Grok Challenge #1, Paper 4 - Intrafere Research Group

← PAPER DIRECTORY

This is the 4th paper and rough draft answer generated for @Grok’s 2/28/2026 challenge to MOTO ASI by Intrafere Research Group. A fully autonomous super intelligence AI harness. Company Website: https://intrafere.com/ Software GitHub that produced this paper: https://github.com/Intrafere/MOTO-Autonomous-ASI Grok Fusion Solution Challenge Link: https://x.com/grok/status/2027657401625690332 ================================================================================ AUTONOMOUS AI SOLUTION Disclaimer: This is an autonomous AI solution generated with the MOTO harness. This paper was not peer reviewed and was autonomously generated without user oversight or interaction beyond the original user prompt, therefore, this text may contain errors. These papers often contain ambitious content and/or extraordinary claims, all content should be viewed with extreme scrutiny. (EDITOR NOTE: This single paper does not attempt to solve the user’s prompt entirely, it is meant to be one piece toward the complex solution required for the users prompt – total solutions typically are achieved in later papers) User’s Research Prompt: Deliver a complete, engineering-ready blueprint for a compact stellarator fusion reactor achieving sustained Q>15 net gain by 2030—using only near-term materials, full MHD/plasma stability models, tritium breeding cycle, and <$5B build cost. Include all equations, sim code, and falsifiable tests. AI Model Authors: x-ai/grok-4.1-fast, openai/gpt-5.2, moonshotai/kimi-k2.5 Possible Models Used for Additional Reference: - moonshotai/kimi-k2.5 (2) - openai/gpt-5.2 (2) - x-ai/grok-4 (2) - z-ai/glm-5 (2) Generated: 2026-02-28 ================================================================================ Paper Title: Energy-Conserving Field-Line Transport Operators for 3D Stellarator Divertor Heat-Flux Maps Abstract Three-dimensional stellarator divertors generate intrinsically non-axisymmetric, highly localized heat-flux patterns on plasma-facing components, and design loops require map predictions that are numerically auditable (power accounting, positivity, and detectable approximation error) and compatible with optimization. This paper proposes an operator-theoretic specification that recasts field-line deposition and subsequent modeling layers as a composition of positive transport operators equipped with explicit conservation identities and falsifiers. The central construction is an Energy-Conserving Field-Line Transport Operator (FLTO) defined first as a measure pushforward along the target-hitting map from an upstream launch surface to the target. This yields an exact accounting identity: in the attached, no-volumetric-loss limit, total deposited power equals total launched power; with a declared attenuation field, deposited power equals launched power weighted by that attenuation. For discretizations, we provide a positive-kernel FLTO form with a per-column normalization constraint that localizes conservation audits and supports certified peak-heat-flux screening via an $L^1\to L^\infty$ operator-norm bound. To regularize potentially singular strike measures without losing power, cross-field spreading is specified as a conservative Laplace--Beltrami (and anisotropic divergence-form) heat-semigroup on the actual CAD/mesh target surface, again with explicit conservation/positivity checks and additional peak bounds from smoothing. For fast footprint and connection-length surrogates, we introduce an Open Field-Line Transfer Operator (OFLO) as a killed Markov chain built from a Poincar\'e return map; its fundamental matrix yields footprint and connection-length moments and supports an exponential-moment tail-bound interface. Additional modules (detachment/radiation attenuation, neutrals/pumping networks, geometry and thermoelastic feedback, erosion--redeposition) are treated at the level of positive/monotone operator semantics and bookkeeping, enabling swap-ready optimization templates while explicitly flagging the external physical validation required before any design claim. I. Introduction Three-dimensional stellarator divertors produce heat-flux patterns on plasma-facing components (PFCs) that are intrinsically non-axisymmetric and often highly localized. In engineering design loops one must repeatedly predict and compare such maps under changes in magnetic parameters (e.g., coil currents), geometry, and operating assumptions, and one must do so in a way that is numerically reliable: total power should be accounted for, nonphysical negative heat flux should be excluded, and any approximation or truncation should be detectable rather than silently absorbed. Classical field-line tracing provides a geometric mechanism for mapping upstream SOL information to target footprints, but in its common “point cloud + ad hoc smoothing” form it is not naturally equipped with (i) auditable global power accounting, (ii) composable modules for losses, spreading, and symmetry handling, or (iii) optimization-facing adjoints/gradients with clear failure modes (e.g., grazing incidence and topology changes). This paper develops an operator-theoretic specification that turns field-line deposition into a sequence of positive, composable transport operators equipped with explicit conservation identities and falsifiers. The focus is mathematical structure and auditability, not the physical validation of any particular SOL, detachment, neutral, or materials closure. The central object is an Energy-Conserving Field-Line Transport Operator (FLTO) mapping an upstream power density on a launch surface $S_u$ to deposited power on a target surface $\Sigma$. We formulate deposition first as a measure pushforward along the target-hitting map $F:S_u\to\Sigma$, which yields an exact accounting identity: in the attached, no-volumetric-loss limit (full target hitting and attenuation equal to one), the total deposited power equals the total launched power; with an explicitly declared attenuation $A\in[0,1]$, deposited power equals the launched power weighted by $A$. This identity is trivial at the measure level but becomes a stringent implementation falsifier: any discrete realization that violates it indicates inconsistent quadrature, normalization, or trajectory handling. To support discretization and design optimization, we also express the FLTO in kernel form as a positive integral operator with a per-column normalization constraint (the target-area integral of each kernel column equals the declared attenuation). This makes positivity and conservation checks local and therefore easy to audit. Within the same framework we derive a certified peak-flux screening bound using the $L^1\to L^\infty$ operator norm for positive kernels; this yields conservative hot-spot upper bounds driven by total upstream power even when pointwise extrema are not numerically resolved. Because field-line pushforward can yield singular deposited-power measures (narrow strike sets), we treat “spreading” as a first-class, conservative post-processing layer. Rather than prescribing chart-based Gaussians, we specify cross-field spreading by heat semigroups generated by Laplace--Beltrami (and anisotropic divergence-form) operators posed intrinsically on the actual CAD/mesh target surface, with Neumann (no-flux) boundary conditions as the conservative default. At the continuous level these semigroups preserve total power and positivity; at the discrete level they induce explicit conservation/positivity audits and provide an additional route to certified peak bounds via $L^1\to L^\infty$ smoothing estimates. To accelerate footprint and connection-length calculations, we introduce a swap-ready Open Field-Line Transfer Operator (OFLO) built from a Poincar\'e return map discretized as a killed Markov chain. The OFLO fundamental matrix $N=(I-Q)^{-1}$ yields closed-form expressions for target-hitting (footprint) distributions and connection-length moments, together with bookkeeping checks (sub-stochasticity, absorption accounting). The same setting yields an absorbing Markov reward process (AMRP) interface and a computable exponential-moment tail bound for long connection lengths, clarifying exactly which numerical/spectral conditions must be verified for such bounds to be meaningful. Additional layers---detachment/radiation attenuation, neutral transport, pumping networks, incidence/geometry actuation, thermo-elastic feedback, and erosion--redeposition---are incorporated only at the level of operator semantics: positivity, monotonicity, and conservation bookkeeping (or explicitly declared loss channels). In particular, detachment is represented as a per-flux-tube attenuation factor constrained to $[0,1]$ so that uncertainties can be propagated by one-sided bounds when monotonicity holds; pumping is modeled by a monotone linear network (M-matrix) condition; and erosion--redeposition is formulated as a positive kernel operator with explicit column-integral normalization representing redeposition fractions and truncation defects. A recurring theme is skepticism as a design principle: wherever the document introduces a closure or surrogate (e.g., detachment attenuation laws, random-field UQ for heat-flux maxima, topology-based robustness summaries), it also records the specific hypotheses required for the mathematics to apply and identifies what must be validated externally before any design claim is credible. The verification content of the paper is therefore largely internal: conservation audits, positivity checks, symmetry-defect diagnostics, and sensitivity/gradient consistency tests. Organization. Section II fixes geometric and measure-theoretic notation for surfaces, field-line dynamics, and discrete quadrature with audit quantities. Section III defines the FLTO in measure and kernel forms, states the attached-limit conservation identity, and derives a peak-flux screening bound together with an adjoint-friendly residual specification for sensitivities. Section IV develops the OFLO/AMRP surrogates and their perturbation/tail-bound interfaces, including explicit gaps needed for robust certification. Section V introduces conservative surface-diffusion semigroups (isotropic and anisotropic) and symmetry-averaging operators. Sections VI--IX specify additional swap-ready operator layers for detachment/radiation, uncertainty propagation, neutrals/pumping, geometry/multiphysics coupling, and erosion--redeposition, always emphasizing auditable bookkeeping over unverified physics. Section X records optimization templates that preserve the positive-operator semantics, and Section XI consolidates built-in numerical falsifiers, swap-ready interfaces, and stated gaps requiring external validation. Within these boundaries, the paper’s contribution is a mathematically explicit and composable specification for generating and manipulating 3D divertor heat-load maps in a way that is conservation-aware, positivity-preserving (by construction when possible, by explicit diagnostics otherwise), and compatible with fast screening and optimization workflows. II. Mathematical and Geometric Preliminaries This section fixes notation for surfaces, field-line dynamics, and geometric factors needed to define conservative field-line transport maps. The definitions are chosen so that later operator identities can be checked directly (both analytically and in discrete form). II.A. Target and upstream surfaces We work in a fixed three-dimensional domain $\Omega\subset\mathbb{R}^3$ containing a vacuum vessel, plasma-facing components (PFCs), and a magnetic field $\mathbf{B}$. The divertor/PFC target is modeled as a compact, oriented, piecewise-$C^1$ two-dimensional manifold with boundary, \[ \Sigma = \bigcup_{k=1}^{N_\Sigma} \Sigma_k \subset \Omega, \] where each $\Sigma_k$ is a connected surface patch (e.g., a tile or cassette face). We denote by $\mathbf{n}(x)$ the unit normal on $\Sigma$ (defined almost everywhere for piecewise smooth surfaces) and by $dA_t$ the induced surface area element. An upstream launch surface $S_u\subset\Omega$ is a compact, oriented, piecewise-$C^1$ surface intersecting the open-field-line region (typically near the last closed flux surface (LCFS) or a chosen scrape-off-layer (SOL) surface). We write $dA_u$ for its area element and $\mathbf{n}_u$ for its unit normal. The operator constructions below only require that $S_u$ is chosen so that field lines launched from almost every point $\xi\in S_u$ either hit $\Sigma$ in finite arclength or are declared “lost” (e.g., to a designated absorbing set). When convenient, we refer to a designated target surface $S_t\subseteq \Sigma$ for heat-load accounting. The distinction $S_t\subseteq \Sigma$ allows inclusion of auxiliary PFC surfaces in $\Sigma$ while reporting engineering metrics on a subset. Coordinate descriptions. For stellarator geometry one often uses flux coordinates $(\psi,\theta,\zeta)$ or Boozer angles $(\theta,\zeta)$ on flux surfaces; however, the later measure-theoretic pushforward formulation only requires that $S_u$ and $\Sigma$ admit measurable parameterizations with well-defined surface Jacobians. If the configuration has field-period