The Twin: Simulating a Machine Before We Build It

Four centuries ago, an astronomer could predict an eclipse to the minute but could not build the heavens he was charting. We have inverted that ancient bargain. Today we can build a star's engine in a computer — every field line, every neutron, every turn of superconducting tape — years before we pour its foundations. There is a particular kind of nerve required to publish the full design of a power plant you have not built, cannot yet build, and will not begin building until construction breaks ground in 2027. The whole argument of this book is that the physics is solved — gain solved, not scaled — and that the two machines are reproducible on paper by anyone willing to check the math. But a design on paper carries a quiet, load-bearing assumption beneath every number: that the real machine, once welded together from steel and superconductor and chilled to within a few degrees of absolute zero, will actually behave the way the equations swear it will. Fusion history is a graveyard of designs that were flawless on paper and wrong in the vessel. So the honest question is not "is the design correct?" It is the harder one: "how do you wring the risk out of a machine before a single component of it exists?" This chapter is about the answer — a digital twin, and the simulation program that gives that twin teeth sharp enough to bite its own maker.

"Digital twin" is one of the most abused phrases in modern engineering — easy to say, brutally hard to earn. Anyone can build a model that nods along with the design it was born from. That is not a twin. It is a mirror, and a mirror tells you nothing you did not already believe. A twin earns the name only when it is faithful enough to surprise you — faithful enough to reproduce a real experiment it was never shown, and then to turn around and reveal something about your own machine you never put in by hand. The difference between a mirror and a twin is the difference between flattery and a second opinion, and only one of them can save your life. That distinction — between a model that flatters the design and a model that could have proven it wrong — is the whole discipline of this chapter. It is also the reason the program is built the way it is, and the reason I will spend as much time on what did not work as on what did.

The gate is confinement

Reach back to the first of the three forties — Q40, the physics: forty times more fusion energy out than the energy we spend to hold the plasma. The breeder, Hyperion, is a compact spherical tokamak with a major radius of just 1.2 metres, an aspect ratio of 2.5, elongation 2.0, and 8 tesla on axis. Its published scientific gain is Q_sci ≈ 3.076 — modest, deliberately so, because Hyperion's near-term business is making fuel, not power. But whether it hits even that number depends on one thing above all others, and it is not a number you can read off a blueprint. It is how fast heat leaks out of the plasma.

Consider the sheer violence of the gradient we are asking this machine to hold. A fusion plasma is a hundred million degrees at its heart and merely warm at the wall a few centimetres away — the steepest temperature cliff anywhere in the solar system this side of a supernova. Nature loathes a gradient like that. Heat claws its way down the slope and toward the exit, and the rate at which it escapes — the turbulent transport — sets the confinement time. Confinement time is the thin line dividing a machine that ignites from a machine that merely glows and dies. Here is the uncomfortable part: turbulent transport is not something you can calculate with a formula. It emerges from the plasma tearing itself into a froth of microscopic eddies, driven by instabilities with names like the ion-temperature-gradient mode, and the only way to compute it from first principles is to simulate the turbulence itself, in five-dimensional phase space, one eddy at a time.

The ladder of description

To see why that calculation is so expensive — and why a surrogate is not a luxury but a necessity — you have to understand that a plasma can be described at several levels of detail, and that each level buys tractability by throwing away information. Fusion modeling is the art of choosing the coarsest description that still keeps the physics you need.

At the bottom of the ladder is the particle description: track every ion and electron through the electromagnetic fields, one Newtonian trajectory at a time. It is exact and it is hopeless — a cubic metre of fusion plasma holds far too many particles to follow individually, and no computer that will ever be built could carry them all. So you climb.

The next rung is the kinetic description. Instead of tracking individual particles, you track a distribution function — a smooth cloud in the six-dimensional space of position and velocity that says how many particles are, statistically, at each place moving at each speed. This is where the honest turbulence physics lives, and it is governed by a kinetic equation for how that cloud evolves. But six dimensions is a brutal price, so fusion physicists use a specialized simplification called gyrokinetics. The trick exploits a fact about magnetized plasma: each particle spirals tightly around a magnetic field line, thousands of times faster than anything interesting happens to its overall drift. You do not care about the fast spiral; you care about the guiding centre it spirals around. Gyrokinetics averages the spiral away, collapsing six dimensions to five and removing the fastest, least interesting timescale — and that single act of averaging is what makes first-principles turbulence simulation possible at all.

