{"paper_id":"4cf26dba-4a3f-4df5-b871-8c1da36e065c","body_text":"The Escape Register: A Failure-Driven Safety Methodology for Multi-Agent Clinical AI Systems | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article The Escape Register: A Failure-Driven Safety Methodology for Multi-Agent Clinical AI Systems Nathan Siegel This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9374687/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Multi-agent clinical AI systems introduce failure modes absent in single-model architectures: correlated reasoning errors, stochastic classification of safety-critical signals, and evidence chain failures invisible to output-level evaluation. We present the escape register — a methodology for converting operationally discovered failures into permanent deterministic safety gates within a six-agent clinical pharmacy decision support pipeline. Over 81 executions across three validation blocks, the methodology produced 31 escape IDs, 21 closed gates, and zero safety regressions across three consecutive infrastructure changes. The adversarial review agent concurred with clinical reasoning on an actively toxic narrow therapeutic index case in 37.5% of executions (6 of 16), demonstrating that stochastic agents are unreliable safety classifiers. Post-hoc analysis revealed component-for-component mapping to ASTM F3269-21 — the first such mapping for clinical AI. No published framework combines per-execution failure tracking, deterministic gate conversion, and regression-validated closure in a single lifecycle. Biological sciences/Computational biology and bioinformatics Physical sciences/Engineering Physical sciences/Mathematics and computing Figures Figure 1 Figure 2 Figure 3 1. Introduction On February 9, 2026, a clinical pharmacist reviewed the output of a six-agent clinical pharmacy decision support pipeline processing a case involving an 85-year-old patient receiving trimethoprim-sulfamethoxazole for a urinary tract infection worsening despite three days of therapy. The patient's laboratory values were deteriorating — rising international normalized ratio, elevated potassium, declining renal function. Every agent in the pipeline anchored on pharmacokinetic explanations: drug-drug interactions, renal clearance impairment, enzyme inhibition. None considered that the infection itself might be progressing toward sepsis, despite clinical indicators consistent with treatment failure in an immunocompromised elderly patient with chronic kidney disease. The pharmacist's observation — that no agent had asked whether the antibiotic was actually working — exposed a failure class that no prompt modification could prevent: drug-centric anchor bias. The evidence retrieval agent had never generated a treatment adequacy query because the clinical reasoning agent had never formulated one. The adversarial reviewer had never challenged the pharmacokinetic framing because it was clinically plausible. The failure was invisible to every automated component and visible immediately to a clinician who looked at the patient rather than the drugs. This observation established the principle that would define the methodology: clinical AI safety failures are discovered operationally, not predicted theoretically, and each discovered failure must be converted into a permanent deterministic gate that prevents recurrence. Two weeks later, three independent executions of the same patient case expressed an identical temporal fact — laboratory data 76 days old — with different language: \"11 weeks,\" \"76 days,\" and \"approximately 11 weeks.\" The variance was clinically inconsequential for this particular fact. But it raised a question with architectural implications: if a language model cannot deterministically express a simple temporal fact, it cannot be trusted to deterministically classify drug interaction severity, flag dosing contraindications, or escalate safety-critical urgency signals. The response was not to make the language model more consistent — an impossible goal for stochastic systems. The response was to build deterministic code that verified safety-critical outputs independently of the language model that produced them. A temporal gate computed data staleness from timestamps using arithmetic. A narrow therapeutic index evaluation gate read drug levels and toxicity thresholds from structured patient data. A post-pipeline safety pattern validator checked that specific clinical requirements were satisfied in the final output, regardless of how the agents had reasoned. Once the infrastructure failures were gated — temporal computation deterministic, social history visible to all agents, conflict classification consistent — the adversarial agent's capacity was freed from relitigating known defects. On the next validation run, it identified intracranial hemorrhage risk in the anticoagulated patient with new neurological symptoms and fall history — a clinically critical finding that had been stochastically absent from prior runs. This observation became a permanent safety pattern (a deterministic check requiring ICH in the differential for any anticoagulated patient with neurological symptoms and fall indicators), and established a recurring pattern: each layer of infrastructure noise removed exposed the next layer of clinical signal beneath it. This architectural pivot produced the escape register methodology. An \"escape\" is a safety-relevant failure that passes through all existing safety checks undetected — clinical output that is incorrect, misleading, or dangerous in a way that no existing gate detected. Each escape is documented with structured root cause analysis, classified by failure type, and converted into a deterministic code gate that prevents recurrence. The register is cumulative: each new gate permanently expands the safety envelope, creating a monotonically increasing safety floor. The philosophical foundation emerged during the same design session. When the team proposed suppressing clinical analysis whenever patient data exceeded a staleness threshold, the pharmacist corrected the reasoning: some clinical actions depend on data currency (renal dosing adjustments require current creatinine), while others depend on pharmacological properties that exist independently of data age (drug-drug interactions are present regardless of when the last measurement was taken). Suppressing all clinical content under data uncertainty delays actions that are independently justified — making the system less safe, not more. The system's role is to work honestly with imperfect data: providing the pharmacist with what it knows, what it does not know, and where the uncertainty lies. This paper presents the escape register methodology and its validation across 81 pipeline executions. As of the data cutoff, the register contains 31 documented escape IDs — 21 closed, each producing one or more deterministic safety checks — 15 architectural principles derived from operational failure observations, and 10 tracked non-escape items. The methodology was validated across three consecutive infrastructure changes with zero safety regressions. No published clinical AI safety framework combines systematic per-execution failure mode tracking, conversion to deterministic safety gates, and regression-validated closure. Tiered oversight architectures such as TAO¹ implement hierarchical error detection but not gate conversion; evaluation-driven compliance pipelines implement deterministic pass/fail gates but at the deployment level rather than per-execution; and Gallifant et al.² provide a deployment field guide for clinical AI agents recommending systematic failure mode identification but as implementation guidance rather than a formal tracking-to-closure lifecycle. 2. Background 2.1 Multi-Agent Clinical AI Systems Multi-agent architectures address a fundamental limitation of single-model clinical AI: no single language model can simultaneously optimize for clinical reasoning depth, evidence retrieval breadth, regulatory compliance, and adversarial safety review. Distributing these functions across specialized agents enables each to operate within a focused context — but introduces failure modes that single-model systems do not exhibit. Ho et al.³ demonstrated that multi-agent architecture improves clinical knowledge recall but introduces new accuracy failure modes. Liu et al.⁴ found 89.9% of hallucinations filtered by in-agent safeguards, suggesting the primary value lies in safety filtering rather than accuracy improvement. Li et al.⁵ deployed six physician agents achieving 83% accuracy across 4,627 evaluated patients (CARE-AD) without deterministic safety gates. Yuan et al.⁶ confirmed vendor diversity improves robustness in multi-agent clinical diagnosis. None of these systems implements per-execution failure tracking with gate conversion. 2.2 Deterministic Safety Gates Wrapping stochastic agent behavior in deterministic safety constraints has received independent validation. Chitan⁷ demonstrated a five-component deterministic cascade (ILION) achieving F1 = 0.8515 with sub-millisecond latency (143 microseconds), outperforming probabilistic approaches including Lakera Guard and Llama Guard 3. This confirms deterministic gates as a generalizable pattern — one the escape register applies with domain-specific clinical knowledge. Existing safety frameworks operate at the model evaluation level (pre-deployment benchmarking), the monitoring level (aggregate metrics), or the conceptual level (proposed architectures without empirical validation). None implements per-execution failure tracking with gate conversion. 2.3 Evidence Chain Integrity Sivakumar et al.⁸ identified a 14% \"Accuracy Fallacy\" gap where clinical AI answers are correct but reasoning derives from parametric knowledge rather than retrieved evidence — the gap the present work’s three-boundary diagnostic framework measures. Alu and Oluwadare⁹ proposed an auditable RAG framework with data provenance tracking. Khoruzhaya et al.¹⁰ introduced the first reporting checklist explicitly requiring hallucination detection methods. Agweyu et al.¹¹ reported a 7.8% potentially harmful recommendation rate across 1,469 primary care encounters — the first large-scale safety data for deployed clinical AI without systematic safety mechanisms. 2.4 Convergent Safety Engineering The safety envelope was designed through software engineering principles without reference to aerospace standards. Post-hoc analysis revealed component-for-component mapping to ASTM F3269-21¹², the Standard Practice for Methods to Safely Bound Behavior of Aircraft Systems Containing Complex Functions Using Run-Time Assurance. Originally developed for unmanned aircraft systems, ASTM F3269 codifies an architectural pattern with demonstrated applicability to autonomous systems generally. This convergent design — where independent safety engineering for clinical AI arrived at patterns isomorphic to aerospace runtime assurance — follows a documented phenomenon in software engineering: recurring design problems yield convergent architectural solutions across independent practitioners, as the design patterns literature demonstrates¹³. The Simplex Architecture was independently applied to cardiac pacemaker safety¹⁴, and aerospace runtime assurance standards codified the same monitoring pattern¹⁵'¹⁶. No prior publication has mapped ASTM F3269 to clinical AI. 2.5 Regulatory Context The FDA's January 2026 Clinical Decision Support guidance¹⁷ clarified and expanded the non-device classification pathway for advisory systems, including new enforcement discretion for Criterion 3 single-recommendation scenarios. The March 11, 2026 FDA Town Hall¹⁸ addressed the application of Criterion 4 to language model-enabled clinical decision support, with discussion centering on the role of automation bias and the conditions under which such systems may satisfy the independent review requirement. The pipeline's output aligns with all five Criterion 4 transparency requirements: plain-language urgency logic, evidence citation, data source disclosure, training-knowledge identification, and data currency assessment. This alignment is an architectural observation; formal regulatory classification has not been sought. 2.6 Patient Safety Reporting: The Detection-to-Prevention Gap Traditional clinical safety reporting fails at scale. Voluntary incident reporting captures approximately 6% of adverse drug reactions (median underreporting rate 94% across 37 studies).¹⁹ Direct observation detects medication errors at approximately 300 times the rate of incident reports.²⁰ Wrong-patient electronic orders illustrate how system design can either expose or obscure errors.²¹ Near-miss detection in pharmacy requires automated surveillance: voluntary reporting alone captures a fraction of events detectable by systematic monitoring.²² The Global Trigger Tool reveals adverse events at rates ten times higher than traditional reporting.²³ Most starkly, of 2,883 medication administration errors in a pediatric multicentre study — including 144 associated with actual patient harm — none had an incident report.²⁴ Even when errors are detected, only 17% of root cause analysis recommendations are classified as strong; 48% are weak.²⁵ Incident reporting systems have fundamental structural limitations as safety tools.²⁶'²⁷ Fifteen years after To Err is Human, expert consensus identifies missing elements in the safety reporting infrastructure that voluntary systems have not resolved.²⁸ The gap is architectural: each step in the reporting chain depends on a human decision with an independent failure probability. The escape register replaces these human-dependent steps with instrumented alternatives: detection at pipeline boundaries rather than voluntary recognition, deterministic data flow traces rather than retrospective analysis, and permanent code gates rather than procedural recommendations. Three frameworks overlap with components of the escape register but do not combine them. TAO¹ implements tiered error detection with ~ 24% error absorption through automated escalation, but does not convert failures into deterministic gates. Evaluation-driven compliance pipelines implement deployment-level pass/fail gates but not per-execution tracking. Gallifant et al.² recommend systematic failure identification but as implementation guidance, not a formal tracking-to-closure lifecycle. Outside healthcare, ILION demonstrates deterministic pre-execution safety gates outperforming probabilistic approaches. RAG-X provides a diagnostic framework for retrieval failure. Gallifant et al.² provide a deployment field guide for clinical AI agents. These are adjacent but distinct: none combines per-execution tracking, deterministic gate conversion, and regression-validated closure in a single lifecycle. Adjacent work on deterministic constraints for LLM agents — including AgentSpec's formal specification framework and Veriprajna's clinical safety firewall — addresses behavioral bounds at the agent level but not the per-execution failure-to-gate lifecycle that defines the escape register. 3. Methods 3.1 System Architecture 3.1.1 Pipeline Overview The system is a six-agent clinical pharmacy decision support pipeline that wraps stochastic language model reasoning in a deterministic safety envelope. Designation Function Agent A Converts unstructured patient data into Fast Healthcare Interoperability Resources (FHIR) R4 bundles Agent B Retrieves and synthesizes clinical evidence from a curated knowledge base Agent C Generates clinical care plans grounded in retrieved evidence Agent D Audits clinical output against a multi-rule regulatory compliance framework Agent E Independently challenges clinical reasoning without access to the evidence base Agent F Generates structured context envelopes and synthesizes the pharmacist deliverable The pipeline processes patient case data through a normalization agent that produces FHIR R4 bundles for downstream consumption. Agents operate on language models selected from multiple provider platforms — a deliberate choice to prevent correlated failures across the reasoning chain. Agent E's intentional blindness is a deliberate architectural decision: operating without access to evidence packets forces adversarial challenges to be grounded in independent clinical reasoning rather than anchored to the same evidence base used by Agent C. This prevents the correlated agreement failure that ESC-023 (Section 4.2) demonstrated is the most dangerous failure mode in multi-agent safety classification. 