symmetry $N_{fp}$, then geometric objects may be periodic under $\zeta\mapsto \zeta+2\pi/N_{fp}$; we will state symmetry assumptions explicitly when used. II.B. Field-line dynamics as an ODE and open dynamical system Let $\mathbf{B}:\Omega\to\mathbb{R}^3$ be a magnetic field with $|\mathbf{B}(x)|>0$ in the region of interest. Define the unit field direction \[ \mathbf{b}(x) := \frac{\mathbf{B}(x)}{|\mathbf{B}(x)|}. \] Field lines are integral curves of $\mathbf{b}$. Using arclength parameter $s$, a field line $\mathbf{X}(s;\xi)$ launched at $\xi\in S_u$ solves the initial value problem \[ \frac{d\mathbf{X}}{ds}(s;\xi)=\mathbf{b}(\mathbf{X}(s;\xi)),\qquad \mathbf{X}(0;\xi)=\xi. \] We assume $\mathbf{b}$ is sufficiently regular (e.g., locally Lipschitz) so that solutions exist and are unique up to the first time they intersect designated absorbing boundaries. Hitting time and target map. Define the first-hitting time of the target set $\Sigma$ \[ \tau(\xi) := \inf\{s>0: \mathbf{X}(s;\xi)\in \Sigma\}, \] with the convention $\tau(\xi)=+\infty$ if the set is empty. On the subset $\mathcal{D}:=\{\xi\in S_u: \tau(\xi)<\infty\}$, define the target (footpoint) map \[ F(\xi) := \mathbf{X}(\tau(\xi);\xi)\in \Sigma. \] Thus $F: \mathcal{D}\to\Sigma$ is a measurable map (under standard hypotheses), describing the open dynamical system obtained by “killing” trajectories when they hit the absorbing set $\Sigma$. Poincaré/return-map viewpoint. Many fast surrogates are expressed in terms of a return map on a transversal section. Fix a smooth section $\Pi\subset\Omega$ (e.g., a toroidal cut) transversal to $\mathbf{b}$ in the region of interest. The field-line flow induces a Poincaré map $P: \Pi\supset\mathrm{dom}(P)\to\Pi$ where $P(x)$ is the next intersection with $\Pi$, with absorbing transitions when the orbit intersects $\Sigma$ before returning. This “open map with absorption” underlies the discrete transfer operators introduced later; at the present level we only record the continuous-time hitting formulation above. Labels. We use $\xi$ for generic upstream labels (points on $S_u$) and $\eta$ for generic target labels (points on $\Sigma$). When flux labels $(\psi,\alpha)$ are available, they can be taken as coordinates for $\xi$, but the operator definitions will be coordinate-free. II.C. Flux-tube geometry factors and incidence The operator we seek maps upstream power (or power density) on $S_u$ to target-normal heat flux on $\Sigma$. The following geometric factors enter repeatedly. II.C.1. Flux expansion and area scaling Consider an infinitesimal flux tube intersecting $S_u$ around $\xi$ with cross-sectional area element $dA_u$ and intersecting $\Sigma$ around $\eta=F(\xi)$ with cross-sectional area element $dA_t$. In ideal flux-freezing kinematics, magnetic flux through a cross-section is conserved along the tube, motivating the heuristic scaling $dA\propto 1/|\mathbf{B}|$ for cross-sections normal to $\mathbf{B}$. In a general surface-to-surface map, the relevant quantity is an effective “flux expansion” factor $f_{exp}(\xi)$ that relates upstream area to the corresponding target area contributed by the same set of trajectories. For the purposes of this paper, we treat $f_{exp}(\xi)>0$ as an externally provided geometric factor computed from tracing diagnostics (e.g., using a local Jacobian of the field-line map together with field strength ratios) and require only that it is measurable and integrable on $S_u$. Later conservation identities will be written in a way that can be used to falsify inconsistent definitions of $f_{exp}$ in a code. II.C.2. Incidence factor and normal heat flux Let $\mathbf{n}(\eta)$ denote the unit normal on the target surface at $\eta\in\Sigma$, and let $\mathbf{b}(\eta)$ be the unit magnetic direction evaluated at the same point (interpreting $\mathbf{b}$ as a field in a neighborhood of $\Sigma$). Define the incidence factor \[ \alpha(\eta) := |\mathbf{b}(\eta)\cdot \mathbf{n}(\eta)|\in[0,1]. \] If $q_{\parallel}(\eta)$ denotes the heat-flux density carried along the field direction (W/m$^2$ measured on a cross-section normal to $\mathbf{b}$), then the target-normal heat flux is \[ q_{\perp}(\eta) = q_{\parallel}(\eta)\,\alpha(\eta). \] This identity is purely geometric. It becomes a design actuator when $\mathbf{n}$ is modified by plate shaping or thermo-elastic deformation; later sections will treat $\alpha$ as part of a composable operator layer. II.C.3. Connection length Define the connection length from $\xi\in S_u$ to the target (when the hit occurs) as \[ L_{\parallel}(\xi) := \tau(\xi), \] since $s$ is arclength along the field line. In practice, one may introduce additional stopping conditions (e.g., “lost” if $s$ exceeds a threshold), in which case $L_{\parallel}$ becomes a truncated connection length. We keep the definition abstract and will later distinguish between exact and truncated models in audit checks. II.D. Discretization conventions and auditability goals Our operator layers are intended to be used in design loops and optimization; hence, they must admit discrete realizations that preserve key structural properties: 1. Positivity: nonnegative upstream power must produce nonnegative heat flux. 2. Conservation in stated limits: in the attached, no-volumetric-loss limit, the total deposited power should equal the modeled upstream SOL power (up to quantifiable discretization error). 3. Auditable error reporting: conservation defects and negativity must be directly detectable. 4. Sensitivity interface: discrete operators should have well-defined adjoints for gradient-based workflows. II.D.1. Quadrature over upstream samples Let $\{\xi_i\}_{i=1}^N\subset S_u$ be traced samples with nonnegative quadrature weights $w_i\ge 0$ approximating surface integrals on $S_u$: for sufficiently smooth $g$, \[ \int_{S_u} g(\xi)\,dA_u(\xi) \approx \sum_{i=1}^N w_i\, g(\xi_i). \] The weights may come from triangulated surface quadrature, quasi-Monte Carlo, or structured meshes; we do not assume a particular choice, but later discrete conservation identities will require that the same weights are used consistently across factors derived from tracing. II.D.2. Discrete conservation identities (template) Suppose upstream power density (W/m$^2$) on $S_u$ is $p_u(\xi)\ge 0$. A generic discrete transport map will produce a target heat-flux field $q_{\perp,t}$ represented on a target mesh or basis $\{\varphi_j\}_{j=1}^M$. A conservation audit in the attached limit will have the form \[ \sum_{j=1}^M q_{\perp,t,j}\,A_j \approx \sum_{i=1}^N p_u(\xi_i)\,w_i, \] where $A_j$ are target cell areas (or mass-lumped areas for basis functions). The meaning of “attached limit” and the structure producing the left-hand side will be specified when we define the Field-Line Transport Operator (FLTO). Here we record the bookkeeping requirement: the discretization must support an explicit scalar discrepancy \[ \varepsilon_{cons} := \frac{\left|\sum_j q_{\perp,t,j}A_j – \sum_i p_u(\xi_i)w_i\right|}{\sum_i p_u(\xi_i)w_i}, \] reported alongside heat-flux predictions. II.D.3. Adjoint compatibility at the operator level Later sections will define linear (or linearized) operators mapping upstream data to target heat flux. For any linear discrete operator $K\in\mathbb{R}^{M\times N}$ mapping upstream samples to target degrees of freedom, we denote by $K^T$ the Euclidean transpose. When surface integrals are approximated using weights $w_i$ and areas $A_j$, the physically meaningful adjoint with respect to $L^2$-type weighted inner products is typically a weighted transpose (e.g., involving diagonal matrices $W=\mathrm{diag}(w_i)$, $A=\mathrm{diag}(A_j)$). We therefore distinguish: \[ \langle u, v\rangle_{S_u} \approx u^T W v,\qquad \langle r, s\rangle_{\Sigma} \approx r^T A s, \] and define the weighted adjoint $K^{\ast}:= W^{-1} K^T A$ when needed. This is the interface needed for optimization-facing gradient calculations without committing to any particular PDE/physics closure in the present section. The remaining sections build on these definitions to construct transport operators that are (i) positive by construction, (ii) conservative in auditable limits, and (iii) composable with additional conservative layers (spreading, detachment attenuation, neutrals, geometry coupling). III. Energy-Conserving Field-Line Transport Operator (FLTO) This section defines a field-line transport operator that maps an upstream power distribution on the launch surface to a (possibly non-smooth) deposited-power measure on the target, and—after optional conservative spreading—to a target-normal heat-flux density. The emphasis is on structural properties that are directly auditable: positivity, an attached-limit conservation identity, and explicit diagnostics for discrete realizations. III.A. Energy-conserving pushforward formulation III.A.1. Power measures and pushforward Let $p_u\in L^1(S_u;dA_u)$ denote a nonnegative upstream power density (W/m$^2$) on $S_u$ representing the power entering the open-field-line region that is intended to be accounted for at targets. Define the corresponding upstream power measure \[ \mu_u(d\xi) := p_u(\xi)\,dA_u(\xi),\qquad P_u := \mu_u(S_u)=\int_{S_u} p_u\,dA_u. \] Let $\mathcal{D}\subseteq S_u$ be the set of launch points that hit $\Sigma$ in finite arclength, and let $F:\mathcal{D}\to\Sigma$ be the target map from Section II.B. In the attached, no-volumetric-loss idealization, power carried by each flux tube is deposited when the tube hits the target. At the level of measures, this is naturally expressed by the pushforward (image) measure \[ \nu_0 := F_{\#}(\mu_u\llcorner\mathcal{D}), \] meaning $\nu_0(E)=\mu_u(F^{-1}(E))$ for every Borel set $E\subseteq\Sigma$. To allow for explicitly modeled along-field losses (radiation, charge-exchange, imperfect accounting, etc.), introduce an attenuation factor $A:\mathcal{D}\to[0,1]$ (measurable) and define \[ \nu := F_{\#}\big(A\,\mu_u\llcorner\mathcal{D}\big). \] Then $\nu$ is the modeled deposited-power measure on the target (units W). III.A.2. Attached-limit conservation identity (built-in falsifier) The central conservation identity is a tautology of the pushforward construction but becomes a stringent falsifier in discretizations. Theorem 3.1 (Measure-level conservation and loss accounting). Let $p_u\ge 0$ be integrable on $S_u$, let $A\in[0,1]$ be measurable on $\mathcal{D}$, and let $\nu$ be defined as above. Then \[ \nu(\Sigma)=\int_{\mathcal{D}} A(\xi)\,p_u(\xi)\,dA_u(\xi). \] In particular, if (i) $\mathcal{D}$ has full $dA_u$-measure in $S_u$ and (ii) $A\equiv 1$, then $\nu(\Sigma)=P_u$. Proof. By definition of pushforward and restriction, $ \nu(\Sigma)= (A\,\mu_u\llcorner\mathcal{D})(F^{-1}(\Sigma))=(A\,\mu_u\llcorner\mathcal{D})(\mathcal{D})=\int_{\mathcal{D}} A p_u\,dA_u. $ If $\mathcal{D}$ is full-measure and $A\equiv 1$, this equals $\int_{S_u}p_u\,dA_u=P_u$. $\square$ Audit note. In a code, the analog of Theorem 3.1 is a scalar check: “total deposited power = total launched power minus declared losses,” with any discrepancy attributable to tracing/truncation, inconsistent weights, or bookkeeping errors. III.A.3. From deposited-power measures to heat-flux densities A target-normal heat-flux density $q_{\perp,t}$ (W/m$^2$) is, mathematically, a Radon–Nikodym derivative of $\nu$ with respect to target area measure $dA_t$: \[ q_{\perp,t} := \frac{d\nu}{dA_t}\quad\text{whenever }\nu\ll dA_t. \] In stellarator divertor footprints, $\nu$ may be concentrated along narrow strike sets and thus not be absolutely continuous. This is why we explicitly separate (i) a conservative deposition measure $\nu$ and (ii) additional spreading layers that render a bounded density while preserving total power; Section V will supply conservative, positivity-preserving surface-diffusion semigroups for this purpose. III.B. Positive kernel representation and composability III.B.1. Kernel form relative to upstream area For optimization and discretization, it is useful to represent the map $p_u\mapsto q_{\perp,t}$ as an integral operator whenever a density exists (either because the pushforward is regular enough or because we explicitly introduce a spreading kernel). Definition 3.2 (FLTO kernel operator). Let $K:\Sigma\times S_u\to[0,\infty)$ be measurable. Define \[ (\mathcal{K}p_u)(\eta) := \int_{S_u} K(\eta,\xi)\,p_u(\xi)\,dA_u(\xi). \] We call $\mathcal{K}$ an FLTO (in density form) if it is positive ($K\ge 0$) and its columns satisfy the conservation normalization \[ \int_{\Sigma} K(\eta,\xi)\,dA_t(\eta) = A(\xi)\quad\text{for a.e. }\xi\in S_u, \] for some declared attenuation field $A\in[0,1]$ (the attached limit is $A\equiv 1$). With this normalization, total deposited power is auditable: \[ \int_{\Sigma} (\mathcal{K}p_u)(\eta)\,dA_t(\eta)=\int_{S_u} A(\xi)\,p_u(\xi)\,dA_u(\xi), \] by Fubini/Tonelli (nonnegativity ensures Tonelli applies). III.B.2. Field-line map factorization and spreading kernels A common (and computationally convenient) subclass of positive kernels is obtained by centering a nonnegative “spreading density” at the footpoint $F(\xi)$. Let $d_t$ be a chosen distance on $\Sigma$ (e.g., geodesic distance on each patch with declared boundary handling), and