space-data-module-sdk 0.8.16 → 0.8.18

package/bin/space-data-module.js

@@ -246,6 +246,9 @@ function printUsage() {
   space-data-module conformance propagator --artifact ./dist/isomorphic/module.wasm             (official-harness conformance: WASM artifacts only)
   space-data-module conformance propagator --artifact ./dist/isomorphic/module.wasm --vectors ./vectors/vectors.json --json
   space-data-module conformance propagator --self-test                                          (must exit 0 BY failing: planted defects all caught)
+  space-data-module conformance estimation --evidence ./conformance/estimation-evidence.json    (evaluates Tier 0/A/B/C evidence and exact edit sets)
+  space-data-module conformance estimation --evidence ./conformance/estimation-evidence.json --json
+  space-data-module conformance estimation --self-test                                          (proves EKF/UKF alias, runtime divergence, and placeholder OCM are caught)
   space-data-module flow check ./flows/my.flow.json --deps ./modules-root
   space-data-module flow compile ./flows/my.flow.json --deps ./modules-root [--out ./flows/my/dist]
   space-data-module protect --manifest ./manifest.json --wasm ./dist/module.wasm --json
@@ -435,6 +438,9 @@ async function runConformanceCommand(argv) {
       case "--vectors":
         options.vectorsPath = path.resolve(requireValue(rest, ++index, value));
         break;
+      case "--evidence":
+        options.evidencePath = path.resolve(requireValue(rest, ++index, value));
+        break;
       case "--json":
         options.json = true;
         break;
@@ -458,25 +464,37 @@ async function runConformanceCommand(argv) {
   const conformance = await import("../src/conformance/index.js");
 
   if (options.selfTest) {
-    if (family !== "propagator") {
-      throw new conformance.UnknownConformanceFamilyError(family);
-    }
-    const outcome = await conformance.runPropagatorSelfTest();
+    const outcome = family === "propagator"
+      ? await conformance.runPropagatorSelfTest()
+      : family === "estimation"
+        ? await conformance.runEstimationSelfTest()
+        : (() => { throw new conformance.UnknownConformanceFamilyError(family); })();
     if (options.json) {
       console.log(JSON.stringify(outcome, null, 2));
     } else {
-      console.log(conformance.formatSelfTestReport(outcome));
+      if (family === "propagator") {
+        console.log(conformance.formatSelfTestReport(outcome));
+      } else {
+        console.log(`estimation conformance self-test — ${outcome.ok ? "PASS" : "FAIL"}`);
+        for (const control of outcome.controls) {
+          console.log(`  [${control.caught ? "PASS" : "FAIL"}] ${control.id}`);
+        }
+      }
     }
     return outcome.ok ? 0 : 1;
   }
 
-  if (!options.artifactPath) {
+  if (family === "estimation" && !options.evidencePath) {
+    throw new Error("estimation conformance requires --evidence <receipt.json>.");
+  }
+  if (family !== "estimation" && !options.artifactPath) {
     throw new Error("conformance requires --artifact <module.wasm> (or --self-test).");
   }
   const report = await conformance.runConformance({
     family,
     artifactPath: options.artifactPath,
     vectorsPath: options.vectorsPath,
+    evidencePath: options.evidencePath,
     leak: options.leak,
   });
   if (options.json) {

package/docs/browser-wasmedge-isomorphic.html

@@ -54,7 +54,7 @@
 <li><a href="./families/effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./families/data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./families/analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./families/scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/byo-wasm-quickstart.html

@@ -54,7 +54,7 @@
 <li><a href="./families/effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./families/data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./families/analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./families/scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/conformance.html

