Prove a change in a simulated twin before live execution: a deterministic pass/block gate (blast radius, freeze windows, rollback) plus a probabilistic failure-risk with a learned historical prior.