Climb once more and you reach the fluid description, which stops tracking the velocity cloud entirely and keeps only its bulk moments — density, flow, pressure — the way you describe water without tracking every molecule. Fluid models are fast and they are indispensable, but they need a closure: an assumption, imported from outside, about the quantities they threw away. And the most important closure of all is the turbulent heat flux — precisely the number gyrokinetics computes and fluid models cannot. At the top of the ladder sits magnetohydrodynamics, MHD, which treats the whole plasma as a single conducting fluid and is the right tool for large-scale stability but blind to the microscopic turbulence underneath.

Every rung of the ladder trades detail for speed, and the whole discipline is choosing the coarsest description that still tells the truth — and then paying, once, in gyrokinetic cycles, to compute the one closure the fast models cannot. The reason the confinement question is the most expensive in the program is now plain: it lives on the kinetic rung, in five dimensions, and it cannot be answered honestly from any rung above it. You either pay the gyrokinetic cost or you guess.

A zoo of instabilities, and how you name them

The turbulence that leaks heat out of a tokamak is not one thing. It is a whole zoo of microscopic instabilities, each with its own trigger, its own signature, and its own remedy, and a twin that hopes to predict confinement has to know which animals are in the cage.

The transport they drive is, by long convention, sorted into three kinds. Classical transport is the irreducible minimum: particles bump into each other and random-walk across the field. Neoclassical transport adds the corrections that come from the doughnut geometry itself — particles that get trapped in the weaker field on the outboard side trace fat "banana" orbits that let them wander farther. Both of these are calculable and, it turns out, small. What dominates real machines is the third kind, historically called anomalous transport precisely because for decades no one could explain why the heat leaked out so much faster than classical and neoclassical theory allowed. The answer, now settled, is turbulence — and the turbulence is driven by drift-wave instabilities feeding on the very gradients that make the plasma useful.

The main offenders have names worth knowing, because the twin has to resolve each one. The ion-temperature-gradient mode feeds on the steep ion temperature profile and is usually the dominant heat leak in the core. Its electron-scale cousin, the electron-temperature-gradient mode, does the same on a finer scale. The trapped-electron mode exploits those banana-orbit electrons. And the microtearing mode is a subtler, magnetic instability that tears and reconnects field lines on a tiny scale, channelling electron heat out through the plasma's edge. That edge is where the highest-stakes physics lives. A well-run tokamak spontaneously forms a pedestal — a narrow region at the boundary where the pressure gradient steepens dramatically and confinement jumps, the transition from ordinary low-confinement operation to the high-confinement mode that every reactor design quietly assumes. The pedestal is a gift and a hazard at once: it lifts performance, but it also stores energy that can be dumped in sudden bursts, the edge-localized modes that flick damaging heat pulses at the wall. Getting the pedestal right — steep enough to confine, controlled enough not to bite — is one of the hardest jobs the twin has.

How do you tell these instabilities apart in a real plasma, where they all contribute at once? You fingerprint them. Each mode has a characteristic frequency, a characteristic spatial scale, and a characteristic ratio between the fluctuations it produces in density and in magnetic field. Modern internal-fluctuation diagnostics can measure those signatures directly, and by comparing the measured fingerprint against what a gyrokinetic simulation predicts for each candidate mode, you can identify which instability is actually running the show in a given discharge. It is genuinely like forensic identification: not "the plasma is turbulent" but "this mode, at this location, is carrying this fraction of the heat."

That fingerprinting is also where fast, learned tools first entered fusion modeling, years before the surrogates of this program. Because a full gyrokinetic scan is far too slow to run inside an operating tokamak, physicists built reduced models — compact approximations, some of them frankly heuristic, that predict which modes will be unstable and how fast they will grow from a handful of local parameters, quickly enough to guide an experiment in progress. Neural networks trained on gyrokinetic databases pushed this further, delivering near-instant estimates of instability growth and even rapid reconstructions of the plasma equilibrium itself. Those early fast-surrogate successes are the direct ancestors of the transport surrogate at the heart of this chapter. The idea is the same one, grown up: pay the exact physics once, learn the shape of its answer, and thereafter reply in the blink of an eye.

Every design in this book rests on an assumption about how well its plasma holds heat. The twin exists to turn that assumption into a computed result.

