space-data-module-sdk 0.8.15 → 0.8.17

package/schemas/orbpro/Propagator.fbs

@@ -41,31 +41,94 @@ attribute "abi_c_prefix";
 /// enum field. Writing these by hand is how padding bytes go stale.
 attribute "abi_c_helper_prefix";
 
-// !! FOUR INCOMPATIBLE `ReferenceFrame` VOCABULARIES CROSS THIS SEAM !!
-// This is the `orbpro.propagator` one. Its NUMERIC values are NOT
-// interchangeable with the others; translate by NAMED TOKEN at every seam.
+// !! FIVE INCOMPATIBLE `ReferenceFrame` VOCABULARIES CROSS THIS SEAM, PLUS AN
+// !! AXIS-TYPE VOCABULARY THAT IS NOT A ReferenceFrame AT ALL !!
+// This is the `orbpro.propagator` one, and it is the ONE that crosses the ABI.
+// The NUMERIC values below are NOT interchangeable with any of the others;
+// translate by NAMED TOKEN at every seam.
 //
-//   (A) orbpro.propagator (THIS)  TEME=0 J2000=1 ICRF=2 ECEF=3 MCI=4 MCMF=5
+//   (A) orbpro.propagator (THIS)  TEME=0 J2000=1 ICRF=2 ECEF=3 MCI=4 MCMF=5,
+//                                 then the appended axis roster at 6+
 //   (B) orbpro.plugins            ECI=0  ECEF=1  TEME=2 ICRF=3
 //       (PropagatorState.fbs / "PRST" — the wire the compiled sgp4, hpop,
 //        conjunction-assessment and sensor-shader modules already emit)
-//   (C) Cesium.ReferenceFrame     FIXED=0 INERTIAL=1
+//   (C) OrbPro engine ReferenceFrame.js — NINE members, not two:
+//       FIXED=0 INERTIAL=1 TEME=2 VVLH=3 ENU=4 NED=5 NEU=6 RIC=7 LVLH=8
+//       (verified on OrbPro 417320c5c5. The long-standing claim in this block
+//        that it was "Cesium.ReferenceFrame FIXED=0 INERTIAL=1" was stale, and
+//        stale in the direction that mattered: it hid seven live members.)
 //   (D) ConjunctionCommon.fbs     ECI=1
+//   (E) foundation/frames `AxisType` (space-data-network-modules) — an
+//       ORIENTATION RULE roster, mirroring SDS `rfmAxisType`. It is not a
+//       ReferenceFrame and must never be numerically equated with one: a
+//       coordinate system is an axis set AND an origin, and this enum carries
+//       no origin.
 //
 // ECI==0, TEME==0 and FIXED==0 all collide, and ECEF is 1 in (B) but 3 here.
 // (B)'s values are frozen by compiled WASM artifacts in the field, so
 // collapsing (A) and (B) is a wire break, not a Wave-0 edit — see
-// graph/tasks/sdk-reference-frame-enum-unification.md. The reference pattern
-// for a correct seam is propagator.hpop/index.js createSourceFromState.
+// graph/tasks/sdk-reference-frame-enum-unification.md, which also owns the
+// (A)-vs-(C) inversion at 0/1. The reference pattern for a correct seam is
