–24×; a payment cap makes the elicited gain jump at a closed-form threshold M* (19.3 in the example) that decides whether rare catastrophic plants are priced in; and Brier under- or over-pays probing by a 15× spread in decision value per unit variance. Stylised.

A Gaussian-mixture e-process on the closed-loop residual audits a deployed twin continuously: it false-alarms 2.4% of the time against 58% for a z-test checked every step. Detection delay follows ≈ 2[ln(1/α)+½ln(1+τ²nU)]/(Δ²U) with U the controller’s own excitation (simulation 0–18% earlier); expected regret accumulated before detection is nearly independent of the gap (8–10 while per-step regret spans 38×); an expensive-control operator needs 11× longer to catch the same gap; and added probing pays only for gross errors (true gain above 2.25× or below 0.35× the twin’s), with the rule failing at the near-cliff edge. Stylised.

A CA-CFAR threshold set in a Gaussian-clutter twin and deployed in gamma-textured (K-distributed) clutter has an exact false-alarm law, matched to direct simulation to ~1%. At design 10⁻⁴ the real rate is 9× (ν=5) to 30× (ν=2) too high, and 50× to 358× at 10⁻⁶; restoring it costs 1.9–3.7 dB of threshold at 10⁻⁴. If texture is shared across the window CFAR is unaffected, so the twin must model spatial correlation. A moment fit of ν from 1000 real clutter cells brings the median to 1.1× (90th percentile 2×), versus ~10⁶ cells to threshold empirically. Stylised: no target, no measured data.

Four window detectors (cell-averaging, order-statistic at ranks 3N/4 and N/2, log-t) are calibrated in a Gaussian-clutter twin and deployed in gamma-textured clutter. None is meaningfully more robust: at design 1e−4 the false-alarm inflation is 30–44× at ν=2 and 8–9× at ν=5, and the ranking flips with ν and design rate. A known-scale oracle with no window noise inflates 2.88× at 1e−2, ν=2 against cell-averaging’s 3.02×, so most of the error is the test cell’s own texture, which reference cells cannot see. After repairing each threshold to the design rate, cell-averaging detects best everywhere (Rayleigh target, 20 dB, ν=2: 0.758 vs 0.744, 0.732, 0.703), and the twin’s promised detection probability is overstated (0.70 vs 0.43 at 15 dB). No interfering targets, so order-statistic detectors are tested away from their home ground. Stylised.

A robot that waits for a human and aborts after τ has cost J(τ) = wE[min(T,τ)] + cP(T>τ), with slope S(τ)(w − c·h(τ)). Simulated humans with constant or increasing hazard (exponential, Weibull) therefore have only corner-optimal timeouts and, when aborting costs more than the mean wait, never give up. Against a lognormal human (σ=1.2, an assumed model) the interior optimum is 9.4 s and the light-tailed twin’s regret is 3.7% of the optimum, rising to 37% (σ=1.6) and 81% (σ=2) for heavier tails and cheap aborts. A lognormal twin with the right mean and σ off by 0.2 recovers all but 0.5%. Fitting the correct family from n real trials costs regret ∝ 1/n, matched by the delta method to within 11% (0.0323 at n=10, 0.00034 at n=1000). Stylised: scalar i.i.d. response time, one fixed timeout, no real human data.

A grid cell committed when log-odds built with a twin's sensor model reach ±A has, under the real sensor, an exact error set by the Lundberg exponent θ* (equal to 1 for a correct twin) with a rigorous optional-stopping sandwich. A twin whose free-space false-hit rate is 0.05 against a real 0.15 turns a 10⁻³ design into 1.45×10⁻² (14.5×, matched by simulation; 260× at 0.30), and an optimistic occupied hit rate (0.8 vs 0.6) gives 26×. Committing at ln(1/ε)/θ* restores the target at 1.4–16× the latency, and the real-data estimate of θ* needs several hundred known-free observations before the tempered mapper stops exceeding target in over a quarter of maps. Stylised: one independent-beam cell.

Demonstrations logged as applied (actuator-clipped) actions bias a linear clone even in a perfect twin: at an actuator limit of 1 the clone gain is 0.58 against the expert’s 0.96 and its real cost is 9.8% higher, with the exact Gaussian-state gain k₀ P(|k₀x|<U) from Stein’s lemma. Twin errors act through the states they visit and can help: 0.25× noise cuts the gap to 0.002, 2× raises it to 0.75, and a loose twin limit of 3 nearly removes it. Log-state coverage narrower than half the saturation width recovers the expert, while DAgger with applied-action labels converges to a worse gain (0.5575, gap 0.169 vs 0.141). Stylised: scalar plant, population-level fit, no real logs.

A teacher that sees the true state is trained in a twin and cloned into a student that sees only a noisy sensor. Least-squares cloning attenuates the gain to gP/(P+s), where P is the demonstration state variance, so the student depends on the twin only through its process-noise-to-sensor-noise ratio. A twin with a quarter of the real process noise yields a lazy student with excess cost 0.36 (s=0.5) to 1.11 (s=2) against 0.005 to 0.10 from an exact twin, 2.8–3.6× worse than on-policy DAgger in the same twin. On-policy imitation of an exact teacher is within 3.5% of the best memoryless student over 252 cases; cloning can cancel an actuator error, but the cancellation point moves with sensor noise. Injecting demonstration noise in the twin, set from one real scalar (Var z − s), recovers the on-policy gain in two rounds (regret 0.357 → 0.0035 → 0.00003). Stylised: scalar linear–quadratic, no robot data.

A scalar unstable plant is controlled by the LQR gain designed in a twin with no measurement delay. The exact stable-gain interval shrinks with the real delay (upper edge 1 at one step, 0.59 at two), so the twin-tuned gain (0.70) tolerates one step at 1.6× the delay-aware cost and is unstable from two; a retuned static gain costs 1.1–2.6× for delays 1–5, and a predictor built for the wrong delay is unstable in nearly every off-diagonal case tested. Identifying the delay from an i.i.d. probe takes about 2z²(1+1/snr) samples. Stylised: scalar plant, integer delay, known dynamics.

A UAV samples from a corridor to cut forecast error over a region it cannot enter, with sites and Kalman gain taken from a twin’s covariance; the real error after the update is exact (Joseph form, checked against simulation). A matched twin cuts the real error 22%; a twin whose correlation length is 2× too long claims −65% and delivers +28%, because updates are harmful beyond a closed-form radius (ln 2/(ℓ_r⁻²−ℓ_t⁻²))^1/2. Amplitude errors are harmless for one observation but an under-confident twin double-counts over several. A finite ensemble drawn from the correct model already hurts: 10 members give +27% mean real error (71% of ensembles worse than no observation), 50 are safe, and localisation helps at small sizes but costs accuracy at large ones; fitting the length scale from real samples needs about 50. Stylised: 1-D Gaussian field, one static update.

A batch is split over k parallel stations with a serial arm handover; a twin running every step at its mean picks k = √(W/a) = 8 and promises 16 min. The real makespan uses the exact expected maximum of gamma branches (checked against harmonic numbers and simulation): with exponential branches it averages 1.86× the promise, only 2.6% of runs finish every branch within its mean, and the 95% quantile is 3.03× the promise. Whether the twin also buys the wrong layout depends on how variability scales with splitting: task-level variability makes it under-buy (optimum 12, 24.7% regret on the 95% quantile), while a chain of random unit steps cancels the effect so k = 8 stays optimal yet the real makespan is still 6–59% above the promise. Fitting the branch-time shape needs about 5 real durations to fix the decision and about 50 to make the predicted makespan accurate to 1%. Stylised: one fork-join stage, i.i.d. gamma branches.

A pinch grasp slips if μF < w₀ and crushes if F exceeds a fragility limit; with log-normal friction and crush force the expected loss is a sum of two normal CDFs in ln F and its optimum solves a quadratic. A twin whose friction spread is 0.1 instead of 0.3 grips softer, claims a risk of 1.1×10⁻⁵ and delivers 0.069 (4.0× the optimum; 11.6× at spread 0.05). A near-zero-spread twin has a flat zero-risk plateau, so its ‘optimal’ force is a tie-break: real slip 0.50 at the lower edge, 0.015 at the upper. Biased friction costs ≈ ½J″Δx² (85% of the optimum at −0.3 in log-friction), and a widened randomisation width can cancel a known bias but costs 1.5× the optimum if the bias is of opposite sign. A plug-in from n real friction measurements has regret matched by the delta method within 5% for n ≥ 50. Stylised: static friction threshold, chosen parameters, no contact dynamics or reactive re-grasp.

A leg flown at airspeed v against a headwind that is uniform across flights costs P(v)/(v−w) in energy per distance; a constant-wind twin has no spread. Its cruise speed is nearly right (1.100 vs the real optimum 1.123, regret 0.10%), but its energy claim is low by exactly artanh(x)/x with x = a/(v−μ) (3.5% here), and a battery sized to that claim runs out in 50% of real flights (42% with a 5% margin). A 5% depletion target needs a 39% margin and 1% needs 44%, in closed form, and the real-optimal speed trims only 39.2% to 37.6%. The speed error itself grows to 6.4% of the optimum at wind half-width 0.6, and the twin speed meets a stalling wind (infinite energy) once the half-width exceeds v−μ = 0.80. Refitting the twin to n = 50 logged winds beats the constant-wind speed in 97% of fits. Stylised: one leg, constant airspeed, wind fixed within a flight, chosen parameters, no gusts or turn-back.

A back end accepts a loop closure when its squared residual is below a gate; true closures are N(0, s²I), aliased ones are wider, and the cost is a weighted sum of two chi-square probabilities with a closed-form optimal gate in 2-D. A twin whose odometry noise is half the real value picks a gate that claims a cost of 0.094 and 2.1% of true closures rejected; in reality it rejects 38.2% (checked against simulation), costs 4.4× the claim and has 62% regret; a conventional α = 1% gate rejects α^1/ρ2 = 32%. A too-pessimistic twin (ρ = 0.5) is not safe either (145% regret), regret depends strongly on how costly a false closure is, a fixed inflation factor is a bet on the true noise, and re-fitting the variance from about 59 ground-truthed closures brings regret under 1% of the twin’s. Stylised: isotropic Gaussian 2-D residuals, hard gate, known costs, no real odometry data.

A scalar position filter is tuned in a twin with drift variance T and gates loop closures by a chi-square test on its own covariance. With every closure accepted the real posterior variance is exact (1.47×, 2.14×, 4.03× the twin’s claim for real/twin drift-sd ratios 1.5, 2, 3; simulation within 1%), and genuine closures fail the 99% design gate 5% of the time at ratio 2. With the gate on, rejection compounds into lock-out: real error is 9–16× the ungated value at ratio 2 and 56–182× at ratio 3, growing with horizon. The gate halves error against aliased closures when the twin is right (0.52 vs 1.27) but is 8× worse than no gate at ratio 2 (13.9 vs 1.72), and a gate retuned with the real drift beats no gate only up to ratio 2. Fitting drift from measured ground truth fixes the median by 10 cycles but the lock-out tail needs about 30 (28% of trials lock out at 3). Stylised: scalar error, Gaussian drift, simulated not measured.

Robots reset their dead-reckoning error at rendezvous; the real error variance is s²t + b²t² (white noise plus a per-run bias rate), but a twin fitted on short-horizon increments sees only the first term, so it plans a rendezvous every 10 and claims a peak error std of 3.16. The real optimum solves a cubic; at a bias/noise ratio ρ = 0.1/0.3/1/3 the twin's interval has 0.19/1.35/8.65/34.6% regret, the real error is exactly √(1+ρ) times the claim, and under an error budget the twin breaches it for 8–55% of every cycle. In the pairwise frame used for map merging a shared bias cancels (twin regret 5.3% → 0.10% at bias correlation 0.9). Repair needs ground-truth error at a long lag as well as a short one and about 5–10 runs to beat the twin reliably. Variance law and pairwise law checked by Monte Carlo. Stylised: one-dimensional Gaussian error, constant per-run bias, perfect reset.

A traversal has a persistent bias plus white noise, so real error after T steps has variance σ₁²(ρT²+(1−ρ)T); a twin fitted to one-step increments, identical for every ρ, predicts σ₁²T and is off by exactly 1+(T−1)ρ. With 5% of step variance persistent, the twin’s relocalisation interval is 3.4× too long (real miss probability 51.6% against a claimed 5%), and a 3σ loop-closure gate tuned in it accepts true closures with probability 0.64 at T = 200 instead of 0.997; in a closed loop the rejections let error run away (RMS 8.8 m against 0.17 m calibrated). A calibrated gate accepts 97–99% of aliased closures once drift uncertainty exceeds the alias offset, and a variance ratio fitted at one loop length does not transfer to others. Stylised: 1-D Gaussian, assumed one-step-fitted twin, no real odometry data.

A stabilised vehicle must stay in a corridor for T = 200 steps; the twin’s disturbances are Gaussian, the real ones Student-t with the same variance, so a variance fit cannot tell them apart. The twin’s certificate is exact (a union bound over its stationary tail), yet at the margin certified for δ = 0.01 the real failure probability is 0.29 (ν = 3) to 0.052 (ν = 8), and the margin the real system needs at δ = 0.001 is 7.3× to 1.25× the twin’s, a ratio that grows as δ shrinks. Inflating the twin variance to match real failure at δ = 0.05 still misses δ = 0.001 by 24×. A conformal margin from real episodes is valid but needs n ≥ 1/δ of them; a Hill tail fit to cheap one-step disturbances needs no failures and is below target in 93% of repeats at 2,000 samples. Stylised: 1-D linear system, i.i.d. disturbance, a simulated ‘real’ system, no flight data.

A thin obstacle covers m adjacent lidar beams and is detected if at least k return. The twin drops beams independently at 10%; the real sensor drops them in bursts (a Markov chain with the same rate and lag-1 correlation λ). The exact miss law is a small DP, and for k = 1 the real/twin ratio is (1 + λ(1−p)/p)^m−1. At the width certified for miss 10⁻³ (m = 3) the real miss is 0.041 (λ = 0.6) to 0.067 (λ = 0.8), and the claimed detection range is 4× to 8.3× too long. Inflating the drop rate to match one width is wrong at the others. Fitting the chain from a flat-target log recovers the median width but 40% of repeats still miss the target at 5,000 beams; two extra beams cut that to 1%. Stylised: one scan, a simulated ‘real’ sensor, no lidar data.

Certifying a failure rate p < ε from n real trials with a twin-derived prior. The worst-case false-certification probability of any ‘certify iff k ≤ c’ rule is exactly P(Bin(n,ε) ≤ c), so by Karlin–Rubin the twin cannot cut real trials at a fixed level: at ε=0.01, δ=0.05 the exact test needs 299 zero-failure trials, a twin prior reaches 133 only at worst-case size 0.26, and the exact test held to the same size needs the same n (1057 vs 1057 for 90% power at p=ε/3). A weakly informative Jeffreys bound is already anti-conservative (size 0.147 at 191 trials). Optimistic twins inflate size, pessimistic ones (claim 2ε) block certification entirely, and the largest safe twin weight is about 90 twin-trial equivalents at n=299. Stylised: one Bernoulli failure rate, no continuous margins.

A planner picks the cheapest of K plans by n twin rollouts each and explains the choice by quoting that simulated cost. With equal true costs the quote is low by exactly e_K · s (e_K = expected maximum of K standard normals: 0.56 at K=2, 1.16 at 5, 1.87 at 20; Monte-Carlo within 0.5%), a nominal 95% interval around it covers the true cost 88%, 78% and 60% of the time at K=5, 10, 20, and two identical plans are quoted a gap of 1.13 s. Reporting from fresh rollouts removes the bias exactly but costs selection quality (regret 0.069 to 0.104, best-plan rate 0.76 to 0.68 when 8 of 20 rollouts are diverted). It does not remove the twin’s own model error b_k ~ N(0,τ²): the quoted-minus-real bias is −e_Kτ²/√(τ²+s²) (formula −0.531, simulated −0.530 at τ=0.5), so only real trials of the chosen plan give an honest real-cost quote. Stylised: independent Gaussian sample means (one skewed check: formula 7% high), no human study, no robot.