@@ -54,7 +54,7 @@
 <li><a href="./families/effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./families/data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./families/analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./families/scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>
@@ -83,20 +83,24 @@
       </nav>
       <main class="doc" id="main">
         <h1>Conformance kit</h1>
-<p><strong>Status:</strong> v1 — W1.4 of <code>graph/tasks/official-harness-shapes-program.md</code>, implementing <code>graph/findings/official-harness-shapes.md</code> §5. Family kits: <code>propagator</code> (SHIP 1). Maneuver is Wave 2 (EXPERIMENTAL, fix-then-freeze); OD is deferred by ruling. <strong>A family with no kit can never be <code>CORE</code>.</strong></p>
+<p><strong>Status:</strong> v1 — W1.4 of <code>graph/tasks/official-harness-shapes-program.md</code>, implementing <code>graph/findings/official-harness-shapes.md</code> §5. Shipped family kits: <code>propagator</code> and <code>estimation</code>. Maneuver is Wave 2 (EXPERIMENTAL, fix-then-freeze). <strong>A family with no kit can never be <code>CORE</code>.</strong></p>
 <p>WASM artifacts ONLY (owner ruling 2026-08-10: &quot;No JS propagator!!!! WASM ONLY&quot;). The runner instantiates a compiled <code>dist/isomorphic/module.wasm</code> and drives the family's ABI directly; there is no path that certifies a JavaScript object, because JS registries are internal engine plumbing, never a public contract.</p>
 <h2 id="commands"><a class="anchor" href="#commands" aria-hidden="true">#</a>Commands</h2>
 <div class="codeblock"><pre><code>space-data-module conformance propagator --artifact ./dist/isomorphic/module.wasm
 space-data-module conformance propagator --artifact ./dist/isomorphic/module.wasm \
     --vectors ./vectors/vectors.json --json
-space-data-module conformance propagator --self-test    # must exit 0 BY failing</code></pre></div>
+space-data-module conformance propagator --self-test    # must exit 0 BY failing
+space-data-module conformance estimation --artifact ./dist/isomorphic/module.wasm \
+    --evidence ./conformance/estimation-receipt.json
+space-data-module conformance estimation --self-test    # planted failures</code></pre></div>
 <ul>
 <li><code>--artifact</code> — the compiled module. Its sha256 goes in the report; a conformance claim binds to CONTENT, not to a name.</li>
 <li><code>--vectors</code> — the module's corpus (<code>vectors.json</code> + <code>PROVENANCE.md</code>, the format proven by the reference module's <code>vectors/</code> suite). Default: the runner walks up from the artifact to the package root and takes <code>vectors/vectors.json</code>. <strong>The corpus is the module's own</strong>: Tier B anchors are model-specific, so a two-body corpus is never forced onto an SGP4 module, and a missing corpus is a NAMED GAP, never a silent pass.</li>
 <li><code>--leak-warmup / --leak-cycles / --leak-entities</code> — lifecycle-leak window overrides (defaults 20 / 200 / 256, the reference module's proven numbers).</li>
+<li><code>--evidence</code> — an estimation receipt binding the artifact hash to browser/WasmEdge/thread-width byte digests and the named Orekit, Vallado, media, Monte-Carlo and invariant outcomes. The evaluator contains no JS estimator; it adjudicates results produced by the compiled artifact.</li>
 <li>Exit codes: <code>PASS</code> and <code>PASS-WITH-GAPS</code> exit 0 (gaps are listed in the report); <code>FAIL</code> exits 1 with the offending check and case named.</li>
 </ul>
-<p>Library surface: <code>space-data-module-sdk/conformance</code> exports <code>runConformance</code>, <code>runPropagatorSuite</code>, <code>runPropagatorSelfTest</code>, <code>computeVerdict</code>, the ABI driver and the error-code table.</p>
+<p>Library surface: <code>space-data-module-sdk/conformance</code> exports <code>runConformance</code>, <code>runPropagatorSuite</code>, <code>runPropagatorSelfTest</code>, <code>runEstimationSuite</code>, <code>runEstimationSelfTest</code>, <code>computeVerdict</code>, the ABI driver and the error-code table.</p>
