1. The Regulatory and Clinical Problem
A surgical robot that adapts intraoperatively faces a contradiction that conventional planning architectures cannot resolve. The clinical value of adaptation is real: anatomy varies, tissue planes shift, bleeding changes the field, and the optimal trajectory at incision is rarely the optimal trajectory ten minutes later. But every regulatory regime that governs the device treats unconstrained adaptation as an unacceptable hazard. IEC 62304 assigns software safety classifications by the severity of the harm a software failure can cause; ISO 14971 requires that every identified risk be controlled and that residual risk be demonstrated acceptable; ISO 80601-2-77 specifies essential performance requirements for robotically assisted surgical equipment; and the FDA's 2024 final guidance on Predetermined Change Control Plans permits a device to change its behavior in the field only when the manufacturer has specified, in advance, the envelope within which change is safe and the evidence that change has stayed inside it.
The two pre-existing architectural answers both fail this test. A pre-operative optimization plan is verifiable but static: it is computed before the procedure against imaging that no longer describes the patient on the table, and it has no mechanism for exploring alternatives once the field diverges from the model. An intraoperative reinforcement-learning controller is adaptive but unverifiable: its policy is a continuous function that can, in principle, command any actuator state, so the manufacturer cannot specify a finite envelope of safe behavior in advance. What both regimes and clinical practice actually demand is a third architecture: a planner that explores alternatives aggressively and continuously, yet structurally cannot move any explored alternative to the patient until that alternative has passed the full constraint stack.
2. The Architectural Requirement
The shape that satisfies the requirement has three structural properties, and conventional planning stacks supply none of them as architectural invariants.
First, speculative exploration must be a first-class operating mode, not an offline rehearsal. The planner must be able to construct many candidate trajectories at once, including mutually contradictory ones (one branch assuming the bleeding is controlled, another assuming it is not), without any of those candidates being treated as a decision.
Second, separation between speculation and execution must be enforced at the substrate, not by convention. A namespace distinction or an access-control flag can be corrupted, bypassed under time pressure, or defeated by a serialization error. For a Class C device the separation has to be an invariant that no operational urgency, configuration setting, or software fault can waive.
Third, the transition from a speculative trajectory to an actuator command must be a single, governed, recorded event with a defined threshold, so that the manufacturer can point an auditor at exactly the gate the PCCP guidance asks them to specify.
3. What the Forecasting Engine Provides
The Forecasting Engine, disclosed in United States Patent Application 19/647,395 (Chapter 4), supplies these three properties as architectural primitives rather than as application code that a surgical-software team would have to invent and then argue for in a submission.
Planning graphs as first-class structures. The engine constructs planning graphs in which each branch is a complete candidate trajectory carrying its own projected state, risk assessment, and actuation plan. For a surgical task this means each branch holds a full proposed sequence of instrument motions, force limits, and waypoints for a given hypothesis about the field. The engine can hold many such branches in parallel, including contradictory ones, because every branch lives in the speculative domain and none has been committed.
Structural separation from verified execution memory. Planning graphs are maintained in architectural separation from the agent's verified execution memory. The specification is explicit that this is not a software convention, a namespace distinction, or an access-control policy, but an invariant enforced at the substrate level: no mechanism exists by which a planning-graph branch can modify verified state except by passing through the governance-validated promotion pathway. Mapped onto the device, verified execution memory is the only domain from which actuator commands are issued; a branch that projects a successful suturing motion does not thereby acquire authority to perform it.
The containment layer and the immutable speculative marker. Every element of a planning graph is tagged at construction time with an immutable speculative marker that identifies it as non-verified content. The marker cannot be altered from within the speculative domain; only the promotion interface, upon successful governance validation, strips the marker and re-tags the content as verified before writing it to execution memory. The specification names the failure of this layer the delusion boundary: containment collapse is the architectural analog of an agent treating projected content as reality. For a surgical robot, the immutable marker is precisely the guarantee the regulator is looking for, since contained simulation is the default context for every proposed action and a motion plan cannot reach an actuator while it still carries the marker.
Branch classification. As branches are evaluated they receive classification labels: a branch that satisfies the constraint stack is marked eligible for promotion; a branch that is admissible but negatively reinforced is marked introspective and retained for analysis rather than discarded; a branch suitable for handoff is marked delegable; and a branch that fails validation is marked pruned and scheduled for removal. In the surgical setting this taxonomy is the difference between a rejected trajectory that is silently dropped and one that is retained as a documented, considered-and-declined alternative, which is exactly what ISO 14971 risk files and after-action review require.
