一句话：提出用反事实重模拟衡量自动驾驶测试危害，构建可证伪连续预言，并揭示被二值判定掩盖的安全风险。
模拟自动驾驶测试常以“碰撞/不碰撞”二值判定为预言，无法区分高速四厘米擦肩与更严重但频率不变的碰撞。本文提出将危害从打分改为可证伪测量：对一次运行扰动反应速度、制动力与交通流，生成邻近世界并让系统重新反应、重模拟，以碰撞比例按严重度加权定义危害，使真值来自重模拟，危险估计可能出错。在 openpilot 套件中，一条被所有遥测基线判过的运行，其100次扰动重放有70次以72 km/h正面碰撞结束，占全套件危害三分之一。仅凭记录运行的廉价估计在10%检查预算下发现61%总危害，优于最佳遥测启发式的35%，并给出校准不确定性。
The verdict that decides a simulated autonomous-driving test is a single bit: collision or no collision. The bit calls a four-centimetre miss at highway speed a pass, and a change that makes crashes more violent — but no more frequent — never changes it, at any testing volume. Continuous danger scores exist; we are aware of none validated on the run it judges, because a near-miss ends without injury, leaving no outcome to check a score against. We propose to measure rather than score: the harm of a test run is the fraction of its plausible neighbouring worlds — slower reactions, weaker brakes, jittered traffic, re-simulated with the system reacting freshly in each — that end in a crash, weighted by severity. Ground truth becomes re-simulation, and a danger estimate can finally be wrong. The measure sees what the verdict cannot: one run in our openpilot suite is classified as a pass by every telemetry-based baseline, yet 70 of its 100 disturbed replays end in a 72 km/h head-on crash — a third of the entire suite’s harm, hidden in a single pass. A cheap estimate computed from the recorded run alone surfaces 61% of total suite harm under a 10% inspection budget (best telemetry heuristic: 35%), with calibrated uncertainty.