+// propagator.hpop/index.js createSourceFromState.
 //
-// Ruling: graph/findings/official-harness-shapes.md §4.2 / §8.2
+// The crosswalk between all of these is DATA, in
+// schemas/orbpro/reference-frame-crosswalk.json, and
+// scripts/check-reference-frame-uniqueness.mjs holds it to this enum.
+//
+// Ruling: graph/findings/official-harness-shapes.md §4.2 / §8.2; Janus consult
+// 2026-08-30 (gmat-08-frames-and-state-representations).
+//
+// VALUES 0-5 ARE FROZEN AND ARE NEVER RENUMBERED. New members are APPENDED.
+// ECEF/MCI/MCMF are body-bound legacy instances of the generic pair at 11/12 —
+// ECEF is BODY_FIXED about the Earth, MCI is BODY_INERTIAL about Mars, MCMF is
+// BODY_FIXED about Mars. They are retained, and the generic members are NOT a
+// second spelling of them.
 enum ReferenceFrame : ubyte (abi, abi_c_name: "OrbProReferenceFrame", abi_c_prefix: "ORBPRO_FRAME_") {
   TEME = 0,
   J2000 = 1,
   ICRF = 2,
   ECEF = 3,
   MCI = 4,
-  MCMF = 5
+  MCMF = 5,
+  /// Mean ecliptic and equinox of J2000. (The mean EQUATOR and equinox of
+  /// J2000 is J2000 = 1 and is not repeated here.)
+  MJ2000EC = 6,
+  /// Mean equator of date.
+  MOD = 7,
+  /// True equator of date.
+  TOD = 8,
+  /// Mean ecliptic of date.
+  MOE = 9,
+  /// True ecliptic of date.
+  TOE = 10,
+  /// Axes rotating with a named body, per its published rotation elements.
+  BODY_FIXED = 11,
+  /// Non-rotating axes on a named body's equator and prime meridian.
+  BODY_INERTIAL = 12,
+  /// Axes built from the relative geometry of two named objects. The three
+  /// live RTN triads — RIC, RSW and RTN — are THIS member with an axes spec,
+  /// not three members; so are LVLH and VVLH.
+  OBJECT_REFERENCED = 13,
+  /// Axes built by aligning one vector and constraining a second.
+  LOCAL_ALIGNED_CONSTRAINED = 14,
+  /// A named body's equatorial plane at the epoch.
+  EQUATOR = 15,
+  /// Solar-ecliptic magnetospheric (GSE).
+  GSE = 16,
+  /// Solar magnetospheric (GSM).
+  GSM = 17,
+  /// Local horizon axes at a surface site.
+  TOPOCENTRIC = 18,
+  /// Axes fixed by a body's spin axis and its direction to the Sun.
+  BODY_SPIN_SUN = 19,
+  /// Axes declared by a loaded ephemeris/orientation kernel.
+  SPICE_DEFINED = 20,
+  /// LEGACY, retained and NAMED rather than left implicit: mean equator of
+  /// date on the IAU-76/FK5 theory. Differs from MOD at the milliarcsecond
+  /// level; the two are not interchangeable.
+  MOD_FK5 = 21,
+  /// LEGACY, retained and NAMED: true equator of date on IAU-76/FK5.
+  TOD_FK5 = 22
 }
 