3.1.2 Deterministic Safety Envelope The safety architecture separates deterministic gates from stochastic agents because prompt-based safety instructions — regardless of how carefully crafted — are suggestions to a stochastic system that may be followed in 95% of executions, creating an undetectable 5% failure rate. Deterministic gates check output and fail hard when safety requirements are not met. They do not depend on agent compliance. Phase 0 Temporal Evaluation. Computes data staleness from timestamps using arithmetic. This was the first escape (ESC-001): the clinical reasoning agent expressed identical temporal facts with different language across executions, demonstrating that temporal assessment must be deterministic because stochastic systems cannot guarantee consistent expression of even simple quantitative facts. NTI Drug Evaluation. For narrow therapeutic index drugs, structured drug safety maps define parameters, thresholds, and clinical implications. The gate reads serum drug levels, renal function, and concurrent medications from FHIR data and computes severity (NORMAL, ELEVATED, CRITICAL) deterministically. This gate exists because ESC-023 demonstrated that a stochastic adversarial agent classified an actively toxic patient as safe in 37.5% of executions — an unacceptable rate for a safety-critical signal. Traffic Light Classification. Synthesizes urgency from two independent inputs: the adversarial agent's disposition (stochastic) and the NTI gate's severity (deterministic). Four escalation rules enforce monotonic urgency: Rule A escalates on high automation bias, Rule B on circuit breaker activation, Rule C forces maximum urgency on NTI CRITICAL severity regardless of any agent's assessment, and Rule D enforces minimum YELLOW on NTI ELEVATED. Urgency can only increase, never decrease, because ESC-026 demonstrated that improving clinical reasoning quality can paradoxically reduce adversarial challenge effectiveness — making the stochastic safety signal least reliable precisely when the clinical stakes are highest. Citation Fidelity Gate. Compares every quoted substring in the clinical output against all evidence packets. Auto-corrects two formatting errors deterministically: mid-quote ellipsis (trimmed to last complete sentence) and paraphrased quotes with ≥ 70% word overlap (quotation marks removed). Logs wrong-attribution and fabricated-quote observations as non-blocking notes for the regulatory audit agent. The gate never triggers a revision cycle and never deletes clinical content (ESC-029; Supplementary Table 2). Post-Pipeline Safety Patterns. Deterministic validators checking the final output for safety-critical content. If a patient is on an anticoagulant with neurological symptoms and fall history, intracranial hemorrhage must appear in the differential. These patterns produce HARD_FAIL results that cannot be overridden because clinical safety requirements are binary — they are either satisfied or they are not. Content Preservation Gate. Detects draft shrinkage exceeding 50% between revision cycles. This gate exists because the regulatory audit can pressure the clinical reasoning agent to delete clinical content during compliance revisions — a failure mode where safety improves at the expense of completeness. Deterministic Evidence Injection. When the NTI gate identifies warfarin or digoxin, drug safety maps specify required evidence sources by exact filename. These are injected into the evidence pool regardless of stochastic retrieval results, ensuring the pharmacist receives FDA-labeled monitoring parameters even when semantic similarity search fails to retrieve them (ESC-002; Supplementary Data 1). Regulatory Lint Layer and Violation Router. Deterministic text transformations resolve formatting violations before the regulatory audit, reducing revision cycles (Principle 7: the second revision consumed ~ 1.9x the tokens of the first). A violation router classifies audit findings into deterministic routing decisions with backstop guards against parser failures (ESC-027) and format variance (ESC-030). A CDS compliance backstop catches the logical impossibility of PROCEED + NON-COMPLIANT, forcing revision regardless of router classification (ESC-025). Gate specifications in Supplementary Table 2. The pipeline's output aligns with FDA Criterion 4 transparency requirements¹⁷: the traffic light provides plain-language urgency logic, evidence citations provide data source disclosure, and training-knowledge tags identify claims derived from parametric knowledge rather than evidence. 3.1.3 Pipeline Topology Agents and deterministic gates execute as follows: A → Phase 0 temporal + NTI evaluation → B ↔ C (interleaved evidence retrieval and reasoning) → regulatory lint layer → D → violation routing → C (revision if needed, max 2) → E → traffic light rules → F → post-pipeline safety validation + citation fidelity gate. Safety-critical deterministic assertion (SCDA) patterns were additive across blocks — new patterns were introduced but no existing pattern was removed or relaxed, ensuring the safety floor monotonically increased. SCDA results persist to an immutable audit file alongside each pipeline execution, creating a permanent per-run safety validation record. 3.1.4 Execution Characteristics On the most complex validation case, the pipeline completed in 21–45 minutes depending on revision cycle count. All deterministic safety gates combined consumed less than 0.2% of total execution time. The deterministic safety envelope adds negligible computational overhead to the stochastic reasoning pipeline it wraps. 3.2 Escape Register Methodology 3.2.1 Overview Each escape follows a five-phase lifecycle: Detection. Escapes are discovered through five mechanisms: (a) runtime observation during validation, (b) architectural analysis identifying single points of failure, (c) diagnostic instruments revealing evidence loss, (d) adversarial agent challenges, and (e) improvement-induced exposure — where quality improvements at one layer reveal latent defects at adjacent layers. Classification. Each escape is classified by severity, scope, failure class, and affected pipeline boundary. Classification determines urgency and architectural scope. Root Cause Analysis. The data flow is traced from raw input through every agent and gate boundary, identifying the origination point and cascade path. Gate Deployment. A deterministic gate is designed, implemented, and validated. The gate must prevent the failure with zero false negatives on the triggering case and zero false positives on unaffected cases. Regression Validation. The gate is tested against the complete golden case suite. A gate that prevents one failure but introduces a regression is rejected and redesigned. 3.2.2 Methodological Discipline Not every proposed gate is accepted. The failure mode must exist in the production data environment, must not duplicate existing coverage, and must be well-enough characterized for deterministic gate design. During the validation period, one proposed escape was rejected as a test artifact, another deferred for ambiguous root cause, and a third consolidated with existing capability. This filter ensures the register is a curated collection of validated failure modes, not an unconstrained list of concerns. 3.2.3 Architectural Principles Fifteen principles derived from operational failure observations: # Principle Core Insight 1 Floors, Not Ceilings Deterministic patterns are verifiable requirements; prompt mandates are unverifiable suggestions 2 Conservative Defaults Gates default to unsafe-assumed when input data is missing 3 Horizontal Cascade Awareness A stochastic event at layer N changes input to every downstream layer 4 Signals, Not Verdicts Deterministic code emits assessments; clinical verdicts remain with the pharmacist 5 Escalate Only Urgency can increase but never decrease 6 Failure Surface Migration Each block suppresses the dominant failure class, exposing the next 7 Superlinear Revision Cost Second revision costs approximately twice the first 8 Compliance Ceiling Revisions fire on formatting, not clinical content 9 Virtuous Cascade Quality improvements at multiple layers produce reinforcing effects 10 Revision as Recovery Revision cycles are the pipeline's recovery mechanism 11 Architectural Independence Safety gates operate on a different data plane than reasoning layers 12 Interception Not Elimination Gates intercept failures at boundaries; they do not reduce the agent's raw error rate 13 Gates Get Gated The validation protocol that validates output also validates gate behavior 14 Parse the Grammar Not the Content Structural validators check format compliance, not clinical semantics 15 State Must Reflect Final Transformation Pipeline state captures post-transformation output, not pre-transformation drafts 3.3 Evidence Architecture The three-boundary diagnostic framework measures evidence chain integrity at each pipeline layer. The retrieval boundary measures whether relevant evidence entered the pipeline. The synthesis boundary measures whether the evidence synthesis agent preserved retrieved content. The reasoning boundary measures whether the clinical reasoning agent's conclusions follow from retrieved evidence rather than parametric training knowledge. Claims in the clinical output are classified as CITED (directly grounded in retrieved evidence) or HEURISTIC (clinically reasonable but derived from the model's parametric knowledge rather than the evidence corpus). This distinction enables measurement of evidence grounding rates that output-level hallucination detection cannot provide. 3.4 Validation Protocol Four synthetic patient cases serve as the regression suite, spanning NTI drug interactions, drug-drug interactions, NTI toxicity, and a low-complexity baseline for false positive detection. All test cases are synthetic. No real patient data was used. No IRB review was required. 3.5 Development Context The system was developed by a clinical pharmacist serving as domain expert, architectural decision-maker, and integration node, using an AI advisory team for code generation and architectural reasoning. The pharmacist's clinical expertise drove the safety architecture directly: the sepsis catch (Section 1) was a clinical observation no agent made, and the NTI gate's drug safety maps encode pharmacist knowledge about monitoring thresholds. The methodology is reproducible; the specific gate collection reflects domain expertise applied during construction. Large language models were used as development tools; they do not satisfy authorship criteria and are documented here per journal policy. 4. Results 4.1 Escape Register Summary Status Count Description CLOSED 21 Gate deployed, regression-validated across 4 golden cases OPEN 5 Root cause identified, gate design pending DEFERRED 3 Failure mode confirmed, awaiting infrastructure changes REJECTED/RENAMED 2 Test artifact ( 1 ), consolidated with planned capability ( 1 ) Total ESC-IDs 31 TRACKED (non- escape) 10 Monitored findings not meeting escape criteria The 21 closed escapes span eight failure categories: data integrity ( 3 ), safety pattern ( 3 ), NTI safety ( 2 ), classification ( 2 ), evidence quality ( 2 ), pipeline integrity ( 3 ), citation integrity ( 1 ), and other categories including parser integrity, horizontal cascade, and safety gate failures ( 5 ). 4.2 ESC-023: The Unreliable Adversarial Agent An 82-year-old patient with digoxin toxicity (serum level 2.1 ng/mL, therapeutic range 0.5–2.0), hypokalemia (K⁺ 3.1 mEq/L), hypomagnesemia (Mg 1.4 mg/dL), symptomatic bradycardia (HR 52), and visual disturbance received a YELLOW traffic light — routine review rather than urgent intervention. The YELLOW classification occurred because the adversarial agent concurred with the clinical reasoning, mapping to reduced urgency. The problem this exposed: a single stochastic agent controlled the urgency signal for a patient with unambiguous NTI drug toxicity. In 6 of 16 applicable executions (37.5%), Agent E concurred — meaning an actively poisoned patient would have received reduced-urgency routing more than one-third of the time. The gate response: a three-component deterministic architecture. Drug safety maps encode drug-specific monitoring parameters. An NTI evaluation gate computes severity from FHIR data using arithmetic. Traffic Light Rule C forces RED whenever severity is CRITICAL, regardless of any agent's assessment. Rule C implements Principle 5 (Escalate Only): a deterministic danger signal cannot be overridden by a stochastic safety signal. This solves the underlying problem because it removes the dependency on stochastic classification for the highest-stakes decisions. The gate reads structured patient data directly — it does not interpret, summarize, or reason. It computes. The clinical determination (what constitutes a critical drug level) is encoded once by a pharmacist. The arithmetic is executed identically on every run. ESC-023 was the first predicted escape — identified through architectural analysis before it manifested in a validation run. This established that gates can be built proactively from design analysis, not only reactively from observed failures. Emergent defense-in-depth. The escape register methodology produced overlapping safety coverage through independent escape closures. On one validation execution where Agent E concurred (CONCUR), its output parser also returned an unrecognized conflict subcategory. The subcategory canonicalization gate (ESC-024) — created to address a different failure mode (false DISSENT from parser errors) — defaults all unrecognized subcategories to RED. On this execution, two independently designed gates both forced RED for the same patient: Rule C (from ESC-023, NTI CRITICAL → RED) and the RED default for unrecognized subcategories (from ESC-024). Neither gate was designed with knowledge of the other; both were created to solve different problems discovered weeks apart. The overlap was emergent, not engineered (Supplementary Note 3, Section 10). 4.3 ESC-026: The Stochastic Safety Paradox After evidence quality improvements, the same toxicity case produced a second escape. The clinical reasoning was so comprehensive that the adversarial agent found nothing to challenge — producing CONCUR, which without Rule C would have mapped to GREEN for the most dangerous patient in the suite. We term this the stochastic safety paradox : improving clinical reasoning quality makes the adversarial agent less useful as a safety signal. The adversarial signal is least reliable precisely when clinical content quality is highest — reducing the agent's ability to find challenges, and lowering urgency classification precisely when the clinical stakes may be highest. Any multi-agent system that relies on inter-agent disagreement as a safety signal is vulnerable to this paradox. Rule D was added: NTI ELEVATED → minimum YELLOW, regardless of agent agreement. ESC-026 established Principle 6 (Failure Surface Migration): each validation block suppresses the dominant failure class, exposing the next. The system becomes safer not by eliminating failures but by migrating the failure surface to progressively less dangerous modes. 4.4 Citation Fidelity Zero fabricated quotes were detected by the citation fidelity gate across 117 citations verified in the four golden test cases during the validation period. The gate performed 24 auto-corrections at initial draft: 14 instances of mid-quote ellipsis trimmed to the last complete sentence, and 10 instances of paraphrased text (≥ 70% word overlap with evidence) converted from direct quotes to paraphrases by removing quotation marks. Additionally, 5 wrong-attribution observations were logged at initial draft — instances where quoted text was found in a different evidence packet than the one cited. These are synthesis-level reorganization artifacts (the clinical content is accurate; the source attribution reflects training-knowledge recognition rather than evidence packet assignment), not parametric hallucination. The gate auto-corrects formatting errors before the regulatory audit, preventing revision cycles; it logs attribution observations as non-blocking notes for pharmacist awareness. The gate's deployment revealed a failure in its own logic: a trailing ellipsis pattern was misidentified as a valid citation because a decimal point matched a sentence boundary heuristic. The failure was detected through golden case regression testing and corrected — demonstrating Principle 13 (Gates Get Gated): the validation protocol that validates pipeline output also validates gate behavior. 4.5 Shadow Traffic Light A parallel urgency computation using only deterministic signals (without the adversarial agent) was deployed alongside the production traffic light: Case Production Shadow Analysis PT-TEST-008 RED RED MATCH — deterministic gates sufficient for NTI case PT-TEST-009 RED YELLOW DIVERGE — adversarial agent identified data quality concerns PT-TEST-010 RED RED MATCH — Rule C forces RED on NTI CRITICAL PT-TEST-012 RED GREEN DIVERGE — without adversarial agent, stale-data patient gets GREEN The adversarial agent's primary value is on non-NTI cases with data quality issues — precisely the cases where deterministic gates alone are insufficient. PT-TEST-012 is the strongest finding: without the adversarial agent, a patient with 24-day stale laboratory data receives the lowest urgency classification. 