 <h2 id="what-is-checked"><a class="anchor" href="#what-is-checked" aria-hidden="true">#</a>What is checked</h2>
 <div class="table-wrap"><table><thead><tr><th>Tier</th><th>Check</th><th>Source of authority</th></tr></thead><tbody><tr><td>0</td><td>real instantiation + required export set</td><td><a href="./families/propagator.html">propagator-abi.md</a> §The export set</td></tr><tr><td>0</td><td>cross-runtime byte-identity</td><td><strong>GAP here by design</strong> — the parity gate (<code>space-data-module parity-gate</code>) is the Tier 0 authority; this runner never re-certifies half of it</td></tr><tr><td>B</td><td>corpus anchors reproduced within band</td><td>the module's <code>vectors.json</code> (tolerance policy `abs + rel *</td><td>expected</td><td>`); NaN is its own failure class</td></tr><tr><td>C</td><td>vis-viva closure, period closure</td><td>corpus-declared invariants (<code>conformance.mu</code> from the corpus; ECEF un-rotation when the module declares frame 3) — run only where the corpus declares them applicable to the model</td></tr><tr><td>C</td><td>determinism as BYTES, surviving destroy/re-ingest</td><td>ABI §Parity envelope</td></tr><tr><td>C</td><td>frame/flags/reserved declared, corpus-consistent</td><td>ABI §Frames — a frame declaration that contradicts the module's own corpus is the silently-wrong-numbers defect</td></tr><tr><td>C</td><td>batch and single agree exactly</td><td>ABI §Threading — the batch path is the same physics</td></tr><tr><td>C</td><td>typed refusals (NOT_INITIALIZED / BAD_ENTITY_INDEX / unphysical ingest)</td><td>ABI §Error codes — the degradation ladder needs distinguishable codes</td></tr><tr><td>C</td><td>create RETURNS its handle</td><td>ABI §Identity — &quot;the entity I just created is count−1&quot; is the race the harness exists to kill (finding §4.4)</td></tr><tr><td>4</td><td>lifecycle leak: zero page growth after warm-up</td><td>ABI §Lifetime</td></tr><tr><td>4</td><td>destroy idempotent, refuses typed, comes back cleanly</td><td>ABI §Lifetime</td></tr><tr><td>4</td><td>leak-metric negative control</td><td>a gate never observed to fail is indistinguishable from one that cannot fail</td></tr></tbody></table></div>
 <h2 id="the-self-test"><a class="anchor" href="#the-self-test" aria-hidden="true">#</a>The self-test</h2>
@@ -105,8 +109,10 @@ space-data-module conformance propagator --self-test    # must exit 0 BY failing
 <p>The self-test exits 0 only when the conformant baseline mock is clean AND every planted defect is caught by the check that owns it. It needs no toolchain, no artifact and no network — <code>npm run conformance:self-test</code>.</p>
 <h2 id="receipt-trust-wave-4-not-yet-wired"><a class="anchor" href="#receipt-trust-wave-4-not-yet-wired" aria-hidden="true">#</a>Receipt &amp; trust (Wave 4, not yet wired)</h2>
 <p>The conformance receipt travels as a bundle <code>ATTESTATION</code> entry (publisher-signed under bundle scope); the graduated listing requirement (receipt REQUIRED for <code>CORE</code>+<code>ANONYMOUS</code>, badge for <code>RECOMMENDED</code>) and the <code>SDN-CONFORMANCE-RECEIPT-V1</code> third-party attestor domain are W4.1/W4.2 of the program — see the finding §5 &quot;Receipt &amp; trust&quot;.</p>
+<p>The estimation self-test plants runtime-byte divergence, the historical EKF/UKF covariance alias, and a placeholder <code>$OCM</code>. All three must be caught.</p>
 <h2 id="reference-implementation"><a class="anchor" href="#reference-implementation" aria-hidden="true">#</a>Reference implementation</h2>
 <p><code>space-data-network-modules propagator/keplerian-reference</code> is the exemplar the kit was generalized from: its <code>tests/</code> are the original expression of these checks, its <code>vectors/</code> suite is the corpus format, and <code>tests/sdk-conformance-runner.test.mjs</code> proves the runner reaches the same verdict on the same artifact — including the corrupted-corpus negative control.</p>
+<p><code>templates/estimation-module</code> is the force-model-blind estimation reference. Its compiled direct export performs a covariance-form position update against a caller-supplied propagator sample; it contains no propagator and no JS physics.</p>
 