 /// StateVector.flags is a BITFIELD carrying any OR-combination of these, so it
@@ -102,6 +165,70 @@ enum PropagatorSourceKind : ubyte {
   SDP8 = 12
 }
 
+/// The negative return codes every propagator export shares.
+///
+/// These were documented in docs/propagator-abi.md and declared NOWHERE, so
+/// every module hand-typed them as literals and the contract lived only in
+/// prose. A propagator that returns -1 for everything is unconformable — the
+/// host cannot tell a bad entity index from an uninitialized module, so it
+/// cannot place the failure on the degradation ladder — and the cheapest way
+/// to end up there is having no names to return.
+///
+/// VALUES ARE FROZEN. New classes are appended downward.
+enum ErrorCode : byte (abi, abi_c_name: "OrbProPropagatorError", abi_c_prefix: "ORBPRO_PROP_") {
+  OK = 0,
+  /// No elements or ephemeris ingested yet.
+  NOT_INITIALIZED = -1,
+  /// Entity index at or beyond the entity count.
+  BAD_ENTITY_INDEX = -2,
+  /// The caller passed a null output pointer.
+  NULL_OUTPUT = -3,
+  /// Malformed or short input buffer.
+  BAD_INPUT = -4,
+  /// The solve failed to converge.
+  NOT_CONVERGED = -5,
+  /// The elements describe no closed orbit, or the result is not a number.
+  UNPHYSICAL = -6,
+  /// The ephemeris container is not one this module reads, or AUTO could not
+  /// identify it, or its declared frame has no member on the ReferenceFrame
+  /// roster.
+  UNSUPPORTED_FORMAT = -7,
+  /// The requested epoch lies outside every segment the loaded ephemeris
+  /// covers. A refusal, never a silent extrapolation: a caller cannot detect
+  /// an extrapolated state from the value alone.
+  EPOCH_OUT_OF_RANGE = -8
+}
+
+/// The container an ephemeris-driven propagator was handed on
+/// `plugin_init_ephemeris`. A format is DATA, not identity: one ephemeris
+/// provider reads every member below behind this discriminator rather than
+/// shipping one artifact per container, because the interpolation, the time
+/// scale handling and the frame rotation are shared and splitting them
+/// re-creates the five-mirror drift this file exists to end.
+///
+/// AUTO is the honest default: every container here is self-identifying in its
+/// first bytes (`DAF/SPK ` / `NAIF/DAF`, the OEM version keyword, the STK
+/// `stk.v.` banner, the SP3 `#d` line, the Code-500 fixed header block), so a
+/// caller that does not know what it fetched says so rather than guessing. A
+/// module that cannot identify the bytes returns UNSUPPORTED_FORMAT; it never
+/// falls back to a default container.
+///
+/// VALUES ARE FROZEN AND ARE NEVER RENUMBERED. New containers are APPENDED.
+enum EphemerisFormat : ubyte (abi, abi_c_name: "OrbProEphemerisFormat", abi_c_prefix: "ORBPRO_EPHEM_FORMAT_") {
+  /// Identify the container from its own leading bytes.
+  AUTO = 0,
+  /// CCSDS Orbit Ephemeris Message, keyword-value notation.
+  CCSDS_OEM_KVN = 1,
+  /// NAIF Double Precision Array File carrying SPK segments.
+  SPK_DAF = 2,
+  /// Fixed-record binary ephemeris, 500-word logical records.
+  CODE500 = 3,
+  /// Ephemeris interchange text with a scenario epoch and typed data blocks.
+  STK_EPHEMERIS = 4,
+  /// Precise orbit product, revision d.
+  SP3_D = 5
+}
+
 /// Orbital state vector — 64 bytes, 8-byte aligned. Mirrors
 /// `OrbProStateVector` in orbpro-integration/sdk/include/orbpro_propagator.h
 /// byte for byte:

package/schemas/orbpro/reference-frame-crosswalk.json

@@ -0,0 +1,108 @@
+{
+  "note": "Every ReferenceFrame-shaped vocabulary that crosses a seam with the orbpro.propagator ABI enum, and how each of its members maps ONTO that enum BY NAMED TOKEN. Numeric identity is never asserted across repositories: ECI==0, TEME==0 and FIXED==0 all collide, and ECEF is 1 in orbpro.plugins but 3 in the ABI. scripts/check-reference-frame-uniqueness.mjs holds this file and schemas/orbpro/Propagator.fbs to each other, and re-reads any listed source that is present on disk.",
+  "authority": "schemas/orbpro/Propagator.fbs :: enum ReferenceFrame",
+  "vocabularies": [
+    {
+      "id": "orbpro.plugins",
+      "description": "PropagatorState.fbs / \"PRST\" \u2014 the wire the compiled sgp4, hpop, conjunction-assessment and sensor-shader modules already emit. Its values are FROZEN by artifacts in the field; collapsing it into the ABI enum is a wire break, tracked as sdk-reference-frame-enum-unification.",
+      "repo": "space-data-network-modules",
+      "source": "propagator/sgp4/schemas/PropagatorState.fbs",
+      "members": {
+        "ECI": "ICRF",
+        "ECEF": "ECEF",
+        "TEME": "TEME",
+        "ICRF": "ICRF"
+      }
+    },
+    {
+      "id": "orbpro.engine",
+      "description": "The OrbPro engine's ReferenceFrame.js. NINE members, not the two this SDK's comment block claimed until 2026-08-30. FIXED/INERTIAL are INVERTED against the ABI's 0/1 \u2014 a live semantic difference, not a numbering accident \u2014 and reconciling that is sdk-reference-frame-enum-unification's job, not this crosswalk's. The four local orbital triads collapse onto OBJECT_REFERENCED with an axes spec.",
+      "repo": "OrbPro",
+      "source": "packages/engine/Source/Core/ReferenceFrame.js",
+      "members": {
+        "FIXED": "ECEF",
+        "INERTIAL": "ICRF",
+        "TEME": "TEME",
+        "VVLH": "OBJECT_REFERENCED",
+        "ENU": "TOPOCENTRIC",
+        "NED": "TOPOCENTRIC",
+        "NEU": "TOPOCENTRIC",
+        "RIC": "OBJECT_REFERENCED",
+        "LVLH": "OBJECT_REFERENCED"
+      }
+    },
+    {
+      "id": "orbpro.conjunction",
+      "description": "ConjunctionCommon.fbs, carried by the conjunction module.",
+      "repo": "space-data-network-modules",
+      "source": "analysis/conjunction-assessment/schemas/ConjunctionCommon.fbs",
+      "members": {
+        "UNKNOWN": null,
+        "ECI": "ICRF",
+        "ECEF": "ECEF",
+        "TEME": "TEME",
+        "ICRF": "ICRF"
+      }
+    },
+    {
+      "id": "modules.foundation.frames",
+      "description": "foundation/frames AxisType, mirroring SDS rfmAxisType. It is an ORIENTATION RULE roster and carries no origin, so it is not a ReferenceFrame; the mapping below is the axis half only, and a consumer still needs the RFMOrigin to have a coordinate system.",
+      "repo": "space-data-network-modules",
+      "source": "foundation/frames/src/axis_engine.hpp",
+      "members": {
+        "UNSPECIFIED": null,
+        "MJ2000EQ": "J2000",
+        "MJ2000EC": "MJ2000EC",
+        "ICRF": "ICRF",
+        "TEME": "TEME",
+        "MOD": "MOD",
+        "TOD": "TOD",
+        "MOE": "MOE",
+        "TOE": "TOE",
+        "BODY_FIXED": "BODY_FIXED",
+        "BODY_INERTIAL": "BODY_INERTIAL",
+        "OBJECT_REFERENCED": "OBJECT_REFERENCED",
+        "LOCAL_ALIGNED_CONSTRAINED": "LOCAL_ALIGNED_CONSTRAINED",
+        "EQUATOR": "EQUATOR",
+        "GSE": "GSE",
+        "GSM": "GSM",
+        "TOPOCENTRIC": "TOPOCENTRIC",
+        "BODY_SPIN_SUN": "BODY_SPIN_SUN",
+        "SPICE_DEFINED": "SPICE_DEFINED",
+        "MOD_FK5": "MOD_FK5",
+        "TOD_FK5": "TOD_FK5",
+        "ITRF": "ECEF"
+      }
+    },
+    {
+      "id": "modules.hpop.coords",
+      "description": "The HPOP propagator's internal chain vocabulary.",
+      "repo": "space-data-network-modules",
+      "source": "propagator/hpop/lib/coords_types.h",
+      "members": {
+        "TEME": "TEME",
+        "GCRF": "ICRF",
+        "ITRF": "ECEF",
+        "J2000": "J2000",
+        "ECEF": "ECEF",
+        "TOD": "TOD",
+        "MOD": "MOD"
+      }
+    }
+  ],
+  "rtnConvention": {
+    "abiMember": "OBJECT_REFERENCED",
+    "note": "The three live RTN triads collapse to ONE ABI member plus an axes spec. RIC, RSW and RTN name the SAME triad (x radial, z orbit normal, y completing); LVLH and VVLH are relabellings of it produced by naming a different primary. None of them is a separate ReferenceFrame, and adding a second RTN-named ABI member is a defect this check refuses.",
+    "aliases": [
+      "RIC",
+      "RSW",
+      "RTN",
+      "LVLH",
+      "VVLH",
+      "QSW",
+      "NTW",
+      "TNW",
+      "UVW"
+    ]
+  }
+}