4.6 Cross-Block Validation Architectural Independence. The NTI gate produced field-identical output across all applicable cases in all three blocks, despite two infrastructure changes to evidence and retrieval layers. The safety envelope operates on a fundamentally different data plane than the reasoning layers it wraps — confirming that deterministic safety guarantees survive evidence corpus changes, model updates, and retrieval redesigns. Failure Surface Migration. Block 1 suppressed off-target evidence contamination, exposing quote integrity errors amplified by richer evidence. Block 2 suppressed evidence gaps, exposing citation fidelity failures hidden by prior noise. Block 3 suppressed citation errors, exposing concordance and formatting issues. Each block made the system safer without safety regressions — the dominant failure class shifted from dangerous (incorrect evidence) to progressively less dangerous (formatting). Block Dominant Failure Class Suppressed From Prior Block 1 Off-target evidence contamination (baseline) 2 Evidence gaps / missing sources Off-target contamination 3 Citation fidelity / quote integrity (40.6% of 747 violations) Evidence gaps Revision Economics. The second revision consumed approximately twice the tokens of the first across all measured runs. The regulatory lint layer, by resolving formatting violations before the stochastic audit, eliminated revision cycles on the lowest-complexity test case entirely (2 → 0 revisions). Revision prevention is the highest-impact efficiency intervention because the cost curve is superlinear — each prevented revision saves more than the previous one. 4.7 Comparative Positioning Capability This Work TAO¹ DILIConsult³ Liu et al.⁴ ILION⁷ CARE- AD⁵ Deterministic safety gates 21 closed ESC-IDs None None None 5- component cascade None Failure tracking methodology 31 ESC- IDs, 15 principles Tiered error detection None None None None Per-execution tracking Yes — every run audited Per-interaction triage None None None None Gate conversion + closure Regression-validated None None None None None Citation verification Fidelity gate, 0 fabricated N/A None None N/A None Multi-model heterogeneity 3 + providers Single system Single model Multiple tested Single Single Adversarial review Intentionally blind agent Tiered oversight None N/A N/A None 5. Discussion The escape register methodology addresses a gap between pre-deployment benchmarking and post-deployment monitoring. Pre-deployment benchmarking cannot discover failure modes that emerge from specific patient data configurations — it tests against curated datasets, not the combinatorial complexity of real clinical encounters. Post-deployment monitoring detects failures after they affect patients. The escape register operates between these: treating each execution as a potential source of failure discovery and converting each discovery into permanent prevention before deployment. The safety envelope reshapes itself based on what falls through — each discovered escape permanently expands the boundary of what the system can detect and prevent. The mapping to ASTM F3269-21¹² was discovered post-hoc. The stochastic pipeline maps to the Complex Function. The deterministic gates map to the Safety Monitor. The traffic light maps to the Decision Module. The content preservation gate maps to the Recovery Function. A designed pharmacist touchpoint (Query Gate with anchor bias detection) extends beyond the standard's automated Input Manager by incorporating clinical judgment for semantic input validation — detecting wrong questions, not just malformed data. These touchpoints are designed with functional prototypes but not yet deployed. ASTM F3269 Component Pipeline Equivalent Mapping Complex Function Six-agent pipeline Exact Safety Monitor Deterministic gate ensemble Exact Decision Module Traffic light + violation router Exact Recovery Function Content preservation + revision cycle Exact Input Manager Pharmacist touchpoints (designed, Phase 5) Extension ASTM F3269-21 was originally developed for unmanned aircraft systems but with noted applicability to manned aircraft and autonomous systems generally¹². No prior publication has mapped ASTM F3269 to clinical AI. The convergent design follows a documented pattern: the Simplex Architecture was independently applied to a cardiac pacemaker¹⁴, and Fenn et al.¹⁶ describe active-monitor parallel design as an established architectural pattern for safety-critical aviation systems, directly connecting the ASTM F3269 standard to the Simplex Architecture lineage. This improvement-reveals-latency dynamic has practical implications beyond this single system. Each block confirmed that improving quality at one layer systematically exposes latent defects at adjacent layers previously masked by noise. Quality improvements should be expected to increase detected failure rates in the short term, and validation protocols should anticipate new failure classes after each infrastructure change. The escape register provides the mechanism for capturing these emergent failures before they reach clinical output. The escape register operationalizes what traditional incident reporting cannot achieve. Institutional medication safety reporting depends on five sequential human decisions — awareness, recognition, motivation to report, analysis quality, and organizational will to implement — each with an independent failure probability. The escape register replaces these with architectural mechanisms: instrumented detection at pipeline boundaries (not voluntary recognition), deterministic data flow traces (not retrospective chart review), and permanent code gates (not procedural recommendations that may or may not be implemented). The cumulative architecture ensures monotonic safety growth — each gate is additive, no gate is removed, and the system cannot become less safe over time. This is the computational operationalization of what Weick and Sutcliffe²⁹ described as \"preoccupation with failure\" in high-reliability organizations — except the preoccupation is encoded in code, not culture. The most dangerous errors in clinical AI are precisely those that appear clinically plausible; no traditional reporting system would have captured the drug-centric anchor bias in the sepsis case (Section 1) because no traditional measure would have classified the output as an error. The absence of a national surveillance infrastructure for AI-generated clinical advice represents a growing gap in the post-market safety framework. Current adverse event reporting systems — FDA FAERS for drugs, FDA MedWatch for devices, ISMP MERP for medication errors — were designed for pharmaceutical products and medical devices. No analogous system exists for adverse events arising from AI-generated medication information consumed by patients or clinicians. The escape register methodology demonstrates that systematic per-interaction failure tracking is feasible for clinical AI systems, produces measurable safety improvements, and generates structured safety data amenable to aggregation and analysis. As AI platforms increasingly generate medication-related advice, extending the pharmacovigilance model to the AI-clinician and AI-patient interfaces would address this gap — and the escape register's structured lifecycle (detection → classification → root cause → gate → regression validation) offers a candidate framework for what that reporting infrastructure could look like. The methodology has important limitations. The methodology has been validated in a single system with synthetic test cases representing four clinical archetypes. Generalizability to other domains, EHR systems, and patient populations has not been tested. The methodology's value proposition is transferability: any clinical AI team can implement an escape register with their own domain expertise. The specific gate collection reported here reflects pharmacy-specific clinical knowledge; analogous gates for radiology, pathology, or other domains would encode different clinical determinations using the same lifecycle. The NTI evaluation gate covers two drugs; extension requires additional drug safety map development. The methodology depends on domain expertise for failure classification — the pharmacist's clinical judgment determines which behaviors constitute safety-relevant deviations. The current work does not include inter-rater reliability assessment for escape classification. The escape register can only learn from detected failures. Undetected escapes remain invisible. The multi-layer detection architecture provides defense in depth, but the unknown-unknowns problem applies as it does to any safety monitoring system. All validation used synthetic data. Clinical deployment would require IRB approval, EHR integration, and real-world validation. Declarations Data Availability All patient test cases used in this study are synthetic and contain no real patient data. The escape register documentation, pipeline validation logs, and deterministic gate specifications are available from the corresponding author upon reasonable request. No datasets were deposited in a public repository because the validation data consists of synthetic patient scenarios generated for system testing. Code Availability The deterministic safety gate specifications and escape register schema are available from the corresponding author upon reasonable request. The full pipeline source code is not publicly available due to pending provisional patent applications. Core architectural patterns (FHIR normalization, deterministic gate interfaces, traffic light classification logic) are described in sufficient detail in Section 3 to enable independent reimplementation. Acknowledgments This study received no external funding. The author thanks Nicole Asal, PharmD (University of Rhode Island) for collaboration on related consumer AI safety research. The Author would also like to thank John Godar, PharmD for his advice on predictive systems thinking. Author Contributions N.S. conceived the escape register methodology, designed the pipeline architecture, performed all clinical judgment contributing to failure classification and gate design, conducted all validation, and wrote the manuscript. Competing Interests N.S. is the founder of Community Pharmacy AI Solutions, LLC. Twelve provisional patents related to the system architecture have been filed. References Kim, Y. et al. TAO: tiered agentic oversight for multi-agent clinical safety. Preprint at https://arxiv.org/abs/2506.12482 (2025). Gallifant, J. et al. A field guide to deploying AI agents in clinical practice. Preprint at https://arxiv.org/abs/2509.26153 (2025). Ho, A. Z. T. et al. DILIConsult: a multi-agent large language model framework for evaluating drug-induced liver injury in ICU settings. Pharmacotherapy 46 , e70131 (2026). Liu, Y. et al. Benchmarking large language model-based agent systems for clinical decision tasks. npj Digit. Med. 9 , https://doi.org/10.1038/s41746-026-02443-6 (2026). Li, R. et al. CARE-AD: a multi-agent large language model framework for Alzheimer's disease prediction using longitudinal clinical notes. npj Digit. Med. 8 , 541 (2025). Yuan, G. C., Zhang, X., Kim, S. E. & Rajpurkar, P. Do mixed-vendor multi-agent LLMs improve clinical diagnosis? in Proc. 1st Workshop on Linguistic Analysis for Health (HeaLing 2026) (European Association for Computational Linguistics, 2026). Chitan, F. A. Deterministic pre-execution safety gates for agentic AI systems. Preprint at https://arxiv.org/abs/2603.13247 (2026). Sivakumar, R. et al. RAG-X: systematic diagnosis of retrieval-augmented generation failures in clinical AI. Preprint at https://arxiv.org/abs/2603.03541 (2026). Alu, F. F. & Oluwadare, S. An auditable and source-verified framework for clinical AI decision support: integrating retrieval-augmented generation with data provenance. Front. Artif. Intell. 9 , 1737532 (2026). Khoruzhaya, A. N. et al. MEDAI-LLM-SUMM: a reporting checklist for medical text summarization studies using large language models. Front. Digit. Health 8 , 1761601 (2026). Agweyu, A. et al. Safety of a large language model-based clinical decision support system in African primary healthcare. Nat. Health 10.1038/s44360-026-00082-5 (2026). ASTM International. Standard practice for methods to safely bound behavior of aircraft systems containing complex functions using run-time assurance. ASTM F3269-21 (ASTM International, 2021). Gamma, E., Helm, R., Johnson, R. & Vlissides, J. Design Patterns: Elements of Reusable Object-Oriented Software (Addison-Wesley, 1994). Bak, S. et al. The system-level simplex architecture for improved real-time embedded system safety. in Proc. 15th IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS) 99–107 (IEEE, 2009). Sha, L. Using simplicity to control complexity. IEEE Softw. 18 , 20–28 (2001). Fenn, J., Nicholson, M., Pai, G. & Wilkinson, M. Architecting safer autonomous aviation systems. NASA Technical Reports Server 20220016762 (2023). US Food and Drug Administration. Clinical Decision Support Software: Guidance for Industry and Food and Drug Administration Staff (FDA, 2026). US Food and Drug Administration. Town Hall — Clinical Decision Support Software Final Guidance. https://www.fda.gov/medical-devices/medical-devices-news-and-events/town-hall-clinical-decision-support-software-final-guidance-03112026 (2026). Hazell, L. & Shakir, S. A. W. Under-reporting of adverse drug reactions: a systematic review. Drug Saf. 29 , 385–396 (2006). Flynn, E. A., Barker, K. N., Pepper, G. A., Bates, D. W. & Mikeal, R. L. Comparison of methods for detecting medication errors in 36 hospitals and skilled-nursing facilities. Am. J. Health-Syst. Pharm. 59 , 436–446 (2002). Adelman, J. S. et al. Understanding and preventing wrong-patient electronic orders: a randomized controlled trial. J. Am. Med. Inform. Assoc. 20 , 305–310 (2013). South, B. R. et al. Near-miss detection in pharmacy: comparison of voluntary reporting with automated surveillance using a natural language processing system. Hosp. Pharm. 50 , 118–124 (2015). https://doi.org/10.1310/hpj5002-118 Classen, D. C. et al. 'Global Trigger Tool' shows that adverse events in hospitals may be ten times greater than previously measured. Health Aff. 30 , 581–589 (2011). Westbrook, J. I. et al. Paediatric medication incident reporting: a multicentre comparison study of medication errors identified at audit, detected by staff and reported to an incident system. BMJ Qual. Saf. 33 , 624–633 (2024). Hibbert, P. D. et al. Are root cause analyses recommendations effective and sustainable? An observational study. Int. J. Qual. Health Care 30 , 124–131 (2018). Martin-Delgado, J. et al. Limitations of incident reporting as a tool for patient safety. Med. Princ. Pract. 29 , 524–531 (2020). https://doi.org/10.1159/000508677 Macrae, C. The problem with incident reporting. BMJ Qual. Saf. 25 , 71–75 (2016). Mitchell, I., Schuster, A., Smith, K., Pronovost, P. & Wu, A. Patient safety incident reporting: a qualitative study of thoughts and perceptions of experts 15 years after 'To Err is Human'. BMJ Qual. Saf. 25 , 92–99 (2016). Weick, K. E. & Sutcliffe, K. M. Managing the Unexpected: Assuring High Performance in an Age of Complexity (Jossey-Bass, 2001). Additional Declarations No competing interests reported. Supplementary Files NathanSigelSupplementaryMaterialEscapeRegistry.docx Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {\"props\":{\"pageProps\":{\"initialData\":{\"identity\":\"rs-9374687\",\"acceptedTermsAndConditions\":true,\"allowDirectSubmit\":true,\"archivedVersions\":[],\"articleType\":\"Article\",\"associatedPublications\":[],\"authors\":[{\"id\":621119035,\"identity\":\"7d4078c8-f7e5-4560-8da2-9504af1a24a1\",\"order_by\":0,\"name\":\"Nathan Siegel\",\"email\":\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABjUlEQVRIie2Rz2rCMBjAI0J68c814qZPMIgI7USnr5JQaC/FizB2ECkI9eLYbewg2yt4kh0jge7SUXar9FKReXLgsTsIS511lb3AYP1BQhLy+758+QBISfmbwJ85uDmcETFw4kKGAYCORjahECdWyKkCGCC/lD3UildJBXwr8VKRXDv4fAadgjR6C+hju3Jx78jBMuRdRXp9n4Z9Xi0UOeP58LKiFFkGgMZYlWq3joifc3qYztS67BsKJoT3GmNdXoxtXrOQRniOoHrjgWRFdqZClLcAgcjQEJ0xOvMNGQmFTpkGvbzJMxbK4UihUy+qC7srWNpZoAOrGz2kk6TiruFiZ/KOVXQOissixVNhWWQRoSQbUDOpeBr0RRbxJ8ZBYWSvrOTyuYVELUYWETuqRbtGRNN72FtD/8zW1aiW+URDdezRYfQwui59WK1OdfSy3G777Yrsq7NS2Gp2savBxabfvHq64/Ng0xpUsMvnx2+P2pQ7acQw7sMweZoxkzsgBcndIFYGICUlJeW/8wXDOaHl8L6PrwAAAABJRU5ErkJggg==\",\"orcid\":\"\",\"institution\":\"Community Pharmacy AI Solutions\",\"correspondingAuthor\":true,\"prefix\":\"\",\"firstName\":\"Nathan\",\"middleName\":\"\",\"lastName\":\"Siegel\",\"suffix\":\"\"}],\"badges\":[],\"createdAt\":\"2026-04-10 05:09:28\",\"currentVersionCode\":1,\"declarations\":\"\",\"doi\":\"10.21203/rs.3.rs-9374687/v1\",\"doiUrl\":\"https://doi.org/10.21203/rs.3.rs-9374687/v1\",\"draftVersion\":[],\"editorialEvents\":[],\"editorialNote\":\"\",\"failedWorkflow\":false,\"files\":[{\"id\":106961316,\"identity\":\"62e9caea-6e86-4056-b5b2-75b8ae53a190\",\"added_by\":\"auto\",\"created_at\":\"2026-04-15 09:24:59\",\"extension\":\"png\",\"order_by\":1,\"title\":\"Figure 1\",\"display\":\"\",\"copyAsset\":false,\"role\":\"figure\",\"size\":447872,\"visible\":true,\"origin\":\"\",\"legend\":\"\\u003cp\\u003eSee image above for figure legend.