That is the single most expensive question in the whole program, and until recently we answered it the way the field always has — with a reduced model, a fast approximation that captures the physics in broad strokes and runs in seconds. Reduced models are indispensable. They are also not proof. The point of the simulation program is to replace the assumption with a first-principles answer, validate that answer against reality, and then compress it into a tool fast enough to redesign the machine in an afternoon.

A machine that has to run in two places at once

Before the physics, a word about time. A fusion generator is a stack of coupled processes whose natural timescales span ten orders of magnitude — the cross-layer timing ladder laid out in full earlier in this chapter, from the microsecond events that can wreck the machine to the months of fuel logistics.

This is why the twin is not a single program. There is the design twin — slow, first-principles, exact, taking hours of supercomputer time to answer one question about one operating point — and there is the predictive shadow, the fast twin that runs alongside a live plasma, integrated fifty to a hundred milliseconds ahead of reality, catching trouble before it arrives. They are the same physics at opposite ends of the time ladder, and the bridge between them is the central trick of this chapter: the surrogate, a learned model that inherits the exact twin's accuracy and the shadow's speed. Get that bridge right and microsecond design exploration becomes possible — you can ask the machine ten thousand "what if" questions in the time it used to take to ask one.

The pipeline: an ordinary desktop, an extraordinary discipline

The exact turbulence physics runs in a first-principles nonlinear gyrokinetic code — the kind of tool that a decade ago lived only on national supercomputers. The program runs it two ways. On the ground is a single workstation, a 28-core machine with 768 gigabytes of memory, on which the full gyrokinetic suite is built, validated, and used for development. In the cloud are the accelerators — banks of high-end GPUs rented by the hour — where the heavy nonlinear runs actually execute. The workstation writes the problem; the cloud solves it; the answer comes home.

The unglamorous detail I want to dwell on is that this pipeline is bit-exact. A calculation launched from the desktop and run on a rented cloud GPU returns results identical, to the last bit, to the same calculation run locally. That sounds like a triviality. It is not. It is the entire reproducibility case in one property. If the cloud and the desktop disagreed even in the last decimal place, you could never be sure whether a result was physics or an artifact of where it happened to run — and a fusion design that cannot be independently rerun is not a design, it is an anecdote. Bit-exactness means anyone, anywhere, on any comparable hardware, can regenerate the numbers. It is the same philosophy that governs the published papers: every headline reproduces off a script from a single random seed. The twin holds itself to the standard we hold the physics to.

Validate against reality, then — and only then — trust the model

Here is the step that separates a twin from a mirror, and it is worth stating as a rule because the whole credibility of the program turns on it.

You never trust a simulation of your own machine until the same simulation, unchanged, has reproduced an experiment someone already ran on a real machine.

So before the code is ever pointed at Hyperion, it is pointed at a real tokamak discharge — a shot from an existing, operating device, with published measurements of how much heat actually leaked out of that real plasma. The code is given the real machine's geometry and profiles and asked, from first principles, to predict the measured heat flux. If it reproduces the experiment, within the error bars, without being tuned to do so, then and only then has it earned the right to be believed about a machine that does not yet exist. This is the difference between "our model says Hyperion works" and "our model reproduces reality, and our model says Hyperion works." The first is a claim. The second is evidence.

I put the validation step deliberately before the design study in the plan, not after, because the temptation runs the other way. It is tempting to simulate your own machine first, get an encouraging number, and validate later if time allows. That ordering quietly poisons everything downstream, because once you have seen the answer you want, every subsequent modeling choice is contaminated by it. Validate first, against a discharge you did not design and cannot fudge, and the design result that follows is honest by construction.

A validation shot, worked through

The rule above — never trust a simulation of your own machine until the same code, unchanged, has reproduced an experiment someone else already ran — is easy to state and laborious to honor. So let me walk one validation through, step by step, because the discipline lives in the details, not the slogan.

You begin by choosing a discharge from an existing, operating tokamak — a real "shot," fired years ago on a machine you had no hand in designing, with published, peer-reviewed measurements of two things: the plasma profiles inside that shot, and, crucially, how much heat actually leaked out of it. The fact that you did not design the machine is not incidental. It is the entire point. A shot you cannot influence is a shot you cannot flatter. It sits in the literature as a fixed fact, indifferent to what you wish your code would say.