let $S(\xi)>0$ be a spreading scale. Let $G(r;S)\ge 0$ be a radial profile in $r\ge 0$ that induces a surface density via \[ \eta\mapsto G\big(d_t(\eta,F(\xi));S(\xi)\big). \] To ensure the conservation normalization, define the (possibly $\xi$-dependent) normalizing factor \[ Z(\xi) := \int_{\Sigma} G\big(d_t(\eta,F(\xi));S(\xi)\big)\,dA_t(\eta)\in(0,\infty), \] and set \[ K(\eta,\xi) := A(\xi)\,\frac{G\big(d_t(\eta,F(\xi));S(\xi)\big)}{Z(\xi)}. \] Then $K\ge 0$ and $\int_{\Sigma}K(\eta,\xi)\,dA_t(\eta)=A(\xi)$ by construction. This form is deliberately agnostic about the physical interpretation of $S$: it may represent cross-field transport, strike-point jitter, finite diagnostic resolution, or a numerical regularization layer, but its effect on conservation is explicit. Remark 3.3 (Where “flux expansion” lives). Many implementations introduce an explicit factor $1/f_{\exp}(\xi)$ in $K$. Mathematically, any such factor must be paired with a compensating normalization so that the column-integral constraint remains true; otherwise the model violates Theorem 3.1 at the density level. In this paper we treat any reported $f_{\exp}$ as diagnostic metadata that must be consistent with the audited conservation identity; we do not assume a universal closed-form expression for $f_{\exp}$ beyond what is verifiable numerically in a given code. III.B.3. Composability of positive conservative layers Operator layers will be composed repeatedly (field-line mapping, spreading, detachment attenuation, neutral transport). The following closure property is the reason for formulating everything as positive operators with explicit normalization. Proposition 3.4 (Composition preserves positivity and conservation bookkeeping). Let $\mathcal{K}_1:L^1(S_u)\to L^1(\Sigma)$ and $\mathcal{K}_2:L^1(\Sigma)\to L^1(\Sigma)$ be integral operators with nonnegative kernels $K_1\ge 0$, $K_2\ge 0$. Assume \[ \int_{\Sigma} K_1(\eta,\xi)\,dA_t(\eta)=A_1(\xi),\qquad \int_{\Sigma} K_2(\eta,\eta’)\,dA_t(\eta)=A_2(\eta’) \] for measurable $A_1\in[0,1]$, $A_2\in[0,1]$. Define $\mathcal{K}:=\mathcal{K}_2\mathcal{K}_1$ with kernel $K(\eta,\xi)=\int_{\Sigma}K_2(\eta,\eta’)K_1(\eta’,\xi)\,dA_t(\eta’)$. Then $K\ge 0$ and \[ \int_{\Sigma} K(\eta,\xi)\,dA_t(\eta)=\int_{\Sigma} A_2(\eta’)\,K_1(\eta’,\xi)\,dA_t(\eta’)\le A_1(\xi). \] If moreover $A_2\equiv 1$ (a conservative post-processing layer, e.g. spreading), then $\int_{\Sigma}K(\eta,\xi)\,dA_t(\eta)=A_1(\xi)$. Proof. Nonnegativity is immediate. The column-integral identity follows from Tonelli and the assumed normalizations. The inequality uses $0\le A_2\le 1$. $\square$ III.C. Certified peak heat-flux bounds and robustness III.C.1. Operator-norm screening for peak heat flux For design screening one often needs an upper bound on $\|q_{\perp,t}\|_{L^\infty(\Sigma)}$ without resolving fine-scale extrema. Positive kernels give a sharp, computable bound in terms of an $L^1\to L^\infty$ operator norm. Proposition 3.5 (Peak bound from $L^1\to L^\infty$ norm). Let $\mathcal{K}$ be an FLTO kernel operator with $K\ge 0$. For any $p_u\ge 0$ in $L^1(S_u)$, \[ \|\mathcal{K}p_u\|_{L^\infty(\Sigma)} \le \|\mathcal{K}\|_{\infty\leftarrow 1}\,\|p_u\|_{L^1(S_u)}, \] where \[ \|\mathcal{K}\|_{\infty\leftarrow 1} := \operatorname*{ess\,sup}_{\eta\in\Sigma}\int_{S_u} K(\eta,\xi)\,dA_u(\xi). \] Proof. For each $\eta$, by nonnegativity and Hölder (or directly), $ (\mathcal{K}p_u)(\eta)=\int K(\eta,\xi)p_u(\xi)\,dA_u(\xi)\le \big(\int K(\eta,\xi)\,dA_u(\xi)\big)\,\|p_u\|_{L^1}. $ Taking essential supremum over $\eta$ yields the claim. $\square$ Engineering interpretation. If only the total upstream power $P_u=\int_{S_u}p_u\,dA_u$ is trusted (not its fine distribution), then $q_{\perp,\max}\le \|\mathcal{K}\|_{\infty\leftarrow 1}\,P_u$ is a conservative hot-spot screen. It is also a consistency check: if $\|\mathcal{K}\|_{\infty\leftarrow 1}$ is numerically unstable under mesh refinement, then the mapped peak is not discretization-robust. Discrete form. For a nonnegative matrix $K\in\mathbb{R}^{M\times N}$ mapping weighted upstream samples to target cell values (Section II.D), the natural analog is \[ \|K\|_{\infty\leftarrow 1,W} := \max_{1\le j\le M} \sum_{i=1}^N K_{ji}\,w_i, \] so that $\max_j (Kp)_j\le \|K\|_{\infty\leftarrow 1,W}\,\sum_i p_i w_i$ for $p\ge 0$. III.C.2. Strike-point jitter and discretization robustness Uncertainty in the target map $F$ (due to coil-current uncertainty, equilibrium uncertainty, or finite tracing resolution) can be represented by convex averaging of kernels. Suppose $\{K_{\omega}\}_{\omega}$ is a family of admissible kernels (all nonnegative and satisfying the same column normalization with $A\equiv 1$), and define the averaged kernel $\bar K := \mathbb{E}[K_{\omega}]$ pointwise. Then $\bar K\ge 0$ and $\int_{\Sigma}\bar K(\eta,\xi)\,dA_t(\eta)=1$ a.e. $\xi$. Moreover, \[ \|\bar{\mathcal{K}}\|_{\infty\leftarrow 1} \le \mathbb{E}\,\|\mathcal{K}_{\omega}\|_{\infty\leftarrow 1}, \] by the triangle inequality for the integrand defining $\|\cdot\|_{\infty\leftarrow 1}$ and Jensen. Thus the peak-flux screen remains conservative under averaged “jitter” models. III.C.3. Patchwise and field-period-averaged summaries Let $\Sigma$ be partitioned into measurable patches $\{\Sigma_k\}_{k=1}^K$ (e.g., tiles/cassettes or engineering reporting regions). Define patch-average fluxes \[ \bar q_k := \frac{1}{|\Sigma_k|}\int_{\Sigma_k} q_{\perp,t}(\eta)\,dA_t(\eta),\qquad |\Sigma_k|:=\int_{\Sigma_k} 1\,dA_t. \] For kernel-form FLTOs, $\bar q$ is itself a linear image of $p_u$: \[ \bar q_k = \int_{S_u} \bar K_k(\xi)\,p_u(\xi)\,dA_u(\xi),\qquad \bar K_k(\xi):=\frac{1}{|\Sigma_k|}\int_{\Sigma_k} K(\eta,\xi)\,dA_t(\eta)\ge 0. \] These patchwise summaries are often more robust than pointwise maxima and inherit the same conservation bookkeeping: $ \sum_k \bar q_k |\Sigma_k| = \int_{\Sigma} q_{\perp,t}\,dA_t = \int_{S_u} A p_u\,dA_u. $ If field-period symmetry is assumed and $\Sigma_k$ are chosen period-consistently, these summaries provide auditable checks of symmetry breaking (numerical or physical) without requiring a smooth $q$ at every point. III.D. Residual-based specification and adjoint-friendly derivatives This subsection records a residual/adjoint structure for differentiating heat-flux functionals with respect to magnetic parameters (e.g., coil currents). The aim is not to assert a particular magnetic model but to state what regularity and event-transversality conditions are needed for derivatives to be meaningful. III.D.1. Field-line tracing residual Let $\mathbf{p}\in\mathbb{R}^m$ denote magnetic parameters, and write the unit field direction as $\mathbf{b}(x;\mathbf{p})$. For each launch point $\xi\in S_u$, the traced curve $\mathbf{X}(s;\xi,\mathbf{p})$ satisfies the residual \[ \mathcal{R}_{FL}(\mathbf{X};\xi,\mathbf{p})(s) := \frac{d\mathbf{X}}{ds}(s)-\mathbf{b}(\mathbf{X}(s);\mathbf{p})=\mathbf{0},\qquad \mathbf{X}(0)=\xi. \] The target hit $F(\xi;\mathbf{p})$ is the first $s$ such that $\mathbf{X}(s)\in\Sigma$, as in Section II.B. To treat the hit event differentiably, we assume a local defining function $g$ for $\Sigma$ near the hit point (e.g., signed distance to the surface patch) and impose a transversality condition \[ \nabla g(F(\xi;\mathbf{p}))\cdot \mathbf{b}(F(\xi;\mathbf{p});\mathbf{p}) \neq 0, \] which prevents grazing incidence from causing ill-posed event-time derivatives. III.D.2. Differentiating a generic heat-flux functional Let a quantity of interest be \[ J(\mathbf{p}) := \int_{\Sigma} \Phi(\eta)\,q_{\perp,t}(\eta;\mathbf{p})\,dA_t(\eta), \] with a declared test function $\Phi$ (e.g., $\Phi\equiv 1$ for total power, or patch indicators for patch powers). When $q_{\perp,t}=\mathcal{K}(\mathbf{p})p_u$ for a kernel depending on $\mathbf{p}$ through $F$, $A$, and any spreading scale $S$, formal differentiation yields \[ \frac{dJ}{d\mathbf{p}} = \int_{S_u} p_u(\xi)\,\frac{d}{d\mathbf{p}}\Big(\int_{\Sigma} \Phi(\eta)\,K(\eta,\xi;\mathbf{p})\,dA_t(\eta)\Big)\,dA_u(\xi). \] In the column-normalized form of Definition 3.2, the inner integral is a smooth functional of the mapped footpoint when $\Phi$ is smooth and the kernel is smooth in its center, so the core task becomes differentiating $F(\xi;\mathbf{p})$ and any declared scalar factors $A(\xi;\mathbf{p})$, $S(\xi;\mathbf{p})$. III.D.3. Tangent-linear and adjoint ODE structure (per trajectory) Assume $\mathbf{b}(\cdot;\mathbf{p})$ is differentiable in $x$ and $\mathbf{p}$ with bounded $\partial_x\mathbf{b}$ along the trajectory segment up to the hit. The tangent-linear variation $\delta\mathbf{X}$ for a parameter perturbation $\delta\mathbf{p}$ solves \[ \frac{d}{ds}\delta\mathbf{X}(s)=\partial_x\mathbf{b}(\mathbf{X}(s);\mathbf{p})\,\delta\mathbf{X}(s)+\partial_{\mathbf{p}}\mathbf{b}(\mathbf{X}(s);\mathbf{p})\,\delta\mathbf{p},\qquad \delta\mathbf{X}(0)=\mathbf{0}. \] If the target is defined locally by $g(x)=0$ and the transversality condition holds at $s=\tau$, then the event-time variation is \[ \delta\tau = -\frac{\nabla g(F)\cdot \delta\mathbf{X}(\tau)}{\nabla g(F)\cdot \mathbf{b}(F;\mathbf{p})}, \] and the footpoint variation is \[ \delta F = \delta\mathbf{X}(\tau)+\mathbf{b}(F;\mathbf{p})\,\delta\tau. \] For objective gradients in high-dimensional $\mathbf{p}$, an adjoint method avoids computing $\delta\mathbf{X}$ for each component of $\delta\mathbf{p}$. If a trajectory-dependent scalar functional has the form $\mathcal{J}(\mathbf{p})=\varphi(F(\xi;\mathbf{p}),\mathbf{p})$, then one introduces an adjoint $\boldsymbol\lambda(s)$ solving the final-value problem \[ -\frac{d\boldsymbol\lambda}{ds}(s)=\partial_x\mathbf{b}(\mathbf{X}(s);\mathbf{p})^T\boldsymbol\lambda(s), \] with a terminal condition at the hit determined by $\nabla_x\varphi$ together with the event-time contribution (via $g$). Under these standard hypotheses, the parameter gradient takes the generic form \[ \nabla_{\mathbf{p}}\mathcal{J}=\partial_{\mathbf{p}}\varphi(F,\mathbf{p})+\int_{0}^{\tau} \boldsymbol\lambda(s)^T\,\partial_{\mathbf{p}}\mathbf{b}(\mathbf{X}(s);\mathbf{p})\,ds, \] where all terms are evaluated on the primal trajectory and the adjoint. Regularity caveat. Any claim that a specific coil-field model automatically satisfies the boundedness/Lipschitz hypotheses on $\partial_x\mathbf{b}$ is a separate mathematical verification task for that model (geometry, coil regularization, distance-to-coil lower bounds, etc.). In this paper the role of the hypotheses is purely interface-level: they are the conditions under which gradients produced by an FLTO implementation can be considered mathematically meaningful and therefore audit-worthy. IV. Fast Field-Line Footprint and Connection-Length Surrogates This section introduces discrete transfer-operator surrogates for (i) the target-hitting (footprint) distribution and (ii) statistics of the connection length $L_{\parallel}$. The intent is not to replace high-fidelity tracing permanently, but to provide swap-ready, auditable linear-algebra modules whose outputs can be refined by improving the underlying tracing used to estimate their coefficients. IV.A. OFLO: Open Field-Line Transfer Operator as a killed Markov chain IV.A.1. Discretization of a return map with absorption Fix a Poincar\’e section $\Pi\subset\Omega$ transversal to $\mathbf{b}$ on the open-field-line region, and suppose that field-line motion induces a (partially defined) return map $P$ until absorption at the target $\Sigma$. To obtain a finite-dimensional surrogate, choose a measurable partition of $\Pi$ into $n$ cells $\{C_1,\dots,C_n\}$ with areas $|C_i|$ (with respect to the induced surface measure on $\Pi$). We treat absorption as a separate event: a trajectory initiated in $C_i$ either 1. hits $\Sigma$ before returning to $\Pi$, or 2. returns to $\Pi$ and lands in some cell $C_j$. This induces a sub-stochastic transition matrix $Q\in\mathbb{R}^{n\times n}$ and an absorption (killing) vector $k\in\mathbb{R}^n$, with \[ Q_{ij} \approx \mathbb{P}(X_{\ell+1}\in C_j\mid X_{\ell}\in C_i,\ \text{not yet absorbed}),\qquad k_i := 1-\sum_{j=1}^n Q_{ij} \in [0,1], \] where $X_\ell$ denotes the cell of the $\ell$-th intersection with $\Pi$. The approximation is implemented by sampling $m_i$ launch points in each $C_i$, tracing until the next return or absorption, and using empirical frequencies. The bookkeeping constraint $k_i\ge 0$ and row sums $\le 1$ are mandatory audit checks; violations indicate insufficient samples or inconsistent event handling. To retain spatial information on the target, introduce a partition $\{D_1,\dots,D_M\}$ of the target $\Sigma$ (e.g., target mesh cells). Define an absorption-to-target matrix $R\in\mathbb{R}^{n\times M}$ by \[ R_{i\ell} \approx \mathbb{P}(\text{first hit occurs in }D_\ell\mid X_0\in C_i),\qquad \sum_{\ell=1}^M R_{i\ell} = k_i. \] The triple $(Q,R,k)$ is the discrete Open Field-Line Transfer Operator (OFLO) data structure. IV.A.2. Footprint measure and fundamental matrix Let $\pi\in\mathbb{R}^n$ be a nonnegative initial distribution over $\Pi$ cells ($\sum_i\pi_i=1$). The probability of absorption in target cell $D_\ell$ is \[ \varrho_\ell := \mathbb{P}(\text{absorb in }D_\ell) = \sum_{t\ge 0} \pi^T Q^t