package/schemas/orbpro/reference-frame.lock.json

@@ -0,0 +1,98 @@
+{
+  "note": "The committed numbering of the ONE ReferenceFrame enum that crosses the ABI seam. scripts/check-reference-frame-uniqueness.mjs holds schemas/orbpro/Propagator.fbs to this file: values 0-5 are FROZEN and no member may ever be renamed, renumbered or removed. Appending a member means appending a row here in the same commit.",
+  "frozenThrough": 5,
+  "members": [
+    {
+      "name": "TEME",
+      "value": 0
+    },
+    {
+      "name": "J2000",
+      "value": 1
+    },
+    {
+      "name": "ICRF",
+      "value": 2
+    },
+    {
+      "name": "ECEF",
+      "value": 3
+    },
+    {
+      "name": "MCI",
+      "value": 4
+    },
+    {
+      "name": "MCMF",
+      "value": 5
+    },
+    {
+      "name": "MJ2000EC",
+      "value": 6
+    },
+    {
+      "name": "MOD",
+      "value": 7
+    },
+    {
+      "name": "TOD",
+      "value": 8
+    },
+    {
+      "name": "MOE",
+      "value": 9
+    },
+    {
+      "name": "TOE",
+      "value": 10
+    },
+    {
+      "name": "BODY_FIXED",
+      "value": 11
+    },
+    {
+      "name": "BODY_INERTIAL",
+      "value": 12
+    },
+    {
+      "name": "OBJECT_REFERENCED",
+      "value": 13
+    },
+    {
+      "name": "LOCAL_ALIGNED_CONSTRAINED",
+      "value": 14
+    },
+    {
+      "name": "EQUATOR",
+      "value": 15
+    },
+    {
+      "name": "GSE",
+      "value": 16
+    },
+    {
+      "name": "GSM",
+      "value": 17
+    },
+    {
+      "name": "TOPOCENTRIC",
+      "value": 18
+    },
+    {
+      "name": "BODY_SPIN_SUN",
+      "value": 19
+    },
+    {
+      "name": "SPICE_DEFINED",
+      "value": 20
+    },
+    {
+      "name": "MOD_FK5",
+      "value": 21
+    },
+    {
+      "name": "TOD_FK5",
+      "value": 22
+    }
+  ]
+}

package/src/browser.js

@@ -29,6 +29,19 @@ export {
   zeroWasmBytes,
   isSharedArrayBufferLike,
 } from "./host/browserModuleHarness.js";
+// The wasi-threads BROWSER WORKER ANCHOR. A bundling consumer MUST tell the SDK
+// where its build serves the host worker chain from — `import.meta.url` inside a
+// bundle points at the bundle, not at the package layout, and the worker 404s
+// (fail-loud: WasiThreadWorkerUnreachableError). Either call
+// `setBrowserWasiThreadWorkerBase(...)` once in the host shim, or pass
+// `wasiThreadWorkerBaseUrl` to `createBrowserModuleHarness`.
+export {
+  setBrowserWasiThreadWorkerBase,
+  getBrowserWasiThreadWorkerBase,
+  resolveBrowserWorkerUrl,
+  DEFAULT_BROWSER_WORKER_URL,
+  WasiThreadWorkerUnreachableError,
+} from "./host/wasiThreadHost.js";
 // The runtime-target gate is reachable so a consumer can catch the refusal by
 // CLASS (`error instanceof RuntimeTargetError`) rather than by matching a
 // message string, and can ask the same question the loaders ask before it