Then you set the problem up honestly. You hand the gyrokinetic code that machine's real geometry and its measured profiles — the density and temperature and, above all, the gradients of those profiles at the radius you are testing, because it is the gradients that feed the turbulence. And then you do the hard thing: you tell the code nothing about the answer. You do not reveal the measured heat flux. You do not reach in and tune a coefficient to nudge the prediction toward the known result. The code integrates the turbulence from first principles — the ion-temperature-gradient mode and its cousins tearing the plasma into a froth of microscopic eddies — running forward until the transport saturates and the heat flux settles to a steady value. Hours of GPU time later, it reports a number it derived without ever being told what it was supposed to find.

Only now do you look. You set the computed heat flux beside the measured one. If they agree within the experiment's error bars — and agree without any tuning to make them — then the code has earned something it can earn no other way: the right to be believed about Hyperion, a machine that does not yet exist. This is the exact moment a claim turns into evidence. Before it, you have "our model says Hyperion confines heat well enough." After it, you have "our model reproduces a real plasma it was never shown, and that same model says Hyperion confines heat well enough." Only the second sentence can carry the weight of a design.

It is worth sitting with what a failure here would have meant, because that is what gives the passing grade its value. Suppose the computed flux had come out at half the measured value. You would not, in that case, have a Hyperion result you merely needed to caveat. You would have a modeling bug wearing the costume of a physics prediction — and every encouraging number the code later produced about your own machine would be worthless, because you would have no way to tell physics from artifact. That is precisely why the validation step is placed before the design study in the plan and never after: the ground has to be proven solid before you build on it, not once the building is up.

And validation is never one triumphant checkmark. The honest version reports the match together with its error bar, flags the radii where the agreement is tight and the ones where it frays, and treats near-marginal points — the delicate cases sitting right at the edge of stability — with extra suspicion, because a coarse calculation will cheerfully report a clean answer there that is simply wrong. A twin earns trust one validated shot at a time, and it keeps a ledger of exactly how far that trust extends.

Surrogates: turning a supercomputer into a pocket calculator

A first-principles turbulence run is accurate and slow. One saturated nonlinear calculation — the kind that tells you how much heat truly leaks out at one set of gradients, one safety factor, one value of plasma pressure — costs hours of GPU time. To map the whole operating space of a machine, you need hundreds of them. That is a database, and a database is exactly what a machine-learning model wants to eat.

A surrogate is a neural network trained on that database to reproduce the slow code's answer in a fraction of the time. Feed it the plasma conditions; it returns the heat flux — not by solving the physics, but by having learned the shape of the solution across every point it was trained on. The first-generation transport surrogate in the program was trained on a fast reduced (quasilinear) transport model rather than the full nonlinear code, as a proof of the mechanism, and it reached a coefficient of determination of R² = 0.999 against its training physics. The successor, now that the first-principles database is being generated, is trained on the exact nonlinear code itself — inheriting its accuracy instead of the reduced model's approximation. Same architecture, better teacher.

What that R² buys is worth translating carefully, because the number hides the point.

``` One first-principles turbulence calculation: ~hours on a cloud GPU One surrogate query for the same answer: ~microseconds on a laptop

Accuracy retained by the surrogate: R² = 0.999

```

In plain words: R² = 0.999 means the surrogate accounts for 99.9 percent of the variation in the exact code's answers — the two agree to about a part in a thousand across the operating space. And it delivers that agreement roughly a billion times faster. That ratio is not a convenience; it is a change in what design is. When one physics answer costs hours, you evaluate a handful of candidate machines and pick the least-bad. When one answer costs microseconds, you let an optimizer roam the entire design space — size, field, shape, gradients — evaluating millions of variants, and you find the operating point that is genuinely best rather than merely acceptable. The surrogate turns the most expensive question in fusion into something you can ask on a laptop between sips of coffee. That is how a design gets de-risked: not by trusting one calculation, but by exhausting the space around it.

A design search, worked through

Once the transport surrogate returns a heat flux in microseconds instead of hours, the design search itself — trading the field's old habit of stopping at the first acceptable machine for an optimizer that roams the whole space of candidate Hyperions and finds the genuinely best one — is the optimization story told in full earlier in this chapter. What matters for the twin is the shape it takes here: because Hyperion sits close to the ion-temperature-gradient threshold, the search does not hunt for a design that merely passes but for the operating point that sits deepest inside the feasible region — robust to exactly the gradient error bars a knife-edge design could not survive. That is what de-risking a design means in practice: not trusting one calculation, but exhausting the space around it so thoroughly that you know your chosen point is not a lucky accident.