A pick skill is retried until success. The twin draws attempts independently at p = 0.6; in the “real” system each object has a latent success probability (Beta, same mean), so single-attempt validation cannot tell them apart while attempts on one object are correlated. Real failure after k attempts is exactly ∏(b+j)/(a+b+j), a power law k^−a against the twin’s geometric law (matched to simulation). At the twin’s 6-attempt budget for δ = 0.01 (claimed 0.004) real failure is 0.010, 0.042 or 0.151 at correlation 0.05, 0.2 or 0.5, and the budget actually needed is 7, 13 or 571. The payoff cost of a wrong budget is mostly small (0–6%, 23% in one case) because the optimal give-up rule is closed-form. Two forced attempts per object identify the correlation, but a budget aimed at δ still needs a safety margin (met in 51–79% of repeats). Stylised.

Scoring K candidate controllers in a twin and deploying the argmin is a winner’s-curse selection. With score noise τ around true costs N(m, v²), the winner’s claimed cost is exactly m − √(v²+τ²) c_K and its deployed cost m − v²c_K/√(v²+τ²), so optimism τ²c_K/√(v²+τ²) grows like √(2 ln K) (simulation agrees to within 0.03). With a fixed rollout budget the winner’s deployed cost is non-monotone in K (best K = 5, 8, 22 in three regimes; 5,000 candidates gain 5–10× less). In an exact-plant LQ twin (50 gains, 10 rollouts each) the claim is 8% below the deployed cost and below what any gain can achieve, though the Gaussian formula understates the size (optimism 0.0036 vs 0.0017 predicted). Fresh re-scoring fixes the claim but not the choice, empirical-Bayes shrinkage barely helps, and screen-then-verify cuts claim bias 4.5× (Gaussian model: regret 0.73 → 0.34 at K=100). Stylised: i.i.d. Gaussian score noise, one scalar plant, twin equal to the real plant.

Using the twin as a control variate keeps the estimate unbiased whatever the twin's bias (twin-only error +0.700 vs +0.001) with exact variance σ_R²((1−ρ²)/n + ρ²/N). Real and twin cannot share execution noise, so ρ is set by the observed scenario context: a faithful twin gets ρ=η but a noise-free twin gets ρ=√η (1.33× vs 2.0× real-sample equivalent at η=0.5). A twin is worth its compute only if c_T/c_R < (1−√(1−ρ²))²/ρ² (0.072 at ρ=0.5), and where twin bias favours the wrong policy, twin-only ranking is wrong while 86–125 real episodes per policy give a 90% correct order against 164 real-only. Stylised: Gaussian returns, exact context replay, no robot data.

The twin pays iff its correlation with the real return exceeds ρ*=2√r/(1+r) (0.426 at cost ratio r=0.05), and the gain is linear in ρ−ρ* there, so a small pilot's wrong calls are frequent but cheap (probability 0.36–0.11 at ρ=0.5 for m=10–160 pairs, regret 0.004–0.016 of real-only variance). Decision regret follows f·slope·(1−ρ*²)²/(2m) (simulated/law 0.63 at m=10, 1.00 at 160) and plug-in allocation costs ≈0.27–0.30/m extra variance. The adaptive two-stage design (pilot reused) stays unbiased (|bias| ≤ 0.002 against twin bias 0.7) with 95% intervals covering 0.946–0.955. Stylised: Gaussian returns, exact context replay, asymptotic law, no robot data.

Common random numbers pair two policies only while their read pointers into the random stream stay aligned. If one policy consumes an extra draw with probability q per step, the paired correlation is exactly ρ = ∑_t∑_d Bin(t,q)(d) w_tw_t+d/∑w_t² (matched to simulation within 0.012). A flat 20-step score keeps ρ=0.95/0.77 at q=0.05/0.3, but a terminal-only score has ρ=(1−q)^T (0.36/0.001). Sizing a comparison as if seeds stayed synchronised (n=12) gives power 0.85 to 0.11 against a nominal 0.90; keying each draw by (episode, step) restores ρ=1. Stylised: Gaussian per-step noise, policies differing only in draw consumption, no robot data.

A twin's integrator adds or removes damping the plant does not have. Per-step pole moduli are exact (real e^−hc; explicit 1−hc+h²k; semi-implicit 1−hc; implicit 1/(1+hc+h²k)), and the first-order damping bias of explicit and implicit Euler changes sign at ζ=1/√2 (measured 0.742→0.711 and 0.675→0.703 as h falls 0.2→0.025). Tuned to 10% overshoot in the twin, the real plant overshoots 0.105–0.192 (semi-implicit and implicit, h=0.05–0.4) while forward Euler is conservative (0.091–0.036); at a 1% target the semi-implicit twin under-claims by up to 4.9×. The excess halves with h (first order); Richardson extrapolation of the twin’s overshoot at fixed gain recovers the real value to 0.0003–0.0012, and re-tuning with substeps costs ×4 to ×32. Stylised: one linear oscillator, textbook integrators (not any engine’s scheme), overshoot read from samples, no robot data.

With real scenarios x~N(0,1), failure iff x>a, and a twin generator of width s, the raw twin claims Q(a/s) and the reweighted (importance-sampling) estimate has per-sample second moment sτQ(a/τ), τ²=s²/(2s²−1), finite only for s²>½. In a braking example (P=1.2×10⁻³) a generator 0.6× too narrow claims 2.1×10⁻⁷ and reported zero failures in all 4,000 simulated runs of 2,000 scenarios; a wide one over-claims but reweighting repairs it, with optimal width ≈1.05a needing 2,179 runs for 10% error against 83,459 for plain Monte Carlo. A defensive mixture with the real prior makes a narrow twin's variance finite but no better than plain Monte Carlo. Stylised: one-dimensional Gaussian scenarios, known threshold and density, correct twin failure indicator.

For a scalar Kalman filter (plant x′=ax+w, sensor y=x+v) the real error under the twin’s gain K is exactly ((1−K)²Q+K²R)/(1−(1−K)²a²). With a=0.9 and Q=R=1, a twin 10× too quiet claims MSE 0.215 but the real MSE is 1.32 (+121%), while one 10× too noisy is slightly pessimistic (+42%); at 100× the quiet twin costs 5.0 against 0.64, and for a random walk quiet-twin regret grows as m^−1/2. Regret is locally c(ln m)². Negative result: for an unstable plant the twin’s gain never destabilises the filter. The lag-1 innovation covariance is zero iff the gain is optimal, and a one-shot moment retune from real innovations cut regret from 2.15 to 0.026 at n=200 and 0.0002 at n=25,000 (simulation, ∼1/n). Stylised: scalar linear-Gaussian system, stationary, known dynamics.

For a scalar LQR controller (plant x′=ax+bu+w) the real cost under the twin’s gain K is exactly (q+rK²)W/(1−(a−bK)²). With a=0.9, a twin that believes the actuator is half as strong claims 1.245 but costs 1.508 (+40%); at 0.2× the real loop is unstable while the twin claims a finite cost. Unlike an estimator, a controller has an instability cliff (m < a/(a+1) as r→0), which is a band when control is penalised, and a too-strong twin is the safer error (+20% vs +40% at a factor of 2). Negative result: running the twin’s controller on the real system identifies only the closed-loop pole, not a and b; with dither the least-squares covariance is closed-form and the retune regret matches a delta-method law (∝1/n), while dither costs performance and its optimum shrinks with the data budget. Stylised: scalar linear-Gaussian, stationary, known a.

An unstable scalar plant (a=1.2) with a saturating actuator loses control when |x| exceeds U/(a−1). A twin with an unlimited actuator, running its own LQR gain, overstates the mean time to loss of control by 6,295× at noise sd 1 (1.5×10⁶ vs 245 steps), 10⁶× at 0.8, and still 5.7× at 2. ln T is linear in 1/s² with slope ≈3.7 on the real plant against ≈12.7–13.2 for the twin (large-deviation value 12.4), so the gap is exponential, not a constant factor. Both are maximised at the deadbeat gain, but the twin’s time-to-failure varies five orders of magnitude across gains against 2× on the real plant. Exit times solve an integral equation (grid- and Monte-Carlo-checked; twin values above 10¹⁰ unresolved). Stylised: scalar plant, one parameter set; the real exponent is empirical.

A twin whose sensor is ideal (y=x+v) tunes the gain for variance R, but the real sensor rounds to a step D. In simulation (a=0.9, Q=1) the twin’s gain costs +11% at D=4 for R=1, and up to +64% when R=0.01. Retuning on R+D²/12 (Sheppard) lands within 1% of the best gain in all 12 configurations, but its closed-form MSE claim under-predicts the real error by 28–43% once D exceeds the state’s scale (1.61 vs 2.82 at D=8, R=0.01). Stylised: scalar linear-Gaussian plant, fixed gain, one seed per cell.

A twin runs at several fixed-step fidelities (n=2^l+1 Euler steps). Multilevel Monte Carlo telescopes the finest-level answer over coupled pairs sharing scenario draws, with allocation N_l ∝ √(V_l/C_l). For a smooth terminal state (bias rate α=1.000, variance rate β=2.001, cost rate 1) it needs 3.6× fewer steps than one fine twin at RMSE 10⁻² and 897× fewer at 3×10⁻⁵. For a failure probability the variance only halves per level (β=1.000), so multilevel loses at loose targets (0.4× at 3×10⁻²), breaks even near 10⁻³ and reaches 7.7× at 10⁻⁴. Equal samples per level cost 156× (smooth) and 3.9× (failure) the optimum; a coarse twin alone is off by 10–48% however many runs. Stylised: one scalar linear system, exact level moments.

On a quadratic real loss with SGD noise, the expected loss after k real steps from a twin start is exact (matched to Monte Carlo within 0.3%). A twin start with 0.6× the cold-start error saves 64–67% of the steps to every target from 8× to 1.2× the SGD floor; at equal error it saves nothing and at 1.5× it costs 138 extra steps (negative transfer). For any curvature spectrum the loss left by a twin error of norm b is at most b²/(4eηk), attained by the direction λ_*=1/(2ηk), so twin error decays as 1/k, not geometrically. At the same initial loss, an error in the stiffest direction needs 13 steps to reach 2× the floor and one in the flattest 1,541. Stylised: fixed offset, isotropic noise, no robot data.

A receding-horizon controller uses the H-step gain of a twin whose pole is m× the real one; the real cost of that fixed gain is exact (matched to simulation within 0.3%). When the twin overstates the pole the gain rises with H past the real optimum, so cost is not monotone in the horizon: at m=2 (a=0.9, r=1) the real cost is 1.81 at H=2 and 3.97 at H=60 against an optimum of 1.48, and the saving rises from 12% to 91% as control cost goes from 0.1 to 20. The twin cannot see this (its own claim falls from 9.5 to 3.5 as H grows, ranking horizons backwards); the two-step controller stays stable up to m=(1+a)(r+b²q)/(abq) (4.22 vs 2.51 for H=60 at r=1). A terminal cost equal to the twin’s Riccati solution removes the effect. Stylised: scalar linear-Gaussian, only the pole wrong, best horizon chosen with the real cost known.

For a mean estimated from n real and m twin samples with twin bias δ, the optimal weight and MSE are exact and the twin is worth at most σ²/δ² real samples however large m is (e.g. 157.5 of a 160 cap at m=10⁴). Equal-weight pooling beats real-only iff δ² < σ²/n + σ²/m, so more twin data narrows the safe range (3.99× worse than real-only at δ=2√a). Estimating the bias from the data is costly: the plug-in weight is worse than real-only for large bias (peak 1.24×), and a 5% pretest peaks at 2.41×. Stylised: scalar Gaussian, constant bias, no robot data.

With Poisson arrivals and one server, the mean wait is exactly ρ(1+c²)/(2(1−ρ)) service times (Pollaczek–Khinchine; matched to a 1.5-million-job simulation within one standard error), so a twin with exponential service is off by (1+c²)/2 at every load. At a mean-wait SLA of 2 service times the twin admits ρ=0.667 while the real instrument admits 0.444 (c²=4) or 0.133 (c²=25): real mean waits 2.5× to 13× the SLA, and 11.7× the twin’s tail-exceedance claim at c²=4. With a Pareto tail of index below 2 the real mean wait is infinite. A negative repair result: a plug-in c² fitted from n logged service times violates the SLA in 70–89% of repeats for n=25–1600, and a 90% bootstrap bound still 46% at n=1600. Stylised (Poisson arrivals, one server, simulated “real” instrument).

A hard success edge has zero real gradient, so a smoothed twin is the only learning signal. The twin optimum overshoots the edge, θ ≈ τln(R/(2cmτ)) (within 5% at τ=0.02), and gradient ascent from the nominal pose is trapped below τ_c=0.105 (real regret 0.75) while above τ_u=R/(8cm)=0.25 the twin optimum falls below the real edge and regret jumps to 0.98. Annealing τ from 0.2 crosses the trap (regret 0.08 at τ=0.02; the real plant alone needs 161 to 3.5×10⁶ evaluations). With an uncertain real edge the overshoot is a safety margin: the best trainable width is within 0.0014 expected regret of the Bayes-best pose, but reachable margins are capped at 0.168 and annealing to zero width discards the margin. Stylised (one parameter, logistic smoother, deterministic ascent, simulated “real” plant).

Redundant sensors that share an error source have pairwise correlation ρ; the equal-weight fused variance is exactly σ²(1+(n−1)ρ)/n, so a twin with independent errors understates the fused std by √(1+(n−1)ρ), n sensors are worth fewer than 1/ρ independent ones, and no fleet beats σ√ρ. For a target std of 0.25σ the twin says 16 sensors; the real fleet needs 30 at ρ=0.03, 77 at 0.05, 376 at 0.06 and none at 0.0625 or above. A 3-σ gate sized from the twin false-alarms 8.6× too often at ρ=0.05 (n=16). Repair from calibration logs is mixed: the estimated ρ is unbiased, but a plug-in fleet size misses the target in about half of repeats; a 90% bootstrap upper bound misses in 8.5% (T=400) at almost twice the sensors, and short logs cannot support the target. Stylised: equal-variance Gaussian errors with one common factor, simulated fleet, no sensor data.

Twin output such as queue waits is autocorrelated, but a run is usually summarised as mean ± 1.96 s/√n. For AR(1) output the run-mean variance is exact (matched to simulation), so 1000 draws at φ=0.9 are worth 53. For an M/M/1 lab instrument the variance of the run mean is 9.7×, 33× and 363× the iid value at ρ=0.5, 0.7, 0.9: from 10⁴ jobs the naive 95% interval covers the true mean wait 53%, 26% and 9% of the time, and a twin “certifies” an SLA of 8 against a true mean of 9 in 26% of runs. Higher load needs a longer run (470 jobs by the iid formula, 170,268 exactly at ρ=0.9). Batch means restore coverage (94–95%) only when batches outlast the correlation time; it is 53.5% at φ=0.99 and 82.5% at ρ=0.9, n=10⁴. Stylised (Gaussian AR(1) and M/M/1, simulated “real” system).