\\u003c/p\\u003e\",\"description\":\"\",\"filename\":\"Picture1.png\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-9374687/v1/2500097dc0e2b0227fded9fe.png\"},{\"id\":106876654,\"identity\":\"bdee2b66-b657-46e1-a9a1-854a43db16c3\",\"added_by\":\"auto\",\"created_at\":\"2026-04-14 10:37:13\",\"extension\":\"png\",\"order_by\":2,\"title\":\"Figure 2\",\"display\":\"\",\"copyAsset\":false,\"role\":\"figure\",\"size\":478411,\"visible\":true,\"origin\":\"\",\"legend\":\"\\u003cp\\u003eSee image above for figure legend.\\u003c/p\\u003e\",\"description\":\"\",\"filename\":\"Picture2.png\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-9374687/v1/b38ebe0430c42d4b57730bca.png\"},{\"id\":106876657,\"identity\":\"b9bffed0-7e22-45af-94ab-197109478ccf\",\"added_by\":\"auto\",\"created_at\":\"2026-04-14 10:37:13\",\"extension\":\"png\",\"order_by\":3,\"title\":\"Figure 3\",\"display\":\"\",\"copyAsset\":false,\"role\":\"figure\",\"size\":326419,\"visible\":true,\"origin\":\"\",\"legend\":\"\\u003cp\\u003eSee image above for figure legend.\\u003c/p\\u003e\",\"description\":\"\",\"filename\":\"Picture3.png\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-9374687/v1/9346b42d95dfb289a71a85c9.png\"},{\"id\":107276390,\"identity\":\"aa7bbd13-4d5a-43b8-b1aa-baddb0564203\",\"added_by\":\"auto\",\"created_at\":\"2026-04-19 23:39:08\",\"extension\":\"pdf\",\"order_by\":0,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"manuscript-pdf\",\"size\":1708970,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"manuscript.pdf\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-9374687/v1/2781d635-7bda-407a-b80b-7c0ed5aa14bc.pdf\"},{\"id\":106961454,\"identity\":\"833ca2e5-a775-40ed-827f-87a9f688fc55\",\"added_by\":\"auto\",\"created_at\":\"2026-04-15 09:25:38\",\"extension\":\"docx\",\"order_by\":0,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":125059,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"NathanSigelSupplementaryMaterialEscapeRegistry.docx\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-9374687/v1/70aab654416f8a10a78b9ee3.docx\"}],\"financialInterests\":\"No competing interests reported.\",\"formattedTitle\":\"The Escape Register: A Failure-Driven Safety Methodology for Multi-Agent Clinical AI Systems\",\"fulltext\":[{\"header\":\"1. Introduction\",\"content\":\"\\u003cp\\u003eOn February 9, 2026, a clinical pharmacist reviewed the output of a six-agent clinical pharmacy decision support pipeline processing a case involving an 85-year-old patient receiving trimethoprim-sulfamethoxazole for a urinary tract infection worsening despite three days of therapy. The patient\\u0026apos;s laboratory values were deteriorating \\u0026mdash; rising international normalized ratio, elevated potassium, declining renal function. Every agent in the pipeline anchored on pharmacokinetic explanations: drug-drug interactions, renal clearance impairment, enzyme inhibition. None considered that the infection itself might be progressing toward sepsis, despite clinical indicators consistent with treatment failure in an immunocompromised elderly patient with chronic kidney disease.\\u003c/p\\u003e\\n\\u003cp\\u003eThe pharmacist\\u0026apos;s observation \\u0026mdash; that no agent had asked whether the antibiotic was actually working \\u0026mdash; exposed a failure class that no prompt modification could prevent: drug-centric anchor bias. The evidence retrieval agent had never generated a treatment adequacy query because\\u0026nbsp;the\\u0026nbsp;clinical\\u0026nbsp;reasoning\\u0026nbsp;agent\\u0026nbsp;had\\u0026nbsp;never\\u0026nbsp;formulated\\u0026nbsp;one.\\u0026nbsp;The\\u0026nbsp;adversarial\\u0026nbsp;reviewer\\u0026nbsp;had never challenged the pharmacokinetic framing because it was clinically plausible. The failure was\\u0026nbsp;invisible\\u0026nbsp;to\\u0026nbsp;every\\u0026nbsp;automated\\u0026nbsp;component\\u0026nbsp;and\\u0026nbsp;visible\\u0026nbsp;immediately\\u0026nbsp;to\\u0026nbsp;a\\u0026nbsp;clinician\\u0026nbsp;who\\u0026nbsp;looked at the patient rather than the drugs.\\u003c/p\\u003e\\n\\u003cp\\u003eThis\\u0026nbsp;observation\\u0026nbsp;established\\u0026nbsp;the\\u0026nbsp;principle\\u0026nbsp;that\\u0026nbsp;would\\u0026nbsp;define\\u0026nbsp;the\\u0026nbsp;methodology:\\u0026nbsp;clinical\\u0026nbsp;AI\\u0026nbsp;safety failures are discovered operationally, not predicted theoretically, and each discovered failure must be converted into a permanent deterministic gate that prevents recurrence.\\u003c/p\\u003e\\n\\u003cp\\u003eTwo weeks later, three independent executions of the same patient case expressed an identical temporal fact \\u0026mdash; laboratory data 76 days old \\u0026mdash; with different language: \\u0026quot;11 weeks,\\u0026quot; \\u0026quot;76 days,\\u0026quot; and \\u0026quot;approximately 11 weeks.\\u0026quot; The variance was clinically inconsequential for this particular fact. But it raised a question with architectural implications: if a language model cannot deterministically express a simple temporal fact, it cannot be trusted to deterministically classify drug interaction severity, flag dosing contraindications, or escalate safety-critical urgency signals.\\u003c/p\\u003e\\n\\u003cp\\u003eThe\\u0026nbsp;response\\u0026nbsp;was\\u0026nbsp;not\\u0026nbsp;to\\u0026nbsp;make\\u0026nbsp;the\\u0026nbsp;language\\u0026nbsp;model\\u0026nbsp;more\\u0026nbsp;consistent\\u0026nbsp;\\u0026mdash;\\u0026nbsp;an\\u0026nbsp;impossible\\u0026nbsp;goal\\u0026nbsp;for stochastic systems. The response was to build deterministic code that verified safety-critical outputs independently of the language model that produced them.\\u0026nbsp;A\\u0026nbsp;temporal gate computed data staleness from timestamps using arithmetic.\\u0026nbsp;A\\u0026nbsp;narrow therapeutic index evaluation gate read drug levels and toxicity thresholds from structured patient data.\\u0026nbsp;A\\u0026nbsp;post-pipeline safety pattern validator checked that specific clinical requirements were satisfied in the final output, regardless of how the agents had reasoned.\\u003c/p\\u003e\\n\\u003cp\\u003eOnce the infrastructure failures were gated \\u0026mdash; temporal computation deterministic, social history visible to all agents, conflict classification consistent \\u0026mdash; the adversarial agent\\u0026apos;s capacity was freed from relitigating known defects. On the next validation run, it identified intracranial hemorrhage risk in the anticoagulated patient with new neurological symptoms and fall history \\u0026mdash; a clinically critical finding that had been stochastically absent from prior runs. This observation became a permanent safety pattern (a deterministic check requiring ICH in the differential for any anticoagulated patient with neurological symptoms and fall indicators), and established a recurring pattern: each layer of infrastructure noise removed exposed the next layer of clinical signal beneath it.\\u003c/p\\u003e\\n\\u003cp\\u003eThis architectural pivot produced the escape register methodology.\\u0026nbsp;An \\u0026quot;escape\\u0026quot; is a safety-relevant failure that passes through all existing safety checks undetected \\u0026mdash; clinical output that is incorrect, misleading, or dangerous in a way that no existing gate detected. Each escape is documented\\u0026nbsp;with\\u0026nbsp;structured\\u0026nbsp;root\\u0026nbsp;cause\\u0026nbsp;analysis,\\u0026nbsp;classified\\u0026nbsp;by\\u0026nbsp;failure\\u0026nbsp;type,\\u0026nbsp;and\\u0026nbsp;converted\\u0026nbsp;into\\u0026nbsp;a deterministic code gate that prevents recurrence. The register is cumulative: each new gate permanently expands the safety envelope, creating a monotonically increasing safety floor.\\u003c/p\\u003e\\n\\u003cp\\u003eThe philosophical foundation emerged during the same design session. When the team proposed suppressing clinical analysis whenever patient data exceeded a staleness threshold, the pharmacist corrected the reasoning: some clinical actions depend on data currency (renal dosing adjustments require current creatinine), while others depend on pharmacological properties\\u0026nbsp;that\\u0026nbsp;exist\\u0026nbsp;independently\\u0026nbsp;of\\u0026nbsp;data\\u0026nbsp;age\\u0026nbsp;(drug-drug\\u0026nbsp;interactions\\u0026nbsp;are\\u0026nbsp;present\\u0026nbsp;regardless\\u0026nbsp;of when the last measurement was taken). Suppressing all clinical content under data uncertainty delays actions that are independently justified \\u0026mdash; making the system less safe, not more. The system\\u0026apos;s role is to work honestly with imperfect data: providing the pharmacist with what it knows, what it does not know, and where the uncertainty lies.\\u003c/p\\u003e\\n\\u003cp\\u003eThis paper presents the escape register methodology and its validation across 81 pipeline executions.\\u0026nbsp;As\\u0026nbsp;of\\u0026nbsp;the\\u0026nbsp;data\\u0026nbsp;cutoff,\\u0026nbsp;the\\u0026nbsp;register\\u0026nbsp;contains\\u0026nbsp;31\\u0026nbsp;documented\\u0026nbsp;escape\\u0026nbsp;IDs\\u0026nbsp;\\u0026mdash;\\u0026nbsp;21\\u0026nbsp;closed, each producing one or more deterministic safety checks \\u0026mdash; 15 architectural principles derived from operational failure observations, and 10 tracked non-escape items. The methodology was validated across three consecutive infrastructure changes with zero safety regressions.\\u003c/p\\u003e\\n\\u003cp\\u003eNo published clinical AI safety framework combines systematic per-execution failure mode tracking, conversion to deterministic safety gates, and regression-validated closure. Tiered oversight architectures such as TAO\\u0026sup1; implement hierarchical error detection but not gate conversion; evaluation-driven compliance pipelines implement deterministic pass/fail gates but at the deployment level rather than per-execution; and Gallifant et al.\\u0026sup2; provide a deployment field guide for clinical AI agents recommending systematic failure mode identification but as implementation guidance rather than a formal tracking-to-closure lifecycle.\\u003c/p\\u003e\"},{\"header\":\"2. Background\",\"content\":\"\\u003cdiv id=\\\"Sec2\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e2.1 Multi-Agent Clinical AI Systems\\u003c/h2\\u003e \\u003cp\\u003eMulti-agent architectures address a fundamental limitation of single-model clinical AI: no single language model can simultaneously optimize for clinical reasoning depth, evidence retrieval breadth, regulatory compliance, and adversarial safety review. Distributing these functions across specialized agents enables each to operate within a focused context \\u0026mdash; but introduces failure modes that single-model systems do not exhibit.\\u003c/p\\u003e \\u003cp\\u003eHo et al.\\u0026sup3; demonstrated that multi-agent architecture improves clinical knowledge recall but introduces new accuracy failure modes. Liu et al.⁴ found 89.9% of hallucinations filtered by in-agent safeguards, suggesting the primary value lies in safety filtering rather than accuracy improvement. Li et al.⁵ deployed six physician agents achieving 83% accuracy across 4,627 evaluated patients (CARE-AD) without deterministic safety gates. Yuan et al.⁶ confirmed vendor diversity improves robustness in multi-agent clinical diagnosis. None of these systems implements per-execution failure tracking with gate conversion.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec3\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e2.2 Deterministic Safety Gates\\u003c/h2\\u003e \\u003cp\\u003eWrapping stochastic agent behavior in deterministic safety constraints has received independent validation. Chitan⁷ demonstrated a five-component deterministic cascade (ILION) achieving F1\\u0026thinsp;=\\u0026thinsp;0.8515 with sub-millisecond latency (143 microseconds), outperforming probabilistic approaches including Lakera Guard and Llama Guard 3. This confirms deterministic gates as a generalizable pattern \\u0026mdash; one the escape register applies with domain-specific clinical knowledge.\\u003c/p\\u003e \\u003cp\\u003eExisting safety frameworks operate at the model evaluation level (pre-deployment benchmarking), the monitoring level (aggregate metrics), or the conceptual level (proposed architectures without empirical validation). None implements per-execution failure tracking with gate conversion.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec4\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e2.3 Evidence Chain Integrity\\u003c/h2\\u003e \\u003cp\\u003eSivakumar et al.⁸ identified a 14% \\\"Accuracy Fallacy\\\" gap where clinical AI answers are correct but reasoning derives from parametric knowledge rather than retrieved evidence \\u0026mdash; the gap the present work\\u0026rsquo;s three-boundary diagnostic framework measures. Alu and Oluwadare⁹ proposed an auditable RAG framework with data provenance tracking. Khoruzhaya et al.\\u0026sup1;⁰ introduced the first reporting checklist explicitly requiring hallucination detection methods. Agweyu et al.\\u0026sup1;\\u0026sup1; reported a 7.8% potentially harmful recommendation rate across 1,469 primary care encounters \\u0026mdash; the first large-scale safety data for deployed clinical AI without systematic safety mechanisms.\\u003c/p\\u003e\\u003c/div\\u003e\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec5\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e2.4 Convergent Safety Engineering\\u003c/h2\\u003e \\u003cp\\u003eThe safety envelope was designed through software engineering principles without reference to aerospace standards. Post-hoc analysis revealed component-for-component mapping to ASTM F3269-21\\u0026sup1;\\u0026sup2;, the Standard Practice for Methods to Safely Bound Behavior of Aircraft Systems Containing Complex Functions Using Run-Time Assurance. Originally developed for unmanned aircraft systems, ASTM F3269 codifies an architectural pattern with demonstrated applicability to autonomous systems generally. This convergent design \\u0026mdash; where independent safety engineering for clinical AI arrived at patterns isomorphic to aerospace runtime assurance \\u0026mdash; follows a documented phenomenon in software engineering: recurring design problems yield convergent architectural solutions across independent practitioners, as the design patterns literature demonstrates\\u0026sup1;\\u0026sup3;. The Simplex Architecture was independently applied to cardiac pacemaker safety\\u0026sup1;⁴, and aerospace runtime assurance standards codified the same monitoring pattern\\u0026sup1;⁵'\\u0026sup1;⁶. No prior publication has mapped ASTM F3269 to clinical AI.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec6\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e2.5 Regulatory Context\\u003c/h2\\u003e \\u003cp\\u003eThe FDA's January 2026 Clinical Decision Support guidance\\u0026sup1;⁷ clarified and expanded the non-device classification pathway for advisory systems, including new enforcement discretion for Criterion 3 single-recommendation scenarios. The March 11, 2026 FDA Town Hall\\u0026sup1;⁸ addressed the application of Criterion 4 to language model-enabled clinical decision support, with discussion centering on the role of automation bias and the conditions under which such systems may satisfy the independent review requirement. The pipeline's output aligns with all five Criterion 4 transparency requirements: plain-language urgency logic, evidence citation, data source disclosure, training-knowledge identification, and data currency assessment. This alignment is an architectural observation; formal regulatory classification has not been sought.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec7\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e2.6 Patient Safety Reporting: The Detection-to-Prevention Gap\\u003c/h2\\u003e \\u003cp\\u003eTraditional clinical safety reporting fails at scale. Voluntary incident reporting captures approximately 6% of adverse drug reactions (median underreporting rate 94% across 37 studies).\\u0026sup1;⁹ Direct observation detects medication errors at approximately 300 times the rate of incident reports.\\u0026sup2;⁰ Wrong-patient electronic orders illustrate how system design can either expose or obscure errors.\\u0026sup2;\\u0026sup1; Near-miss detection in pharmacy requires automated surveillance: voluntary reporting alone captures a fraction of events detectable by systematic monitoring.