package/src/conformance/estimationReference.js

@@ -0,0 +1,81 @@
+/**
+ * A deterministic, non-physics reference receipt for exercising the
+ * estimation-family conformance evaluator. Real modules replace every value
+ * with measurements produced by their compiled WASM artifact. Keeping the
+ * evaluator's own known-good input here lets the negative controls prove that
+ * each required lane can fail without shipping a second JS estimator.
+ */
+
+const reference = {
+  schemaVersion: 1,
+  family: "estimation",
+  artifact: { sha256: "reference-estimation-artifact" },
+  runtime: {
+    browser: { outputSha256: "reference-output" },
+    wasmedge: { outputSha256: "reference-output" },
+    threads: {
+      "1": "reference-output",
+      "2": "reference-output",
+      "4": "reference-output",
+      "8": "reference-output",
+    },
+  },
+  batch: {
+    positionAbsoluteErrorM: 0.25,
+    positionRelativeError: 4e-8,
+    covarianceRssRelativeError: 0.02,
+    residualRmsRelativeError: 2e-8,
+    rejectedExpected: [7, 19],
+    rejectedActual: [7, 19],
+    iterationCount: 4,
+    iterationCovarianceCount: 4,
+    iterationCovariancesSpd: true,
+  },
+  filter: {
+    positionErrorM: 0.65,
+    smootherPositionErrorM: 0.21,
+    smootherCovarianceMonotone: true,
+    neesMean: 6.02,
+    nees95Lower: 5.34,
+    nees95Upper: 6.70,
+    sncCovarianceGrowthRatio: 1.21,
+    dmcCovarianceGrowthRatio: 1.58,
+    ekfUkfCovarianceDifference: 0.08,
+  },
+  measurements: {
+    rangeMaxRelativeError: 6e-16,
+    rangeRateMaxRelativeError: 5e-16,
+    azElMaxRelativeError: 5e-16,
+    raDecMaxRelativeError: 5e-16,
+    lightTimeMagnitudeErrorM: 2e-10,
+    sagnacMagnitudeErrorM: 2e-10,
+  },
+  media: {
+    hopfieldSaastamoinenMaxRelativeError: 6e-5,
+    mariniMaxRelativeError: 7e-5,
+    p531PublishedPrecisionError: 0,
+  },
+  iod: {
+    gaussPrintedPrecisionError: 0,
+    laplacePrintedPrecisionError: 0,
+    gibbsPrintedPrecisionError: 0,
+    herrickGibbsPrintedPrecisionError: 0,
+  },
+  simulator: {
+    runs: 200,
+    stateInsideThreeSigmaFraction: 0.965,
+    recoveredNoiseSigmaRelativeError: 0.031,
+  },
+  invariants: {
+    covarianceSymmetric: true,
+    covariancePositiveDefinite: true,
+    residualOrthogonalityMax: 3e-11,
+    actualOcmCovariance: true,
+  },
+};
+
+export const ESTIMATION_REFERENCE_EVIDENCE = Object.freeze(reference);
+
+export function makeEstimationReferenceEvidence() {
+  return structuredClone(reference);
+}