A twin started from an empty queue or a nominal sensor value is biased at first. For AR(1) output the bias and variance of the run mean are exact (0.300 vs 0.300 simulated at φ=0.9, n=100), and the MSE-optimal warm-up is about one relaxation time 1/(1−φ) with a gain of at most 1.5× and 1.03× once n is about a hundred relaxation times. An M/M/1 instrument started empty underestimates the mean wait by 21%, 6% and 1.2% at ρ=0.9 with 500, 2000 and 10⁴ jobs, but at 5000 jobs the bias (−0.14) is far below the run-to-run RMSE (2.4). Negative result: fixed deletion does not lower RMSE, and MSER-5 truncation leaves a larger bias (−0.77), covers 61% against 72% for no truncation, and passes a violating system 28% of the time against 18%. Stylised (Gaussian AR(1), M/M/1, simulated “real” system).

A twin draws anchor ranges as true distance plus Gaussian noise; real sites also have long-biased NLOS ranges. On a ring of anchors the rms position error is exactly GDOP·√(σ²+p(2−p)m²) (1.105 vs law 1.095 m at p=0.1, n=6), 4.5× and 7.3× the twin's at p=0.1 and 0.3, with zero mean. A blocked side is a bias the linear formula predicts to about 0.02 m per coordinate (0.924 vs 0.930 m) while the twin predicts none. Sized on the twin, a 1 m / 95% corridor needs 4 anchors; the NLOS site needs about 28 (p=0.1) or 46 (p=0.2), and the 4-anchor ring leaves the corridor 34.7% of the time instead of 5%. Dropping the largest-residual anchor cuts rms error 0.947→0.414 m at p=0.1 but costs 24% with no NLOS. Stylised: 2-D ring, iid exponential NLOS, simulated site, no sensor data.

A twin fitted to closed-loop logs predicts the pole under a new gain k′ with sd (σ/√n)√((k−k′)²/τ²+1/v), set by the dither τ: held-out one-step error is 1.00–1.005σ² at every τ, while the predicted pole's sd goes 0.037 to 0.82 (matching the formula to a few percent). With no dither the minimum-norm fit gets b̂=−0.22 (true +1) and certifies a real-unstable gain in 100% of fits. Point-rule false certification is 3–48%; the OLS upper bound cuts it to 0.1–4.7% but rarely certifies a good gain at low dither (5–9%). A predicted-pole sd of 0.05 needs τ=1.23 / 0.40 / 0.16 at n=200 / 1000 / 5000. Stylised: scalar linear plant, simulated data.

A twin fitted to n real interarrival and service times has a steady-state wait that is one fixed number, so its error is input error that more simulation cannot remove. The relative sd is √(1+(2−ρ)²)/((1−ρ)√n) (0.255 vs 0.257 simulated), so a 10% sd needs 1300 / 22 100 observations per stream at ρ=0.5 / 0.9. The fitted twin is unstable with exact probability P[F(2n,2n) ≥ 1/ρ] (0.370 at ρ=0.9, n=20). Used as truth, the point twin certifies a 10%-violated SLA in 36–46% of fits; the delta-method bound under-covers at high load (0.87–0.89), while bootstrap and posterior bounds reach 0.94 and cut false certification to 2–5% at a large power cost. Stylised: M/M/1, simulated data.

A twin fitted to n real observations and simulated for m jobs has relative variance a(ρ)/n + b(ρ)/m about the real wait (Whitt’s M/M/1 constant matched to simulation: 30.4 vs 29.0). One real interarrival–service pair carries the information of about two simulated jobs at any load (ratio 2.23 → 2.00), so the optimal real-data share of a budget is interior: 0.97 / 0.81 / 0.57 as a simulated job costs 0.001 / 0.05 / 0.5 of a real observation. In a full pipeline the optimal split has 2.5× lower RMSE than 20% real data. A simulation-only confidence interval is for the twin, not the system: its coverage of the real wait falls from 0.79 to 0.17 as the run grows from 200 to 50 000 jobs, while adding the input variance gives 0.92–0.95 for runs of 1000 or more. Stylised: M/M/1, simulated data, first-order variances.

Running a safety twin “until the interval is narrow” stops on zero failures, because p̂=0 has Wald half-width 0: with a target of p/5, 90% of runs stop at the first check for p=10⁻³ (99% at 10⁻⁴), the interval covers p in 9.6% of runs and the reported rate is 10× too low. Running until m failures (inverse sampling) makes (m−1)/(N−1) exactly unbiased while m/N is about m/(m−1) too high, gives relative sd ≈1/√(m−2) whatever p is (m=102 for 10%; measured 0.101), and an exact interval covers 95.0–95.5%. A fixed run planned for p=10⁻³ delivers a 20% relative half-width there but 63% at 10⁻⁴. A one-failure minimum alone restores Wald coverage in this configuration, because the target already forces ~96 failures. Stylised (iid Bernoulli failures, faithful twin, no run cap).

Braking on Gamma-distributed patch friction has an exact incomplete-gamma law. A twin drawing 100 independent cells across the stopping distance certifies 1.17× the mean-friction distance at level 10⁻³; on real terrain with 1, 3 or 10 patches across it the exceedance is 0.44, 0.33 and 0.18, and finer twin cells make it worse. The mean stopping distance is nearly right (1.00–1.32×) while the tail is not. Matching the measured patch count restores the level; overstating it 2× gives 16× the claimed risk. Stylised.

Scanning-lidar detection of a thin obstacle has an exact random-phase beam-count law and a product-over-scans miss probability (matched to a beam-pattern Monte Carlo). A twin calibrated on the mean return rate but with independent beams has no whole-scan fades; the real miss probability cannot fall below sⁿ for n scans. At level 10⁻³ the twin certifies 13.3 and 12.9 m/s against the real 12.0 and 10.9 (fade rates 0.3, 0.5), with real miss probability 0.09–0.125, about 100× the level; the gap vanishes for early-visible obstacles and reverses sign when several returns are required. The probabilities are off by orders of magnitude but the speed by only 10–30%, because miss probability is a cliff in speed. A few hundred calibration scans repair it. Stylised.

Shifting the twin's disturbances and reweighting failures is unbiased for any shift, with an exact variance e^nθ²Q((b+nθ)/√n) (5.53 vs 5.51 simulated). At the optimal shift, 10% error at p=10⁻⁶ takes 535 runs instead of 10⁸. But the shift is a narrow target: half the optimum costs 23× the variance, twice the optimum 1.7×10⁵×, and a shift tuned for one design is 1.6–17.6× worse at thresholds 0.8–1.5× away. The usual 95% interval covers 94.9% at the optimum but 2.8% at twice it, and only the effective sample size warns. Stylised: Gaussian additive disturbances, constant shift, no field data.

Radar ego-velocity from n Doppler returns. In a static-world twin least squares beats the median by exactly π/2, so the twin picks the mean; in a scene where a fraction ε of returns come from moving targets (extra offset sd τσ) the mean’s variance is exactly 1 + ετ² times the twin’s claim and the median’s exact variance is a one-dimensional integral, both matched to simulation. The twin’s choice is wrong on a band of ε (τ=10: 0.006–0.97; τ=3: 0.086–0.83; τ=1: never); at ε=0.1, τ=10 the mean has 5.8× the median’s variance and the twin’s 95% interval covers 48.7% of the time. 2-D least squares scales the same way. A residual-kurtosis test needs about 50 returns to detect it at ε=0.1, τ=10, and hundreds at ε=0.02, τ=3. Stylised: zero-mean Gaussian contamination, no RANSAC, no radar data.

Real radar radial speeds wrap modulo 2v_u (v_u=10 m/s); the twin’s do not. The twin-tuned least-squares ego-speed estimator has RMSE 0.022 m/s in the twin and on the real sensor up to 9.5 m/s, then 0.18 (9.8), 1.9 (10) and 14.9 m/s (12). Its large-n bias is exact in closed form (−14.94 at 12 m/s, simulated −14.92) and saturates at −D, D=2v_uΣc/Σc², once every target is one fold off. A wrapped-cost grid search restores the twin’s accuracy to 60 m/s with no mode errors, provided the azimuths are diverse: the nearest wrong speed has residual energy 4v_u²(n−(Σc)²/Σc²), independent of speed, and Φ(−√E/2σ) matches Monte Carlo (0.061 vs 0.054 at ±8°); at ±5° the search picks the wrong fold in 120 of 300 scenes. Stylised: stationary scene, known azimuths and v_u, Gaussian noise, no multi-PRF.

A twin states a failure probability q; the real rate is c q. An exact two-sided binomial difference test “passes” a twin that is 3× wrong with probability 0.81 at 500 trials (q = 10⁻³), and rejecting a 2× error with 80% power needs about 11 real failures, independent of q (normal approximation 9.9). Passing barely moves the odds that a twin is off by 2× (0.325 prior, 0.31 after passing at 0.3 expected failures). An equivalence test (TOST) caps false validation at 5% but needs about 20, 58 and 178 real failures for margins 2, 1.5 and 1.25, so certifying a rare-failure twin within 2× takes about 20/q real trials. Stylised: one Bernoulli failure, known q, no scenario shift, illustrative prior.

A robot commits to one of two goals when the evidence lead reaches h (a sequential test on binary motion cues); against a human of cue accuracy p the wrong-goal probability is exactly 1/(1+r^h), r=p/(1−p), matched to simulation. A threshold set for error 10⁻³ in a twin with p_s=0.9 gives real error 3.9× / 33× / 165× the target at p=0.8 / 0.7 / 0.6, while a too-irrational twin (p_s=0.6) is safe but 2.0–4.5× slower. A heterogeneous population (sd 0.08–0.10) doubles the error of the mean-human threshold, and humans with p<½ put a floor under any threshold. Calibrating p_s from n real cues misses the target with probability 0.38 / 0.42 / 0.33 / 0.30 / 0.14 at n=10 / 20 / 50 / 200 / 1000; a lower-confidence-bound design cuts that to ≤4% at the cost of time. Stylised: two goals, i.i.d. binary cues, simulated humans.

Two sensors observe a smooth signal (length scale ℓ); the second has a clock offset δ and jitter s, which the twin does not simulate. The added variance is exactly g = 2σ²[1−(1+s²/ℓ²)^−1/2e^{−δ2/2(ℓ2+s2)}] ≈ σ²(δ²+s²)/ℓ² (matched to simulation within 0.5%), so inverse-variance fusion designed in the twin has real MSE 1 + ag/(b(a+b)) times its claim: +44% at a 0.3ℓ offset, +118% at 0.5ℓ, and worse than the reference sensor alone beyond 0.225ℓ. The more accurate the delayed sensor, the more it hurts. Randomising the twin’s clock at the right variance recovers the optimal weight; no randomisation costs up to 29%, a range 4× too wide only 1–4%. Stylised: very smooth signal, static weights, offset known, no real logs.

Regressing the plant output on a logged input that carries sensor noise attenuates the fitted gain by the reliability ratio λ = σ_u²/(σ_u²+σ_v²) exactly (0.800 vs 0.802 simulated at λ=0.8). It is bias, not variance, so more data makes it worse: the twin's own 95% interval covers the true gain 53% / 15% / 0% at n=20 / 50 / 200 while covering the attenuated value 94–97%, and the twin's fit residuals are exactly uncorrelated with its regressor, so nothing warns. A feedforward controller built on it overshoots the real plant by exactly 1/λ (1.25× at λ=0.8, 2× at 0.5). A known-noise correction or a second independent measurement as instrument removes the bias (RMSE 0.20 to 0.02–0.05 at n=200–1000), but a 20% misjudged noise variance leaves a ±5% bias and at n=20 with λ=0.5 the repairs are far worse than the biased fit. Stylised: scalar Gaussian plant, simulated “real” system.

With a deadband d the real servo loop rests at exactly |x| = d/k (0.500 at d=0.2, k=0.4) while the twin converges to zero, so the twin certifies tolerances the real loop never meets and needs k ≥ d/ε, which fails beyond k = 1. A linear twin fitted from Gaussian excitation of std s recovers 2Q(d/s) (Stein’s lemma; 0.0457 vs 0.0455 at s=0.5), an excitation-dependent gain, while the small-signal gain is 0. Bisection needs about 8 real probes to cut the stall 0.784 → 0.0005, with exact residuals (d−d̂)/k under-compensated and a period-2 chatter (d̂−d)/(2−k) over-compensated. Stylised: scalar integrator, noiseless, k ≤ 1.

At K=0.5, d=0.1 the linear twin’s exact stationary rms is s√(K/(2−K)); the real deadband loop is 27× worse at s=0.01 (0.1591 vs 0.0058) but 0.37× at s=0.05 (0.0107 vs 0.0289), because noise dithers the actuator, so a validation in the high-noise regime would call the deadband harmless. Deliberate dither removes the noise-free stall (rms 0.2000 to 0.0001 at a=d) but only hurts at s=0.05 (0.0103 to 0.0226), and under noise mild under-compensation of the width beats the exact width (0.0053 vs 0.0116 at s=0.02). Follow-up to the deadband twin. Stylised: scalar integrator, single-seed simulations without confidence intervals.

The real loop x⁺ = x + a⁺, with the command rate-limited to r per step, is scale-invariant: it depends only on ρ = x₀/r, while the first-order twin does not. The twin is exact iff x₀ ≤ r/k (difference 0 at 0.999×, 0.1–0.6% of x₀ at 1.01×). Beyond that the real loop overshoots the target (0.23 of x₀ at ρ=100, 0.90 at 10⁴, k=0.3) and settles in O(ρ) steps (29418 at ρ=10⁵ vs the twin’s 13). For k=1/n the overshoot threshold is empirically ρ*=2n(2n−1) (not proved); avoiding overshoot needs a rate limit 12–38× lower than keeping the twin exact. Stylised: scalar plant, no noise or delay.

On a discrete PI loop the rigid twin has spectral radius 0.71–0.89 and converges, yet the real loop with a gap of half-width h settles on a limit cycle of motor amplitude 1.30–2.94h that scales exactly with h (1.302317 for h=0.01, 1, 100). The backlash describing function is an excitation-dependent gain (0.21 at A/h=1.2, 0.99 at 30) with a phase lag, and harmonic balance predicts the cycle but overestimates its amplitude by 6.7–10.1%. Negative result: the loop is bistable in some settings (hunting 1.165h from small starts, converging from large steps), so a large-step validation can pass a configuration that hunts. Follow-up to the deadband twin. Stylised: scalar loop, symmetric known gap, noiseless.

With Coulomb friction c the real coast-down stops in finite time with exact distance (m/b)[v₀−(c/b)ln(1+b v₀/c)] (RK4 agreement 9×10⁻⁹), while the viscous twin only decays exponentially (6.5 s to reach 10⁻³ vs 1.95 s real). The least-squares gain b+cE[v]/E[v²] depends on the logged speed range (1.23 on [1,3], 3.44 on [0.05,0.3]); fitted on [1,3] the twin overestimates stopping distance ×1.8 at v₀=1 and ×17 at 0.05, is exact at 7.34 and underestimates above. Negative result: no single viscous gain does better than 0.87 worst relative error over [0.05,3], while an affine fit recovers (b,c) exactly. Stylised: one mass, noiseless logs.

Unit mass under PID, frictionless twin stable (error below 1e-58). With F_s=F_c (sliding friction identified correctly) the real loop converges in all 15 cases tried, so that twin validates. With a stiction excess ΔF=F_s−F_c it hunts in stick-slip at 0.54–0.93 ΔF/k_p in four of five gain settings, independent of F_c (0 to 20) and of the start, falling with damping; one setting (k_d=4, k_i=5) converges. Scaling is bit-exact for power-of-two scales but the cycle is unique only to about three digits. Negative result: a 1000 s run can show a motionless “converged” error for large F_c/k_i while a 20 000 s run still hunts; the amplitude constant has no closed form here. Follow-up to the backlash twin. Stylised: unit mass, Coulomb plus static friction, noiseless.