The burner's twin, and a real net-gain result

The breeder is a tokamak, and its turbulence is a tokamak's turbulence. The burner is another creature altogether — a D–³He tandem mirror, a straight magnetic bottle some 440 metres long, stoppered at each end by colossal mirror coils reaching 26.49 tesla, burning a fuel so clean it sheds only about 5.4 percent of its energy as neutrons. Picture it: not a doughnut of fire chasing its own tail, but a river of plasma running the length of a city block, pinched at both ends by two of the most powerful magnetic corks ever conceived. A tandem mirror does not confine plasma by bending it into a ring; it confines it by squeezing it between those corks. Whether that works — whether the machine produces more power than it spends holding the plasma in — comes down to a delicate balance between the pressure in the central cell and the far higher pressure in the plugs.

The consequence for the twin is fundamental: a mirror is not a Grad–Shafranov machine, so almost none of the tokamak's equilibrium and turbulence machinery carries over. The confining physics is the force balance along the axis — how the pressure profile from the low-field central cell up to the towering plug field holds together — and the twin for the burner is built around that balance rather than around cross-field turbulent transport. Two machines, two twins, one discipline: build the exact model, validate it, compress it into a surrogate. The physics under the surrogate could hardly be more different; the method on top of it is identical.

We built a surrogate for that balance too, trained on the burner's mirror force-balance model. It reached R² = 0.98, and it returned a result I find genuinely encouraging: the machine crosses into net power gain when the plug-to-central-cell density ratio reaches about 13.8. The design target for that ratio is 16, comfortably above the crossover, at which point the engineering gain lands near Q_E ≈ 1.318 — more electricity out than in. That is exactly the kind of margin you want to see fall out of a surrogate: not a knife-edge, but a design point sitting on the safe side of the threshold with room to spare. It is a small, honest, computed result that says the burner's core premise holds.

The gaps, told plainly

I would not trust this chapter — you should not trust this chapter — if it were all clean R² values and comfortable margins. It is not. Three things in the program do not reconcile, and each teaches something.

The first linear map was noisy. The opening step of the turbulence campaign is a linear stability map: sweep the plasma gradients and find where the instabilities switch on and how fast they grow. Our first pass came out under-converged near the margin — the near-threshold modes, the ones sitting right at the edge of stability, were not integrated long enough or resolved finely enough to trust. Near-marginal modes are notoriously delicate; a coarse calculation will happily report a clean answer that is simply wrong. The fix is not clever, it is disciplined: longer integration, more radial resolution, rerun. That sweep is running as this is written. I mention it because a design program that never shows you a noisy first result is a program that is hiding its first results.

Hyperion sits close to the turbulence threshold. When we swept the gradients, the real machine came out weakly unstable to the ion-temperature-gradient mode near threshold — turbulent, but not violently so, right in the sensitive regime where small changes in the assumed gradients move the answer a lot. That is not a problem to paper over; it is a flag that says the operating point must be pinned down with the machine's real profile gradients, not the placeholder gradients used to explore the space. The geometry of Hyperion is locked and real. The gradients that ride on top of it are still being nailed to the design, and until they are, the confinement number carries an honest error bar.

And the one we abandoned. The burner needs a number called η_α — the efficiency with which the energy of fusion-born alpha particles is channelled back into the fuel ions rather than lost. We tried to compute it with a Fokker–Planck kinetic prototype, the natural tool for the job. It did not work. It predicted an ion-heating fraction of 1.6 percent against an accepted analytic value near 12 percent — off by nearly an order of magnitude, which is not a result, it is a broken model. So we abandoned it, and we said why: a survey of the available codes confirmed that η_α is simply not a turnkey output of any existing tool. There is no button to press. Getting it right is a collaboration-and-custom-development problem — the burner's kinetics belong to a different code lineage than the tokamak's turbulence, run in partnership with specialists, with bespoke code written for the alpha-channelling physics on top. We logged it as an open build item rather than fudging a number to fill the hole. An abandoned prototype, honestly retired, is worth more than a plausible number nobody can defend.

The prototype that failed by a factor of seven taught us more than the surrogate that succeeded to a part in a thousand. It told us where the real work is.

That is the two-track reality of the program in one paragraph. The breeder's turbulence is a GPU problem, solved with a first-principles gyrokinetic code and compressed into a surrogate — a track we can drive ourselves, today. The burner's kinetics is a partnership problem, requiring collaboration and custom development, and no amount of GPU time substitutes for it. Pretending the second track is as far along as the first would be the easiest and most dishonest thing in this book.