package/src/conformance/estimationSuite.js

@@ -0,0 +1,134 @@
+/** Estimation-family conformance receipt evaluator. No physics lives here. */
+
+import { computeVerdict } from "./propagatorSuite.js";
+
+const pass = (id, tier, detail) => ({ id, tier, required: true, status: "pass", detail });
+const fail = (id, tier, detail) => ({ id, tier, required: true, status: "fail", detail });
+
+function check(checks, id, tier, condition, detail, failure = detail) {
+  checks.push(condition ? pass(id, tier, detail) : fail(id, tier, failure));
+}
+
+function finiteAtMost(value, limit) {
+  return Number.isFinite(value) && value <= limit;
+}
+
+function sameSet(left = [], right = []) {
+  const a = [...new Set(left)].sort((x, y) => x - y);
+  const b = [...new Set(right)].sort((x, y) => x - y);
+  return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+
+export function runEstimationSuite(evidence) {
+  const checks = [];
+  const runtimeHashes = [
+    evidence?.runtime?.browser?.outputSha256,
+    evidence?.runtime?.wasmedge?.outputSha256,
+    evidence?.runtime?.threads?.["1"],
+    evidence?.runtime?.threads?.["2"],
+    evidence?.runtime?.threads?.["4"],
+    evidence?.runtime?.threads?.["8"],
+  ];
+  check(checks, "tier0/tri-runtime-byte-identity", "0",
+    runtimeHashes.every(Boolean) && new Set(runtimeHashes).size === 1,
+    "browser, WasmEdge and worker widths 1/2/4/8 emitted byte-identical results",
+    "missing or divergent browser/WasmEdge/thread-width output digests");
+
+  const batch = evidence?.batch ?? {};
+  check(checks, "tierA/batch-state", "A",
+    finiteAtMost(batch.positionAbsoluteErrorM, 1) &&
+      finiteAtMost(batch.positionRelativeError, 1e-3),
+    `absolute=${batch.positionAbsoluteErrorM} m relative=${batch.positionRelativeError}`,
+    "batch state exceeds 1 m absolute or 1e-3 relative");
+  check(checks, "tierA/batch-covariance", "A",
+    finiteAtMost(batch.covarianceRssRelativeError, 0.05),
+    `RSS position sigma relative error=${batch.covarianceRssRelativeError}`,
+    "batch covariance RSS differs from authority by more than 5%");
+  check(checks, "tierA/batch-residual-rms", "A",
+    finiteAtMost(batch.residualRmsRelativeError, 1e-6),
+    `residual RMS relative error=${batch.residualRmsRelativeError}`,
+    "batch residual RMS differs from authority by more than 1e-6 relative");
+  check(checks, "tierA/sigma-edit-set", "A",
+    sameSet(batch.rejectedExpected, batch.rejectedActual),
+    `exact rejected set [${batch.rejectedActual ?? []}]`,
+    "sigma editing rejected a different observation set");
+  check(checks, "tierC/batch-iteration-covariance", "C",
+    Number.isInteger(batch.iterationCount) && batch.iterationCount > 0 &&
+      batch.iterationCovarianceCount === batch.iterationCount &&
+      batch.iterationCovariancesSpd === true,
+    `${batch.iterationCovarianceCount}/${batch.iterationCount} iteration covariances are SPD`,
+    "batch iteration covariance history is missing, incomplete, or not SPD");
+
+  const filter = evidence?.filter ?? {};
+  check(checks, "tierA/filter-and-smoother-state", "A",
+    finiteAtMost(filter.positionErrorM, 1) &&
+      finiteAtMost(filter.smootherPositionErrorM, 0.5),
+    `filter=${filter.positionErrorM} m smoother=${filter.smootherPositionErrorM} m`,
+    "filter exceeds 1 m or RTS smoother exceeds 0.5 m");
+  check(checks, "tierC/smoother-covariance", "C",
+    filter.smootherCovarianceMonotone === true,
+    "smoothed covariance is no larger than filtered covariance at every epoch");
+  check(checks, "tierC/nees-100-run", "C",
+    Number.isFinite(filter.neesMean) && filter.neesMean >= filter.nees95Lower &&