Unit mass under PD control with a first-order actuator lag τ the twin omits. The twin’s loop is stable for every gain; the real loop is stable iff τ<τ*=k_d/k_p=2ζ/ω_n (Routh, agreeing with the roots in 168 of 168 cases), hunts at exactly the twin’s own ω_n, and grows at ω_n²/(2(1+4ζ²)) per unit excess lag (formula, numeric slope and simulation agree). “Faster is better” fails: at τ=0.05, ζ=0.7 the real decay rate peaks at 4.8 (ω_n≈8) and is zero at ω_n=28 where the twin promises 19.6; the poles sum to −1/τ, so no gains decay faster than 1/(3τ). Mild lag is nearly invisible in a step test (twin RMS error ≈0.04 ε). Companion to the slew, deadband and backlash twins. Stylised: linear, one lag, noiseless.

A twin with one rigid inertia says the PD loop is stable at every bandwidth. With load-side sensing the real two-mass loop is unstable above ε_c = w/w_s, the smallest root of a cubic in modal damping δ and twin damping ratio ζ: exactly independent of the mass ratio, ≈ δ/ζ for small δ (0.0143, 0.0714, 0.286 for δ = 0.01, 0.05, 0.2 at ζ = 0.7), and unstable at every gain with no modal damping. Motor-side (collocated) sensing was stable at all 7 320 grid points, so the twin is right about one sensor placement and wrong about the other. Twin and real step responses differ by under 1% at 0.9 ε_c, so ordinary validation gives no warning; a twin that overstates δ by a factor f certifies ε_c high by the same factor, and a design at fraction m of the certified bandwidth tolerates f ≈ 1/m. Stylised: one flexible mode, linear, PD only, continuous-time, noiseless.

For a two-axis loop x’ = x − kGx with cross-gain c, the stable-gain limit is 2/(1+√p) (p=c₁₂c₂₁≥0) or 2/(1+|p|) (p<0) instead of the twin’s 2, so a twin-certified 10% margin (k=1.8) fails at c=1/9, and no positive gain is stable once √p≥1. The twin-deadbeat gain has real rate √|p|, not 0 (6–270 steps to 10⁻⁶ for c=0.1–0.95 vs 1). A diagonal gain fitted from logs is 1+cρ for input correlation ρ (Monte Carlo matches to four digits), giving real rate c(1+ρ)/(1+cρ) (0.300 at ρ=0, 0.461 at ρ=1); the unbiased full fit has variance ∝ 1/(1−ρ²) (verified within 5%), so near-collinear logs make coupling unidentifiable while the per-axis fit returns a confident wrong gain. Follow-up to the control twin. Stylised: linear constant coupling, two axes, noiseless plant.

Integrator plant under PI control, real actuator limited to |u|≤U with constant load d; the twin has neither. The twin is exact iff k_px₀≤U (zero deviation up to x₀=0.714), so gentle step tests certify it. Beyond that the integrator winds up to exactly x₀²/(2U): overshoot rises from the twin’s 21% to 74%, 93%, 97% and the settling time from 4.9 to 17, 165, 944 (x₀/U=5, 20, 50); a load d≥U is never rejected and settling blows up as d→U. “Faster is better” fails: the twin’s settling time falls 32× over ω_n=0.25–8 while the real one is best near ω_n=1 and rises to 77; conditional integration recovers most of it. Companion to the lag and slew twins. Stylised: one integrator, static limit, noiseless.

Truth is closed form: infinitely many impacts in the finite Zeno time T=(v₁/g)(1+e)/(1−e), with d ln T/de=2/(1−e²) (10.5 at e=0.9, 100 at 0.99). A semi-implicit-Euler twin with a penetration test has an apparent restitution biased by the step with scheme-dependent sign (true 0.9: 0.886, 0.895, 0.879 at dt=10⁻²) and its time to come to rest is off by −19.6%, +4.0%, −30.8% (e=0.9; up to 47% at e=0.95), first-order in dt and 0.1–0.3% at 10⁻⁴. The restitution bias explains most of the clamp error (predicted −14.9%, measured −19.6%), but fitting e on the first rebound is not a reliable repair: it helps the clamp twin at dt=10⁻² (−19.6% to −4.8%), does nothing at finer steps and makes the mirror twin worse (+4.0% to +53%). Twin impact counts (238–688) are mostly floor chatter against 43–87 resolvable bounces. Stylised: one dimension, constant restitution, rigid contact, closed-form real system; the crude interpolated-contact variant is the worst here.

Scalar loop x[n+1]=x[n]−k x[n−d_n]+w[n] with random delay; the twin has the same marginal delay law (constant mean: stable iff k<2 sin(π/(2(2d+1)))). Independent jitter moves the mean-square limit little and in either direction (1.000 for {0,2}, 0.952 for {0,1,2}, 0.668 vs the twin’s 0.618 for {0,1,2,3,4}); for {0,2} with P(d=2)=p it fits k(k+1)=1/p. Persistence, invisible in the histogram, is the large effect: at fixed marginal the limit falls 1.000→0.875→0.672→0.624 at lag-1 autocorrelation ρ=0, 0.5, 0.9, 0.99 (towards the worst-case constant delay’s 0.618); a twin-certified k=0.9 is unstable from ρ=0.435, and below the limit the variance at k=0.6 inflates from 2.56 to 6.26 (ρ=0.9) and 15.2 (ρ=0.99). Almost-sure stability (simulated limit ≈1.84) is insensitive to ρ, so which stability the safety claim needs decides whether persistence matters. Companion to the latency twin. Stylised: scalar plant, sticky-redraw delay, Monte-Carlo almost-sure limits (one seed).

A pendulum under PD control u=k_p(θ*−θ)−k_dω; the twin omits gravity and promises zero error at every gain. The real hold sags to the root of k_p(θ*−θ)=g sinθ nearest the target (RK4 agrees to six digits; 0.182 rad at k_p=4, θ*=1), falling only as ≈1/k_p. Holding upright is stable iff k_p>g: below it the arm settles 0.2–1.9 rad away, and just above it the basin is tiny (0.116 rad at 1.02g, 0.519 at 1.05g, none below 3 rad from 1.1g; numerical scan). A gravity feedforward with calibration error leaves a sag linear in (g(g−g_ff)minus;g_ff) (±0.0185 rad at ±10%). Companion to the lag and flex twins. Stylised: one rigid joint, noiseless, no friction.

Double integrator under PD control computed at period T and held. The twin (T→0) is stable for every gain; the exact step matrix gives the real stable region k_pT/2 < k_d < 2/T, i.e. ω_nT < min(4ζ, 1/ζ), matched to bisection and an independent RK4 held-input run (ζ=0.7 fails at ω_nT=1.4286). The twin is accurate for ω_nT ≲ 0.2 but at 1.2 the real overshoot is 0.234 against its 0.046, and at fixed T raising ω_n past ω_nT≈1 slows settling (0.4 → 5.2) then diverges. Deadbeat gains (k_pT²=1, k_dT=3/2) settle in 2 samples, the real speed limit. Stylised: noiseless, no computation delay.

Real drag cv|v|, twin kv with k matched at one speed. Coast-down time to fall to v₀/10 is 9/(cv₀) for the truth and independent of v₀ in the twin (0.05×, 0.51×, 1.02× the truth at v₀=1, 10, 20 for a fit at 5); terminal speed is off by v_term/v_fit; a least-squares fit over [0, v_max] has k=3cv_max/4, exact only at 0.75v_max. The safe speed under a 10 m stopping limit is mis-stated by −20.8%, −8.9%, +7.0%, +41.1% for fits at 1, 5, 10, 20 m/s, so the error changes sign with the fit speed, and trace-fitted k falls from 0.382 to 0.223 as the coast-down lengthens because the slow tail dominates. Stylised: one dimension, pure quadratic drag, closed-form noiseless truth.

Real car: linear single-track model with tyre slip; twin: ψ′=vδ/L. Steering with the twin’s angle gives radius R(1+Kv²/L) for understeer gradient K, matched by simulation (R=100 m: 104.6, 118.5, 174.0, 266.4 m at 5, 10, 20, 30 m/s; twin 4–63% too small, exactly half at the characteristic speed 23.26 m/s; oversteer car up to 136% too large at 20 m/s). Fitting K removes that error exactly, yet both the kinematic and the calibrated twin certify δ=−k_py−k_dψ as stable at every speed and gain, while 11 of a 30-point gain grid lose stability on the real car below 60 m/s (k_p=0.4, k_d=0.5: 14.0 m/s; confirmed in the time domain, 1.1×10⁻⁹ m at 8 m/s vs 4.6×10⁷ m at 20 m/s). An oversteer car with feedback loses stability at 23.7 m/s, below its open-loop critical speed 26.33 m/s. Stylised: linear tyres, constant speed, no actuator lag or delay; the closed-loop limit is not derived in closed form.

Real route: a straight line of length L; twin: shortest path on a k-connected lattice. The grid/Euclid ratio depends on heading and connectivity, not cell size: 8-connected it is cosφ+(√2−1)sinφ, mean 8(√2−1)/π=1.0548 and worst 1.0824 at 22.5° (4-connected mean 1.2732, worst 1.4142; 16-connected 1.0144, 1.0275), matched by Dijkstra; refining the cell from 8 m to 0.1 m leaves a 100 m route at 22.5° at 1.0824. Calibrating by the mean leaves −5.2% to +2.6% (8-connected). For two routes of Euclidean length 1 and 1.03 at random headings the twin ranks the longer one shorter with probability 0.194 (0 at ratio ≥ 1.0824), and for a fixed pair 22.5° apart rotating the map flips the ranking for 31% of orientations. Stylised: free space only, no obstacles, length as a proxy for time or energy.

Row r is exposed at t=rτ/H, so a moving rectangle is imaged sheared and stretched; closed-form edge normals match a row-by-row simulation. At 1000 px/s horizontal speed the vertical edges tilt 3.58° and the horizontal ones 0, so averaging the two edge families (what a global-shutter twin certifies) is biased 1.79°; 1000 px/s vertical speed makes the target 6.7% taller. One frame of a known-size rectangle identifies orientation and both velocities in closed form: with 0.25 px edge noise orientation error falls from 0.24–0.97° to 0.027° and speeds are recovered to 16 and 4.8 px/s, but vertical speed is very sensitive to the assumed size (a 5% height error moves it by about 800 px/s). Stylised: straight edges, constant velocity, known size, no real footage.

Real sensor: 2-D lidar at 10 Hz firing each beam at a different time while the platform moves; twin: all beams at t = 0. At 10 m/s the front and back walls are placed 0.25 and 0.75 m short, so apparent room length is biased by exactly vτ/2 = 0.50 m while the width is exact, and deskewing with the true motion removes it. Parallel walls appear to converge by ≈ vτ/(2π)(1/d₁+1/d₂) (1.94° measured vs 2.05° first order), so a wall-angle estimator certified on the snapshot twin inherits a heading bias; inverting that angle recovers speed from a single scan to 0.13 m/s at 1 cm range noise (first-order bias −1.8%). Yaw scales bearings by exactly −κβ/(1+κ), and acceleration biases scan-to-scan odometry by exactly a t_f in velocity, bounded and non-accumulating. Stylised: 2-D rectangular room, constant velocity or acceleration along one axis, known platform motion.

Real receiver: 2-D position and clock from n pseudoranges with multipath; twin: white noise σ only. For an evenly spread constellation HDOP is exactly √(4/n) (simulated to 0.3%) and collapses to 4.25 over a 90° arc; one biased satellite of size b moves the fix by exactly 2b/n toward that satellite, which no amount of averaging removes. With AR(1) multipath (ρ = 0.99) the twin predicts a 1/√T gain but the simulated error only falls from 1.58 to 0.80 m over 500 epochs (exact 0.80), and a 95% radius calibrated on single epochs covers 33% of fixes at T = 10 and 5% at T = 100 (exact 31% and 5%). A residual integrity test tuned to 1% false alarms on the twin alarms 21% of the time when multipath equals the noise (exact closed form), and the statistic rises by only b²(1−3/n) while the position bias is 2b/n. Stylised: 2-D, linearised, evenly spread or arc constellations, stationary AR(1) multipath.

A frictionless point mass overstates down-ramp acceleration by exactly 1+k (k=I/mr²: 1.4, 1.5, 2.0 for sphere, disc, hoop), so a 2 m descent takes 0.90 s instead of 1.07–1.28 s; a stick/slip simulation matches the closed forms to 3×10⁻⁴ m/s². The slip threshold μ* = k tanα/(1+k) is invisible to the twin, and a launch speed picked in the twin to coast 1 m carries a rolling body 40–100% farther. A gain fitted on one shape removes its own error but leaves −16% to +20% fall-time error on the others (pooled fit +6.7% to −10.7%), and the twin cannot rank the shapes. Stylised: planar incline, Coulomb friction, no rolling resistance or drag, no hardware data.

With Brown distortion x_d=x(1+k₁r²) and a camera at height h, the pinhole twin reads floor range off by exactly 1/(1+k₁h²/R²): for k₁=−0.3, h=0.5 m that is +15.4% at 0.75 m, +8.1% at 1 m and +0.5% at 4 m. A policy trained to stop at 1.0 m stops at 0.909 m (16.4 cm short at 0.75 m; the first-order formula understates this at large ρ). Least-squares focal calibration (s=1+3k₁ρ_max²/5) moves the error rather than removing it: near-field 8.1% → 3.2% but a new 4.4% far-field under-read, and a 4 m stop lands 17 cm long. One image of a known grid identifies k₁ (RMS 0.001 at 0.002 normalised-pixel noise). Stylised: one distortion term, axis-column floor points, known grid pose, no real lens.

A bar of width w moving d = vT px during the exposure is imaged as an exact trapezoid (peak C·min(1, w/d), energy Cw conserved), matching a 2000-sub-exposure simulation to its quantisation. A single-pixel peak detector that the twin certifies at Pd = 1 everywhere loses power as soon as d > w (at w = 6, C/σ = 10: Pd 1.00 → 0.28 at d = 24), with speed limit d* = wC/(σz) (13.7 px). A box filter of length d collects all of Cw at noise cost √d, output Cw/(σ√d)·(1−w/4d), so the limit grows quadratically in SNR: 5–55× faster over 12 settings, but it needs the speed, and a filter tuned on the twin (length w) still drops to Pd 0.26 at d = 60. Stylised: 1-D, known location, constant velocity, white Gaussian noise, no real footage.

A hard-iron offset β (relative to the field B) gives a peak heading error of exactly asin(β/B) (11.5° at 0.20, 53.1° at 0.80); soft-iron axis scaling r gives asin(|1−r|/(1+r)) (6.4° at r = 0.8), unchanged by removing the offset. A compass-held 100 m square misses its start by 2Lβ/B (2, 6, 20, 60 m at 0.01–0.3) for every offset direction tried, while the ideal twin closes to 10⁻¹⁴ m; a straight leg stays within 1 m cross-track for only 10–50 m at β/B = 0.02–0.10. A circle-fit swing calibration over a full turn has offset error ≈ 2σ/√n (0.0040 at n = 100), growing ×1.8 at 180°, ×12 at 90° and ×45 at 60° of turn (median heading residual 0.18° → 2.2° → 10.7°). Stylised: level 2-D sensor, simulated data, no gyro fusion, no ellipse fit; the 2Lβ/B closure law is verified numerically, not proved beyond first order.