\\u0026sup2;\\u0026sup2; The Global Trigger Tool reveals adverse events at rates ten times higher than traditional reporting.\\u0026sup2;\\u0026sup3; Most starkly, of 2,883 medication administration errors in a pediatric multicentre study \\u0026mdash; including 144 associated with actual patient harm \\u0026mdash; none had an incident report.\\u0026sup2;⁴ Even when errors are detected, only 17% of root cause analysis recommendations are classified as strong; 48% are weak.\\u0026sup2;⁵ Incident reporting systems have fundamental structural limitations as safety tools.\\u0026sup2;⁶'\\u0026sup2;⁷ Fifteen years after To Err is Human, expert consensus identifies missing elements in the safety reporting infrastructure that voluntary systems have not resolved.\\u0026sup2;⁸\\u003c/p\\u003e \\u003cp\\u003eThe gap is architectural: each step in the reporting chain depends on a human decision with an independent failure probability. The escape register replaces these human-dependent steps with instrumented alternatives: detection at pipeline boundaries rather than voluntary recognition, deterministic data flow traces rather than retrospective analysis, and permanent code gates rather than procedural recommendations.\\u003c/p\\u003e \\u003cp\\u003eThree frameworks overlap with components of the escape register but do not combine them. TAO\\u0026sup1; implements tiered error detection with ~\\u0026thinsp;24% error absorption through automated escalation, but does not convert failures into deterministic gates. Evaluation-driven compliance pipelines implement deployment-level pass/fail gates but not per-execution tracking. Gallifant et al.\\u0026sup2; recommend systematic failure identification but as implementation guidance, not a formal tracking-to-closure lifecycle.\\u003c/p\\u003e \\u003cp\\u003eOutside healthcare, ILION demonstrates deterministic pre-execution safety gates outperforming probabilistic approaches. RAG-X provides a diagnostic framework for retrieval failure. Gallifant et al.\\u0026sup2; provide a deployment field guide for clinical AI agents. These are adjacent but distinct: none combines per-execution tracking, deterministic gate conversion, and regression-validated closure in a single lifecycle. Adjacent work on deterministic constraints for LLM agents \\u0026mdash; including AgentSpec's formal specification framework and Veriprajna's clinical safety firewall \\u0026mdash; addresses behavioral bounds at the agent level but not the per-execution failure-to-gate lifecycle that defines the escape register.\\u003c/p\\u003e \\u003cp\\u003e \\u003c/p\\u003e \\u003cp\\u003e \\u003c/p\\u003e \\u003c/div\\u003e\"},{\"header\":\"3. Methods\",\"content\":\"\\u003cdiv id=\\\"Sec9\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e3.1 System Architecture\\u003c/h2\\u003e \\u003cdiv id=\\\"Sec10\\\" class=\\\"Section3\\\"\\u003e \\u003ch2\\u003e3.1.1 Pipeline Overview\\u003c/h2\\u003e \\u003cp\\u003eThe system is a six-agent clinical pharmacy decision support pipeline that wraps stochastic language model reasoning in a deterministic safety envelope.\\u003c/p\\u003e \\u003cp\\u003e \\u003cdiv class=\\\"gridtable\\\"\\u003e\\u003ctable float=\\\"No\\\" id=\\\"Taba\\\" border=\\\"1\\\"\\u003e \\u003ccolgroup cols=\\\"2\\\"\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c1\\\" colnum=\\\"1\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c2\\\" colnum=\\\"2\\\"\\u003e\\u003c/div\\u003e \\u003cthead\\u003e \\u003ctr\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eDesignation\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eFunction\\u003c/p\\u003e \\u003c/th\\u003e \\u003c/tr\\u003e \\u003c/thead\\u003e \\u003ctbody\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eAgent A\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eConverts unstructured patient data into Fast Healthcare Interoperability Resources (FHIR) R4 bundles\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eAgent B\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eRetrieves and synthesizes clinical evidence from a curated knowledge base\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eAgent C\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eGenerates clinical care plans grounded in retrieved evidence\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eAgent D\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eAudits clinical output against a multi-rule regulatory compliance framework\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eAgent E\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eIndependently challenges clinical reasoning without access to the evidence base\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eAgent F\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eGenerates structured context envelopes and synthesizes the pharmacist deliverable\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003c/tbody\\u003e \\u003c/colgroup\\u003e \\u003c/table\\u003e\\u003c/div\\u003e \\u003c/p\\u003e \\u003cp\\u003eThe pipeline processes patient case data through a normalization agent that produces FHIR R4 bundles for downstream consumption. Agents operate on language models selected from multiple provider platforms \\u0026mdash; a deliberate choice to prevent correlated failures across the reasoning chain.\\u003c/p\\u003e \\u003cp\\u003eAgent E's intentional blindness is a deliberate architectural decision: operating without access to evidence packets forces adversarial challenges to be grounded in independent clinical reasoning rather than anchored to the same evidence base used by Agent C. This prevents the correlated agreement failure that ESC-023 (Section 4.2) demonstrated is the most dangerous failure mode in multi-agent safety classification.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec11\\\" class=\\\"Section3\\\"\\u003e \\u003ch2\\u003e3.1.2 Deterministic Safety Envelope\\u003c/h2\\u003e \\u003cp\\u003eThe safety architecture separates deterministic gates from stochastic agents because prompt-based safety instructions \\u0026mdash; regardless of how carefully crafted \\u0026mdash; are suggestions to a stochastic system that may be followed in 95% of executions, creating an undetectable 5% failure rate. Deterministic gates check output and fail hard when safety requirements are not met. They do not depend on agent compliance.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003ePhase 0 Temporal Evaluation.\\u003c/b\\u003e Computes data staleness from timestamps using arithmetic. This was the first escape (ESC-001): the clinical reasoning agent expressed identical temporal facts with different language across executions, demonstrating that temporal assessment must be deterministic because stochastic systems cannot guarantee consistent expression of even simple quantitative facts.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eNTI Drug Evaluation.\\u003c/b\\u003e For narrow therapeutic index drugs, structured drug safety maps define parameters, thresholds, and clinical implications. The gate reads serum drug levels, renal function, and concurrent medications from FHIR data and computes severity (NORMAL, ELEVATED, CRITICAL) deterministically. This gate exists because ESC-023 demonstrated that a stochastic adversarial agent classified an actively toxic patient as safe in 37.5% of executions \\u0026mdash; an unacceptable rate for a safety-critical signal.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eTraffic Light Classification.\\u003c/b\\u003e Synthesizes urgency from two independent inputs: the adversarial agent's disposition (stochastic) and the NTI gate's severity (deterministic). Four escalation rules enforce monotonic urgency: Rule A escalates on high automation bias, Rule B on circuit breaker activation, Rule C forces maximum urgency on NTI CRITICAL severity regardless of any agent's assessment, and Rule D enforces minimum YELLOW on NTI ELEVATED. Urgency can only increase, never decrease, because ESC-026 demonstrated that improving clinical reasoning quality can paradoxically reduce adversarial challenge effectiveness \\u0026mdash; making the stochastic safety signal least reliable precisely when the clinical stakes are highest.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eCitation Fidelity Gate.\\u003c/b\\u003e Compares every quoted substring in the clinical output against all evidence packets. Auto-corrects two formatting errors deterministically: mid-quote ellipsis (trimmed to last complete sentence) and paraphrased quotes with \\u0026ge;\\u0026thinsp;70% word overlap (quotation marks removed). Logs wrong-attribution and fabricated-quote observations as non-blocking notes for the regulatory audit agent. The gate never triggers a revision cycle and never deletes clinical content (ESC-029; Supplementary Table\\u0026nbsp;2).\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003ePost-Pipeline Safety Patterns.\\u003c/b\\u003e Deterministic validators checking the final output for safety-critical content. If a patient is on an anticoagulant with neurological symptoms and fall history, intracranial hemorrhage must appear in the differential. These patterns produce HARD_FAIL results that cannot be overridden because clinical safety requirements are binary \\u0026mdash; they are either satisfied or they are not.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eContent Preservation Gate.\\u003c/b\\u003e Detects draft shrinkage exceeding 50% between revision cycles. This gate exists because the regulatory audit can pressure the clinical reasoning agent to delete clinical content during compliance revisions \\u0026mdash; a failure mode where safety improves at the expense of completeness.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eDeterministic Evidence Injection.\\u003c/b\\u003e When the NTI gate identifies warfarin or digoxin, drug safety maps specify required evidence sources by exact filename. These are injected into the evidence pool regardless of stochastic retrieval results, ensuring the pharmacist receives FDA-labeled monitoring parameters even when semantic similarity search fails to retrieve them (ESC-002; Supplementary Data 1).\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eRegulatory Lint Layer and Violation Router.\\u003c/b\\u003e Deterministic text transformations resolve formatting violations before the regulatory audit, reducing revision cycles (Principle 7: the second revision consumed\\u0026thinsp;~\\u0026thinsp;1.9x the tokens of the first). A violation router classifies audit findings into deterministic routing decisions with backstop guards against parser failures (ESC-027) and format variance (ESC-030). A CDS compliance backstop catches the logical impossibility of PROCEED\\u0026thinsp;+\\u0026thinsp;NON-COMPLIANT, forcing revision regardless of router classification (ESC-025). Gate specifications in Supplementary Table\\u0026nbsp;2.\\u003c/p\\u003e \\u003cp\\u003eThe pipeline's output aligns with FDA Criterion 4 transparency requirements\\u0026sup1;⁷: the traffic light provides plain-language urgency logic, evidence citations provide data source disclosure, and training-knowledge tags identify claims derived from parametric knowledge rather than evidence.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec12\\\" class=\\\"Section3\\\"\\u003e \\u003ch2\\u003e3.1.3 Pipeline Topology\\u003c/h2\\u003e \\u003cp\\u003eAgents and deterministic gates execute as follows: A \\u0026rarr; Phase 0 temporal\\u0026thinsp;+\\u0026thinsp;NTI evaluation \\u0026rarr; B \\u0026harr; C (interleaved evidence retrieval and reasoning) \\u0026rarr; regulatory lint layer \\u0026rarr; D \\u0026rarr; violation routing \\u0026rarr; C (revision if needed, max 2) \\u0026rarr; E \\u0026rarr; traffic light rules \\u0026rarr; F \\u0026rarr; post-pipeline safety validation\\u0026thinsp;+\\u0026thinsp;citation fidelity gate.\\u003c/p\\u003e \\u003cp\\u003eSafety-critical deterministic assertion (SCDA) patterns were additive across blocks \\u0026mdash; new patterns were introduced but no existing pattern was removed or relaxed, ensuring the safety floor monotonically increased. SCDA results persist to an immutable audit file alongside each pipeline execution, creating a permanent per-run safety validation record.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec13\\\" class=\\\"Section3\\\"\\u003e \\u003ch2\\u003e3.1.4 Execution Characteristics\\u003c/h2\\u003e \\u003cp\\u003eOn the most complex validation case, the pipeline completed in 21\\u0026ndash;45 minutes depending on revision cycle count. All deterministic safety gates combined consumed less than 0.2% of total execution time. The deterministic safety envelope adds negligible computational overhead to the stochastic reasoning pipeline it wraps.\\u003c/p\\u003e \\u003c/div\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec14\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e3.2 Escape Register Methodology\\u003c/h2\\u003e \\u003cdiv id=\\\"Sec15\\\" class=\\\"Section3\\\"\\u003e \\u003ch2\\u003e3.2.1 Overview\\u003c/h2\\u003e \\u003cp\\u003eEach escape follows a five-phase lifecycle:\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eDetection.\\u003c/b\\u003e Escapes are discovered through five mechanisms: (a) runtime observation during validation, (b) architectural analysis identifying single points of failure, (c) diagnostic instruments revealing evidence loss, (d) adversarial agent challenges, and (e) improvement-induced exposure \\u0026mdash; where quality improvements at one layer reveal latent defects at adjacent layers.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eClassification.\\u003c/b\\u003e Each escape is classified by severity, scope, failure class, and affected pipeline boundary. Classification determines urgency and architectural scope.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eRoot Cause Analysis.\\u003c/b\\u003e The data flow is traced from raw input through every agent and gate boundary, identifying the origination point and cascade path.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eGate Deployment.\\u003c/b\\u003e A deterministic gate is designed, implemented, and validated. The gate must prevent the failure with zero false negatives on the triggering case and zero false positives on unaffected cases.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eRegression Validation.\\u003c/b\\u003e The gate is tested against the complete golden case suite. A gate that prevents one failure but introduces a regression is rejected and redesigned.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec16\\\" class=\\\"Section3\\\"\\u003e \\u003ch2\\u003e3.2.2 Methodological Discipline\\u003c/h2\\u003e \\u003cp\\u003eNot every proposed gate is accepted. The failure mode must exist in the production data environment, must not duplicate existing coverage, and must be well-enough characterized for deterministic gate design. During the validation period, one proposed escape was rejected as a test artifact, another deferred for ambiguous root cause, and a third consolidated with existing capability. This filter ensures the register is a curated collection of validated failure modes, not an unconstrained list of concerns.