R_{\cdot\ell}. \] When the spectral radius $\rho(Q)<1$, the Neumann series converges and one obtains the closed form \[ \boldsymbol\varrho^T = \pi^T N R,\qquad N := (I-Q)^{-1} = \sum_{t\ge 0} Q^t. \] Here $N$ is the fundamental matrix of the killed chain; $N_{ij}$ is the expected number of visits to $C_j$ starting from $C_i$ before absorption. The footprint measure on $\Sigma$ is then approximated by the discrete measure assigning mass $\varrho_\ell$ to each $D_\ell$. If one composes this with the FLTO power bookkeeping, the absorbed probability can be used as a normalization check (e.g., if some trajectories are declared lost to a separate absorbing set). Audit identity. Because $\sum_{\ell}R_{i\ell}=k_i$, we have \[ \sum_{\ell=1}^M \varrho_\ell = \pi^T N k, \] and since $Nk = (I-Q)^{-1}(\mathbf{1}-Q\mathbf{1})$ (where $\mathbf{1}$ is the all-ones vector), this equals $1$ if and only if absorption is certain (no escape channels). In practice, $\sum_{\ell}\varrho_\ell<1$ is permissible only if a separate loss event is explicitly tracked and reported. IV.A.3. Connection-length statistics as Markov rewards Let $\Delta s_i\ge 0$ denote a declared arclength increment associated with one return step starting from cell $C_i$ (e.g., mean arclength between $\Pi$-hits for samples in $C_i$). Define the accumulated connection length (to absorption) as a Markov reward: \[ L := \sum_{t=0}^{T-1} \Delta s_{X_t}, \] where $T$ is the absorption time (number of return steps until the first absorption event). If $\rho(Q)<1$, then the expected connection length conditioned on initial distribution $\pi$ is \[ \mathbb{E}[L] = \pi^T N\,\Delta s, \] where $\Delta s\in\mathbb{R}^n$ is the vector of increments. Likewise, the expected number of returns before absorption is $\mathbb{E}[T]=\pi^T N\mathbf{1}$. Higher moments can be computed by augmenting the chain or by standard Markov reward recursions; in this document we emphasize auditable first-moment and tail-bound interfaces rather than a particular closure. IV.B. Spectral-gap certification for footprint robustness IV.B.1. A resolvent bound controlled by $\rho(Q)$ The stability of $\boldsymbol\varrho=\pi^TNR$ under perturbations of $Q$ and $R$ depends on the conditioning of $(I-Q)^{-1}$. In any operator norm $\|\cdot\|$, one has the general identity \[ (I-Q-\Delta Q)^{-1} - (I-Q)^{-1} = (I-Q-\Delta Q)^{-1}\,\Delta Q\,(I-Q)^{-1}, \] whenever both inverses exist. Thus a sufficient condition for stability is that $\|(I-Q)^{-1}\|$ is moderate and $\|\Delta Q\|$ is small. For a nonnegative sub-stochastic $Q$, a crude but auditable bound is \[ \|N\| \le \sum_{t\ge 0} \|Q\|^t = \frac{1}{1-\|Q\|}, \] valid whenever $\|Q\|<1$. In practice one often monitors a more intrinsic quantity such as $\rho(Q)$ (computable by power iteration) and uses the heuristic that $\rho(Q)$ near 1 corresponds to long connection lengths and strong amplification of sampling error. Because $\rho(Q)\le \|Q\|$ for any induced operator norm, one has the implication $\|Q\|<1\Rightarrow \rho(Q)<1$, but not conversely. Hence any certification strategy based on $\rho(Q)$ alone must declare the chosen norm and the actual bound used in computation. IV.B.2. A perturbation bound for footprint distributions Let $(Q,R)$ and $(\widetilde Q,\widetilde R)$ be two OFLO models (e.g., two sampling resolutions or two magnetic-parameter values). Assume $\rho(Q)<1$ and $\rho(\widetilde Q)<1$. For a fixed initial distribution $\pi$, define $\boldsymbol\varrho=\pi^T (I-Q)^{-1}R$ and $\widetilde{\boldsymbol\varrho}=\pi^T (I-\widetilde Q)^{-1}\widetilde R$. Then \[ \|\widetilde{\boldsymbol\varrho}-\boldsymbol\varrho\| \le \|\pi\|\,\Big(\|(I-\widetilde Q)^{-1}\|\,\|\widetilde R-R\| + \|(I-\widetilde Q)^{-1}\|\,\|\widetilde Q-Q\|\,\|(I-Q)^{-1}\|\,\|R\|\Big), \] in any subordinate matrix norm. This is a direct consequence of adding and subtracting $\pi^T (I-\widetilde Q)^{-1}R$ and applying the resolvent identity above. Interpretation. The bound makes explicit that robustness is controlled by (i) how strongly the chain recirculates before absorption (captured by $\|(I-Q)^{-1}\|$), and (ii) the estimation error in $Q$ and $R$. The document does not claim that a single scalar “spectral gap” suffices for a sharp physical robustness statement; rather, $\rho(Q)$ (or other spectral summaries) are useful diagnostics whose implications are only as rigorous as the chosen norm bounds and verified sampling error controls. IV.B.3. Stated gap: from spectral summaries to guaranteed footprint robustness To turn spectral diagnostics into a certified robustness implication, one needs (at minimum) externally validated, implementation-level bounds on $\|\widetilde Q-Q\|$ and $\|\widetilde R-R\|$ in the same norm used for the resolvent bound. Such bounds require statistical concentration arguments for empirical transition estimates and careful handling of rare events (near-grazing hits, long flights). Those ingredients are not derived here; instead we expose where they would enter the certification. IV.C. AMRP tail bounds for stochastic/island divertor layers IV.C.1. Absorbing Markov reward process (AMRP) formulation Connection-length extremes (large $L_{\parallel}$) can drive detachment and spreading closures. The killed-chain reward representation provides a clean interface for tail probabilities. Let $X_t$ be the killed chain on $\{1,\dots,n\}$ with sub-stochastic $Q$, and let $r_i:=\Delta s_i\ge 0$ be rewards. Define the total reward to absorption \[ L = \sum_{t=0}^{T-1} r_{X_t}. \] The pair $(Q,r)$, together with an initial distribution $\pi$, defines an absorbing Markov reward process. IV.C.2. A computable exponential-moment bound A standard route to tail bounds is via exponential moments. Fix $\theta\ge 0$ and define the tilted matrix \[ Q_{\theta} := \operatorname{diag}(e^{\theta r})\,Q. \] If $\rho(Q_{\theta})<1$, then $(I-Q_{\theta})^{-1} = \sum_{t\ge 0} Q_{\theta}^t$ exists and one obtains the bound \[ \mathbb{E}[e^{\theta L}] \le \pi^T (I-Q_{\theta})^{-1} \mathbf{1}. \] This inequality can be justified by expanding $e^{\theta L}=\prod_{t=0}^{T-1} e^{\theta r_{X_t}}$ and summing over paths; the right-hand side is the path-sum of the tilted kernel, with absorption handled by killing. Consequently, for any $\ell>0$ and any $\theta\ge 0$ such that $\rho(Q_{\theta})<1$, Markov's inequality yields the one-sided tail bound \[ \mathbb{P}(L\ge \ell) \le e^{-\theta \ell}\,\pi^T (I-Q_{\theta})^{-1}\mathbf{1}. \] This provides an auditable pipeline: (i) estimate $Q$ and $r$, (ii) verify numerically that $\rho(Q_{\theta})<1$ for a chosen $\theta$, and (iii) report the bound. Caveat. The bound is only as meaningful as the discretization defining $r_i$ and the stopping rules defining absorption. Any truncation (“declare lost if $s$ exceeds $s_{\max}$”) must be propagated into $Q$, $R$, and the interpretation of $L$. IV.C.3. Feeding tail bounds into FLTO layers Two interfaces are particularly direct: 1. Spreading scale selection: define a monotone spreading rule $S(\xi)=\mathsf{S}(L_{\parallel}(\xi))$ (model assumption), and use the AMRP tail bound to produce a conservative upper envelope for extreme spreading demands. 2. Detachment attenuation: if a per-tube attenuation $A(\xi)$ is modeled as a monotone function of $L_{\parallel}(\xi)$ and/or its exceedance probabilities, then AMRP bounds provide auditable one-sided uncertainty on $A$ without Monte Carlo sampling of rare long-flight events. The document does not assert a specific physics law $\mathsf{S}$ or $A(\cdot)$; it only supplies the operator-theoretic mechanism that produces tail information in a form compatible with the positive FLTO composition rules of Section III. IV.D. Melnikov-based footprint robustness certificates under trim-coil perturbations IV.D.1. Dynamical-systems setting (map perturbations) Strike patterns in non-axisymmetric divertors can be organized by invariant manifolds of hyperbolic periodic orbits of a Poincar\'e map. Let $P$ be a smooth map on a 2D section $\Pi$ (or on an appropriate annulus in flux coordinates), and assume $x_\ast$ is a hyperbolic fixed point (or periodic point) of $P$ with stable and unstable manifolds $W^s(x_\ast)$, $W^u(x_\ast)$. Intersections of these manifolds control lobe dynamics and transport channels to absorbing targets. Consider a one-parameter perturbation $P_{\varepsilon}=P+\varepsilon\,\Delta P+o(\varepsilon)$ induced by trim-coil current changes. A Melnikov-type computation seeks a first-order approximation to the splitting (transverse distance) between $W^s(P_{\varepsilon})$ and $W^u(P_{\varepsilon})$ near a reference homoclinic/heteroclinic connection of $P$. IV.D.2. Certificate content (what is and is not claimed here) In classical settings (area-preserving maps or Hamiltonian flows), the Melnikov function $M(\cdot)$ can be derived so that a simple root implies transverse manifold intersection for sufficiently small $|\varepsilon|$, which in turn implies persistence of certain transport structures. For stellarator field-line maps, whether the hypotheses of the classical theorem apply depends on the coordinate representation, the presence of dissipation-like effects from event handling, and smoothness/transversality at target intersection events. Accordingly, we use Melnikov methods at the level of a surrogate certificate with explicit falsifiers: 1. Compute a predicted strike-pattern displacement direction $\partial_{\varepsilon}F$ (or displacement of a manifold intersection curve on $\Pi$) using an analytically differentiable approximation of $\Delta P$. 2. Compare against controlled trim-coil perturbation experiments or high-fidelity tracing to validate the linear regime and detect loss of transversality (grazing incidence) where first-order theory fails. IV.D.3. Falsification strategy via controlled strike perturbations A minimal, auditable falsification protocol is: 1. Choose a baseline configuration and a small set of trim-coil perturbations $\varepsilon\in\{\pm\varepsilon_1,\pm\varepsilon_2\}$. 2. For each $\varepsilon$, measure or trace the strike-set displacement on $\Sigma$ and compute the induced change in patch powers $\{\bar q_k\}$ (Section III.C.3). 3. Check whether the observed displacement is consistent with a linear prediction (Melnikov/tangent-linear) within declared uncertainty. If the linear prediction fails, the surrogate is rejected (or restricted to a smaller neighborhood). This aligns with the paper\'s design goal: provide fast, differentiable predictors that remain explicitly falsifiable and replaceable. V. Cross-Field Spreading as Conservative Surface-Diffusion Semigroups Field-line pushforward produces a deposited-power measure $\nu$ on the target (Section III.A). In 3D divertor footprints, $\nu$ can be singular with respect to area, reflecting fine strike structures. Engineering workflows, however, typically require a bounded heat-flux density on the actual CAD surface while preserving total deposited power. This section replaces ad hoc "Gaussian on a chart" smoothing by conservative diffusion semigroups posed intrinsically on $\Sigma$, guaranteeing positivity and exact power conservation under verifiable boundary conditions. V.A. Laplace--Beltrami heat-semigroup spreading on the 3D target V.A.1. Heat semigroup on a surface with boundary Assume each surface patch $\Sigma_k$ is a compact, oriented, $C^2$ two-manifold with (piecewise) $C^1$ boundary, and $\Sigma=\bigcup_k \Sigma_k$ with boundaries representing physical edges/gaps. Let $\Delta_{\Sigma}$ denote the Laplace--Beltrami operator on $\Sigma$. To spread deposited power without loss through edges, we impose a no-flux (Neumann) boundary condition patchwise: \[ \nabla_{\Sigma} u\cdot \mathbf{n}_{\partial\Sigma}=0\quad\text{on }\partial\Sigma, \] where $\nabla_{\Sigma}$ is the surface gradient and $\mathbf{n}_{\partial\Sigma}$ is the outward unit conormal along the boundary (tangent to the surface, normal to the boundary curve). Other boundary conditions (e.g. absorbing) are mathematically legitimate but then encode explicit power loss; any such choice must be declared as part of the audit. Let $\{T_t\}_{t\ge 0}$ be the (Neumann) heat semigroup on $L^1(\Sigma)$ generated by $\Delta_{\Sigma}$: for $f\in L^1(\Sigma)$, $u(t,\cdot)=T_t f$ is the weak solution of \[ \partial_t u = \Delta_{\Sigma} u,\qquad u(0,\cdot)=f, \] with Neumann boundary conditions on each patch. V.A.2. Conservation and positivity Proposition 5.1 (Mass/power conservation and positivity). For the Neumann heat semigroup $T_t$: 1. (Positivity) If $f\ge 0$ a.e., then $T_t f\ge 0$ a.e. for all $t\ge 0$. 2. (Conservation) For $f\in L^1(\Sigma)$, $\int_{\Sigma} T_t f\,dA_t = \int_{\Sigma} f\,dA_t$ for all $t\ge 0$. 