+      filter.neesMean <= filter.nees95Upper,
+    `NEES mean=${filter.neesMean} band=[${filter.nees95Lower},${filter.nees95Upper}]`,
+    "100-run NEES lies outside the declared chi-square 95% band");
+  check(checks, "tierC/process-noise", "C",
+    Number.isFinite(filter.sncCovarianceGrowthRatio) && filter.sncCovarianceGrowthRatio !== 1 &&
+      Number.isFinite(filter.dmcCovarianceGrowthRatio) && filter.dmcCovarianceGrowthRatio !== 1,
+    `SNC ratio=${filter.sncCovarianceGrowthRatio} DMC ratio=${filter.dmcCovarianceGrowthRatio}`,
+    "SNC or DMC failed to change covariance growth");
+  check(checks, "tierC/ekf-ukf-not-aliased", "C",
+    Number.isFinite(filter.ekfUkfCovarianceDifference) && filter.ekfUkfCovarianceDifference > 0,
+    `covariance history distance=${filter.ekfUkfCovarianceDifference}`,
+    "EKF and UKF covariance histories are identical");
+
+  const measurement = evidence?.measurements ?? {};
+  for (const [name, key] of [["range", "rangeMaxRelativeError"],
+    ["range-rate", "rangeRateMaxRelativeError"], ["az-el", "azElMaxRelativeError"],
+    ["ra-dec", "raDecMaxRelativeError"]]) {
+    check(checks, `tierA/measurement-${name}`, "A", finiteAtMost(measurement[key], 1e-6),
+      `max relative error=${measurement[key]}`, `${name} exceeds 1e-6 relative`);
+  }
+  check(checks, "tierA/light-time", "A", finiteAtMost(measurement.lightTimeMagnitudeErrorM, 1e-6),
+    `magnitude error=${measurement.lightTimeMagnitudeErrorM} m`);
+  check(checks, "tierA/sagnac", "A", finiteAtMost(measurement.sagnacMagnitudeErrorM, 1e-6),
+    `magnitude error=${measurement.sagnacMagnitudeErrorM} m`);
+
+  const media = evidence?.media ?? {};
+  check(checks, "tierA/troposphere-hopfield-saastamoinen", "A",
+    finiteAtMost(media.hopfieldSaastamoinenMaxRelativeError, 1e-4),
+    `relative error=${media.hopfieldSaastamoinenMaxRelativeError}`);
+  check(checks, "tierA/troposphere-marini", "A",
+    finiteAtMost(media.mariniMaxRelativeError, 1e-4),
+    `relative error=${media.mariniMaxRelativeError}`);
+  check(checks, "tierB/ionosphere-p531", "B", media.p531PublishedPrecisionError === 0,
+    "P.531 table value reproduced to published precision");
+
+  for (const [name, key] of [["gauss", "gaussPrintedPrecisionError"],
+    ["laplace", "laplacePrintedPrecisionError"], ["gibbs", "gibbsPrintedPrecisionError"],
+    ["herrick-gibbs", "herrickGibbsPrintedPrecisionError"]]) {
+    check(checks, `tierB/iod-${name}`, "B", evidence?.iod?.[key] === 0,
+      "Vallado worked example reproduced to printed precision");
+  }
+
+  const simulator = evidence?.simulator ?? {};
+  check(checks, "tierC/simulator-coverage", "C",
+    simulator.runs >= 200 && simulator.stateInsideThreeSigmaFraction >= 0.95,
+    `${simulator.stateInsideThreeSigmaFraction} inside 3-sigma over ${simulator.runs} runs`);
+  check(checks, "tierC/simulator-noise-recovery", "C",
+    finiteAtMost(simulator.recoveredNoiseSigmaRelativeError, 0.05),
+    `noise sigma relative error=${simulator.recoveredNoiseSigmaRelativeError}`);
+
+  const invariants = evidence?.invariants ?? {};
+  check(checks, "tierC/covariance-spd", "C",
+    invariants.covarianceSymmetric === true && invariants.covariancePositiveDefinite === true,
+    "covariance is symmetric positive definite");
+  check(checks, "tierC/residual-orthogonality", "C",
+    finiteAtMost(invariants.residualOrthogonalityMax, 1e-6),
+    `max normalized normal-equation projection=${invariants.residualOrthogonalityMax}`);
+  check(checks, "tierC/ocm-covariance", "C", invariants.actualOcmCovariance === true,
+    "the emitted OCM carries the estimator covariance");
+
+  return { checks, verdict: computeVerdict(checks) };
+}