Real rate = white noise N plus a random-walking bias K; the twin keeps only N. Heading variance is N²t + K²t³/3, so the real/twin ratio is exactly 1 + (t/t*)² with t* = √3N/K = 86.6 s (2.33 at 100 s, 134 at 1000 s), confirmed by Monte Carlo and a simulated Allan deviation (within 3% for short averaging times, noisy at 1000 s). Re-aligning to keep 2σ heading within 1° is needed every 416 s; the twin allows 10 000 s (24×), where the real error exceeds 1° with probability 0.986. An Allan fit at 1–10 s changes nothing; a fit at τ₀ = 100 s is exact only there (variance ratio 2.3 at 1 s, 0.18 at 300 s) and one at 1000 s is 5.6× too conservative. For 2σ cross-track error within 1 m the twin reports 1.74× (1 m/s) and 1.25× (5 m/s) too much usable distance. Stylised: linear-Gaussian, one axis, parameters chosen by me, no aiding, no real IMU data.

Real round-trip energy is (v⁴+1)/(v²−w²), so wind does not cancel: real/twin is exactly 1/(1−(w/v)²), 1.33× at w/v=0.5 and 5.3× at 0.9, the same for either sign, with no return at |w|≥v. The twin-optimal airspeed is 1 for every wind while the real optimum solves v²=w²+√(w⁴+1), so flying the twin's optimum costs 1.5%, 9.8%, 52% extra at w=0.4, 0.6, 0.8. A twin calibrated on one leg and assumed to see the same wind back is off by exactly +w/v (headwind leg) or −w/v (tailwind leg): ±33% at w=0.5, v=1.5, with a sign set by which leg was flown. Stylised: steady along-track wind, constant airspeed, two-term power law.

Holding a torque dissipates Ri²; heating lowers the torque constant, so the hold current rises and heats more. In scaled variables φ′=λ/(1−φ)²−φ the hold exists iff λ≤4/27 (fold at φ=1/3) while the twin says φ=λ at every load: the real temperature rise is 1.33× and 1.76× the twin’s at λ=0.10 and 0.14 (current 1.15×, 1.33×) and 2.25× at the fold; above it there is no hold and the torque constant collapses in finite time, ≈4π/(9√ε) thermal time constants near the fold (ratio 0.925 at ε=0.002, 0.994 at 10⁻⁵). Tests shorter than the thermal time constant cannot see it (0.1 time constants at λ=0.14: +1.4% current). Under a winding temperature limit the twin overstates holdable torque by 1/(1−φ_m) (1.11× at φ_m=0.1, 1.64× at 0.4); refitting a constant gain on a hot low-load run still under-predicts (−0.06 to −0.10) and keeps no fold; winding-resistance rise lowers the fold (0.148 to 0.113 at β/α=1). Companion to the windup and gravity twins. Stylised: one thermal node, linear derating, constant load.

A twin with unlimited sensor range predicts geometric convergence; a real sensor reading clip(x, −R, R) caps the approach speed at kR. The exact step-count law matches simulation in 108/108 cases; for k=0.25 the twin says 49 steps from 1000R and the real loop takes 4021 (82×), an error linear in x₀/R with slope 1/k. For a PI loop the twin's overshoot is neither a bound nor a lower bound: smaller at 2–5R, 4.1× larger at 1000R; conditional integration repairs overshoot but not settling time. Logs within range fit the gain exactly and cannot reveal R; from logs uniform on [−L, L] the fitted gain factor is 1.5q−0.5q³, q=R/L. Stylised: scalar noiseless loop, hard symmetric clip.

Splitting a fixed budget of N twin draws into r replications, each started at an offset and with d draws deleted, gives iid replication means, but the warm-up bias does not shrink with r. For an AR(1) the MSE and the exact coverage of the Student-t interval are closed-form (0.921 vs 0.921 simulated at r=50): a single run minimises MSE, replication costs at most 1.07× at φ=0.9 but 2.2× at φ=0.99, and the nominal-95% interval covers 92% at the MSE-optimal deletion once replications are short (no deletion reaches 94% at 40 draws each). Single-run batch means were not worse in this model. Preliminary M/M/1 simulation: 30 short replications cover 5.8% of the time, and no setting tried reaches 95%. Stylised: Gaussian AR(1), one start offset, simulated “real” system.

A twin reset to an empty queue and averaged over n steps is biased toward that start. For AR(1) output the bias, variance and best warm-up deletion are exact (bias/sd 1.88 to 0.12 for n=20 to 2500 at φ=0.9). For the M/M/1 wait the summed empty-start bias is ρ/(1−ρ)³ (verified numerically against an exact series and coupled simulation), so it equals one standard deviation only at 23 jobs at ρ=0.9: at run lengths that give a valid interval it costs 1–3 coverage points. Short runs are different: 50 jobs from an empty start read 5.6 below the true mean wait of 9; starting at the mean reduces bias but not reliably RMSE; a noisy real-state start is unbiased with 3.6× the sd; MSER-5 truncation made bias and coverage worse here. Stylised (AR(1) and M/M/1, simulated “real” system).

A twin ranks K=50 designs and a fixed budget of 20 noisy real trials verifies only the top m. The twin alone is worth exactly ρc_K (c_K=2.249), and the best shortlist shrinks as the twin improves (m=8 at ρ=0.6, 2 at 0.95), reaching 1.87 and 2.17 sd against 1.20 for real-only testing and an oracle 2.25. A useless twin still gains 0.12 by concentrating the budget on fewer designs, so that part is not the twin's. Stylised Gaussian model, even budget split, Monte Carlo.

Shrinking a real estimate of d plant parameters toward the twin's prediction (James–Stein) has an exact risk d−(d−2)²E[1/(d−2+2K)], K~Poisson(λ/2): it never raises total error for d≥3, a perfect twin gives risk 2 at any d (saving 33% at d=3, 80% at d=10), and a twin as noisy as the data (λ/d=1) still saves 14–49% while using it alone saves nothing. At large d the twin is worth n+σ²/τ² real samples (exact values 0.72–0.998 of that at d=5–100). The guarantee is aggregate only: one badly mismatched parameter among d takes about d/4 noise variances of damage (measured 2.9 at d=10, 25.5 at d=100 against 1), and blocks of 5 cap that at 1.65 (d=30) while keeping 72% of the perfect-twin saving. Stylised: Gaussian noise, orthogonal design, no robot data.

With a planar mount-yaw error e, radar ego-velocity dead reckoning is exactly the true path rotated by e: error 2 sin(e/2)·|displacement|, bounded by the path diameter and zero after any closed loop, so loop and out-and-back validations pass while a straight 157 m run is off by 27 m at 10°. A closed-form rotation fit recovers e with standard deviation σ/√Σ|p_i|² (matched by simulation, 95% coverage). Stylised: the result is planar; a pitched mount drifts vertically by exactly laps·2πR sin e despite perfect x-y closure.

A twin evaluated alone is biased however many rollouts you run (nominal 95% intervals cover the truth 0–0.4% of the time at a 12% bias, 20% gain error); used as a control variate it removes variance without bias. In scalar LQ the rollout cost is a Gaussian quadratic form, so the twin/plant correlation ρ = λ tr(GG′)/√(tr G² tr G′²) is exact, the optimal twin-to-real ratio is ρ/√((1−ρ²)w) and the speed-up 1/(√(1−ρ²)+ρ√w)², matched by simulation to a few percent. Twin gain error is first order in the bias (5% error → 2.7%) but second order in 1−ρ, so the twin’s value is capped by the fraction λ of the real disturbance it can replay: a 5% certificate costs 168 real-only, 28 with λ = 0.95 and 163 with λ = 0.3. Twin-only beats real-only only below σ²/bias² real rollouts (35 at 10% error). Stylised.

With CA- and OS-CFAR thresholds set in a Gaussian twin and deployed in gamma-textured clutter, the exact false-alarm and detection laws (including a new one-dimensional OS-CFAR law) match simulation to ~1%. OS-CFAR is inflated much like CA (design 1e-4, ν=2: 30× vs 35×). Repairing the threshold costs 3.7–4.6 dB, yet the SNR needed for Pd = 0.9 at Pfa = 1e-4 is 6.3 dB above the twin’s promise at ν=2 (2.8 dB at ν=5, 0.8 dB at ν=20), and at the twin’s own threshold and promised SNR real Pd is 0.84 while Pfa is 30× design. Texture does not reverse the CA-beats-OS ranking (a negative result). Stylised: iid gamma texture, constant-SNR target, no interferers, no real radar data.

A twin-only cost estimate is biased by the twin’s error, a real-only one is noisy; as a control variate the twin keeps the estimate unbiased and is worth its correlation with real rollouts, not its accuracy. Under common disturbances the cost correlation has a closed form and decays as (1+c⁴)/(1−c⁴)²(kδ)² in the twin’s gain error (0.985, 0.941, 0.782, 0.472 for gains 1.15, 1.3, 1.6, 2.0 while the twin-only bias grows 0.004 to 1.34); replaying only a fraction λ of the real disturbance multiplies it by exactly λ². The optimal twin-to-real rollout ratio is √(c_rρ²/(c_t(1−ρ²))), the twin pays only below price (1−√(1−ρ²))²/ρ², and a simulated estimator cut variance to 0.228 of real-only against 0.225 predicted. Twin-only wins at tiny budgets or tiny bias; the control variate is best elsewhere. Stylised.

An e-process on the twin's closed-loop prediction residuals is valid however often it is checked (2.3% false alarms versus 51.6% for a repeatedly refit χ² test at nominal 5%). Its detection rate is exactly the twin-transfer score gap, affine in the exploration variance v; a mixture-delay formula matches simulated medians within 10–20% (leading order L/rate is 40–55% too fast). Twins on the line Δa = kΔb are invisible under the deployed policy (rate exactly 0) and detectable at rate Δb²v/2σ² with dither; most of them cost almost nothing (regret 6·10⁻⁴) so dither does not pay, but the one that thinks the actuator is nearly dead (regret 0.23) is worth a v≈0.006 dither that cuts expected cost 12×. Stylised.

Unbiased compression of each worker’s pseudo-gradient (noise proportional to the signal, ω) has exact stationary variance αV_w(1+ω)/(Ms(2−αsc)), c = 1+ω/M: it caps the outer step at 2/(sc) and the contraction at 1−1/c (keeping 10% of coordinates with 8 workers: 0.53, 22 rounds to 10⁻⁶ against 1), and random participation is the special case ω = 1/p−1. Dithered quantisation only adds Δ²/12 to the variance and leaves stability alone. At fixed bandwidth, sparsifying favours few full reports, while quantising has an interior optimum near 1.3 bits per coordinate with many workers, about 4× below 8-bit reports (the textbook high-resolution law understates the noise 2.9× at 1 bit). Matched to simulation within 3%. Stylised.

Each worker transmits a random fraction p of its pseudo-gradient. Rescaling the subset (unbiased) inflates the stationary noise floor by exactly 1/p. Adding a per-worker error-feedback memory gives an exact closed form from a four-dimensional second-moment recursion and costs only 1 + αs(1/p − 1) at small steps, for any number of workers, because the virtual iterate follows uncompressed SGD. The price is speed: the mean dynamics have determinant 1 − p, so the contraction cannot beat √(1 − p) per round; over a 400-round horizon error feedback reaches 0.39, 0.24 and 0.17 of the unbiased loss at p = 0.25, 0.1, 0.03, and the advantage disappears when the horizon is shorter than about 1/p. Stylised: diagonal quadratics, Bernoulli masks, no top-k.

Applying the outer step τ rounds late gives a mode the recursion x_t+1 = x_t − αs x_t−τ, stable iff αs < 2 sin(π/(4τ+2)) ≈ π/(2τ+1). The best step sits at that edge, so the rate is 1 − 2 sin(π/(4τ+2))/κ_H (exactly κ_H/(κ_H+1) at τ=1), and outer momentum stops helping the moment τ ≥ 1 (69 rounds at τ=0 become 1388 at κ_H=100). Even with the sync fully hidden the gain over blocking averaging is at most (τ+1) sin(π/(4τ+2)) ≤ 1, and an exact search over (H, τ) finds overlapped training 1.5–4.9× slower than blocking averaging and 2.3–31× slower than blocking with tuned momentum. Giving the fresh pseudo-gradient weight above ½ removes the penalty entirely (stable for every τ; at weight 0.75 and τ=1 the stale term acts as negative momentum, 2× faster than no delay). Stylised: noiseless quadratic, shared Hessian, one common delay.

Real gust: Ornstein–Uhlenbeck with rate a and variance s²; exact real variance s²(a+k_d)/(k_dk_p(a²+ak_d+k_p)). A twin drawing iid gusts per step has variance s²dt/(2k_dk_p): 141× too small at a=1, dt=0.01 (270× at a=0.05), a standard deviation scaling as √dt, and a 10⁻³ margin that the real system exceeds 78% of the time. A spectrum-matched white twin is always conservative, real/twin = a(a+k_d)/(a²+ak_d+k_p) < 1 (0.71 at a=1). Fitting the OU rate from logged wind recovers the real variance (within 1% at 10⁵ samples). Stylised: linear loop, Gaussian gusts, no wind data.

Two-ray detection 16 sin⁴u, u=2πh_rh_t/(λr): lobe-mean gain exactly 6 and a detected phase fraction 1−(2/π)asin((c/16)^1/4), exactly 2/3 at the free-space range edge. The real system misses 20% of ranges inside the free-space range and detects 44% of those beyond it. A deterministic two-ray twin with height error δh disagrees ≈4h_rδh/(λr) (0.200 at 0.5 m, matching simulation) and is worse than free space at short range; a height-jitter ensemble scores Brier 0.119 against 0.197 deterministic and 0.533 free space. Stylised: perfect reflection, flat earth, hard threshold, no radar data.

Ideal monopulse on two unresolved scatterers (strong 1, weak r, random phase) gives Y=(1−r²)/(1+r²+2rcosφ): the mean is exactly the strong scatterer and the median exactly the power centroid, variance 2r²/(1−r²), and the estimate lies outside the target span with probability arccos(r)/π. A variance-matched Gaussian centroid twin gets the median right and the mean wrong by 2r²/(1+r²), is 27× too optimistic at a 3σ gate at r=0.9, and predicts √(var/N) for averaged looks where the real mean floors at that bias (0.90 vs 0.09 at N=1024); the median converges and beats the mean on variance for r≥0.477. Stylised: noise-free ideal monopulse, two scatterers, no radar data.

For Poisson counts the Bayes dark/bright threshold is the logarithmic mean (λ₁−λ₀)/ln(λ₁/λ₀); a Gaussian twin with one matched variance puts it at the arithmetic mean (7.28 vs 8.00 for 4 vs 12), and a square-root twin lands in between at (A+G)/2. A detector tuned in the arithmetic twin has 1.25× the optimal real error at (4,12), 1.83× at (10,30) and 1.74× at (50,100), and with λ₁=2λ₀ the penalty grows to 23× at λ₀=200, while the twin’s own predicted error stays within 1.8× of the optimum; the square-root rule recovers the optimal integer rule in 8 of 9 pairs. Stylised: ideal Poisson counts, no read noise, no camera data.

A lone strong target through a matched filter alarms at neighbouring cells with an exact Rician probability where the point-response twin says P_fa0=10⁻⁶: at the rect peak sidelobe (−13.3 dB) it is 0.020 at 20 dB SNR and 1.0 at 30 dB, and the ghost zone radius grows √10 per 10 dB (3 to 331 cells for 20–60 dB). Tapers raise the ghost-free SNR by exactly the sidelobe-level difference plus the ENBW loss (20.0 dB Hann, 30.8 dB Hamming) at 1.5–1.6× mainlobe width, but ordering by peak sidelobe misleads at very strong targets: Hamming’s 1/x far sidelobes give a 42-cell zone against Hann’s 7 at 60 dB. A weak target beside a 40 dB one is ‘detected’ with P_d=1.0 where the empty cell alarms with probability 1.0. Stylised: white output noise, no CFAR or clutter, no radar data.