Proving the twin is not a mirror

Return to the promise at the top of this chapter: a model that agrees with the design it was built from is a mirror, not a twin, and it tells you nothing you did not already assume. Validating against someone else's experiment is the first defence against that trap. There is a second, and it is worth describing because it is the kind of check most simulation programs quietly skip.

The worry is circularity. Our twin computes an equilibrium; our surrogate learns that equilibrium; our controller trusts the surrogate. If every link in that chain was written by the same team with the same assumptions, the chain can be internally consistent and wrong — a closed loop congratulating itself. So we deliberately introduced an outsider. We took the twin's equilibrium and checked it against a completely separate, open-source equilibrium solver, written by a different community for a different purpose, with no knowledge of our machine. The fields agreed to within 2.66 percent — close enough to trust, and — the honest part — with one discrepancy in the flux near the magnetic axis that we keep on the record as a characterized failure mode rather than sand away. By that independent check, our internal measure of circularity roughly halved. The twin was made to answer to an authority it did not control.

We did the same with the engineering. The twin's assumptions about magnets, materials, and structural strain were benchmarked, one by one, against the published engineering design basis of the largest international tokamak project — nineteen assumptions, each tagged as inside that reference envelope, deliberately outside it, or having no basis in it either way. Some of our choices sit outside the reference on purpose, because we use a high-temperature superconductor at a field and strain that project never designed for, and we label those honestly rather than imply an endorsement we do not have. It is an engineering-basis benchmark, not validation from an operating plasma — that machine has not run either — and I say so. But it is the difference between a twin that only ever talks to itself and one forced, repeatedly, to answer to the outside world.

Quantum, honestly

The three-tier quantum honesty — sensing near, computing far, tensor methods in the middle — is laid out in full earlier in this chapter; the twin consumes the near-term sensing tier and nothing more, letting a sharper magnetic measurement tighten the boundary condition the equilibrium reconstruction depends on and so lower the state-estimation error every downstream surrogate inherits.

Where NVIDIA comes in

Every revolution needs an engine room, and ours hums with silicon. The accelerated half of this program runs, in part, through NVIDIA's Inception program — the one cleared outside partner named anywhere in this book. Concretely, that means access to the GPU compute the nonlinear campaign consumes and to NVIDIA's open physics-machine-learning framework, which is the natural home for the transport surrogate: it is built precisely for training networks that respect physical laws, and the R² = 0.999 transport model is the exhibit that shows the pipeline works end to end. The partnership matters less for any single result than for what it makes routine — turning the once-exotic act of running first-principles turbulence and distilling it into a deployable model into something a small team can do on a rolling basis. The compute is a tool. The discipline around it is ours.

What the twin is, and what it is not

Let me end with the disclosure that governs this chapter as it governs the whole book, because it is the honest frame for everything above. Kronos operates no fusion plant. Every number here — the R² values, the net-gain ratio of 13.8, the confinement estimates, the noisy first map and the abandoned prototype alike — comes from simulation, from a physics-based twin, or from public data. Nothing in this chapter came off a burning plasma, because there is no burning plasma. There is a design, published and reproducible, and there is a twin built to stress-test it.

That is not a weakness of the program. It is the correct order of operations — the order that the whole history of engineering, written in wreckage and hard-won caution, insists upon. You do not build a machine the size of a building, meant to cage a fragment of a star, and only afterward discover whether your physics was right. You build the twin first. You validate it against experiments other people have already run and cannot be flattered into confirming. You send it hunting through your own design for flaws while those flaws are still cheap, still made of nothing but electrons. And you keep an honest ledger of everything it cannot yet tell you. When breeder construction begins in 2027, it will rise against a design that a faithful twin has already tried, again and again, to break — and failed. That is what it truly means to de-risk a machine before it exists: not a promise that nothing will surprise us, but a discipline that has spent every cheap surprise in silicon so that the expensive ones, in steel and superconductor, are as few as human care can make them.

The twin is how a design earns the right to become a machine. It is how a drawing earns the right to become a star on Earth. And it is how, when this book tells you the physics is solved, you are entitled to sit down, open the code, and check for yourself.

This chapter's forty. Q40 — the gain the twin exists to protect, by keeping the fire controllable long enough to climb toward it.