The promotion interface as the sole gateway. The boundary between the speculative domain and verified execution memory is a single governance-controlled gateway that subjects each candidate branch to the full evaluation pipeline, including policy compatibility and integrity-impact assessment, and either admits it as a committed mutation or returns it to the speculative domain with a rejection annotation. The specification states there is no alternative pathway from speculative to verified status and that the gateway's requirements are not waivable by the agent's affective state, personality configuration, or operational urgency. This sole-gateway property is what lets a manufacturer describe a finite, specifiable promotion envelope in a PCCP rather than an open-ended adaptive policy.
Confidence-gated dispatch and modulated breadth. Promotion is confidence-gated: a branch is dispatched to execution only when the governing confidence threshold is met, and otherwise the engine continues to reason in a non-executing mode. Personality and affect modulation tune the breadth and depth of branch expansion and the aggressiveness of pruning without changing the architecture, so a device can be configured conservative or exploratory while the containment guarantees stay invariant.
4. The Surgical Mapping
Concretely, an intraoperative planning cycle runs as follows. The forecasting engine reads the current verified state of the field (registered imaging, tracked instrument poses, force-sensor readings, and the verified procedural step) as the root of a new planning graph; the specification notes this read is a snapshot, so concurrent execution does not perturb an in-flight graph. It then expands candidate trajectories for the next surgical sub-task: alternative approach angles, alternative dissection planes, alternative retraction sequences. Each candidate is simulated entirely within containment and carries the immutable speculative marker throughout.
Each candidate is then evaluated against the device's constraint stack. The policy-compatibility stage carries the IEC 62304 safety classification rules, the ISO 14971 risk controls, the ISO 80601-2-77 essential-performance limits, and the device-specific PCCP envelope. A candidate that would exceed a force limit, cross a defined no-fly zone around a critical structure, or otherwise violate a control is marked pruned. A candidate that is admissible but worse than another is marked introspective and retained. Only a candidate that passes every stage is marked eligible, and only an eligible candidate that clears the confidence gate is promoted through the sole gateway, at which point its speculative marker is stripped and it becomes an actuator command.
Because the promotion event is a single recorded crossing of the containment boundary, the device's audit trail is generated by the architecture rather than reconstructed afterward. For each motion the robot actually executed, the record shows the branch it was promoted from, the observations that supported promotion, the alternatives that were considered and pruned or held as introspective, and the confidence at which the gate opened. This is the evidence the PCCP guidance asks a manufacturer to produce on demand.
5. Embodiments and Deployment Options
The application admits several embodiments, and a skilled implementer can build any of them on the disclosed primitives.
Supervisory autonomy. The robot proposes promoted trajectories to the surgeon, who confirms before dispatch. Here the confidence gate is set high and a human confirmation is an additional promotion precondition, while the contained exploration still surfaces and documents the full decision space.
Task autonomy within an envelope. For well-bounded sub-tasks (knot tying, a defined resection within marked margins), eligible branches that clear the confidence gate dispatch directly, with the surgeon supervising the envelope rather than each motion. The PCCP describes exactly that envelope as the promotion criteria.
Pre-operative planning. The same engine runs before the procedure against imaging, producing a promoted plan plus a retained set of introspective contingency branches that are carried into the OR; intraoperatively, a contingency that matches the emerging field is re-evaluated rather than planned from scratch.
Multi-arm and multi-agent coordination. Where several robotic arms or several devices operate in a shared field, each runs its own planning graph and an executive-graph arbitration layer (disclosed in the same application) compares promoted plans across agents, surfacing actuation conflicts (two arms contending for the same space, or a retraction that undermines another arm's exposure) as structural branch incompatibilities before either commits.
Modulation by procedure and institution. The personality- and affect-modulated breadth controls let a conservative configuration (narrow expansion, aggressive pruning, high promotion threshold) be used for high-acuity steps and a broader configuration for low-risk steps, all without altering the containment architecture or the single promotion gateway.
The substrate does not replace the surgical robot's existing motion controller, kinematics, or safety interlocks; it sits above them as the planning and governance layer that decides which motions those lower layers are ever asked to perform.
6. Disclosure Scope
This article is an enabling, dated, public disclosure of the application of forecasting-engine technology to surgical robot planning. The underlying technology, including planning graphs maintained in structural separation from verified execution memory, the containment layer with an immutable speculative marker and a delusion boundary, branch classification into eligible, introspective, delegable, and pruned, a sole governed promotion interface, confidence-gated dispatch, personality- and affect-modulated branch expansion, and executive-graph arbitration across agents, is disclosed in United States Patent Application 19/647,395. The surgical domain framing, the regulatory mapping to IEC 62304, ISO 14971, ISO 80601-2-77, and the FDA PCCP guidance, and the deployment embodiments described above are applications of that disclosed technology and are not themselves claimed by this article.