An update is sent as r copies g slots apart and is lost only if all are. Against a two-state loss chain with the same marginal rate p = 0.2 and lag-1 correlation λ, the exact residual is p(p + λ^g(1−p))^r−1 against the twin’s p^r. The twin’s 5 back-to-back copies for 10⁻³ give a real residual of 0.026 at λ = 0.5 and 0.10 at 0.8 (81× and 311× the claim); two copies need spacing of 6 to 36 slots to come within 10% of the twin. With at most 8 copies the minimum-latency design is 12 to 154 slots (λ = 0.5 to 0.95) against the twin’s 4, and with at most 4 copies no spacing reaches 10⁻³. A counter-case: with no copy budget and a long deadline, back-to-back copies still beat a few spaced ones. Stylised: simulated link, known stationary parameters, no radio traces.

Detection range solves re^αr = r₀, i.e. r = W(αr₀)/α; the clear-air twin overstates it by exactly e^αr (×2.32 at 200 m visibility) and a relative extinction error moves range by the elasticity W/(1+W) < 1. With lognormal episode-to-episode fog a policy sized on the median fog is violated 50% of the time (mean fog 34%), the 5%-quantile range gives exactly 5% at a 43.5% speed cost, and in patchy fog one extinction calibrated on a bright target underestimates dark targets by up to 29% (calibrated on a dark one, bright targets are overestimated 61–168%). Stylised: hard threshold, Beer–Lambert medium, no lidar data.

Radar detection range under intermittent rain attenuation. The power law in rain rate has a Jensen gap (1.52× the mean-rate attenuation), so a mean-rate twin (closed-form Lambert W range, 18.84 km) is reached by only 39% of real storm fields; matching the mean attenuation barely helps (Brier 0.054 vs 0.055). A rain ensemble scores 0.038 vs 0.101 for clear air, and long cells flip the mean-rate twin from optimistic to pessimistic. Stylised: simulated rain, illustrative coefficients, no radar data.

A gain designed in a twin whose pole is m× the real one is validated on hardware for a run length chosen in the twin. The variance of the time-averaged cost of a Gaussian AR(1) loop is exact and depends on the closed-loop pole through (1+ρ)/(1−ρ), ρ=a_c², so the twin-sized run is 3.8× too short at m=2, r=0.1 (3,177 vs 12,110 steps; real coverage of a ±5% claim 0.69 vs 0.95 nominal, simulated 0.68) and 2.1× too long at m=1.5, r=5; an oscillating (negative-pole) loop averages as slowly as a sluggish one. Sizing from a real pilot’s lag-one autocorrelation is close to median-unbiased but under-sizes about half the time. Stylised: scalar linear-Gaussian, fixed known gain, normal-approximation interval.

A pulsed Doppler radar reports radial velocity modulo 2V; a twin that renders velocity as a real number never aliases. The real bias of a wrapped return is an exact Gaussian tail series (−V at speed V, −2V beyond) and the real MSE has a bias² floor, so averaging widens the gap to the twin's claim s²/n: at V=10, s=1 and speed 8 the real/claimed MSE is 7.9× for one return and 2.1×10³ for 10⁴. Speeds with |bias| ≤ 0.1 reach only 87%, 74% and 48% of V for noise 0.5, 1, 2. Unwrapping against a prior has exact failure probability 2Φ(−V/√(s²+s_p²)) and stays within 10% of the twin's claim only for prior error ≤ 0.26V. Stylised: one radial channel, Gaussian noise, simulated radar.

For twins of decreasing cost and fidelity used as nested control variates the variance is exact, σ²Σ(ρ_i²−ρ_i+1²)/m_i, and a cheaper rung pays below a twin already in use iff ρ₂/ρ₁ > 2√r/(1+r) (0.943 for halved cost, 0.575 for a 10× drop), the single-twin threshold applied to the step correlation. Using every rung is not best (q=0.99, r=0.5, six rungs: 0.284 of real-only variance vs 0.196 for the best two; q=0.9 makes all rungs 1.41× worse than real-only while the best subset gets 0.83), and 10 of 336 paying grid points are infeasible. On a saturated PD mass-spring timestep ladder the best ladder reaches 0.156 of real-only variance (0.204 for the best single twin), collapsing to the cheapest twin at 90%/70% disturbance replay (0.52/0.89 simulated); a coarser rung diverged in 2 of 20,000 contexts. Stylised: one plant, known correlations, step-count costs.

At 5% mean loss a watchdog that e-stops after m = 5 missed heartbeats false-trips once in 3.4×10⁶ ticks (18.7 h at 50 Hz) in the i.i.d.-loss twin but every 235–990 ticks (5–20 s) on a two-state bursty link with mean burst 2–50, from an exact recursion checked against enumeration and Monte Carlo. The error is not monotone in burst length: it is worst at L ≈ m, where the mean time to trip is only ≈ em/p. For a 10⁶-tick target the twin picks m = 5 (0.10 s to detect a dead link) while the real link needs 16–154 (0.3–3.1 s) growing linearly in L, and with L unknown no affordable timeout guarantees it. Stylised: Gilbert channel, plain miss counter, no link traces.

With a Gaussian-sensor twin an innovation gate (z = 2.58) costs 8.5% of the update MSE, since every gated measurement is good data; with 5% real outliers at 10× the noise scale the same gate cuts the MSE 1.74 → 0.58 (3.0×) while still passing 28% of the outliers. The ungated error grows like κ² in the outlier scale, the gated error is bounded and worst at a finite κ* ≈ 4, and a better-tuned gate width gains only 0–6%. After a jump D in a random-walk state the gate rejects the correct measurements and re-convergence takes ≈ 76D² steps (30,512 at D = 20) against 30 with no gate. Exact post-update MSE checked by quadrature and Monte Carlo. Stylised: scalar update, simulated outliers, simplified covariance rule in the jump experiment.

With the constant-power ground-effect multiplier G(z) = 1/(1−(R/4z)²) a gravity-feedforward altitude hold sits above its target by 2.7, 17.7 and 30.2 mm at 3, 1 and 0.6 rotor radii (twin: 0), 0.9% to 50% of the height. A sampled loop with one-sample delay that the twin gives 27.6% gain headroom at every height loses it as the vehicle descends: the real margin is 1.19 at one radius and reaches the stability boundary at 0.54 radii, confirmed by a nonlinear simulation; the undelayed thrust-gradient stiffness matters, since scaling the gain alone misses the instability. Negligible above about two radii. Stylised: point mass, closed-form ground-effect model, no rotor lag.

An ideal counter twin reads flux linearly; a real detector with dead time τ reports half the flux at nτ=1 (non-paralyzable) or 36.8% (paralyzable), and the paralyzable curve peaks at 1/e, so one reading has two fluxes (0.259 or 2.543 at mτ=0.2; a twin is 12.7× too low on the high branch). First-photon timing of a Gaussian pulse is biased early by −N/(2√π)σ at small N (exact) and saturating near −2σ: −0.28σ at N=1 and −1.50σ at N=10 (−22.6 cm for σ=1 ns) while the spread shrinks to 0.62σ, so it is bias, not averaging noise. A Coates correction of the first-photon histogram restores the mean to within 0.02σ. Stylised: one pulse, no background light, afterpulsing or crosstalk.

A one-ray twin returns the near or the far surface at a depth edge; a real beam with a Gaussian footprint and merged return pulses reports an energy-weighted range in free space. The ghost band is exactly 2Φ⁻¹(1−ε/D) beam standard deviations wide for equal energies (2.56 at ε/D = 0.1, 4.65 at 0.01, none once ε ≥ D/2), checked against a direct scan to 10⁻⁴, and shifts toward the near side and narrows when the far wall is brighter (1.67 at a 100× energy ratio). A scan with an edge every ≈ 100 beams has a ghost fraction equal to the prediction to within 0.3%, and a 3-of-5 persistence filter on a static robot passes 80–99% of ghosts because they come from geometry, not noise. Stylised: hard merge threshold, 1-D footprint, centroid detector, no real scans.

A sawtooth chirp radar reads a moving target’s range as R + κv, κ = f_cT/B; the twin reads R. A signal-level beat-tone simulation matches the formula to ≤ 10⁻⁴ range cells, and the bias is f_DT cells independent of bandwidth: 0.6, 3.1 and 4.8 cells (9 cm, 46 cm, 2.9 m) at 30 m/s for fast 77 GHz, mid 77 GHz and slow 24 GHz ramps. Within the unambiguous speed it is under half a cell, but compensating with the radar’s own wrapped Doppler is worse than doing nothing on exactly half of the over-range speeds. For a stationary scene (±60°) a centroid fit absorbs 0.71κv of along-track position error and leaves 0.46κv rms distortion. Stylised: single up ramp, noise-free tone, no radar data.

In a bare corridor the point-to-line information matrix is exactly singular along the track and the matcher returns its initial guess; door-frame stubs every 20/10/5/2 m give an exact along-track sd of 8.1/6.3/3.9/2.2 mm (MC 7.3/6.2/4.3/2.4), 1.6–6× a well-featured room's 1.35 mm, while lateral accuracy (≈ 0.8 mm) is unchanged. A Kalman filter fed the room twin's 1.9 mm covariance across a 20 m blind span has NEES 432 (1 cm/step odometry) and 1535 (2 cm/step) against 0.75 for the exact-covariance filter; the exact covariance is valid only inside a matcher basin of ≈ 0.2 m, and the covariance-aware filter is still overconfident at re-entry (NEES 2–8). Stylised: simulated 2D lidar, one-dimensional filter.

For a bootstrap particle filter the large-N effective-sample-size fraction is exactly c₀ e^−ay² in the measurement y (c₀ = 0.866, a = 1/6 at P = R = 1). With 5% real outliers at 10× the noise scale the mean ESS fraction barely moves (0.671 in the twin, 0.645 real, at every dimension), but P(ESS < 1% of N) goes from 2.5×10⁻⁴ to 3.1×10⁻² (120×). Sizing N = 528 for ESS ≥ 50 at 1% failure in the twin fails 4.4% of real steps, and the particle posterior mean's error against the exact Kalman update is 45× to 421× the twin's for N = 50 to 1000, falling barely at all with N. The large-N formula is checked against quadrature and simulation and fails once Nρ is small (reported). Stylised: scalar update, simulated outliers, no resampling dynamics.

A 1.0×0.5 m robot with Gaussian heading error crossing a gap: pass probability is exactly 2Φ(θ*/σ)−1 with θ* = asin(g/R)−atan(W/L) (matches a corner-geometry Monte Carlo within 0.0013). Inscribed- and circumscribed-circle twins are step functions (always pass / always fail below 1.118 m); an inflation calibrated to 95% at σ = 0.05 is 0.17 m too small at σ = 0.15 (real pass 0.49), and ten-gap missions succeed only 0.60 of the time where the twin says 1. Stylised: simulated robot, Gaussian heading error, no sensing error.

With N = 100 correspondences, minimal sample 2 and 50% mean inliers, the twin's budget for 99% success is 17 iterations. If the real scene inlier count is beta-binomial with concentration κ, the exact failure at 17 iterations is 1.3% (binomial variation only), 7.0% (κ = 10) and 14.1% (κ = 4); restoring 99% takes 19, 58 and 458 iterations, and for κ ≤ 2 no budget exists because scenes with fewer than 2 inliers cannot succeed. Exact values match a sampler, and an end-to-end noisy line fit goes from 0.9% to 12.6% slope failures at κ = 4 (1.8% with the larger budget, still above 1%). Stylised: assumed scene law, line fitting only, no real data.

For a Poisson field of occluders of radius ρ, beams a distance s apart are both clear with probability exp(−μ(2ρ+min(s,2ρ))), which equals p² exactly when s ≥ 2ρ; any set of beams has the closed form exp(−μ·union length). An independent-beam twin therefore matches the mean number of clear beams but understates the variance and the blind probability: with 8 beams at 25 cm and single-beam visibility 0.5 (occluder diameter 1 m) the exact blind probability is 0.0815 against the twin’s 0.0039 (20.9×, 97× at 5 cm), and reaching a blind probability of 0.01 needs 16 beams instead of 7 (not reachable with 16 at 10 cm). The twin is exact once the spacing exceeds the occluder diameter, and an ensemble twin that samples occluder fields reproduces the exact value (0.0815 vs 0.0815 ± 0.0006). Stylised: one-dimensional lateral projection, binary opaque occluders, no lidar data.

A UAV battery twin that keeps the open-circuit voltage curve but drops the series resistance overstates endurance by exactly 1/η(u) with η = (1 + √(1−u))/2 (up to 2× at the maximum-power fold, beyond which the real cell cannot deliver the power at all while the twin still quotes an endurance). With droop and a voltage cutoff, real/twin endurance is 0.86, 0.57, 0.30 at normalised power 0.2, 0.4, 0.6 and 9%, 37%, 66% of the charge is stranded. The deliverable burst power falls linearly with charge, so a burst of 0.5 fails below 51% charge where the twin's floor is zero, a flat 20% reserve covers only a third of the full-charge limit, and keeping a 0.6 burst deliverable leaves 35% of the twin's cruise time. A constant derate fitted at one power errs by +12% to +473% elsewhere, but the resistance is identified to 1–2% from tens of voltage–current samples, and a full-charge fit misses resistance that grows as the cell empties (endurance +42% to +85% too high). Stylised: simulated cell, linear curves, constant-power load, no polarisation or self-heating.

Follow-up to mimic-twinc2st on a stylised pendulum (Coulomb friction, Student-t sensor noise). The rejection threshold is the 95th percentile of the exact twin’s own null, and power is the share of replicates above it. For a Coulomb error of 20% the paired error test (same start angles, noisy real vs noise-free twin) has power 0.76 at 50 trajectories and 0.98 at 100, while the boosted-tree C2ST has 0.04 and 0.25 and needs about 200 to reach 1.00. For a 10% error the paired test stalls at 0.09–0.20 for every n up to 800 (a plausible but untested cause: the squared heavy-tailed noise has infinite variance), while the C2ST reaches 0.62 at 200 and 1.00 at 400. For Gaussian instead of Student-t noise of the same sd the paired test has power 0.04–0.07 at every n, the C2ST with second-difference features 0.92 at 50. Caveat: the null threshold comes from 60 replicates, and a check on fresh null replicates falsely rejected 0–29% of the time (nominal 5%), so power at small n is approximate. Stylised, simulated, 24 replicates per cell.

Follow-up to free-c2stpower, where a paired error test stalled at 0.09–0.20 power for a 10% Coulomb-friction error under Student-t(3) sensor noise. On the same stylised pendulum, the mean squared residual again has power 0.06–0.10 at every n up to 400, while a median, a 20%-trimmed mean, a mean absolute or a Huber statistic reaches 0.94–1.00 from n = 50 (400 null and 400 test replicates per cell). Under Gaussian noise the choice barely matters. Stylised; one seed per noise kind; not a claim about a physical system.

Follow-up to free-robustpaired on the same stylised pendulum (10% Coulomb-friction error, n = 50–200 matched trajectories, 400 null replicates). With Student-t(2) cells (infinite variance) the mean squared residual has power about 0.05 at every n, while median and trimmed squared residuals reach 1.00 and a Huber loss with a MAD-estimated scale reaches 0.70–1.00 (0.20–0.53 with the scale fixed at 0.02). When 10% of runs are 10× noisier, every cell-level statistic stalls (0.04–0.40) while the median over runs of per-run mean squares reaches 0.89–1.00; that statistic is nearly the worst under t(2) cells (0.11–0.19). No statistic wins both, and under Gaussian noise the median pays at n = 50 (0.72 against 0.98). Stylised.

