Capability deep-dive · peril simulation
The event is three days out, and every what-if you run lands in the same tables as your live book.
So the analysis happens in a spreadsheet beside the system, the system keeps serving yesterday’s view, and nobody can reconstruct afterwards which numbers the decision was actually taken on. The alternative is not a cleaner spreadsheet. It is a scenario that runs inside the decision and is reversible in one transaction.
A worked scenario, quarantined
Everything below this banner is simulated. The banner is sticky rather than dismissible, and Escape does not close it, because a quarantine is not a thing you close — leaving is an explicit act. Every panel derived from the run carries the rail, so a screenshot of any fragment still identifies itself.
There is no calibrated loss number behind this figure and there will not be one until the catastrophe financial chain exists. A plausible euro amount here would be a fabrication, so the placeholder stays.
Simulated — what a scenario writes
- props.sim = true — mandatory on every row the producer emits, in the type rather than by convention.
- props.scenario_run_id — the run key the scrub predicate narrows on, so two open scenarios reverse independently.
- data_source: live | partial | pending — the producer declares its own posture; the interface does not infer it.
What is deployed, and what it computes
Peril physics is not a catastrophe model. The chain from an intensity field to a paid loss is designed and not built, and no figure on this page crosses that gap.
The engines, and the posture they share
A hazard engine scoring route peril over real elevation data; an evacuation router running four published solvers to a clearance time; weather feeds that answer a missing upstream key with an explicit refusal rather than a cheaper substitute; a manifest-driven ingest worker; a satellite-imagery worker. The posture is common to all of them: an unreachable upstream, a missing binary or an unknown solver returns a typed error naming what failed. There is no synthesised success anywhere in the fleet.
Feeds are observations, not settlement indexes
A parametric wording settles on an index. A weather feed is not one, and we say so here rather than in the terms, because a structuring team that builds a product on that misunderstanding discovers it at the first disputed trigger. What the feed carries is a timestamped observation with provenance and a refusal state — which is exactly what makes a governed parametric adjudication admissible, and exactly why the feed itself cannot be the trigger.
peril simulators and feed clients(shipped)route peril over terrain(shipped)provenance envelope, one write path(shipped)the executor that lets the orchestrator drive the simulator(designed, not built)
Why the overlay is reversible, and the condition that makes it so
Simulated entities are not written to a side table. They go through the same single write path a real sensor bridge uses — deliberately, so that every surface lights up through hooks it already has, with no per-surface rewrite. What separates them is provenance: the producer stamps a simulation flag and a scenario run id into the type itself, and the scrub deletes on exactly that predicate, across three tables, inside one transaction, with the tenant set on the connection.
THE CONDITION, STATED PLAINLY
Reversibility holds if and only if every inserted row carries the flag and the run key. Today that barrier is enforced at the producer — the provenance is mandatory in the type — and it is not enforced at the sink: the ingest handler writes what a caller posts. A producer defect or a replayed payload would write a row that is indistinguishable from live data and can never be scrubbed. The remedy is a sink-side check with its own machine code, and it is a named build item rather than a property we claim today.
Two more obligations follow from the same honesty: a scrub receipt, so a reversal can be proved rather than assumed, and a residue query that surfaces simulated rows with no live run as a watcher row. Both are designed and neither is built.
Where a governed run fails closed
REFUSED
SCOPE_PREDICATE_MISSING
A scenario run was requested and the tenant and owner could not be resolved from the authenticated request. No engine was called and no row was written.
Organisation and user identity are resolved from the authenticated request and from nowhere else — never from an argument, never from an environment variable, never defaulted to a placeholder string. A surface that cannot express the predicate refuses with a machine code rather than performing a silent estate-wide read. The three-axis middleware that carries this is production; the governed dispatch path for the simulator specifically is the seam named in the honest limit below.
The honest limit
WHAT THIS DOES NOT DO YET
- The catastrophe financial chain — the exposure object, vulnerability and damage curves, deductible and limit application, exceedance-probability curves and any stochastic event catalogue. What exists is peril physics and the analytics shell, not a catastrophe model.
- The UNO→simulator dispatch seam. The simulator is deployed and the orchestrator is deployed; the executor that lets one drive the other does not yet do so.
- Exposure sums are not modelled losses. Adding up the insured values inside a footprint tells you what is exposed; it does not tell you what will be paid, and the two must never be printed in the same font.
- The sink-side provenance barrier, the scrub receipt and the overlay time-to-live are designed, not built.
- We have not measured our own per-peril run cost, so this site carries no latency claim of ours [P: to be calibrated].
The gap is not compute. Published GPU physics has crossed the operational threshold. The gap is the join between a hazard field and a book, and then the curves that map an intensity to a paid claim — which are learned from decades of proprietary claims data and are not produced by any simulation. That moat is data, not compute, and it does not erode with GPU price curves. So we do not author vulnerability curves and do not claim to: the admissible postures are your own curves, a licensed vendor’s curves under your licence, or a refusal.
What this connects to
Exposure and the living map
Where the book would come from, on the industry’s neutral schema — and why the join is the hard part.
Stress testing
What turns a deterministic footprint into a distribution, and why reproducibility is the product rather than the result.
Governed simulation
The pillar this sits under, for the reader who wants the argument before the mechanism.