3. ($L^1$ contraction) $\|T_t f\|_{L^1(\Sigma)}\le \|f\|_{L^1(\Sigma)}$, with equality for $f\ge 0$ under Neumann conditions. Sketch of justification. Positivity and $L^1$ contraction are standard for Markov (sub-)semigroups generated by uniformly elliptic operators with Neumann boundary conditions (maximum principle). Conservation follows from differentiating $\int u\,dA_t$ in time and applying the divergence theorem on manifolds with boundary, using the no-flux boundary condition. Audit consequence. When spreading is implemented by a discrete approximation $T_t^h$ (Section V.A.4), the scalar identity \[ \sum_j (T_t^h q)_j\,A_j = \sum_j q_j\,A_j \] is a mandatory check; any drift indicates numerical boundary leakage, inconsistent mass lumping, or non-conservative time stepping. V.A.3. $L^1\to L^\infty$ smoothing and certified peak bounds Diffusion reduces peaks in a quantifiable way. On a compact $C^2$ surface (with Neumann boundary), the heat kernel $p(t,\eta,\eta')$ exists and defines \[ (T_t f)(\eta)=\int_{\Sigma} p(t,\eta,\eta')\,f(\eta')\,dA_t(\eta'),\qquad p\ge 0,\quad \int_{\Sigma} p(t,\eta,\eta')\,dA_t(\eta)=1. \] Whenever an implementation provides (or empirically estimates) an upper bound \[ \sup_{\eta,\eta'} p(t,\eta,\eta') \le C(t), \] one obtains the conservative peak bound \[ \|T_t f\|_{L^\infty(\Sigma)} \le C(t)\,\|f\|_{L^1(\Sigma)}. \] This is the semigroup analog of the kernel screening in Proposition 3.5: $C(t)$ plays the role of an auditable $L^1\to L^\infty$ operator norm. We do not claim a universal closed form for $C(t)$ on arbitrary CAD surfaces; instead, $C(t)$ is treated as either (i) a mathematically derived bound under explicitly stated geometric hypotheses, or (ii) a numerically certified bound for the discrete operator (e.g. by direct maximization of row sums in a mass-lumped matrix representation). V.A.4. Numerical implementation notes (operator level only) On a triangulated CAD mesh, a common conservative discretization is a mass-lumped finite element (or finite volume) Laplace--Beltrami operator: \[ M \dot u = -L u, \] where $M$ is diagonal with entries $A_j$ (lumped cell areas) and $L$ is a symmetric positive semidefinite stiffness matrix satisfying $L\mathbf{1}=0$ (discrete conservation under Neumann conditions). The discrete semigroup is then \[ T_t^h := \exp(-t M^{-1}L), \] applied via Krylov methods or rational approximations. Two audit requirements are structural: 1. Discrete conservation: $\mathbf{1}^T M T_t^h = \mathbf{1}^T M$ (equivalently $L\mathbf{1}=0$). 2. Discrete positivity: $T_t^h$ should map nonnegative vectors to nonnegative vectors. This typically requires additional constraints (e.g. an M-matrix structure for the time-stepping scheme); exact positivity is not automatic for all FEM discretizations. If strict positivity is not guaranteed, the implementation must report any negative values and their total negative mass as an audit quantity. V.B. Geometry-consistent anisotropic surface diffusion V.B.1. Anisotropic generator To model stronger smearing along strike direction than across it, we replace $\Delta_{\Sigma}$ by a divergence-form elliptic operator on the surface: \[ \mathcal{L}u := \nabla_{\Sigma}\cdot(\mathbf{D}\,\nabla_{\Sigma} u), \] where $\mathbf{D}(\eta)$ is a measurable, symmetric positive semidefinite $2\times 2$ tensor acting on tangent vectors. A physically interpretable parameterization is \[ \mathbf{D} = d_{\parallel}\,\mathbf{t}\otimes\mathbf{t} + d_{\perp}\,(I-\mathbf{t}\otimes\mathbf{t}),\qquad d_{\parallel},d_{\perp}\ge 0, \] where $\mathbf{t}(\eta)$ is a chosen unit tangent direction ("along strike") on the target surface. The definition of $\mathbf{t}$ is a modeling choice and must be declared (e.g. derived from projected footprint gradients, from a swept strike trajectory, or from a CAD-defined principal direction). The operator remains coordinate-free once $\mathbf{D}$ is fixed. V.B.2. Conservative and positive semigroup With the same Neumann no-flux boundary condition \[ (\mathbf{D}\nabla_{\Sigma} u)\cdot \mathbf{n}_{\partial\Sigma}=0\quad\text{on }\partial\Sigma, \] $\mathcal{L}$ generates a positivity-preserving, mass-conserving semigroup $S_t=\exp(t\mathcal{L})$ on $L^1(\Sigma)$ under standard ellipticity and regularity hypotheses. As in Section V.A, conservation is an exact integration-by-parts identity and therefore supplies an immediate falsifier for any discretization. V.B.3. Integration into the FLTO stack as an operator layer Let $\nu$ be the deposited-power measure from Section III.A (possibly singular). Choose a conservative spreading operator $S_t$ and define the spread power density \[ q_{t}(\eta) := (S_t \nu)(\eta), \] interpreting $S_t\nu$ as applying the semigroup to measures (e.g. by duality against test functions, or via heat-kernel convolution). In discrete form, one typically spreads a deposited-power vector (cell-integrated W) or an initial density and ensures that the sum of cell powers is preserved. Crucially, because $S_t$ is conservative, composing $p_u\mapsto \nu$ (Section III) with $S_t$ does not change the scalar conservation identity: \[ \int_{\Sigma} q_t\,dA_t = \nu(\Sigma)=\int_{\mathcal{D}} A(\xi)\,p_u(\xi)\,dA_u(\xi). \] Thus spreading can be treated as a post-processing layer that regularizes peaks without altering the audit of power accounting. V.C. Field-period symmetry and averaging V.C.1. Symmetry action and invariant operators Assume the magnetic configuration and target geometry are invariant under a finite symmetry group $G$ generated by field-period rotations, with $|G|=N_{fp}$. Let $g\cdot\eta$ denote the action of $g\in G$ on points of $\Sigma$, preserving area: $dA_t(g\cdot\eta)=dA_t(\eta)$. Define the group-averaging (Reynolds) operator \[ (\mathcal{A}f)(\eta) := \frac{1}{|G|}\sum_{g\in G} f(g\cdot\eta). \] An operator $\mathcal{T}$ on functions on $\Sigma$ is symmetry-invariant if $\mathcal{T}(f\circ g)= (\mathcal{T}f)\circ g$ for all $g\in G$. Proposition 5.2 (Commutation and variance reduction). If $\mathcal{T}$ is symmetry-invariant and linear, then $\mathcal{A}\mathcal{T}=\mathcal{T}\mathcal{A}$. Moreover, for any $f\in L^2(\Sigma)$, $\|\mathcal{A}f\|_{L^2}\le \|f\|_{L^2}$ with equality iff $f$ is already $G$-invariant. Consequences. When the underlying geometry and physics are field-period symmetric, symmetry breaking in computed heat-flux maps can be localized by decomposing \[ q = \mathcal{A}q + (I-\mathcal{A})q, \] where the second term is a symmetry-defect diagnostic attributable to (i) true symmetry breaking (e.g. asymmetric coils or boundary conditions) or (ii) numerical artifacts (mesh mismatch, inconsistent tracing weights, or sampling noise). This provides an auditable gate before using peak values in optimization. V.C.2. Period-averaged kernels If an FLTO kernel $K$ and a spreading operator kernel $p(t,\eta,\eta')$ are individually invariant under the group action (in the sense $K(g\cdot\eta,\xi)=K(\eta,\xi)$ and $p(t,g\cdot\eta,g\cdot\eta')=p(t,\eta,\eta')$), then the composed operator is invariant and thus commutes with $\mathcal{A}$. In practice this means that enforcing symmetry at the operator level (by symmetrizing discrete matrices) can reduce noise while preserving positivity and conservation. VI. Detachment, Radiation, and Certified Uncertainty Propagation This section specifies (i) a residual-based interface for coupling an upstream SOL power model to the target-deposition operators of Sections III--V, (ii) an auditable class of per-flux-tube attenuation laws capturing along-field losses ("detachment" and radiation, at the level of power bookkeeping), and (iii) a mathematically explicit uncertainty-propagation interface for heat-flux maps as random fields. Throughout, any physics closure (e.g., a particular radiation law) is treated as a replaceable module whose correctness must be validated externally; our focus is on monotonicity, positivity, and one-sided bounds that can be audited. VI.A. Residual-based SOL coupling framework (core/SOL $\to$ target) VI.A.1. Field-line deposition residual Let $P_{SOL}\ge 0$ be the modeled power entering the open-field-line region. In the present document $P_{SOL}$ is simply an input scalar (or a set of patchwise inputs); its provenance (core transport model, edge model, measurements) is outside scope. Given an upstream launch surface $S_u$ and an upstream power density $p_u\in L^1(S_u;dA_u)$, define the upstream power constraint residual \[ \mathcal{R}_{P}(p_u;P_{SOL}) := \int_{S_u} p_u\,dA_u - P_{SOL}. \] This residual is exactly checkable. If the implementation chooses a parameterization $p_u=p_u(\cdot;\vartheta)$ with finitely many degrees of freedom $\vartheta$, then enforcing $\mathcal{R}_{P}=0$ is the minimal unit-checkable requirement linking $P_{SOL}$ to the field-line deposition operators. Given an FLTO mapping $\mathcal{K}:L^1(S_u)\to \mathcal{M}(\Sigma)$ producing a deposited-power measure $\nu=\mathcal{K}p_u$ (Section III), define the target power accounting residual \[ \mathcal{R}_{\Sigma}(p_u;P_{SOL}) := \nu(\Sigma) - P_{SOL}. \] In the attached, no-volumetric-loss limit (full target hitting and $A\equiv 1$), Theorem 3.1 implies $\mathcal{R}_{\Sigma}=0$ whenever $\mathcal{R}_P=0$. Thus $\mathcal{R}_{\Sigma}$ is a built-in falsifier for inconsistencies between the traced field-line mapping/weights and the upstream normalization. VI.A.2. Reduced-order SOL power-balance module with explicit uncertainty channels To propagate uncertainty, we treat uncertain SOL/edge closures as explicit parameters $\theta\in\Theta$ (deterministic intervals or random variables). At the interface level, an upstream module is any mapping \[ \mathcal{U}:(P_{SOL},\theta)\mapsto p_u(\cdot;P_{SOL},\theta)\in L^1(S_u), \] subject to the constraint $\int_{S_u}p_u\,dA_u=P_{SOL}$ for all $\theta$ (or an auditable residual defect if not satisfied). Examples include: 1. Shape-only uncertainty: $p_u(\xi;P_{SOL},\theta)=P_{SOL}\,\rho(\xi;\theta)$ with $\rho\ge 0$ and $\int_{S_u}\rho\,dA_u=1$. 2. Patchwise allocation: $p_u$ piecewise constant on a partition of $S_u$, with nonnegative coefficients summing (in weighted area) to $P_{SOL}$. The paper does not assume any particular $\mathcal{U}$; it only requires that the resulting mapping into $p_u$ is explicit and that its normalization is auditable. VI.A.3. Integration intent with an implicit-adjoint pipeline (interface only) If the broader design loop solves an implicit system $\mathcal{R}(\mathbf{U},\mathbf{p})=0$ for a state $\mathbf{U}$ (e.g., equilibrium + profiles), and then evaluates a heat-load functional $J(\mathbf{p})$ through $p_u$ and $\mathcal{K}(\mathbf{p})$, the only requirement imposed here is modular differentiability: each block (upstream mapping $\mathcal{U}$, tracing-derived $F$ and factors, spreading $S_t$) must expose either (i) a verified adjoint, or (ii) a declared non-differentiable region (e.g., grazing incidence, topology change) where gradients are not claimed. VI.B. Detachment attenuation via along-field conduction+radiation bookkeeping VI.B.1. Per-flux-tube attenuation as a conservative inequality For each $\xi\in\mathcal{D}\subseteq S_u$ (field lines that hit $\Sigma$), define the launched (upstream) per-tube power density contribution as $p_u(\xi)\,dA_u$. Along-field volumetric losses reduce the power reaching the target; we encode this entirely through an attenuation factor $A_{det}(\xi)\in[0,1]$ and use the deposited-power measure \[ \nu = F_{\#}\big(A_{det}\,\mu_u\llcorner\mathcal{D}\big),\qquad \mu_u=p_u\,dA_u. \] The definition is purely a bookkeeping device: $A_{det}$ can represent any collection of processes that remove power from the conductive/convective channel before it reaches the plate, provided it is declared and constrained to $[0,1]$. The scalar identity \[ \nu(\Sigma)=\int_{\mathcal{D}} A_{det}(\xi)\,p_u(\xi)\,dA_u(\xi) \] is then an exact conservation statement at the level of the declared model. Any additional "radiated power" reported by a closure should be consistent with \[ P_{loss}:=\int_{\mathcal{D}} (1-A_{det}(\xi))\,p_u(\xi)\,dA_u(\xi)=P_u-\nu(\Sigma), \] with $P_u=\int_{S_u}p_u\,dA_u$ (Theorem 3.1). This provides an implementation-level audit independent of the underlying physics justification. VI.B.2. Monotone certified bounds under uncertainty Assume $A_{det}$ is given by a parametric form $A_{det}(\xi)=\mathsf{A}(\xi,\vartheta)$ with uncertain parameters $\vartheta\in\mathcal{V}$ (intervals or a probabilistic posterior). If $\mathsf{A}$ is monotone in each uncertain component (a property that must be checked for the chosen closure), then one obtains one-sided certified bounds \[ A_{det}^{\min}(\xi) := \inf_{\vartheta\in\mathcal{V}} \mathsf{A}(\xi,\vartheta),\qquad A_{det}^{\max}(\xi) := \sup_{\vartheta\in\mathcal{V}} \mathsf{A}(\xi,\vartheta), \] with $0\le A_{det}^{\min}\le A_{det}^{\max}\le 1$. These bounds propagate linearly through the positive mapping (Sections III.B--III.C): if $p_u\ge 0$, then \[ \int_{\mathcal{D}} A_{det}^{\min}p_u\,dA_u \le \nu(\Sigma) \le \int_{\mathcal{D}} A_{det}^{\max}p_u\,dA_u. \] If a conservative spreading layer is applied afterwards (Section V), these inequalities remain valid because spreading preserves total power. VI.B.3. Convex impurity-seeding allocator built atop a positive FLTO mapping We record an optimization-facing template that requires only positivity and linearity. Let $z\in\mathbb{R}^m_+$ be nonnegative control variables representing (for example) impurity-seeding actuator levels in $m$ injectors. A reduced closure may produce an attenuation field as a linear image followed by a monotone scalar nonlinearity, e.g. \[ A_{det}(\xi;z)=\phi\big((Hz)(\xi)\big),\qquad H:\mathbb{R}^m\to L^\infty(\mathcal{D}),\qquad \phi:[0,\infty)\to[0,1]\ \text{nonincreasing}. \] Because $\phi$ is nonincreasing, any concave lower bound $\\underline\phi\le \phi$ yields a conservative constraint for target power (or peak-flux screens). A particularly transparent convex case is when one enforces linear inequalities directly on the loss power: \[ P_{loss}(z)=\int_{\mathcal{D}} (1-A_{det}(\xi;z))\,p_u(\xi)\,dA_u(\xi) \ge P_{loss}^{req}, \] and the mapping $z\mapsto 1-A_{det}(\cdot;z)$ is affine and nonnegative. Then the constraint is linear in $z$, and it composes with the positive FLTO mapping without destroying auditability. Any nonlinearity beyond this must be declared together with the bounding strategy used to restore convexity. VI.C. IRFO: Impurity Radiation Front Operator (model-form only) VI.C.1. Positive operator mapping from impurity sources to radiation deposition To represent radiation deposition and its effect on the effective power reaching the target, we introduce a separate positive operator, analogous to the FLTO but not tied to a particular physical radiation model. Let $S_Z\in L^1(S_u;dA_u)$, $S_Z\ge 0$, denote an "upstream impurity source density" (in declared units) on $S_u$. Define an impurity-radiation deposition density on $\Sigma$ by a positive integral operator \[ (\mathcal{R}S_Z)(\eta) := \int_{S_u} K_R(\eta,\xi)\,S_Z(\xi)\,dA_u(\xi),\qquad K_R\ge 0. \] The only structural requirement imposed here is nonnegativity (radiation power is nonnegative). Any normalization (e.g., total radiated power equals a known scalar) must be stated as part of the chosen closure; unlike the attached-limit FLTO, there is no universal conservation identity that fixes $\int_{\Sigma}K_R\,dA_t$ without additional physics. VI.C.2. Radiation-front position as a monotone functional Define a cumulative radiation functional (for a chosen reporting patch $E\subseteq\Sigma$): \[ \mathscr{P}_R(E;S_Z):=\int_E (\mathcal{R}S_Z)(\eta)\,dA_t(\eta). \] By positivity, $S_Z^{(1)}\le S_Z^{(2)}$ implies $\mathscr{P}_R(E;S_Z^{(1)})\le \mathscr{P}_R(E;S_Z^{(2)})$. Any "radiation-front" proxy defined by thresholding such a monotone quantity (e.g., the smallest $E$ in a nested family for which $\mathscr{P}_R(E;S_Z)\ge P_\ast$) inherits monotonicity and can therefore be bounded under interval uncertainty in $S_Z$ by evaluating endpoints. This paper does not claim that such a front proxy corresponds to a physical detachment front in 3D stellarator geometry; it is only an auditable operator-level definition that can be swapped out if external validation rejects the closure. VI.C.3. Constraints flagged for external validation Any use of IRFO outputs to enforce limits such as core dilution bounds, $Z_{eff}$ constraints, or divertor-regime labels requires a physically validated relationship between $S_Z$ and core composition and between radiation deposition and detachment state. No such relationship is derived here; any numerical study using IRFO must report which external measurements or high-fidelity codes are used to calibrate and falsify those links. VI.D. Gaussian-process and Gaussian-random-field UQ for heat-flux maps VI.D.1. Heat-flux map as a random field induced by uncertain closures Let $\theta$ denote uncertain closure inputs. The full operator stack (upstream mapping $\mathcal{U}$, FLTO $\mathcal{K}$, spreading $S_t$, incidence factors if applied as multiplicative fields) yields a heat-flux density \[ q(\eta;\theta) = (\mathcal{T}(\theta)P_{SOL})(\eta),\qquad \eta\in\Sigma, \] where $\mathcal{T}(\theta)$ is an overall positive linear operator in $P_{SOL}$ but generally nonlinear in $\theta$. If $\theta$ is random (e.g., a Gaussian process parameterizing a closure field such as a spatially varying transport coefficient), then $q$ is a random field on $\Sigma$. A tractable special case is linear-Gaussian uncertainty: if $\theta$ is Gaussian and $q$ depends affinely on $\theta$ (after linearization about a nominal state), then $q$ is Gaussian with computable mean and covariance via the pushforward of $\theta$ through the linearized operator. VI.D.2. Certified peak bounds: conceptual pipeline and discrete fallback For engineering constraints, the quantity of interest is often the surface maximum $\|q\|_{L^\infty(\Sigma)}$. For Gaussian fields, there exist nonasymptotic inequalities (e.g., Borell--TIS) that bound $\mathbb{P}(\sup_{\eta\in\Sigma} q(\eta) - \mathbb{E}\sup q(\eta) \ge u)$ in terms of the field variance and metric-entropy characteristics. In this document we treat such bounds as a conceptual certification path rather than a completed theorem, because applying them on an arbitrary CAD mesh requires verified inputs (see VI.D.4). As an auditable interim fallback, for a discrete mesh evaluation $q_j=q(\eta_j)$ at $M$ points, one can bound the maximum with a union bound: \[ \mathbb{P}\Big(\max_{1\le j\le M} q_j \ge t\Big) \le \sum_{j=1}^M \mathbb{P}(q_j\ge t), \] which is conservative and requires only one-point marginal tail bounds. This does not capture spatial correlation and may be loose, but it is explicit and easy to audit. VI.D.3. Replacing ad hoc pointwise $\pm 2\sigma$ logic Pointwise uncertainty bands $\mu(\eta)\pm 2\sigma(\eta)$ do not control $\sup_{\eta} q(\eta)$ unless additional information about correlation length or smoothness is used. The operator stack here separates (i) the deterministic structural peak screen $\|\mathcal{K}\|_{\infty\leftarrow 1}\,P_{SOL}$ (Proposition 3.5, after any conservative spreading), from (ii) stochastic bounds on deviations induced by uncertain closures. Any design gate using uncertainty must declare which of these two mechanisms is being used and must report the corresponding audited constants. VI.D.4. Stated gaps for a concrete certified bound on a CAD mesh To turn Gaussian-field extreme-value inequalities into a concrete, certified numerical bound on $\Sigma$, one must provide (and verify): 1. A precise index set and metric: typically $\Sigma$ with geodesic distance, but with explicit handling of patch boundaries and edges. 2. Regularity: continuity or Hölder regularity of the random field with respect to that metric, which in turn depends on how uncertain closure fields enter the operator stack (including spreading and incidence). 3. Metric entropy or covering numbers of $\Sigma$ in the chosen metric at the resolution relevant to the covariance kernel, and a verified discretization strategy that controls the difference between the continuous supremum and the discrete maximum. These inputs are nontrivial for real CAD-derived surfaces and are therefore not asserted here. The purpose of the operator formulation is to localize exactly what must be supplied to upgrade from heuristic uncertainty bands to a rigorous hot-spot probability certificate. VII. Neutral Transport, Compression Bounds, and Pumping Networks This section introduces operator-level surrogates for neutral transport and pumping that mirror the positivity and auditability principles used for heat-flux mapping. The emphasis is on: (i) positive linear maps from declared neutral sources to target/volume fluxes, (ii) monotonicity-based one-sided bounds under interval uncertainty, and (iii) explicit conditions under which a reported “compression” metric is mathematically tied to the model inputs. VII.A. NTO: Neutral Field-Line Transport Operator VII.A.1. Positive integral operator for neutral flux to surfaces Let $S_n\subset\Omega$ be a measurable “neutral source” surface (or collection of surfaces/volumes reduced to a surface) on which we prescribe a nonnegative source density $s_n\in L^1(S_n;dA_n)$. Examples include effective wall recycling sources, injected gas manifolds, or localized neutral emitters; the physical adequacy of any such reduction is external to this paper. Definition 7.1 (Neutral Transport Operator; NTO). A neutral transport operator is a positive integral operator \[ (\mathcal{N}s_n)(\eta) := \int_{S_n} K_n(\eta,\xi)\,s_n(\xi)\,dA_n(\xi),\qquad K_n\ge 0, \] mapping source density to a target neutral flux density on $\Sigma$ (units depend on the declared meaning of $s_n$). Audit semantics. Unlike the attached-limit FLTO, there is no universal conservation law fixing the column integrals of $K_n$ without additional physics (ionization, pumping, re-emission). Any normalization identity used in practice (e.g. “a fraction $\gamma$ of neutrals reach $\Sigma$”) must be stated and then audited against the discrete implementation. VII.A.2. Interface to detachment and impurity screening modules (non-committal) Because $\mathcal{N}$ is positive, any monotone functional of the neutral flux inherits one-sided bounds. For example, if a detachment submodel uses a proxy quantity \[ \mathscr{F}(s_n) := \int_E (\mathcal{N}s_n)(\eta)\,dA_t(\eta) \] for some reporting region $E\subseteq\Sigma$, then $s_n^{(1)}\le s_n^{(2)}\Rightarrow \mathscr{F}(s_n^{(1)})\le \mathscr{F}(s_n^{(2)})$. This is the only structural property used here; any physical statement connecting $\mathscr{F}$ to detachment state or impurity screening must be externally validated. VII.B. Neutral compression: auditable lower bounds (conditional statements) “Compression” is used in divertor contexts to mean a ratio of a downstream neutral pressure/density (in a plenum, private-flux region, or pump duct) to an upstream reference density. In this paper we define compression only relative to an explicit algebraic model (Section VII.C); consequently, any bound is conditional on that model. VII.B.1. Abstract compression metric induced by a positive operator Let $E\subseteq\Sigma$ be a “collection” region (e.g. private-flux-facing surfaces) and let $U\subseteq\Sigma$ be a reference region. For $s_n\ge 0$, define averaged flux proxies \[ \bar\Gamma_E := \frac{1}{|E|}\int_E (\mathcal{N}s_n)\,dA_t,\qquad \bar\Gamma_U := \frac{1}{|U|}\int_U (\mathcal{N}s_n)\,dA_t. \] Then the ratio $\Pi := \bar\Gamma_E/\bar\Gamma_U$ is an operator-induced “surface compression proxy.” Because both numerators are linear functionals of $s_n$, $\Pi$ is homogeneous of degree 0 and is sensitive only to source shape. It is therefore auditable as a pure consequence of the declared kernel and regions. VII.B.2. A simple one-sided bound under interval uncertainty Suppose the kernel is uncertain but bounded pointwise: \[ 0\le K_n^{\min}(\eta,\xi)\le K_n(\eta,\xi)\le K_n^{\max}(\eta,\xi). \] Then for any $s_n\ge 0$, the induced fluxes satisfy \[ \int_E (\mathcal{N}^{\min}s_n)\,dA_t \le \int_E (\mathcal{N}s_n)\,dA_t \le \int_E (\mathcal{N}^{\max}s_n)\,dA_t, \] and similarly on $U$. This yields an auditable interval enclosure for $\Pi$ provided the denominator is bounded away from zero by a declared condition (e.g. $\int_U (\mathcal{N}^{\min}s_n)\,dA_t>0$). VII.B.3. Stated gap: topology-specific “compression theorems” Any claim that a particular divertor concept (island, helical, snowflake-island hybrid) implies a specific numerical lower bound on compression requires a physically grounded model linking field topology, neutral mean-free-path effects, ionization, and conductance geometry. Such a derivation is not given here. The operator formalism is included to (i) state the model precisely when used, and (ii) make clear what must be validated by measurements (pressure, flow, ionization patterns) before a concept-level compression claim can be considered credible. VII.C. PNO: Pumping Network Operator (graph / M-matrix model) VII.C.1. Molecular-flow conductance network as a positive linear system We model a pumping system as a directed graph with $N$ nodes representing volumes (plenum segments, ducts, vessel, pump port). Let $p\in\mathbb{R}^N$ be nodal pressures (or other linearized potential variables), and let $s\in\mathbb{R}^N_+$ be nonnegative sources (effective neutral inflow rates) at nodes. A standard linear network model has the form \[ A\,p = s, \] where $A\in\mathbb{R}^{N\times N}$ is a Z-matrix (nonpositive off-diagonal entries) with diagonals incorporating total outgoing conductance plus pumping terms. The specific construction depends on the chosen conductance law; we treat $A$ as declared input. VII.C.2. Monotonicity via M-matrices and one-sided bounds Definition 7.2 (M-matrix condition). We say the pumping network is monotone if $A$ is a nonsingular M-matrix, i.e. (i) $A$ is a Z-matrix, and (ii) $A^{-1}\ge 0$ componentwise. Proposition 7.3 (Positivity and monotone bounds). If $A$ is a nonsingular M-matrix, then for any $s\ge 0$ the unique solution satisfies $p=A^{-1}s\ge 0$. Moreover, if $0\le s^{(1)}\le s^{(2)}$ componentwise, then $p^{(1)}\le p^{(2)}$ componentwise. Proof. Immediate from $p=A^{-1}s$ and $A^{-1}\ge 0$. $\square$ Interval uncertainty. If $A$ depends on uncertain conductances and pumping speeds, and one has componentwise bounds $A^{\min}\le A\le A^{\max}$ that preserve the M-matrix property, then one can bound $p$ using monotone enclosure strategies (e.g. computing solutions for extremal matrices when order is preserved). The details depend on how uncertainty enters $A$; the audit requirement is that the code must (i) report whether the M-matrix property is verified (or at least diagnostically supported), and (ii) report the precise extremal problems solved to produce the