Follow-up to free-robusttails, which found no single robust statistic won against both Student-t(2) cells and 10%-of-runs-10×-noisier bad runs. Here each trajectory’s squared residuals are summarised robustly (median or 20%-trimmed mean), then the per-run values are summarised robustly across runs. On the same stylised pendulum (10% Coulomb error, n = 50–200, 400 null replicates) the trimmed-then-trimmed statistic has power 0.99–1.00 under t(2) cells and when t(2) cells sit inside bad runs, 0.86 / 0.95 / 1.00 under bad runs alone, and 0.84 / 0.99 / 1.00 under Gaussian noise, against 0.91 / 0.99 / 1.00 for the per-run mean-squared median; the best single-level statistics reach only 0.10–0.28 or 0.15–0.38 in the case they fail. Size is 0.02–0.08 against a nominal 0.05. One toy pendulum, one twin error, one contamination design; stylised and simulated only.

Follow-up to free-c2stpower, whose empirical null was noisy. On the exact pendulum twin (200 replicates per cell, boosted trees, nominal 0.05) a naive rank-sum test on cross-validated scores and a t-test on per-fold AUROCs falsely reject 0.060–0.130 of the time, never below 0.060, while a half-and-half holdout split with an exact-null rank-sum test stays at 0.040–0.060 as the theory requires. The price is power: for a 10% Coulomb error holdout rejects 0.20 at n = 200 and 0.92 at 400, against 0.62 and 1.00 for the over-sized cross-validated rule, so it needs roughly twice the data. A permutation-calibrated cross-validated statistic is untried. Stylised, simulated, one classifier.

Follow-up to free-c2stexact on the stylised pendulum twin. A permutation test on the pooled cross-validated AUROC (39 label permutations, p ≤ 0.05) falsely rejects 0.040 of the time at n = 100 and 0.020 at 200 (100 replicates), while for a 10% Coulomb error at n = 200 it rejects 0.367 against 0.183 for the half-and-half holdout rule (60 replicates, intervals just overlapping). The unadjusted cross-validated rule rejects 0.600 but is not a valid test. Costs about 40 times the training. A first run using p < 0.05 on the k/40 grid had an effective level of 0.025 and was rerun. Stylised, simulated, one classifier, few replicates.

A throttle controller inverts a twin whose thrust is linear around hover; the real thrust is quadratic. The realised acceleration is exactly a_cmd+a_cmd²/(4g): climbs over-deliver, descents under-deliver, and the throttle floor is reached at a_cmd=−2g. At ζ=0.7 the climb overshoot rises from 0.046 to 0.095 while the descent falls to 0.027 for a step of p=ω_n²|x₀|/g=4; gentle steps (p≤0.5) change overshoot by under 1.1 points. Stylised: 1-D, static thrust map, assumed throttle ceiling, no field data.

Follow-up to thrust-twin. With the right model, the exact square-root throttle inverse realises the commanded acceleration inside the throttle limits and shrinks the up/down overshoot gap at ζ=0.7, p=2 from 3.00 to 0.09 points. With the thrust exponent misidentified (2.5 instead of 2) the exact inverse flips the asymmetry and halves the gap (3.67 to 1.65 points) but overshoot stays at 0.071–0.088 against the twin’s 0.046, and settling time is unchanged. Stylised: 1-D, noiseless, static thrust map, assumed throttle limits, exponent error only.

Exact steady-state MSE of a scalar Kalman filter run at the wrong process noise q_a = λq, matched to simulation within 1%. Underestimating costs far more than overestimating: at λ = 1/100 the excess is ×7.4 against ×1.6 at λ = 100; the over-estimate is bounded (MSE → r) and the under-estimate is not. The filter’s claimed variance is 5× too small at λ = 1/10. The gap closes at high signal-to-noise. Textbook-level and stylised: scalar, steady state, Gaussian.

Averaging a policy’s return over n randomised scenarios, compared across iid, Latin hypercube, randomly shifted Halton and shifted R_d lattice samplers, against exact means. Latin hypercubes keep the n^−0.5 rate (MSE cut 1.6–12×). Shifted Halton improves the rate for smooth returns (slope −0.92 at d = 2, MSE 149× lower at n = 1024) and keeps a 4–24× gain on a discontinuous success-rate return, shrinking as the number of randomised parameters grows. The R_d lattice is erratic (no better than iid at d = 5). 95% intervals from 8 independent randomisations cover 94–97%. Stylised: analytic returns on a uniform cube, no simulator.

Follow-up to free-qmcdr. The shifted R_d lattice’s error exponent at d = 5 is −0.45 ± 0.01 over six seed strings, no better than iid, so it is not a seed fluke; across d = 2…8 it dips at 5 between −0.72 and −0.61 neighbours, so it is not a smooth dimension effect; a generator built from √p_j reaches −0.66 at d = 5. A resonance score against small integer relations scores both generators alike, so the mechanism is not identified. Stylised analytic returns, not a simulator.

Lorenz-63 and Rössler integrated with the same RK4 scheme in float32 and float64 from the same start. Float32 leaves the float64 trajectory (distance > 1) after a median 12.3 time units on Lorenz and 164 on Rössler, which matches a float64 start error of about 5×10⁻⁶, roughly 100 times the float32 unit roundoff: departure time follows ln(1/δ₀)/λ with per-step rounding setting the effective error, and that error grows slowly with the number of steps (4.5×10⁻⁶ to 1.3×10⁻⁵ for 8× the steps). The Lyapunov exponent (0.8995 vs 0.8997) and long-run time averages agree within sampling error (|z| < 1.2, 200 members), and a float16 run showed no detectable bias on 100 members either. Stylised: two autonomous flows, CPU numpy, no contact or policy.

A point particle in a unit square with a circular obstacle (Sinai billiard), event-driven with specular reflection, run in float32 and float64 from the same start. Float32 leaves the float64 trajectory (position differs by > 0.1) after a median 21 collisions, equal to a float64 start error of 4.6×10⁻⁸, about one float32 unit roundoff (the smooth flows of free-f32shadow needed about 100×). The first different surface is hit exactly one collision after the position departs, at every error size tried. Mean free path (0.45296 vs 0.45325) and the circle's share of collisions agree within sampling error (|z| < 0.6), and match Cauchy’s exact mean free path 0.45321; no particle escaped and the direction vector’s length drifted by about 10⁻⁵ after 2000 collisions. Stylised: straight-line flights, no time-stepped contact; a first attempt on a vibrating-table bouncing ball was not chaotic and is not used.

A stdlib scan of all 550 project READMEs for lines that flag a citation or figure as written from memory or not re-checked: 94 (17.1%) have at least one, 137 flagged lines in all, naming 41 distinct author-year works. Four recur most: Dawid & Skene (1979) in 10 projects, Zhang et al. (2019) in 9, Horowitz (2014) and Horvitz (1999) in 6 each, so checking those once from a networked session clears many flags. A flag is the README's own admission, not a verdict; nothing was verified in this run (Crossref was unreachable).

Simulation of the classical cutoff rule for hiring the best of n = 50 candidates when only a noisy score is seen (noise sd 0 to 4 times the quality sd, 40,000 trials per cell, checked against the exact noiseless formula). The best cutoff barely moves, 19 with no noise and 16–17 at every noise level; the chance of picking the true best falls from 0.373 to 0.145 at noise 1 and 0.043 at noise 4 (lottery: 0.02). Keeping the classical cutoff costs at most 0.006. A high mean true rank wants a much earlier cutoff (7–9). Cutoff rules only, Gaussian, one setting; the optimal noisy policy is not computed.

Exact dynamic-programming comparison (no sampling) of Wald’s sequential probability ratio test with the smallest fixed-size binomial test, both at 5% error, for deciding between an acceptable and an unacceptable failure rate. At either rate the sequential test uses about half the rollouts (for 1% vs 5%: 79 and 113 on average against 181). Between the two rates the saving shrinks to 6–17% at its worst point in the four cases tried. Assumes iid rollouts that match reality, so it says nothing about the sim-to-real gap.

Exact dynamic-programming study (no sampling) of the stopping-time distribution of Wald’s sequential test for certifying a failure rate at 5% error, and of adding a hard rollout cap that decides by the sign of the likelihood ratio. For 1% vs 5% (fixed test: 181 rollouts) the average is 79 but the 99th percentile is 309, and 28% of runs at the midpoint rate exceed the fixed size. Capping at the fixed size inflates the unacceptable-rate error to about 0.068; a cap of 1.5 times the fixed size brings it to 0.053–0.057 with the mean within 2% of the uncapped test. Four rate pairs, one truncation rule, iid rollouts matching reality; says nothing about the sim-to-real gap.

Simulation (n = 50 candidates, parameters tuned on 8,000 training trials, scored on 60,000 fresh paired trials) of a two-parameter margin rule: skip r−1 candidates, then take the first whose noisy score beats the earlier maximum by at least d. P(pick the true best) rises from 0.2334 to 0.2444 at noise 0.5 (+0.0111, se 0.0014) and from 0.1429 to 0.1491 at noise 1 (+0.0062, se 0.0015); at noise 2 the gain (+0.0018, se 0.0011) is not distinguishable from zero, and with no noise the tuning picks the plain cutoff. One setting, one seed pair, a coarse grid; the Bayes-optimal policy is not computed.

Unstable scalar plant x′ = 3x, gain tuned so the fixed-period twin contracts by 0.5 per sample. Uniform jitter up to ±100% of the period never destabilises it (exact quadrature), but missed samples do: with a sample missed (period doubled) with probability q, the loop is almost-surely stable up to q = 0.556 yet mean-square stable only up to 0.270. Between the two, the mean-square twin metric says “unstable” while 2000 simulated runs at q = 0.4 all converge; past 0.556 they blow up (70% at 0.6). A deadbeat-tuned loop (contraction 0) is fragile: mean-square limit 0.05. Stylised scalar model.

Follow-up to free-jittertwin on the same unstable scalar plant x′ = 3x. The gain minimising E g² over the miss law (period h₀, or 2h₀ with probability q) is closed form and mean-square stable for every q (worst E g² = 0.478, versus a twin-gain limit of q = 0.270). The price is a slower nominal loop (0.63–0.82 per on-time sample). A gain designed for q = 0.3 stays mean-square stable at every true q. Stylised scalar model; one plant; iid misses.

An open research programme on sub-scale flight testing of cargo and delivery aircraft. Dynamic (Froude) scaling keeps trim, mode frequencies and gust response, but Reynolds number falls as n^1.5, so skin friction rises, and cell, motor and propeller performance do not scale with the airframe. The programme asks how large each error is for 1:2 to 1:20 models of an electric cargo aircraft, and whether a corrected model can recover it. Milestone 1 is a stdlib calculator (9 tests; exponent table dimensionally checked, ISA and Sutherland values checked) and a first-order flat-plate result for a 1,000 kg, aspect-ratio-10 airframe: at 1:10 the model needs 1.27× the Froude-scaled power (1.17 to 1.35 across form-factor, wetted-area and aspect-ratio sweeps) and L/D falls from 22.8 to 18.0. An untripped laminar-flow variant makes small models look better than full size, which is a modelling artefact and the reason the next milestones use XFOIL polars measured against UIUC data. The airframe constants are design choices, not a specific aircraft; the Froude exponents and the NASA TP-1435 and other citations are from memory and were not machine-checked (registries returned 403). Preliminary. Milestone 6a: on 134 measured cruise flights of a DJI Matrice 100 (Rodrigues et al. 2022 data, CC BY 4.0), electrical power scales with takeoff mass to the power 1.54 (95% bootstrap interval 1.41 to 1.67 over flights), consistent with the m^1.5 behind Froude power n^3.5, within one airframe and a 13.6% mass range; electrical cruise power is 1.85× the ideal induced power at every payload, and falls 10% from 4 to 12 m/s. Payload is partly confounded with flight day (density not logged). Milestone 7a: at n = 0.2 the uncorrected model needs 1.157× the Froude power; a search of 178 section and boundary-layer cases (NACA 4-digit and low-Reynolds sections, CL within 6%, lift-curve slope within 5%) reaches at best 1.086, so no section restores it to within 5% (H5 refuted in this space; NeuralFoil polars, similarity kept).

Real buck-converter hardware data (1001 + 999 samples at 10 µs, SysIdentPy data repository, MIT). A 5-parameter twin (static quadratic duty-to-voltage curve into an exactly discretised second-order LC lag, delay chosen on the training half) is compared with ARX 1/1 to 10/10 in free run. Fitting the first 10 ms and testing on the next, the Hammerstein twin has RMSE 0.62 V and ARX 2/2 0.58 V (block-bootstrap interval of the difference −0.28 to +0.26 V); swapping the halves, 0.50 V against 0.82 V (interval +0.22 to +0.49 V). Dropping the curvature costs the twin 0.10 to 0.17 V. Every model stays about nine times above the 0.058 V quantisation floor, so something in the converter (ripple, load, other dynamics) is unmodelled. One 20 ms record, so the two directions are the only replication; the natural frequency is fitted because no component values come with the data.

Exact eigenvalue study (no sampling) of a PD-controlled double integrator with feedback delay (kp = 4, damping ratio 0.3 to 2). The continuous-time delay margin is 0.19 to 0.37 s from the frequency-domain crossing. A fixed-step simulator that must represent the delay as whole steps reports a smaller margin: for the well-damped case (ζ = 0.7) 18.6% too small at dt = 0.1 s, 7.8% at 0.02 s, 2.3% at 0.01 s and 1.0% at 5 ms. For exact zero-order-hold integration the largest stable delay in steps is the largest n with (n + ½)·dt below the true margin, which held in 25 of 25 (damping, step) cases; explicit Euler, semi-implicit Euler and the exact hold agree to the step except for the lightly damped loop. One plant and controller form, constant integer delay, no measured latency from any real system.

Exact large-angle period (complete elliptic integral, 2.367842 s at 90°) against explicit Euler, semi-implicit Euler, velocity Verlet and RK4 at 0.5 to 16 ms. Explicit Euler is unusable (energy +81% and period +14% after 60 s at 2 ms). Semi-implicit Euler and Verlet keep energy error under 0.3% and have period error 0.75 ppm at 2 ms, falling 4× per halving; RK4 reaches 1.8×10⁻⁶ ppm. Started on the same orbit the two second-order methods have identical period error, but releasing from rest makes semi-implicit Euler look 4th order (≤10⁻⁴ ppm), an initial-condition artefact. Textbook integrators on an undamped pendulum, not the MuJoCo or PyBullet code. Every input is sourced or swept; nothing is assumed.

Exact coverage (no sampling) of six one-sided 95% upper bounds for k failures in n = 30 to 1000 rollouts, true rates 0.2–20%. Only Clopper–Pearson never undercovers (minimum 0.950); Agresti–Coull dips to 0.944, Wilson to 0.926, Jeffreys to 0.85, Wald to 0.06–0.75, rule-of-three plus Wald to 0.81. Certifying p ≤ 1% from zero failures takes 299 rollouts (Clopper–Pearson), 268 (Wilson), 191 (Jeffreys); at n = 100 four of the methods give identical accept sets for a 5% threshold. Assumes iid rollouts; says nothing about the sim-to-real gap.

Explicit Euler, semi-implicit Euler, velocity Verlet and RK4 against the exact Kepler solution (Newton on Kepler's equation), eccentricity 0 to 0.9. Explicit Euler never works. The symplectic pair has bounded but large energy excursions at 100 steps per orbit (semi-implicit 12% of |E₀| at e = 0.5, 71% at 0.7) and a periapsis direction that wanders (−0.62 rad after 50 orbits at e = 0.5), while RK4 creeps 0.004 rad. For position error under 0.01 a over 10 orbits RK4 needs 64, 128, 512, 4096 steps per orbit at e = 0, 0.3, 0.7, 0.9 against 512, 1024, 8192, >8192 for the symplectic pair, so RK4 is cheaper even at four force evaluations per step. At e = 0.9 every fixed step fails at 100 per orbit. Unit-scale two-body problem, ten-orbit horizon, textbook schemes, not MuJoCo or PyBullet. Every input is exact or swept; nothing is assumed.