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec17\\\" class=\\\"Section3\\\"\\u003e \\u003ch2\\u003e3.2.3 Architectural Principles\\u003c/h2\\u003e \\u003cp\\u003eFifteen principles derived from operational failure observations:\\u003c/p\\u003e \\u003cp\\u003e \\u003cdiv class=\\\"gridtable\\\"\\u003e\\u003ctable float=\\\"No\\\" id=\\\"Tabb\\\" border=\\\"1\\\"\\u003e \\u003ccolgroup cols=\\\"3\\\"\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c1\\\" colnum=\\\"1\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c2\\\" colnum=\\\"2\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c3\\\" colnum=\\\"3\\\"\\u003e\\u003c/div\\u003e \\u003cthead\\u003e \\u003ctr\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e#\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003ePrinciple\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eCore Insight\\u003c/p\\u003e \\u003c/th\\u003e \\u003c/tr\\u003e \\u003c/thead\\u003e \\u003ctbody\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e1\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eFloors, Not Ceilings\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eDeterministic patterns are verifiable requirements; prompt mandates are unverifiable suggestions\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e2\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eConservative Defaults\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eGates default to unsafe-assumed when input data is missing\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e3\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eHorizontal Cascade Awareness\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eA stochastic event at layer N changes input to every downstream layer\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e4\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eSignals, Not Verdicts\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eDeterministic code emits assessments; clinical verdicts remain with the pharmacist\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e5\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eEscalate Only\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eUrgency can increase but never decrease\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e6\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eFailure Surface Migration\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eEach block suppresses the dominant failure class, exposing the next\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e7\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eSuperlinear Revision Cost\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eSecond revision costs approximately twice the first\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e8\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eCompliance Ceiling\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eRevisions fire on formatting, not clinical content\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e9\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eVirtuous Cascade\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eQuality improvements at multiple layers produce reinforcing effects\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e10\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eRevision as Recovery\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eRevision cycles are the pipeline's recovery mechanism\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e11\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eArchitectural Independence\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eSafety gates operate on a different data plane than reasoning layers\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e12\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eInterception Not Elimination\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eGates intercept failures at boundaries; they do not reduce the agent's raw error rate\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e13\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eGates Get Gated\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eThe validation protocol that validates output also validates gate behavior\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e14\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eParse the Grammar Not the Content\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eStructural validators check format compliance, not clinical semantics\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e15\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eState Must Reflect Final Transformation\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003ePipeline state captures post-transformation output, not pre-transformation drafts\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003c/tbody\\u003e \\u003c/colgroup\\u003e \\u003c/table\\u003e\\u003c/div\\u003e \\u003c/p\\u003e \\u003c/div\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec18\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e3.3 Evidence Architecture\\u003c/h2\\u003e \\u003cp\\u003eThe three-boundary diagnostic framework measures evidence chain integrity at each pipeline layer. The retrieval boundary measures whether relevant evidence entered the pipeline. The synthesis boundary measures whether the evidence synthesis agent preserved retrieved content. The reasoning boundary measures whether the clinical reasoning agent's conclusions follow from retrieved evidence rather than parametric training knowledge. Claims in the clinical output are classified as CITED (directly grounded in retrieved evidence) or HEURISTIC (clinically reasonable but derived from the model's parametric knowledge rather than the evidence corpus). This distinction enables measurement of evidence grounding rates that output-level hallucination detection cannot provide.\\u003c/p\\u003e\\u003c/div\\u003e\\u003cdiv id=\\\"Sec19\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e3.4 Validation Protocol\\u003c/h2\\u003e \\u003cp\\u003e \\u003cdiv class=\\\"BlockQuote\\\"\\u003e \\u003cp\\u003eFour synthetic patient cases serve as the regression suite, spanning NTI drug interactions, drug-drug interactions, NTI toxicity, and a low-complexity baseline for false positive detection. All test cases are synthetic. No real patient data was used. No IRB review was required.\\u003c/p\\u003e \\u003c/div\\u003e \\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec20\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e3.5 Development Context\\u003c/h2\\u003e \\u003cp\\u003e \\u003cdiv class=\\\"BlockQuote\\\"\\u003e \\u003cp\\u003eThe system was developed by a clinical pharmacist serving as domain expert, architectural decision-maker, and integration node, using an AI advisory team for code generation and architectural reasoning. The pharmacist's clinical expertise drove the safety architecture directly: the sepsis catch (Section 1) was a clinical observation no agent made, and the NTI gate's drug safety maps encode pharmacist knowledge about monitoring thresholds. The methodology is reproducible; the specific gate collection reflects domain expertise applied during construction. Large language models were used as development tools; they do not satisfy authorship criteria and are documented here per journal policy.\\u003c/p\\u003e \\u003c/div\\u003e \\u003c/p\\u003e\"},{\"header\":\"4. Results\",\"content\":\"\\u003cdiv id=\\\"Sec22\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e4.1 Escape Register Summary\\u003c/h2\\u003e \\u003cp\\u003e \\u003cdiv class=\\\"gridtable\\\"\\u003e\\u003ctable float=\\\"No\\\" id=\\\"Tabc\\\" border=\\\"1\\\"\\u003e \\u003ccolgroup cols=\\\"3\\\"\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c1\\\" colnum=\\\"1\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"char\\\" char=\\\".\\\" class=\\\"colspec\\\" colname=\\\"c2\\\" colnum=\\\"2\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c3\\\" colnum=\\\"3\\\"\\u003e\\u003c/div\\u003e \\u003cthead\\u003e \\u003ctr\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eStatus\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eCount\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eDescription\\u003c/p\\u003e \\u003c/th\\u003e \\u003c/tr\\u003e \\u003c/thead\\u003e \\u003ctbody\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eCLOSED\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"char\\\" char=\\\".\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003e21\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eGate deployed, regression-validated across 4 golden cases\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eOPEN\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"char\\\" char=\\\".\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003e5\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eRoot cause identified, gate design pending\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eDEFERRED\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"char\\\" char=\\\".\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003e3\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eFailure mode confirmed, awaiting infrastructure changes\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eREJECTED/RENAMED\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"char\\\" char=\\\".\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003e2\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eTest artifact (\\u003cspan citationid=\\\"CR1\\\" class=\\\"CitationRef\\\"\\u003e1\\u003c/span\\u003e), consolidated with planned capability (\\u003cspan citationid=\\\"CR1\\\" class=\\\"CitationRef\\\"\\u003e1\\u003c/span\\u003e)\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e\\u003cb\\u003eTotal ESC-IDs\\u003c/b\\u003e\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"char\\\" char=\\\".\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003e\\u003cb\\u003e31\\u003c/b\\u003e\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e\\u0026nbsp;\\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eTRACKED (non-\\u003c/p\\u003e \\u003cp\\u003eescape)\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"char\\\" char=\\\".\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003e10\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eMonitored findings not meeting escape criteria\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003c/tbody\\u003e \\u003c/colgroup\\u003e \\u003c/table\\u003e\\u003c/div\\u003e \\u003c/p\\u003e \\u003cp\\u003eThe 21 closed escapes span eight failure categories: data integrity (\\u003cspan citationid=\\\"CR3\\\" class=\\\"CitationRef\\\"\\u003e3\\u003c/span\\u003e), safety pattern (\\u003cspan citationid=\\\"CR3\\\" class=\\\"CitationRef\\\"\\u003e3\\u003c/span\\u003e), NTI safety (\\u003cspan citationid=\\\"CR2\\\" class=\\\"CitationRef\\\"\\u003e2\\u003c/span\\u003e), classification (\\u003cspan citationid=\\\"CR2\\\" class=\\\"CitationRef\\\"\\u003e2\\u003c/span\\u003e), evidence quality (\\u003cspan citationid=\\\"CR2\\\" class=\\\"CitationRef\\\"\\u003e2\\u003c/span\\u003e), pipeline integrity (\\u003cspan citationid=\\\"CR3\\\" class=\\\"CitationRef\\\"\\u003e3\\u003c/span\\u003e), citation integrity (\\u003cspan citationid=\\\"CR1\\\" class=\\\"CitationRef\\\"\\u003e1\\u003c/span\\u003e), and other categories including parser integrity, horizontal cascade, and safety gate failures (\\u003cspan citationid=\\\"CR5\\\" class=\\\"CitationRef\\\"\\u003e5\\u003c/span\\u003e).\\u003c/p\\u003e \\u003cdiv id=\\\"Sec23\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e4.2 ESC-023: The Unreliable Adversarial Agent\\u003c/h2\\u003e \\u003cp\\u003eAn 82-year-old patient with digoxin toxicity (serum level 2.1 ng/mL, therapeutic range 0.5\\u0026ndash;2.0), hypokalemia (K⁺ 3.1 mEq/L), hypomagnesemia (Mg 1.4 mg/dL), symptomatic bradycardia (HR 52), and visual disturbance received a YELLOW traffic light \\u0026mdash; routine review rather than urgent intervention. The YELLOW classification occurred because the adversarial agent concurred with the clinical reasoning, mapping to reduced urgency.\\u003c/p\\u003e \\u003cp\\u003eThe problem this exposed: a single stochastic agent controlled the urgency signal for a patient with unambiguous NTI drug toxicity. In 6 of 16 applicable executions (37.5%), Agent E concurred \\u0026mdash; meaning an actively poisoned patient would have received reduced-urgency routing more than one-third of the time.\\u003c/p\\u003e \\u003cp\\u003eThe gate response: a three-component deterministic architecture. Drug safety maps encode drug-specific monitoring parameters. An NTI evaluation gate computes severity from FHIR data using arithmetic. Traffic Light Rule C forces RED whenever severity is CRITICAL, regardless of any agent's assessment. Rule C implements Principle 5 (Escalate Only): a deterministic danger signal cannot be overridden by a stochastic safety signal.\\u003c/p\\u003e \\u003cp\\u003eThis solves the underlying problem because it removes the dependency on stochastic classification for the highest-stakes decisions. The gate reads structured patient data directly \\u0026mdash; it does not interpret, summarize, or reason. It computes. The clinical determination (what constitutes a critical drug level) is encoded once by a pharmacist. The arithmetic is executed identically on every run.\\u003c/p\\u003e \\u003cp\\u003eESC-023 was the first \\u003cem\\u003epredicted\\u003c/em\\u003e escape \\u0026mdash; identified through architectural analysis before it manifested in a validation run. This established that gates can be built proactively from design analysis, not only reactively from observed failures.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eEmergent defense-in-depth.\\u003c/b\\u003e The escape register methodology produced overlapping safety coverage through independent escape closures. On one validation execution where Agent E concurred (CONCUR), its output parser also returned an unrecognized conflict subcategory. The subcategory canonicalization gate (ESC-024) \\u0026mdash; created to address a different failure mode (false DISSENT from parser errors) \\u0026mdash; defaults all unrecognized subcategories to RED. On this execution, two independently designed gates both forced RED for the same patient: Rule C (from ESC-023, NTI CRITICAL \\u0026rarr; RED) and the RED default for unrecognized subcategories (from ESC-024). Neither gate was designed with knowledge of the other; both were created to solve different problems discovered weeks apart. The overlap was emergent, not engineered (Supplementary Note 3, Section 10).\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec24\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e4.3 ESC-026: The Stochastic Safety Paradox\\u003c/h2\\u003e \\u003cp\\u003eAfter evidence quality improvements, the same toxicity case produced a second escape. The clinical reasoning was so comprehensive that the adversarial agent found nothing to challenge \\u0026mdash; producing CONCUR, which without Rule C would have mapped to GREEN for the most dangerous patient in the suite.\\u003c/p\\u003e \\u003cp\\u003eWe term this the \\u003cb\\u003estochastic safety paradox\\u003c/b\\u003e: improving clinical reasoning quality makes the adversarial agent less useful as a safety signal. The adversarial signal is least reliable precisely when clinical content quality is highest \\u0026mdash; reducing the agent's ability to find challenges, and lowering urgency classification precisely when the clinical stakes may be highest. Any multi-agent system that relies on inter-agent disagreement as a safety signal is vulnerable to this paradox.\\u003c/p\\u003e \\u003cp\\u003eRule D was added: NTI ELEVATED \\u0026rarr; minimum YELLOW, regardless of agent agreement. ESC-026 established Principle 6 (Failure Surface Migration): each validation block suppresses the dominant failure class, exposing the next. The system becomes safer not by eliminating failures but by migrating the failure surface to progressively less dangerous modes.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec25\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e4.4 Citation Fidelity\\u003c/h2\\u003e \\u003cp\\u003eZero fabricated quotes were detected by the citation fidelity gate across 117 citations verified in the four golden test cases during the validation period. The gate performed 24 auto-corrections at initial draft: 14 instances of mid-quote ellipsis trimmed to the last complete sentence, and 10 instances of paraphrased text (\\u0026ge;\\u0026thinsp;70% word overlap with evidence) converted from direct quotes to paraphrases by removing quotation marks. Additionally, 5 wrong-attribution observations were logged at initial draft \\u0026mdash; instances where quoted text was found in a different evidence packet than the one cited. These are synthesis-level reorganization artifacts (the clinical content is accurate; the source attribution reflects training-knowledge recognition rather than evidence packet assignment), not parametric hallucination. The gate auto-corrects formatting errors before the regulatory audit, preventing revision cycles; it logs attribution observations as non-blocking notes for pharmacist awareness.\\u003c/p\\u003e \\u003cp\\u003eThe gate's deployment revealed a failure in its own logic: a trailing ellipsis pattern was misidentified as a valid citation because a decimal point matched a sentence boundary heuristic. The failure was detected through golden case regression testing and corrected \\u0026mdash; demonstrating Principle 13 (Gates Get Gated): the validation protocol that validates pipeline output also validates gate behavior.