Q-Safe: Compiling Bounded-Loss Contracts for Risk-Controlled Policy Replacement

Adaptive imaging can fail before learning begins: a nonuniform schedule may have no equal-cost oracle advantage, its objective may not match the scientific query, or its proxy may not align with a downstream human endpoint. We organize these failures into a diagnose–then–replace protocol and present Q-Safe as a model-agnostic compiler for the remaining decision: whether a proposed action may replace an executable, budget-matched fallback. It compiles declared bounded losses into an auditable replacement contract and emits certificates for schedule headroom, calibration, and deployment risk; the proposal itself may come from a neural model or a fixed rule. An initial frozen binary-harm contract improves ConnectomeBench2 utility over ExtraTrees by 1.16 points (paired 95% CI: 0.81–1.51), although the gain is mouse-driven. We then freeze a severity-aware fallback-regret contract before opening four additional shards. All pass the 2% endpoint; pooled regret is 0.191%, and relative to the frozen incidence contract, coverage and utility rise by 13.99 and 3.30 points. Conversely, on 36 registered EMDiffuse regions from three tissues, an equal-cost tile oracle fails to beat uniform acquisition in all 18 tested conditions for one fixed preview-plus-complete-rescan schedule. The contribution is therefore an auditable replacement interface, not a claim of architectural superiority or universal benefit from learned scanning.