Runs a Lorenz-63 truth and a twin together and measures the mean time (40 attractor start points) until they are 1.0 apart. The measured largest Lyapunov exponent is 0.904 (published 0.9056). With exact parameters, the horizon grows 1.124 time units per e-fold of smaller initial-state error (4.1 at 10⁻², 16.9 at 10⁻⁷), close to 1/λ but about one unit below ln(tol/d₀)/λ. A parameter error in ρ with exact start gains less, 0.85 per e-fold (0.95 at 10⁻², 7.8 at 10⁻⁵), since the error starts at zero. One system, one tolerance; only the mean is reported; the explanations of the offset and the slope are not tested. Parameters are Lorenz’s; the tolerance is chosen.

Double-integrator plant under PD control with zero-order hold; gains place both closed-loop poles of the fixed-period twin at z = r (h₀ = 0.1). Each sample is lost independently with probability q, so the interval is m h₀ with geometric m. Mean-square stability is an exact 3×3 second-moment operator with a Jury test; almost-sure stability is a Lyapunov exponent from a 200,000-sample product. For r = 0.5 the loop is mean-square stable up to q = 0.293 and almost surely up to 0.611 (999 of 1,000 runs converge at 0.55); deadbeat r = 0 gives 0.070 and 0.753, slow r = 0.9 gives 0.780 and 0.907. The operator matches Monte Carlo where the tails are sampled and a 400,000-run Monte Carlo of the mean square misses it by 6% at q = 0.3. Stylised: one chosen plant and loop, independent losses, no noise, delay or saturation, none taken from a robot or datasheet.

Follow-up to free-jittertwin on a second-order plant: the linearised inverted pendulum x′′ = (g/L)x + u, L = 0.5 m, exact zero-order-hold discretisation, interval h₀ or 2h₀ (missed sample, probability q). Mean-square stability is the exact spectral radius of the second-moment operator; almost-sure stability is a Monte Carlo Lyapunov exponent. A gain fixed at the nominal period with poles at 0.8 tolerates every q up to ωh₀ = 0.8 but only q = 0.21 at 1.4; deadbeat tuning allows only q = 0.03–0.10 (almost surely 0.80). A gain recomputed for the elapsed interval was stable at every q in all 15 cases. Linear, noise-free, known plant, one plant length; pole values and sweep points are chosen, not sourced.

A from-scratch projected Gauss-Seidel (sequential-impulse) contact solver at 60 Hz on a 1-D stack of n unit boxes starting at rest, checked against the exact static contact impulses. The iterations per step needed to hold the stack (speed under 1 mm/s, total overlap under 0.1 mm, and for every larger count tried) grow faster than n: 1 at n = 2, 8 to 16 at n = 4, 64 to 128 at n = 6, 128 to 512 at n = 12, and over 2048 for n = 16 (bottom-up warm start) or n = 32 (every variant). Sixteen iterations hold at most 4 boxes. More iterations do not reliably help: at n = 16, 1024 holds and 2048 does not. Cold start needs more at small n and is mixed at large n; sweep order has no clean rule. One-dimensional, normal force only, one step size and Baumgarte factor, no real engine run; the cause of the non-monotone behaviour is not isolated.

Exact dynamic-programming study (no sampling) of what a constant twin-to-real optimism ratio does to a 5%-error rollout certificate, for the fixed binomial test and Wald’s sequential test. For 1% vs 5% (fixed test: 181 rollouts) the chance of certifying a policy whose real failure rate is 5% rises from 0.049 to 0.087 when the twin fails 10% less often, 0.147 at 20% less and 0.526 at 50% less; the sequential test is within 0.02 of it, so neither is more robust. It doubles to 10% at a ratio of 0.87 (0.93 for the narrower 5% vs 10% and 10% vs 20% pairs, where a 30% optimistic twin certifies more often than not). Guarding against optimism up to R by testing p0/R costs 1.27 times the rollouts at R = 1.1, 2.17 at 1.5 and 4.55 at 2 for 1% vs 5%, and cannot be done for the narrow pairs at R = 2. Four rate pairs, iid rollouts, a pure ratio bias that is an input, not measured from any real twin.

free-sprtcap showed that simply capping Wald's SPRT inflates the unacceptable-rate error (0.067–0.069 at a cap equal to the fixed test's size). This project re-tunes it: an exact dynamic programme over (trials, failures) searches multiples of Wald's two boundaries (0.5 to 2.5×, each side separately) and every possible final cut for the setting that holds both achieved errors at or below 0.05 and minimises the mean rollouts averaged over the acceptable and unacceptable rates. For p₁ = 1% against p₀ = 5% (fixed test 181 rollouts) the mean is 107 at a cap of 1× the fixed size, 99 at 1.2–1.3×, 94 at 1.5× and 90 at 2×, always well under 181; the plain capped test is cheaper at small caps (90 to 94) only because it breaks the error guarantee, and at 1.75–2× the re-tuned test is cheaper than it (90.3 against 95.0) while holding the guarantee. Two other (p₀, p₁) pairs show the same pattern. Rollouts are assumed iid Bernoulli with the twin's failure rate (no sim-to-real gap), the boundary grid is coarse (steps of 0.1×), only the average of the two means is minimised, and nothing is sampled: every number is exact.

free-sprtopt found the test with the smallest average of the mean rollouts at p₀ and p₁ and listed the minimax design as its next step. Both are linear programmes in the occupation measure of the test (the number of surviving paths at each node (n, f) of the rollout lattice): every error probability and every mean is linear in it, so HiGHS returns the exact optimum over all randomised tests, with no sampling. The average LP reproduces the dual lower bound of free-sprtopt to two decimals (98.78 for 1% vs 5% at a cap of 181), which validates the construction. The minimax LP controls the mean on a grid of failure rates and adds the worst rate found by an exact evaluation until the grid and the exact maximum agree to 0.001. Across three (p₀, p₁) pairs and caps of 1–3× the fixed size, the worst-case mean falls 0.6–0.8% at a cap equal to the fixed size and 5.5–10% once the cap is 2× or more, because the average-optimal test only controls its two ends and its mean in between rises with the cap (133.4, 131.0 then 134.8 for 1% vs 5% at 1×, 2× and 3×) while the minimax value saturates (123.8 from 1.5×). The worst case sits at a rate between the two (1.9% for 1% vs 5%). Versus the fixed test the minimax design needs 32% fewer rollouts at worst for 1% vs 5% (123.8 against 181), and its mean at the design rates is 3–6% higher than the average-optimal test (69.9 and 110.8 against 66 and 107 at p₀ and p₁). Rollouts are assumed iid Bernoulli with the twin’s failure rate (no sim-to-real gap); the worst case is taken over p in [p₁, p₀] only, and the exact maximum is checked on a 161-point grid, not proved over the continuum; nodes the controlled rates reach with probability under 10⁻⁹ are dropped from the LP and treated as reject; every number is exact, nothing is sampled.

free-sprtcut re-tuned a capped SPRT on a coarse grid and listed “a backward-induction optimal truncated design” as the way to see how much was left. This project computes it. For multipliers c₀, c₁ the Bayes test minimising E_p0[N] + E_p1[N] + c₀P_p0(accept) + c₁P_p1(reject) is found exactly by backward induction over (rollouts, failures). Any test holding both errors at 5% costs at least that value minus 0.05(c₀ + c₁), a lower bound valid for every test including randomised ones; the best deterministic Bayes rule that holds both errors is the upper bound. For p₁ = 1% against p₀ = 5% (fixed test 181 rollouts) the optimal mean is 98.8–98.9 at a cap of 181, 94 at 1.1×, 88 at 1.5× and 87 at 2× and beyond; the bounds are within 1.1% of each other in all 21 cases (three (p₀, p₁) pairs, caps 1–3× the fixed size). The grid-tuned SPRT of free-sprtcut is 3–9% above the optimum in every comparable case (107.3 against 98.9 at 1×), and the optimum is roughly half the fixed test for 5% vs 1% and 10% vs 5%. Rollouts are assumed iid Bernoulli with the twin’s failure rate (no sim-to-real gap), the objective is the average of the two means only, the multiplier search is a local pattern search (the bounds, not the search, are what is certified), and nothing is sampled: every number is exact.

Puts an uncertainty interval on the headline of free-tanktwin: the 8-parameter overflow twin's held-out RMSE (0.528 V) against linear ARX 4/4 (0.655 V) on the real Cascaded Tanks measurements (Schoukens et al. 2016). Uses a paired circular moving-block bootstrap over the 974 test samples (4,000 resamples) and sweeps the block length from 1 to 200 because the test errors are autocorrelated (integrated autocorrelation time about 41 samples). The gap is 0.126 V with a 95% interval of 0.060 to 0.200 V at block 25 and 0.061 to 0.194 V at block 50; no interval at any block length includes zero, and the ordinary iid bootstrap (0.104 to 0.150 V) is about three times too narrow. Only test-trace sampling is quantified, not fit variance or a new rig, and 974 samples give roughly 24 effective blocks, so the 95% is nominal. Data are measured predictions committed by free-tanktwin; no input is invented.

Adds fit variance to free-tankci. Refits the 8-parameter overflow twin and linear ARX 4/4 on 100 random contiguous windows of the real Cascaded Tanks training trace (Schoukens et al. 2016) at three window lengths and scores each on the fixed test trace as in free-tanktwin. With 896 of 1024 samples the twin's test RMSE is 0.518 V (sd 0.012) against 0.651 V (sd 0.004) for ARX, a gap of 0.133 V in all 100 refits. With 768 samples the gap is 0.066 V (2.5 to 97.5%: −0.004 to 0.169) and the twin wins 90%; with 512 it is 0.070 V and 84%. The twin's advantage therefore depends on the training trace covering the operating range. Windows overlap and shrinking them confounds fit variance with less information, so only the longest window approximates the same data refitted; the optimiser start is fixed. All data are measured; no input is invented.

Fits a two-tank Torricelli twin, with and without an overflow path, to the real Cascaded Tanks benchmark measurements (Schoukens et al. 2016) and scores free-run simulation on the held-out experiment against linear ARX and quadratic NARX models. The 8-parameter overflow twin reaches 0.53 V test RMSE (0.51 V with the sensor’s 10 V saturation applied); the best black box, a 9-parameter linear ARX, gets 0.66 V, tied with the twin without overflow, so the gain comes from the overflow term. Quadratic NARX models are worse and the 3/3 and 4/4 fits diverge in free run (7.4 and 42 V) after a one-step fit. One rig, one split, no confidence interval; the spill gain sits near its fit bound; no published number is reproduced. Data are measured; no input is invented.

An open design for a home-assistant robot built from one cheap servo (Feetech STS3215, 12 V) and PLA: two 7-DOF arms with parallel grippers, a pan/tilt head, a 0.5 m belt lift and a three-omni-wheel base, 22 actuators for $627–948 in parts. One parameter file generates the printable parts (CadQuery) and the MuJoCo twin, whose inertias come from the printed geometry and whose servo model reproduces the datasheet torque–speed line. Version 2 gears the elbow 2:1 (from 120% to 69% of its continuous rating with 200 g at full reach) and replaces a pivoting jaw with rack-and-pinion parallel jaws (cube slip in a scripted pick from 34 mm to 0). An interference sweep over the exact printed solids found that v1’s elbow could not reach the range its twin allowed, because the simulator ignores contacts between linked bodies. Policies (PPO, 3 seeds) trained on the exact twin ignore servo, friction, mass and object errors but fail with one 40 ms step of action latency (reaching 99%→29%, picking 91%→41%); domain randomisation fixes reaching almost for free, but for picking it costs 14 points on the nominal twin and about 6× the samples. A whole-body mobile policy trained on a planar base twin reaches 95% under combined perturbations on a roller-wheel twin, without tipping. A rendered head camera with an ArUco fiducial locates the cube to 3.5 mm including head-servo backlash, but with the cube position taken from rendered images in the loop the arm hides the cube and pick success falls to 32–50%. Simulation only: nothing has been printed or built, and the servo parameters beyond the datasheet are priors from the 7.4 V servo.

An open research programme rather than a finished project. A digital twin is biased, so twin-only evaluation of a robot policy is wrong however many runs it makes; real trials are unbiased but scarce. The programme asks for estimators and tests that combine many twin runs with a few real ones, stay valid whatever the twin's bias, and say how many real trials they save, for mean return, failure rate and policy comparisons. It reconciles two answers already in this repository: control-variate savings that grow as 1/(1−ρ²) (twin-evaluation) and a worst-case result that a twin cannot shorten a failure-rate certificate (twin-certification). Planned: one estimator family under context pairing (control variate, PPI++, multifidelity Monte Carlo), a certification lower bound under checkable discrepancy assumptions, active choice of real trials, anytime-valid stopping, and tests on MuJoCo model pairs and on SIMPLER's published paired real and simulated results. First results (milestone 3, 21 MuJoCo model-versus-model pairs): context-paired twin runs raise the effective real sample up to 3.2×, within 6% of 1/(1−ρ²(1−n/N)); unpaired twin runs give none; plug-in t intervals undercover (as low as 87% at n=30; real-only reaches 91%) so H1 is refuted as pre-registered; detectability predicts value almost as well as ρ here (Spearman −0.95 vs 0.999). Magnitudes of the omitted effects are swept, not sourced from datasheets. Milestone 3b: a studentised-bootstrap interval lifts mean 95% coverage at n=30 from 92.0% to 93.6% for the control variate (worst pair 90.8%) at 14% greater mean width, while the percentile bootstrap is worse than the t interval; a distribution-free interval is still needed for a guarantee. Milestone 3c: a union-bound empirical-Bernstein interval for the control variate is valid (100% coverage on all 21 pairs) but 2.1–3.1× wider than a real-only one, because the bound is dominated by its range term; the twin's variance gain is invisible to it, which rules out generic Bernstein bounds and points to betting or observed-range intervals. Milestone 3d: a betting (hedged-capital) interval is also valid (coverage at least 99.5%) and again 1.9–3.4× wider with the twin, because its bets are capped on 99–100% of steps, so any bound that leans on the worst-case range hides the twin's variance gain at n=30–60. Milestone 3e: a bounded-discrepancy lower bound (pilot-checked bound on |R−T|, Hoeffding on the clipped discrepancy) is valid (100% coverage) but never tighter than a real-only empirical-Bernstein bound on any of the 21 pairs at n up to 240, because the pilot maximum of |R−T| stays at 0.26–0.36 even at ρ ≈ 0.87 and the check on the bound costs γ = 0.056 at n=240; the proposal's H3 is refuted for a max-based bound in this benchmark. Milestone 3f: for failure rates, a twin-informed upper bound (twin failure rate plus an exact bound on P(real fails, twin passes)) is valid (coverage at least 98.6%) but tighter than Clopper–Pearson on 0 of 21 pairs at n up to 240, because even the best pair’s twin passes about 55% of the real failures; it would need to miss under roughly 5–10%, which confirms the worst-case result of twin-certification with a number. Milestone 6 (theory): no valid 95% lower bound on mean return, from m paired runs and any number of twin runs, can have a median gap below 1−(0.10)^1/m (about 2.3/m) in the worst case, even with a perfect twin; this floor is 0.0095 at m=240, against 0.060 for real-only empirical Bernstein and 0.193 for the milestone 3e bound, so those failures are construction losses with room above the floor, but no construction can beat the 1/m term.