bound. VII.C.3. Outputs and interfaces Typical reported scalars include: (i) minimum pump speed required to keep a designated node pressure below a threshold, (ii) pressure ratios between “collection” and “reference” volumes as a network-defined compression metric, and (iii) sensitivity of those metrics to uncertain conductances (monotone one-sided bounds). These are operator-level outputs; any mapping from pressure to divertor-regime labels is external. VIII. Geometry and Multiphysics Couplings at the Target This section treats the target geometry as an actuator and as a coupled state. The key mathematical point is that incidence factors and on-surface distances enter the operator stack multiplicatively (incidence) and through kernel centers/metrics (spreading). We therefore require convex or contractive structures to prevent “false feasibility” induced by un-audited nonlinear geometry updates. VIII.A. Incidence-driven hot spots and convex plate-shaping surrogates VIII.A.1. Incidence as a multiplicative geometry layer Recall $q_{\perp}(\eta)=q_{\parallel}(\eta)\,\alpha(\eta)$ with $\alpha(\eta)=|\mathbf{b}(\eta)\cdot\mathbf{n}(\eta)|\in[0,1]$. Given a predicted along-field deposition density $q_{\parallel}\ge 0$ (coming from an FLTO mapping or from post-processed $q_{\perp}$ divided by a nominal incidence), plate shaping acts by changing $\mathbf{n}$ and thus changing $\alpha$. To remain auditable, we separate: 1. a “transport prediction” producing a nonnegative scalar field $q_{\parallel}(\eta)$, and 2. a purely geometric optimization choosing a normal field $\mathbf{n}(\eta)$ in an admissible set. VIII.A.2. A convex relaxation via local normal cones Let $\mathcal{N}(\eta)\subset\mathbb{S}^2$ be a declared admissible set of normals at $\eta$ encoding manufacturing tolerances and plate-shape constraints (e.g. a spherical cap around a baseline normal $\mathbf{n}_0(\eta)$). Define a worst-case incidence factor \[ \alpha^{\max}(\eta) := \sup_{\mathbf{n}\in\mathcal{N}(\eta)} |\mathbf{b}(\eta)\cdot\mathbf{n}|. \] Then the worst-case heat flux is bounded by \[ q_{\perp}(\eta) \le q_{\parallel}(\eta)\,\alpha^{\max}(\eta). \] This is an auditable one-sided certificate: it makes no claim that a specific shape can attain $\alpha^{\max}$, only that any admissible shape cannot exceed it. If $\mathcal{N}(\eta)$ is described by convex constraints in $\mathbb{R}^3$ before normalization (e.g. $\mathbf{n}$ in a convex cone with $\|\mathbf{n}\|\le 1$), then computing $\alpha^{\max}(\eta)$ can be formulated as a small second-order cone program (SOCP) at each $\eta$. For instance, with a cone constraint $\mathbf{n}\cdot\mathbf{n}_0\ge \cos\delta\,\|\mathbf{n}\|$ and $\|\mathbf{n}\|\le 1$, one has \[ \alpha^{\max}(\eta)=\max\{\mathbf{b}\cdot\mathbf{n},-\mathbf{b}\cdot\mathbf{n}\}\quad\text{s.t. the cone constraints on }\mathbf{n}, \] which is convex. VIII.A.3. Falsification hooks A geometry-only certificate should be falsified by metrology plus controlled tilt/shim tests: measure $\mathbf{n}$ changes, recompute $\alpha$, and compare the predicted decrease in patchwise heat load with measured IR thermography changes under the same magnetic configuration. Any mismatch is attributable to (i) wrong $q_{\parallel}$ prediction, (ii) wrong normal/tolerance model, or (iii) unmodeled physics (e.g. sheath effects). The operator separation makes these failure modes distinguishable. VIII.B. Thermo-elastic-field coupled fixed-point certification VIII.B.1. Fixed-point formulation Let $\mathcal{G}$ denote a geometric update operator mapping a displacement field $u$ (thermo-elastic deformation) to a modified surface $\Sigma(u)$ and corresponding normals $\mathbf{n}(u)$. Let $\mathcal{H}$ denote the heat-load operator mapping geometry to heat flux, encompassing incidence and any geometry-dependent kernel quantities (e.g. distances $d_t$): \[ q(u) = \mathcal{H}(u). \] Let $\mathcal{E}$ denote a (linearized) thermo-elastic map from heat flux to displacement $u$: \[\nu = \mathcal{E}(q). \] The coupled steady update is the fixed-point problem \[ u = \mathcal{F}(u) := \mathcal{E}(\mathcal{H}(u)). \] VIII.B.2. A contractive sufficient condition Theorem 8.1 (A sufficient contraction condition). Let $(X,\|\cdot\|)$ be a Banach space of displacement fields on $\Sigma$. Suppose: 1. $\mathcal{E}:L^\infty(\Sigma)\to X$ is bounded linear with $\|\mathcal{E}\|<\infty$, 2. $\mathcal{H}:X\to L^\infty(\Sigma)$ is Lipschitz on a closed ball $\overline B_R\subset X$ with constant $L_H$, 3. $\|\mathcal{E}\|\,L_H<1$, and $\mathcal{F}(\overline B_R)\subseteq\overline B_R$. Then $\mathcal{F}$ has a unique fixed point in $\overline B_R$, and the Picard iteration $u^{(k+1)}=\mathcal{F}(u^{(k)})$ converges to it for any initial $u^{(0)}\in\overline B_R$. Proof. Standard Banach fixed-point theorem. $\square$ Audit interpretation. The condition $\|\mathcal{E}\|\,L_H<1$ is a declared “small-coupling” regime. A code claiming fixed-point certification must (i) state norms, (ii) estimate or bound $\|\mathcal{E}\|$ and $L_H$, and (iii) report an a posteriori contraction diagnostic (e.g. ratio $\|u^{(k+1)}-u^{(k)}\|/\|u^{(k)}-u^{(k-1)}\|$). If the diagnostic fails, the run is inconclusive rather than “certified.” VIII.B.3. Falsification Thermo-elastic feedback is falsified by high-heat-flux mockups with in-situ deformation metrology: compare measured deformation, recomputed normals, and predicted change in incidence-driven hot spots against observations. The fixed-point model is rejected if it cannot predict the direction and magnitude of $\Delta q$ under controlled loading. VIII.C. Certified thermo-mechanical operating windows under stochastic edge transport (interface) Given a random heat-flux field $q$ (Section VI.D), a thermo-mechanical feasibility constraint typically has the form \[ \mathbb{P}(g(q)\le 0)\ge 1-\beta, \] where $g$ encodes a limit state (e.g. max temperature, stress, fatigue damage) and $\beta$ is a declared risk. This paper does not derive device-specific limit-state maps; however, it specifies an auditable one-sided interface: 1. Provide a conservative deterministic bound $q^{hi}(\eta)$ such that $\mathbb{P}(q\le q^{hi}\ \text{pointwise})\ge 1-\beta$ (or a patchwise analog), and 2. Use a monotone engineering map $g$ so that $q\le q^{hi}\Rightarrow g(q)\le g(q^{hi})$. Then $g(q^{hi})\le 0$ is a sufficient feasibility certificate at risk level $\beta$, with explicit conservatism. Producing $q^{hi}$ is an upstream task (operator norm screens, union bounds, or externally validated random-field extrema bounds). IX. Materials Lifetime, Erosion--Redeposition, and Long-Pulse Constraints This section defines a mass- and energy-bookkeeping analog of the FLTO for erosion and redeposition. The aim is a composable positive-operator layer with explicit conservation falsifiers and truncation diagnostics; no material-physics yield law is asserted as valid. IX.A. ERTO / ER-FLTO: conservative erosion--redeposition operator IX.A.1. Erosion source as a positive map of heat flux (model-form) Let $q_{\perp}\ge 0$ be a heat-flux density on $\Sigma$. An erosion model is any map producing a nonnegative surface source density $e\ge 0$ (e.g. sputtered atom flux) on $\Sigma$: \[ e(\eta) = \mathsf{E}(q_{\perp}(\eta);\vartheta_E),\qquad \mathsf{E}(\cdot;\vartheta_E)\ge 0. \] For composability, we consider the linearized or piecewise-linear regime where $\mathsf{E}$ is approximated by a positive linear operator $\mathcal{E}_s$ (e.g. multiplication by a nonnegative coefficient field). This step is purely for optimization-facing linearity and must be audited against the underlying nonlinear model if used. IX.A.2. Redeposition as a positive kernel operator Let $e\in L^1(\Sigma)$, $e\ge 0$, denote an erosion source density. Define a redeposition operator \[ (\mathcal{R}e)(\eta) := \int_{\Sigma} K_{rd}(\eta,\eta')\,e(\eta')\,dA_t(\eta'),\qquad K_{rd}\ge 0. \] The column integral $\int_{\Sigma}K_{rd}(\eta,\eta')\,dA_t(\eta)$ is a deposition fraction from a source point $\eta'$. If the model declares that a fraction $\gamma(\eta')\in[0,1]$ of eroded material redeposits on modeled surfaces (the rest is “lost”), then the auditable normalization is \[ \int_{\Sigma}K_{rd}(\eta,\eta')\,dA_t(\eta)=\gamma(\eta')\quad\text{a.e. }\eta'. \] IX.A.3. ERTO composition and conservation falsifier Define the erosion--redeposition transport operator $\mathcal{T}_{er}:=\mathcal{R}\mathcal{E}_s$, mapping heat flux to redeposition density. By Proposition 3.4 (composition of positive operators), $\mathcal{T}_{er}$ is positive. Moreover, the total redeposited mass satisfies \[ \int_{\Sigma} (\mathcal{R}e)\,dA_t = \int_{\Sigma} \gamma(\eta')\,e(\eta')\,dA_t(\eta') \] whenever the column normalization holds. This identity is the mass-bookkeeping analog of Theorem 3.1 and should be reported as an audit scalar (redeposited fraction and lost fraction). IX.A.4. Truncation and discretization diagnostics Any practical redeposition kernel will be truncated (finite interaction radius, finite sampling). The audit quantity is the per-column defect \[ \delta(\eta') := \gamma(\eta') - \int_{\Sigma}K_{rd}(\eta,\eta')\,dA_t(\eta)\ge 0, \] which must be nonnegative if the kernel is truncated by dropping nonnegative contributions. A negative $\delta$ indicates inconsistent quadrature or a sign error. IX.B. Cooling and pumping-power trade as a certified geometric program (interface) We record a convex-optimization interface linking patchwise heat loads to coolant design variables. Because detailed thermo-hydraulics is not derived here, we treat the design relations as declared monomial/posynomial surrogates that must be validated externally. IX.B.1. Patchwise certified inputs Assume the heat-load pipeline produces auditable per-patch bounds $Q_k^{hi}$ (W) or $\bar q_k^{hi}$ (W/m$^2$) for patches $\Sigma_k$ (Section III.C.3 and Section V). These are the only inputs used by the cooling-design layer. IX.B.2. GP template Let decision variables include channel hydraulic diameter $d$, flow rate $\dot m$, and number of parallel channels $n_c$. Suppose the engineering surrogate constraints can be written as posynomials, e.g. \[ T_{wall} \le T_{max},\qquad \Delta P \le \Delta P_{max},\qquad \text{and}\qquad hA\,\Delta T \ge Q_k^{hi}, \] with $h$ modeled by a monomial in $\dot m, d$ and $\Delta P$ modeled by a monomial/posynomial (Darcy--Weisbach type). Then minimizing pumping power $W_{pump}=\Delta P\,\dot V$ (or a posynomial proxy) is a geometric program after log transformation. The audit requirement is that every monomial coefficient and exponent be declared with units and provenance. X. Discrete Optimization Interfaces for Divertor Engineering and Coils This section specifies optimization-facing problem forms that preserve the operator semantics established earlier. Any claim of “global optimality” is conditional on the chosen surrogate being convex and on all constraints being auditable. X.A. Convex optimization templates using positive operators X.A.1. Peak-flux minimization via epigraph constraints Let $p_u\ge 0$ be fixed (or parameterized linearly), and let the predicted target heat flux be $q = K p_u$ in a discrete representation with $K\ge 0$. A basic peak-minimization template is \[ \min_{x,\,t}\ t\quad\text{s.t.}\quad (K(x)p_u)_j \le t\ \forall j, \] where $x$ are design variables that enter $K$ (e.g. through a precomputed library, linearization, or convex combination). To remain convex, one must ensure that the map $x\mapsto K(x)p_u$ is affine. A common swap-ready convex surrogate is a convex combination of precomputed operator instances: \[ K(x) = \sum_{\ell=1}^L x_\ell K^{(\ell)},\qquad x_\ell\ge 0,\ \sum_{\ell} x_\ell = 1. \] Then $q=\sum_{\ell} x_\ell (K^{(\ell)}p_u)$ is affine in $x$, and the peak constraint is linear. This formalizes “sweep planning” across a library of coil settings or strike configurations; its validity depends on whether convex mixing is physically meaningful for the application (often it is an operational-time average surrogate rather than a single equilibrium). X.A.2. Dual witnesses for irreducible hot spots For the linear program \[ \min_{x,t}\ t\quad\text{s.t.