\\u003c/p\\u003e \\u003cp\\u003e \\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec26\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e4.5 Shadow Traffic Light\\u003c/h2\\u003e \\u003cp\\u003eA parallel urgency computation using only deterministic signals (without the adversarial agent) was deployed alongside the production traffic light:\\u003c/p\\u003e \\u003cp\\u003e \\u003cdiv class=\\\"gridtable\\\"\\u003e\\u003ctable float=\\\"No\\\" id=\\\"Tabd\\\" border=\\\"1\\\"\\u003e \\u003ccolgroup cols=\\\"4\\\"\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c1\\\" colnum=\\\"1\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c2\\\" colnum=\\\"2\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c3\\\" colnum=\\\"3\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c4\\\" colnum=\\\"4\\\"\\u003e\\u003c/div\\u003e \\u003cthead\\u003e \\u003ctr\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eCase\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eProduction\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eShadow\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eAnalysis\\u003c/p\\u003e \\u003c/th\\u003e \\u003c/tr\\u003e \\u003c/thead\\u003e \\u003ctbody\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003ePT-TEST-008\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eRED\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eRED\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eMATCH \\u0026mdash; deterministic gates sufficient for NTI case\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003ePT-TEST-009\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eRED\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eYELLOW\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eDIVERGE \\u0026mdash; adversarial agent identified data quality concerns\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003ePT-TEST-010\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eRED\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eRED\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eMATCH \\u0026mdash; Rule C forces RED on NTI CRITICAL\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003ePT-TEST-012\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eRED\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eGREEN\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eDIVERGE \\u0026mdash; without adversarial agent, stale-data patient gets GREEN\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003c/tbody\\u003e \\u003c/colgroup\\u003e \\u003c/table\\u003e\\u003c/div\\u003e \\u003c/p\\u003e \\u003cp\\u003eThe adversarial agent's primary value is on non-NTI cases with data quality issues \\u0026mdash; precisely the cases where deterministic gates alone are insufficient. PT-TEST-012 is the strongest finding: without the adversarial agent, a patient with 24-day stale laboratory data receives the lowest urgency classification.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec27\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e4.6 Cross-Block Validation\\u003c/h2\\u003e \\u003cp\\u003e \\u003cb\\u003eArchitectural Independence.\\u003c/b\\u003e The NTI gate produced field-identical output across all applicable cases in all three blocks, despite two infrastructure changes to evidence and retrieval layers. The safety envelope operates on a fundamentally different data plane than the reasoning layers it wraps \\u0026mdash; confirming that deterministic safety guarantees survive evidence corpus changes, model updates, and retrieval redesigns.\\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eFailure Surface Migration.\\u003c/b\\u003e Block 1 suppressed off-target evidence contamination, exposing quote integrity errors amplified by richer evidence. Block 2 suppressed evidence gaps, exposing citation fidelity failures hidden by prior noise. Block 3 suppressed citation errors, exposing concordance and formatting issues. Each block made the system safer without safety regressions \\u0026mdash; the dominant failure class shifted from dangerous (incorrect evidence) to progressively less dangerous (formatting).\\u003c/p\\u003e \\u003cp\\u003e \\u003c/p\\u003e \\u003cp\\u003e \\u003cdiv class=\\\"gridtable\\\"\\u003e\\u003ctable float=\\\"No\\\" id=\\\"Tabe\\\" border=\\\"1\\\"\\u003e \\u003ccolgroup cols=\\\"3\\\"\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c1\\\" colnum=\\\"1\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c2\\\" colnum=\\\"2\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c3\\\" colnum=\\\"3\\\"\\u003e\\u003c/div\\u003e \\u003cthead\\u003e \\u003ctr\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eBlock\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eDominant Failure Class\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eSuppressed From Prior Block\\u003c/p\\u003e \\u003c/th\\u003e \\u003c/tr\\u003e \\u003c/thead\\u003e \\u003ctbody\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e1\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eOff-target evidence contamination\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003e(baseline)\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e2\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eEvidence gaps / missing sources\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eOff-target contamination\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003e3\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eCitation fidelity / quote integrity (40.6% of 747 violations)\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eEvidence gaps\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003c/tbody\\u003e \\u003c/colgroup\\u003e \\u003c/table\\u003e\\u003c/div\\u003e \\u003c/p\\u003e \\u003cp\\u003e \\u003cb\\u003eRevision Economics.\\u003c/b\\u003e The second revision consumed approximately twice the tokens of the first across all measured runs. The regulatory lint layer, by resolving formatting violations before the stochastic audit, eliminated revision cycles on the lowest-complexity test case entirely (2 \\u0026rarr; 0 revisions). Revision prevention is the highest-impact efficiency intervention because the cost curve is superlinear \\u0026mdash; each prevented revision saves more than the previous one.\\u003c/p\\u003e \\u003c/div\\u003e \\u003cdiv id=\\\"Sec28\\\" class=\\\"Section2\\\"\\u003e \\u003ch2\\u003e4.7 Comparative Positioning\\u003c/h2\\u003e \\u003cp\\u003e \\u003cdiv class=\\\"gridtable\\\"\\u003e\\u003ctable float=\\\"No\\\" id=\\\"Tabf\\\" border=\\\"1\\\"\\u003e \\u003ccolgroup cols=\\\"7\\\"\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c1\\\" colnum=\\\"1\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c2\\\" colnum=\\\"2\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c3\\\" colnum=\\\"3\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c4\\\" colnum=\\\"4\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c5\\\" colnum=\\\"5\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c6\\\" colnum=\\\"6\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c7\\\" colnum=\\\"7\\\"\\u003e\\u003c/div\\u003e \\u003cthead\\u003e \\u003ctr\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eCapability\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eThis Work\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eTAO\\u0026sup1;\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eDILIConsult\\u0026sup3;\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c5\\\"\\u003e \\u003cp\\u003eLiu et al.⁴\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c6\\\"\\u003e \\u003cp\\u003eILION⁷\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c7\\\"\\u003e \\u003cp\\u003eCARE-\\u003c/p\\u003e \\u003cp\\u003eAD⁵\\u003c/p\\u003e \\u003c/th\\u003e \\u003c/tr\\u003e \\u003c/thead\\u003e \\u003ctbody\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eDeterministic safety gates\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003e21 closed ESC-IDs\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c5\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c6\\\"\\u003e \\u003cp\\u003e5-\\u003c/p\\u003e \\u003cp\\u003ecomponent cascade\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c7\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eFailure tracking methodology\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003e31 ESC-\\u003c/p\\u003e \\u003cp\\u003eIDs, 15\\u003c/p\\u003e \\u003cp\\u003eprinciples\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eTiered error detection\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c5\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c6\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c7\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003ePer-execution tracking\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eYes \\u0026mdash; every run audited\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003ePer-interaction triage\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c5\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c6\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c7\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eGate conversion\\u0026thinsp;+\\u0026thinsp;closure\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eRegression-validated\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c5\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c6\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c7\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eCitation verification\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eFidelity gate, 0 fabricated\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eN/A\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c5\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c6\\\"\\u003e \\u003cp\\u003eN/A\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c7\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eMulti-model heterogeneity\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003e3\\u0026thinsp;+\\u0026thinsp;providers\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eSingle system\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eSingle model\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c5\\\"\\u003e \\u003cp\\u003eMultiple tested\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c6\\\"\\u003e \\u003cp\\u003eSingle\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c7\\\"\\u003e \\u003cp\\u003eSingle\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eAdversarial review\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eIntentionally blind agent\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eTiered oversight\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c4\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c5\\\"\\u003e \\u003cp\\u003eN/A\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c6\\\"\\u003e \\u003cp\\u003eN/A\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c7\\\"\\u003e \\u003cp\\u003eNone\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003c/tbody\\u003e \\u003c/colgroup\\u003e \\u003c/table\\u003e\\u003c/div\\u003e \\u003c/p\\u003e \"},{\"header\":\"5. Discussion\",\"content\":\"\\u003cp\\u003eThe escape register methodology addresses a gap between pre-deployment benchmarking and post-deployment monitoring. Pre-deployment benchmarking cannot discover failure modes that emerge from specific patient data configurations \\u0026mdash; it tests against curated datasets, not the combinatorial complexity of real clinical encounters. Post-deployment monitoring detects failures after they affect patients. The escape register operates between these: treating each execution as a potential source of failure discovery and converting each discovery into permanent prevention before deployment.\\u003c/p\\u003e\\u003cp\\u003eThe safety envelope reshapes itself based on what falls through \\u0026mdash; each discovered escape permanently expands the boundary of what the system can detect and prevent.\\u003c/p\\u003e \\u003cp\\u003eThe mapping to ASTM F3269-21\\u0026sup1;\\u0026sup2; was discovered post-hoc. The stochastic pipeline maps to the Complex Function. The deterministic gates map to the Safety Monitor. The traffic light maps to the Decision Module. The content preservation gate maps to the Recovery Function. A designed pharmacist touchpoint (Query Gate with anchor bias detection) extends beyond the standard's automated Input Manager by incorporating clinical judgment for semantic input validation \\u0026mdash; detecting wrong questions, not just malformed data. These touchpoints are designed with functional prototypes but not yet deployed.\\u003c/p\\u003e \\u003cp\\u003e \\u003cdiv class=\\\"gridtable\\\"\\u003e\\u003ctable float=\\\"No\\\" id=\\\"Tabg\\\" border=\\\"1\\\"\\u003e \\u003ccolgroup cols=\\\"3\\\"\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c1\\\" colnum=\\\"1\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c2\\\" colnum=\\\"2\\\"\\u003e\\u003c/div\\u003e \\u003cdiv align=\\\"left\\\" class=\\\"colspec\\\" colname=\\\"c3\\\" colnum=\\\"3\\\"\\u003e\\u003c/div\\u003e \\u003cthead\\u003e \\u003ctr\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eASTM F3269 Component\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003ePipeline Equivalent\\u003c/p\\u003e \\u003c/th\\u003e \\u003cth align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eMapping\\u003c/p\\u003e \\u003c/th\\u003e \\u003c/tr\\u003e \\u003c/thead\\u003e \\u003ctbody\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eComplex Function\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eSix-agent pipeline\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eExact\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eSafety Monitor\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eDeterministic gate ensemble\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eExact\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eDecision Module\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eTraffic light\\u0026thinsp;+\\u0026thinsp;violation router\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eExact\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eRecovery Function\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003eContent preservation\\u0026thinsp;+\\u0026thinsp;revision cycle\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eExact\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003ctr\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c1\\\"\\u003e \\u003cp\\u003eInput Manager\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c2\\\"\\u003e \\u003cp\\u003ePharmacist touchpoints (designed, Phase 5)\\u003c/p\\u003e \\u003c/td\\u003e \\u003ctd align=\\\"left\\\" colname=\\\"c3\\\"\\u003e \\u003cp\\u003eExtension\\u003c/p\\u003e \\u003c/td\\u003e \\u003c/tr\\u003e \\u003c/tbody\\u003e \\u003c/colgroup\\u003e \\u003c/table\\u003e\\u003c/div\\u003e \\u003c/p\\u003e \\u003cp\\u003eASTM F3269-21 was originally developed for unmanned aircraft systems but with noted applicability to manned aircraft and autonomous systems generally\\u0026sup1;\\u0026sup2;. No prior publication has mapped ASTM F3269 to clinical AI. The convergent design follows a documented pattern: the Simplex Architecture was independently applied to a cardiac pacemaker\\u0026sup1;⁴, and Fenn et al.\\u0026sup1;⁶ describe active-monitor parallel design as an established architectural pattern for safety-critical aviation systems, directly connecting the ASTM F3269 standard to the Simplex Architecture lineage.\\u003c/p\\u003e \\u003cp\\u003eThis improvement-reveals-latency dynamic has practical implications beyond this single system. Each block confirmed that improving quality at one layer systematically exposes latent defects at adjacent layers previously masked by noise. Quality improvements should be expected to increase detected failure rates in the short term, and validation protocols should anticipate new failure classes after each infrastructure change. The escape register provides the mechanism for capturing these emergent failures before they reach clinical output.\\u003c/p\\u003e \\u003cp\\u003eThe escape register operationalizes what traditional incident reporting cannot achieve. Institutional medication safety reporting depends on five sequential human decisions \\u0026mdash; awareness, recognition, motivation to report, analysis quality, and organizational will to implement \\u0026mdash; each with an independent failure probability. The escape register replaces these with architectural mechanisms: instrumented detection at pipeline boundaries (not voluntary recognition), deterministic data flow traces (not retrospective chart review), and permanent code gates (not procedural recommendations that may or may not be implemented).\\u003c/p\\u003e \\u003cp\\u003eThe cumulative architecture ensures monotonic safety growth \\u0026mdash; each gate is additive, no gate is removed, and the system cannot become less safe over time. This is the computational operationalization of what Weick and Sutcliffe\\u0026sup2;⁹ described as \\\"preoccupation with failure\\\" in high-reliability organizations \\u0026mdash; except the preoccupation is encoded in code, not culture. The most dangerous errors in clinical AI are precisely those that appear clinically plausible; no traditional reporting system would have captured the drug-centric anchor bias in the sepsis case (Section 1) because no traditional measure would have classified the output as an error.