What would fixing it score?
Start from a domain's recorded passport scan, assume some of the fixes it has not made, and see what the same scoring code would give. Four kinds of number are kept apart and labelled: what was observed, what you assumed, what is simulated, and what a real scan later records. Nothing here is written anywhere.
The lab reads the domain's most recent stored scan (the same one its badge and the league show). A domain never scanned has nothing to start from: scan it on Passport control first, for free.
The model
The model is the scanner's own scoring code, registry-backend/passport.mjs, imported by this page: thirteen public checks, their points, and the grade boundaries. No AI model estimates anything here. The lab assumes a fix earns the check's full points, which is what the scanner awards when the fix is made correctly.
Its limits
A simulated score is not a score. A header sent with a typo, a DMARC record at p=none, or DNSSEC that the registrar never switched on earns less than full points, and only a real scan will say so. The passport also says nothing about who runs a domain: that is the register's job, and no simulation reaches it.