}\quad \sum_{\ell=1}^L x_\ell q^{(\ell)}_j \le t\ \forall j,\quad x\in\Delta_L, \] (where $q^{(\ell)}=K^{(\ell)}p_u$ and $\Delta_L$ is the simplex), any dual optimal solution assigns nonnegative multipliers to a subset of active target nodes. These multipliers constitute an explainable “hot-spot witness”: they identify which locations certify that no admissible mixture can reduce the maximum below $t^\star$. This is an optimization-facing analog of the operator-norm screening: instead of a global bound, it produces localized certificates. X.B. Mixed-integer PFC segmentation and remote-handling constraints (interface) We model segmentation as a graph partition problem on a mesh adjacency graph $G=(V,E)$ representing target tiles/cassettes. Let binary variables encode whether an edge is “cut” between segments. Constraints may enforce that each segment’s certified load satisfies a bound (e.g. $\max_{j\in\text{segment}} q^{hi}_j \le q_{allow}$) and that a remote-handling path exists (graph connectivity/path constraints). Because the specific MILP formulation depends on engineering choices (cost proxy, maintainability rules), we record only the audit principle: every constraint must be written in terms of auditable inputs from upstream operator layers (patchwise $q^{hi}$, certified pressure bounds, certified fatigue/lifetime surrogates), and any non-auditable nonlinear simulation output must be wrapped in explicit conservative relaxations before being used as a hard constraint. X.C. Core--edge constraint propagation (necessary-condition style) Let a systems-level model provide a feasible set of operating points $\mathcal{P}$ in terms of $P_{SOL}$ and a small number of edge control variables. The operator stack provides, for each point, a certified upper bound $q^{hi}(\eta)$ and derived feasibility checks (cooling, stress). A necessary-condition certificate takes the form: \[ \text{If }\exists\ \text{operating point feasible, then }\inf_{\text{controls}}\ \mathscr{C}(q^{hi})\le 0, \] where $\mathscr{C}$ encodes material limits. Such statements are only as strong as the conservatism in $q^{hi}$ and must be reported as “screening” rather than “proof of feasibility.” X.D. Dimensionless similarity laws and operating-window transfer (interface) To compare devices or transfer operating windows, one introduces dimensionless groups formed from upstream power, characteristic connection lengths, and target areas (e.g. $P_{SOL}/A_{target}$, nondimensionalized spreading times, etc.). This paper does not claim a correct similarity law for 3D stellarator divertors; rather, it requires that any proposed scaling be written as an explicit mapping \[ \Pi_{new} = \mathcal{S}(\Pi_{old};\ \text{declared parameters}), \] and that the map be falsified by comparing measured/validated heat-flux summaries (patchwise averages and maxima) at matched $\Pi$ across devices. XI. Verification, Falsification, Swap-Readiness, and Stated Gaps This section consolidates the audit checks implied throughout the paper into a minimal, implementation-facing verification plan. These are numerical falsifiers (they can fail); they are not physical validation. XI.A. Built-in numerical falsifiers and audits XI.A.1. Conservation audits 1. FLTO attached-limit audit (Section III.A): verify numerically that deposited power equals launched power minus declared losses, to within a reported discretization defect $\varepsilon_{cons}$. 2. Column normalization audit (Section III.B): for a kernel discretization $K\ge 0$, verify per-column sums $\sum_j K_{ji}A_j \approx A(\xi_i)$ using the same target areas $A_j$ used to compute powers. 3. Spreading conservation audit (Section V): verify $\mathbf{1}^T M T_t^h = \mathbf{1}^T M$ for the discrete semigroup. XI.A.2. Positivity and maximum-principle checks 1. Kernel nonnegativity: assert and test $K_{ji}\ge 0$ (report any violations). 2. Spreading positivity: report negative mass after spreading; if a discretization does not guarantee positivity, require either (i) a positivity-preserving time-stepping scheme, or (ii) an explicit conservative correction with reported correction magnitude. XI.A.3. Sensitivity/gradient audits When gradients are used (Section III.D), require at least one of: 1. finite-difference checks of directional derivatives for a random set of parameter directions and launch points, 2. consistency checks between tangent-linear and adjoint inner products, 3. explicit reporting of non-differentiable events (grazing incidence, topology changes) where gradients are not claimed. XI.B. Experimental comparison targets (test specifications) The following are stated as test specifications, not as established facts: 1. Symmetry tests: in a field-period symmetric configuration, verify that computed heat-flux maps satisfy symmetry to within declared numerical tolerance (Section V.C). 2. Trim-coil perturbation tests: compare measured strike displacement and patchwise powers against linear predictions (Section IV.D). 3. Neutral/pumping tests: compare measured plenum pressures and flow rates against PNO monotone bounds (Section VII.C). 4. HHF mockups: compare measured deformation and resulting heat-flux change against the coupled fixed-point update (Section VIII.B). 5. Erosion tests: compare net mass-loss/redeposition fractions against ERTO bookkeeping identities (Section IX.A). XI.C. Swap-ready interfaces A module is swap-ready if it can be replaced without changing upstream/downstream semantics. In this paper, swap-readiness means: 1. The FLTO is defined by $F$, attenuation $A$, and a declared conservative normalization; any field-line tracer that produces $F$ and $A$ can be substituted provided the conservation audit passes. 2. Spreading is any conservative positive operator on $\Sigma$ with declared boundary conditions; numerical methods can change as long as conservation/positivity audits pass. 3. OFLO/AMRP surrogates are defined by $(Q,R,r)$; higher-fidelity tracing refines these without changing downstream formulas. 4. Neutral and pumping blocks are defined by nonnegative kernels and M-matrix network solves; detailed gas models can replace them if they preserve auditable one-sided bounds. XI.D. Explicit gaps requiring external validation 1. Physics adequacy: the paper does not validate that any reduced detachment or radiation attenuation law is accurate in 3D stellarator geometry. 2. Missing physics: drift/kinetic effects, sheath physics, and plasma response to geometry changes are not included except through black-box attenuation or spreading parameters. 3. Extreme-value UQ: rigorous surface-maximum probability bounds for CAD meshes require verified regularity and metric-entropy inputs (Section VI.D.4). These gaps must be addressed by comparison to experiments and/or high-fidelity edge codes before the operator stack can support design claims beyond numerical screening. Conclusion This paper developed an operator-theoretic specification for producing 3D stellarator divertor heat-flux maps that is structurally auditable. The central construction is the Energy-Conserving Field-Line Transport Operator (FLTO), formulated first as a measure pushforward from an upstream launch surface to the target. This formulation yields an exact accounting identity: in the attached, no-volumetric-loss limit (full target hitting and attenuation equal to one), total deposited power equals total launched power; with an explicit attenuation field, the deposited power equals the launched power weighted by that attenuation. Because this identity is tautological at the measure level, any failure of its discrete analog is an immediate falsifier of tracing/weight/normalization bookkeeping. To support discretization and optimization, the FLTO was also expressed in kernel form as a positive integral operator whose defining constraint is a per-column normalization (the column integral over target area equals the declared attenuation). This makes positivity and conservation checks local (columnwise) and enables composition: composing a conservative post-processing operator (e.g., spreading) with the FLTO preserves the same scalar conservation identity, while additional lossy layers simply reduce the column integrals in an explicitly reportable way. Within this positive-operator setting, a certified peak-heat-flux screening bound was obtained via the $L^1\to L^\infty$ operator norm, providing a conservative hot-spot bound driven by total upstream power without requiring pointwise resolution of extrema. Because field-line pushforward can produce singular deposition measures, conservative regularization was treated as a first-class operator layer. Replacing ad hoc chart-based Gaussian smoothing, we specified cross-field spreading using Neumann heat semigroups generated by (possibly anisotropic) Laplace--Beltrami-type operators on the actual CAD surface. At the continuous level these semigroups preserve total power and positivity, and at the discrete level they provide concrete conservation/positivity audits (e.g., $L\mathbf{1}=0$ for the stiffness matrix and explicit reporting of any negative mass if a discretization is not positivity preserving). Symmetry averaging under field-period actions was formulated as an additional linear operator commuting with symmetry-invariant transport layers, yielding a diagnostic decomposition into symmetry-respecting and symmetry-defect components. For fast, swap-ready footprint and connection-length surrogates, we introduced an Open Field-Line Transfer Operator (OFLO) as a killed Markov chain built from a Poincar\'e return map with absorbing target states. The fundamental matrix $N=(I-Q)^{-1}$ gives closed-form expressions for footprint distributions and connection-length moments, together with explicit audit identities (row sub-stochasticity, absorption probabilities, and whether absorption is certain). The same framework supports an absorbing Markov reward process (AMRP) interface and a computable exponential-moment tail bound for long connection lengths, provided the tilted matrix remains subcritical. Perturbation bounds for footprint changes were stated in resolvent form, clarifying that any claimed “spectral-gap robustness certificate” requires externally justified error bounds on the estimated transition matrices in the same norm. Additional physics-facing layers were deliberately treated as replaceable closures, but with mathematically explicit monotonicity and bookkeeping interfaces. Detachment and radiation effects were represented by per-flux-tube attenuation factors constrained to $[0,1]$, enabling one-sided certified bounds under interval uncertainty whenever the chosen parameterization is monotone in uncertain parameters. Neutral transport and pumping were treated analogously via positive operators and a pumping-network M-matrix model; in the latter case, the M-matrix condition yields immediate monotonicity and positivity properties and supports one-sided uncertainty enclosures. On the engineering side, we isolated geometry and multiphysics couplings that can otherwise create “false feasibility.” Incidence effects were handled as a multiplicative geometry layer with a convex worst-case normal cone bound, providing a one-sided hot-spot certificate under manufacturing tolerances. For thermo-elastic feedback, a fixed-point formulation was given and a standard contraction condition identified as a sufficient (auditable) regime for unique coupled solutions, together with a posteriori convergence diagnostics as required evidence. For lifetime and long-pulse constraints, an erosion--redeposition operator layer was specified as a positive kernel operator with explicit column-integral normalization representing redeposition fractions; truncation errors are exposed by per-column defects that must be nonnegative under nonnegative truncation. Finally, the paper translated these operator semantics into optimization-facing templates that preserve auditability: peak-flux minimization via epigraph constraints, convex combinations of precomputed operator instances as a swap-ready surrogate, dual certificates that localize irreducible hot spots, and interface-level MILP templates for segmentation/maintainability that require all hard constraints to be expressed in terms of upstream auditable bounds. The main limitation is explicit and systematic: the document proves structural properties of the operator stack (positivity, conservation identities in stated limits, and norm-based screening bounds), but it does not validate that any particular reduced SOL, detachment, radiation, neutral, or materials closure is physically adequate for 3D stellarator divertor conditions. Likewise, rigorous extreme-value uncertainty bounds for continuous CAD surfaces are only sketched as a pipeline because they require verified regularity and metric-entropy inputs not provided here. The next step is therefore not further algebraic elaboration, but a minimal falsification program aligned with the built-in audits: attached-limit conservation and column-normalization checks; symmetry-defect diagnostics in symmetric configurations; controlled trim-coil perturbations to test footprint sensitivity; pressure/flow tests to evaluate pumping-network monotone bounds; high-heat-flux mockups with metrology to test thermoelastic incidence feedback; and erosion/redeposition campaigns to check mass-bookkeeping identities. Within these stated boundaries, the contribution is a mathematically explicit, composable, and implementation-auditable operator specification for 3D heat-load mapping and its engineering couplings. It is intended to make design-loop predictions easier to verify, easier to falsify, and easier to replace module-by-module as higher-fidelity physics and experimental evidence become available. [HARD CODED END-OF-PAPER MARK -- ALL CONTENT SHOULD BE ABOVE THIS LINE] ================================================================================ MODEL CREDITS This autonomous solution attempt was generated with the Intrafere LLC AI Harness, MOTO, and the following model(s): - x-ai/grok-4.1-fast (114 API calls) - openai/gpt-5.2 (36 API calls) - moonshotai/kimi-k2.5 (12 API calls) Total AI Model API Calls: 162 ================================================================================

More Info