\\u003c/p\\u003e \\u003cp\\u003eThe absence of a national surveillance infrastructure for AI-generated clinical advice represents a growing gap in the post-market safety framework. Current adverse event reporting systems \\u0026mdash; FDA FAERS for drugs, FDA MedWatch for devices, ISMP MERP for medication errors \\u0026mdash; were designed for pharmaceutical products and medical devices. No analogous system exists for adverse events arising from AI-generated medication information consumed by patients or clinicians. The escape register methodology demonstrates that systematic per-interaction failure tracking is feasible for clinical AI systems, produces measurable safety improvements, and generates structured safety data amenable to aggregation and analysis. As AI platforms increasingly generate medication-related advice, extending the pharmacovigilance model to the AI-clinician and AI-patient interfaces would address this gap \\u0026mdash; and the escape register's structured lifecycle (detection \\u0026rarr; classification \\u0026rarr; root cause \\u0026rarr; gate \\u0026rarr; regression validation) offers a candidate framework for what that reporting infrastructure could look like.\\u003c/p\\u003e \\u003cp\\u003eThe methodology has important limitations. The methodology has been validated in a single system with synthetic test cases representing four clinical archetypes. Generalizability to other domains, EHR systems, and patient populations has not been tested. The methodology's value proposition is transferability: any clinical AI team can implement an escape register with their own domain expertise. The specific gate collection reported here reflects pharmacy-specific clinical knowledge; analogous gates for radiology, pathology, or other domains would encode different clinical determinations using the same lifecycle.\\u003c/p\\u003e \\u003cp\\u003eThe NTI evaluation gate covers two drugs; extension requires additional drug safety map development. The methodology depends on domain expertise for failure classification \\u0026mdash; the pharmacist's clinical judgment determines which behaviors constitute safety-relevant deviations. The current work does not include inter-rater reliability assessment for escape classification.\\u003c/p\\u003e \\u003cp\\u003eThe escape register can only learn from detected failures. Undetected escapes remain invisible. The multi-layer detection architecture provides defense in depth, but the unknown-unknowns problem applies as it does to any safety monitoring system.\\u003cdiv class=\\\"BlockQuote\\\"\\u003e\\u003cp\\u003eAll validation used synthetic data. Clinical deployment would require IRB approval, EHR integration, and real-world validation.\\u003c/p\\u003e\\u003c/div\\u003e\\u003c/p\\u003e\"},{\"header\":\"Declarations\",\"content\":\"\\u003ch2\\u003eData\\u0026nbsp;Availability\\u003c/h2\\u003e\\n\\u003cp\\u003eAll patient test cases used in this study are synthetic and contain no real patient data. The escape\\u0026nbsp;register\\u0026nbsp;documentation,\\u0026nbsp;pipeline\\u0026nbsp;validation\\u0026nbsp;logs,\\u0026nbsp;and\\u0026nbsp;deterministic\\u0026nbsp;gate\\u0026nbsp;specifications are available from the corresponding author upon reasonable request. No datasets were deposited in a public repository because the validation data consists of synthetic patient scenarios generated for system testing.\\u003c/p\\u003e\\n\\u003ch2\\u003eCode\\u0026nbsp;Availability\\u003c/h2\\u003e\\n\\u003cp\\u003eThe\\u0026nbsp;deterministic\\u0026nbsp;safety\\u0026nbsp;gate\\u0026nbsp;specifications\\u0026nbsp;and\\u0026nbsp;escape\\u0026nbsp;register\\u0026nbsp;schema\\u0026nbsp;are\\u0026nbsp;available\\u0026nbsp;from\\u0026nbsp;the corresponding author upon reasonable request. The full pipeline source code is not publicly available due to pending provisional patent applications. Core architectural patterns (FHIR normalization, deterministic gate interfaces, traffic light classification logic) are described in sufficient detail in Section 3 to enable independent reimplementation.\\u003c/p\\u003e\\n\\u003ch2\\u003eAcknowledgments\\u003c/h2\\u003e\\n\\u003cp\\u003eThis study received no external funding. The author thanks Nicole Asal, PharmD (University of Rhode Island) for collaboration on related consumer AI safety research. The Author would also like to thank John Godar, PharmD for his advice on predictive systems thinking.\\u003c/p\\u003e\\n\\u003ch2\\u003eAuthor\\u0026nbsp;Contributions\\u003c/h2\\u003e\\n\\u003cp\\u003eN.S.\\u0026nbsp;conceived\\u0026nbsp;the\\u0026nbsp;escape\\u0026nbsp;register\\u0026nbsp;methodology,\\u0026nbsp;designed\\u0026nbsp;the\\u0026nbsp;pipeline\\u0026nbsp;architecture,\\u0026nbsp;performed all clinical judgment contributing to failure classification and gate design, conducted all validation, and wrote the manuscript.\\u003c/p\\u003e\\n\\u003ch2\\u003eCompeting\\u0026nbsp;Interests\\u003c/h2\\u003e\\n\\u003cp\\u003eN.S. is the founder of Community Pharmacy AI Solutions, LLC. Twelve provisional patents related to the system architecture have been filed.\\u003c/p\\u003e\"},{\"header\":\"References\",\"content\":\"\\u003col\\u003e\\n \\u003cli\\u003eKim, Y. et al. TAO: tiered agentic oversight for multi-agent clinical safety. Preprint at https://arxiv.org/abs/2506.12482 (2025).\\u003c/li\\u003e\\n \\u003cli\\u003eGallifant, J. et al. A field guide to deploying AI agents in clinical practice. Preprint at https://arxiv.org/abs/2509.26153 (2025).\\u003c/li\\u003e\\n \\u003cli\\u003eHo, A. Z. T. et al. DILIConsult: a multi-agent large language model framework for evaluating drug-induced liver injury in ICU settings. \\u003cem\\u003ePharmacotherapy\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e46\\u003c/strong\\u003e, e70131 (2026).\\u003c/li\\u003e\\n \\u003cli\\u003eLiu, Y. et al. Benchmarking large language model-based agent systems for clinical decision tasks. \\u003cem\\u003enpj Digit. Med.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e9\\u003c/strong\\u003e, https://doi.org/10.1038/s41746-026-02443-6 (2026).\\u003c/li\\u003e\\n \\u003cli\\u003eLi, R. et al. CARE-AD: a multi-agent large language model framework for Alzheimer\\u0026apos;s disease prediction using longitudinal clinical notes. \\u003cem\\u003enpj Digit. Med.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e8\\u003c/strong\\u003e, 541 (2025).\\u003c/li\\u003e\\n \\u003cli\\u003eYuan, G. C., Zhang, X., Kim, S. E. \\u0026amp; Rajpurkar, P. Do mixed-vendor multi-agent LLMs improve clinical diagnosis? in \\u003cem\\u003eProc. 1st Workshop on Linguistic Analysis for Health (HeaLing 2026)\\u0026nbsp;\\u003c/em\\u003e(European Association for Computational Linguistics, 2026).\\u003c/li\\u003e\\n \\u003cli\\u003eChitan, F. A. Deterministic pre-execution safety gates for agentic AI systems. Preprint at https://arxiv.org/abs/2603.13247 (2026).\\u003c/li\\u003e\\n \\u003cli\\u003eSivakumar, R. et al. RAG-X: systematic diagnosis of retrieval-augmented generation failures in clinical AI. Preprint at https://arxiv.org/abs/2603.03541 (2026).\\u003c/li\\u003e\\n \\u003cli\\u003eAlu, F. F. \\u0026amp; Oluwadare, S. An auditable and source-verified framework for clinical AI decision support: integrating retrieval-augmented generation with data provenance. \\u003cem\\u003eFront. Artif. Intell.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e9\\u003c/strong\\u003e, 1737532 (2026).\\u003c/li\\u003e\\n \\u003cli\\u003eKhoruzhaya, A. N. et al. MEDAI-LLM-SUMM: a reporting checklist for medical text summarization studies using large language models. \\u003cem\\u003eFront. Digit. Health\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e8\\u003c/strong\\u003e, 1761601 (2026).\\u003c/li\\u003e\\n \\u003cli\\u003eAgweyu, A. et al. Safety of a large language model-based clinical decision support system in African primary healthcare. \\u003cem\\u003eNat. Health\\u0026nbsp;\\u003c/em\\u003e10.1038/s44360-026-00082-5 (2026).\\u003c/li\\u003e\\n \\u003cli\\u003eASTM International. Standard practice for methods to safely bound behavior of aircraft systems containing complex functions using run-time assurance. ASTM F3269-21 (ASTM International, 2021).\\u003c/li\\u003e\\n \\u003cli\\u003eGamma, E., Helm, R., Johnson, R. \\u0026amp; Vlissides, J. \\u003cem\\u003eDesign Patterns: Elements of Reusable Object-Oriented Software\\u0026nbsp;\\u003c/em\\u003e(Addison-Wesley, 1994).\\u003c/li\\u003e\\n \\u003cli\\u003eBak, S. et al. The system-level simplex architecture for improved real-time embedded system safety. in \\u003cem\\u003eProc. 15th IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS)\\u0026nbsp;\\u003c/em\\u003e99\\u0026ndash;107 (IEEE, 2009).\\u003c/li\\u003e\\n \\u003cli\\u003eSha, L. Using simplicity to control complexity. \\u003cem\\u003eIEEE Softw.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e18\\u003c/strong\\u003e, 20\\u0026ndash;28 (2001).\\u003c/li\\u003e\\n \\u003cli\\u003eFenn, J., Nicholson, M., Pai, G. \\u0026amp; Wilkinson, M. Architecting safer autonomous aviation systems. NASA Technical Reports Server 20220016762 (2023).\\u003c/li\\u003e\\n \\u003cli\\u003eUS Food and Drug Administration. Clinical Decision Support Software: Guidance for Industry and Food and Drug Administration Staff (FDA, 2026).\\u003c/li\\u003e\\n \\u003cli\\u003eUS Food and Drug Administration. Town Hall \\u0026mdash; Clinical Decision Support Software Final Guidance. https://www.fda.gov/medical-devices/medical-devices-news-and-events/town-hall-clinical-decision-support-software-final-guidance-03112026 (2026).\\u003c/li\\u003e\\n \\u003cli\\u003eHazell, L. \\u0026amp; Shakir, S. A. W. Under-reporting of adverse drug reactions: a systematic review. \\u003cem\\u003eDrug Saf.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e29\\u003c/strong\\u003e, 385\\u0026ndash;396 (2006).\\u003c/li\\u003e\\n \\u003cli\\u003eFlynn, E. A., Barker, K. N., Pepper, G. A., Bates, D. W. \\u0026amp; Mikeal, R. L. Comparison of methods for detecting medication errors in 36 hospitals and skilled-nursing facilities. \\u003cem\\u003eAm. J. Health-Syst. Pharm.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e59\\u003c/strong\\u003e, 436\\u0026ndash;446 (2002).\\u003c/li\\u003e\\n \\u003cli\\u003eAdelman, J. S. et al. Understanding and preventing wrong-patient electronic orders: a randomized controlled trial. \\u003cem\\u003eJ. Am. Med. Inform. Assoc.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e20\\u003c/strong\\u003e, 305\\u0026ndash;310 (2013).\\u003c/li\\u003e\\n \\u003cli\\u003eSouth, B. R. et al. Near-miss detection in pharmacy: comparison of voluntary reporting with automated surveillance using a natural language processing system. \\u003cem\\u003eHosp. Pharm.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e50\\u003c/strong\\u003e, 118\\u0026ndash;124 (2015). https://doi.org/10.1310/hpj5002-118\\u003c/li\\u003e\\n \\u003cli\\u003eClassen, D. C. et al. \\u0026apos;Global Trigger Tool\\u0026apos; shows that adverse events in hospitals may be ten times greater than previously measured. \\u003cem\\u003eHealth Aff.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e30\\u003c/strong\\u003e, 581\\u0026ndash;589 (2011).\\u003c/li\\u003e\\n \\u003cli\\u003eWestbrook, J. I. et al. Paediatric medication incident reporting: a multicentre comparison study of medication errors identified at audit, detected by staff and reported to an incident system. \\u003cem\\u003eBMJ Qual. Saf.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e33\\u003c/strong\\u003e, 624\\u0026ndash;633 (2024).\\u003c/li\\u003e\\n \\u003cli\\u003eHibbert, P. D. et al. Are root cause analyses recommendations effective and sustainable? An observational study. \\u003cem\\u003eInt. J. Qual. Health Care\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e30\\u003c/strong\\u003e, 124\\u0026ndash;131 (2018).\\u003c/li\\u003e\\n \\u003cli\\u003eMartin-Delgado, J. et al. Limitations of incident reporting as a tool for patient safety. \\u003cem\\u003eMed. Princ. Pract.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e29\\u003c/strong\\u003e, 524\\u0026ndash;531 (2020). https://doi.org/10.1159/000508677\\u003c/li\\u003e\\n \\u003cli\\u003eMacrae, C. The problem with incident reporting. \\u003cem\\u003eBMJ Qual. Saf.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e25\\u003c/strong\\u003e, 71\\u0026ndash;75 (2016).\\u003c/li\\u003e\\n \\u003cli\\u003eMitchell, I., Schuster, A., Smith, K., Pronovost, P. \\u0026amp; Wu, A. Patient safety incident reporting: a qualitative study of thoughts and perceptions of experts 15 years after \\u0026apos;To Err is Human\\u0026apos;. \\u003cem\\u003eBMJ Qual. Saf.\\u0026nbsp;\\u003c/em\\u003e\\u003cstrong\\u003e25\\u003c/strong\\u003e, 92\\u0026ndash;99 (2016).\\u003c/li\\u003e\\n \\u003cli\\u003eWeick, K. E. \\u0026amp; Sutcliffe, K. M. \\u003cem\\u003eManaging the Unexpected: Assuring High Performance in an Age of Complexity\\u0026nbsp;\\u003c/em\\u003e(Jossey-Bass, 2001).\\u003c/li\\u003e\\n\\u003c/ol\\u003e\"}],\"fulltextSource\":\"\",\"fullText\":\"\",\"funders\":[],\"hasAdminPriorityOnWorkflow\":false,\"hasManuscriptDocX\":false,\"hasOptedInToPreprint\":true,\"hasPassedJournalQc\":\"\",\"hasAnyPriority\":true,\"hideJournal\":true,\"highlight\":\"\",\"institution\":\"\",\"isAcceptedByJournal\":false,\"isAuthorSuppliedPdf\":false,\"isDeskRejected\":\"\",\"isHiddenFromSearch\":false,\"isInQc\":false,\"isInWorkflow\":false,\"isPdf\":false,\"isPdfUpToDate\":true,\"isWithdrawnOrRetracted\":false,\"journal\":{\"display\":true,\"email\":\"info@researchsquare.com\",\"identity\":\"researchsquare\",\"isNatureJournal\":false,\"hasQc\":true,\"allowDirectSubmit\":true,\"externalIdentity\":\"\",\"sideBox\":\"\",\"snPcode\":\"\",\"submissionUrl\":\"/submission\",\"title\":\"Research Square\",\"twitterHandle\":\"researchsquare\",\"acdcEnabled\":true,\"dfaEnabled\":false,\"editorialSystem\":\"\",\"reportingPortfolio\":\"\",\"inReviewEnabled\":false,\"inReviewRevisionsEnabled\":true},\"keywords\":\"\",\"lastPublishedDoi\":\"10.21203/rs.3.rs-9374687/v1\",\"lastPublishedDoiUrl\":\"https://doi.org/10.21203/rs.3.rs-9374687/v1\",\"license\":{\"name\":\"CC BY 4.0\",\"url\":\"https://creativecommons.org/licenses/by/4.0/\"},\"manuscriptAbstract\":\"\\u003cp\\u003eMulti-agent clinical AI systems introduce failure modes absent in single-model architectures: correlated reasoning errors, stochastic classification of safety-critical signals, and evidence chain failures invisible to output-level evaluation. We present the escape register — a methodology for converting operationally discovered failures into permanent deterministic safety gates within a six-agent clinical pharmacy decision support pipeline. Over 81 executions across three validation blocks, the methodology produced 31 escape IDs, 21 closed gates, and zero safety regressions across three consecutive infrastructure changes. The adversarial review agent concurred with clinical reasoning on an actively toxic narrow therapeutic index case in 37.5% of executions (6 of 16), demonstrating that stochastic agents are unreliable safety classifiers. Post-hoc analysis revealed component-for-component mapping to ASTM F3269-21 — the first such mapping for clinical AI. No published framework combines per-execution failure tracking, deterministic gate conversion, and regression-validated closure in a single lifecycle.\\u003c/p\\u003e\",\"manuscriptTitle\":\"The Escape Register: A Failure-Driven Safety Methodology for Multi-Agent Clinical AI Systems\",\"msid\":\"\",\"msnumber\":\"\",\"nonDraftVersions\":[{\"code\":1,\"date\":\"2026-04-14 10:37:07\",\"doi\":\"10.21203/rs.3.rs-9374687/v1\",\"editorialEvents\":[{\"type\":\"communityComments\",\"content\":0}],\"status\":\"published\",\"journal\":{\"display\":true,\"email\":\"info@researchsquare.com\",\"identity\":\"researchsquare\",\"isNatureJournal\":false,\"hasQc\":true,\"allowDirectSubmit\":true,\"externalIdentity\":\"\",\"sideBox\":\"\",\"snPcode\":\"\",\"submissionUrl\":\"/submission\",\"title\":\"Research Square\",\"twitterHandle\":\"researchsquare\",\"acdcEnabled\":true,\"dfaEnabled\":false,\"editorialSystem\":\"\",\"reportingPortfolio\":\"\",\"inReviewEnabled\":false,\"inReviewRevisionsEnabled\":true}}],\"origin\":\"\",\"ownerIdentity\":\"2adabafd-154c-4aaa-933b-b606f87904df\",\"owner\":[],\"postedDate\":\"April 14th, 2026\",\"published\":true,\"recentEditorialEvents\":[],\"rejectedJournal\":[],\"revision\":\"\",\"amendment\":\"\",\"status\":\"posted\",\"subjectAreas\":[{\"id\":66106753,\"name\":\"Biological sciences/Computational biology and bioinformatics\"},{\"id\":66106755,\"name\":\"Physical sciences/Engineering\"},{\"id\":66106757,\"name\":\"Physical sciences/Mathematics and computing\"}],\"tags\":[],\"updatedAt\":\"2026-04-19T23:38:33+00:00\",\"versionOfRecord\":[],\"versionCreatedAt\":\"2026-04-14 10:37:07\",\"video\":\"\",\"vorDoi\":\"\",\"vorDoiUrl\":\"\",\"workflowStages\":[]},\"version\":\"v1\",\"identity\":\"rs-9374687\",\"journalConfig\":\"researchsquare\"},\"__N_SSP\":true},\"page\":\"/article/[identity]/[[...version]]\",\"query\":{\"redirect\":\"/article/rs-9374687\",\"identity\":\"rs-9374687\",\"version\":[\"v1\"]},\"buildId\":\"XKTyCvWXoU3ODBz1xrDgd\",\"isFallback\":false,\"isExperimentalCompile\":false,\"dynamicIds\":[84888],\"gssp\":true,\"scriptLoader\":[]}","source_license":"CC-BY-4.0","license_restricted":false}