         <p class="doc-footer">
           Source of truth for this page:

package/docs/conformance.md

@@ -1,9 +1,9 @@
 # Conformance runner
 
 **Status:** v1 — W1.4 of `graph/tasks/official-harness-shapes-program.md`,
-implementing `graph/findings/official-harness-shapes.md` §5. Family kits:
-`propagator` (SHIP 1). Maneuver is Wave 2 (EXPERIMENTAL, fix-then-freeze); OD
-is deferred by ruling. **A family with no kit can never be `CORE`.**
+implementing `graph/findings/official-harness-shapes.md` §5. Shipped family
+kits: `propagator` and `estimation`. Maneuver is Wave 2 (EXPERIMENTAL,
+fix-then-freeze). **A family with no kit can never be `CORE`.**
 
 WASM artifacts ONLY (owner ruling 2026-08-10: "No JS propagator!!!! WASM
 ONLY"). The runner instantiates a compiled `dist/isomorphic/module.wasm` and
@@ -18,6 +18,9 @@ space-data-module conformance propagator --artifact ./dist/isomorphic/module.was
 space-data-module conformance propagator --artifact ./dist/isomorphic/module.wasm \
     --vectors ./vectors/vectors.json --json
 space-data-module conformance propagator --self-test    # must exit 0 BY failing
+space-data-module conformance estimation --artifact ./dist/isomorphic/module.wasm \
+    --evidence ./conformance/estimation-receipt.json
+space-data-module conformance estimation --self-test    # planted failures
 ```
 
 - `--artifact` — the compiled module. Its sha256 goes in the report; a
@@ -30,12 +33,17 @@ space-data-module conformance propagator --self-test    # must exit 0 BY failing
   module, and a missing corpus is a NAMED GAP, never a silent pass.
 - `--leak-warmup / --leak-cycles / --leak-entities` — lifecycle-leak window
   overrides (defaults 20 / 200 / 256, the reference module's proven numbers).
+- `--evidence` — an estimation receipt binding the artifact hash to
+  browser/WasmEdge/thread-width byte digests and the named Orekit, Vallado,
+  media, Monte-Carlo and invariant outcomes. The evaluator contains no JS
+  estimator; it adjudicates results produced by the compiled artifact.
 - Exit codes: `PASS` and `PASS-WITH-GAPS` exit 0 (gaps are listed in the
   report); `FAIL` exits 1 with the offending check and case named.
 
 Library surface: `space-data-module-sdk/conformance` exports
 `runConformance`, `runPropagatorSuite`, `runPropagatorSelfTest`,
-`computeVerdict`, the ABI driver and the error-code table.
+`runEstimationSuite`, `runEstimationSelfTest`, `computeVerdict`, the ABI driver
+and the error-code table.
 
 ## What is checked
 
@@ -82,6 +90,9 @@ The conformance receipt travels as a bundle `ATTESTATION` entry
 `SDN-CONFORMANCE-RECEIPT-V1` third-party attestor domain are W4.1/W4.2 of the
 program — see the finding §5 "Receipt & trust".
 
+The estimation self-test plants runtime-byte divergence, the historical
+EKF/UKF covariance alias, and a placeholder `$OCM`. All three must be caught.
+
 ## Reference implementation
 
 `space-data-network-modules propagator/keplerian-reference` is the exemplar
@@ -90,3 +101,8 @@ these checks, its `vectors/` suite is the corpus format, and
 `tests/sdk-conformance-runner.test.mjs` proves the runner reaches the same
 verdict on the same artifact — including the corrupted-corpus negative
 control.
+
+`templates/estimation-module` is the force-model-blind estimation reference.
+Its compiled direct export performs a covariance-form position update against
+a caller-supplied propagator sample; it contains no propagator and no JS
+physics.

package/docs/events-abi.html

@@ -54,7 +54,7 @@
 <li><a href="./families/effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./families/data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./families/analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./families/scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/families/analytics.html

@@ -54,7 +54,7 @@
 <li><a href="./effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./analytics.html" aria-current="page"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/families/attitude.html

@@ -54,7 +54,7 @@
 <li><a href="./effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/families/behavior.html

@@ -54,7 +54,7 @@
 <li><a href="./effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/families/breakup.html

@@ -54,7 +54,7 @@
 <li><a href="./effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/families/conjunction.html

@@ -54,7 +54,7 @@
 <li><a href="./effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/families/data-source.html

@@ -54,7 +54,7 @@
 <li><a href="./effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./data-source.html" aria-current="page"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>
@@ -88,6 +88,10 @@
 <p><strong>Status:</strong> v1 — owner directive 2026-08-07, graph task <code>sdk-provider-access-abi</code>.</p>
 <p>One generalized port that lets a WASM module <strong>control</strong> imagery and terrain providers and <strong>read the already-decoded bytes</strong> those providers hold in memory — identical import names and signatures in the browser, in native WasmEdge, and in the Docker WasmEdge container.</p>
 <p>This is a <em>provider access</em> port, not a <em>Cesium</em> port and not an <em>OrbPro</em> port. Nothing in the guest ABI names an engine, a tile scheme, or a vendor. The same three imports serve a browser engine's live quadtree cache, a host-side tile store, and a deterministic test fixture.</p>
+<h2 id="what-this-port-is-not"><a class="anchor" href="#what-this-port-is-not" aria-hidden="true">#</a>What this port is NOT</h2>
+<p>Stated because it was read the other way and a consumer nearly built on it: this is a <strong>raster tile</strong> port. <code>sdm_provider_tile_desc_t.kind</code> has exactly two members — terrain and imagery — and every <code>acquire</code> operation (<code>tile</code>, <code>profile</code>, <code>region</code>) is geospatial. There is no <code>kind</code>, no <code>encoding</code> and no operation that describes a DAF record, an ephemeris block, a tracking-data message or any other non-raster container.</p>
+<p>A module that reads bytes which are not tiles does <strong>not</strong> use this port. It takes those bytes on a declared input port of its own method surface, as <code>data-source/oem-source-iss</code> does (<code>pluginFamily: &quot;data_source&quot;</code>, <code>capabilities: []</code>, <code>externalInterfaces: []</code>), and an ephemeris container reaches a propagator through <code>plugin_init_ephemeris</code> — see <a href="./propagator.html#ephemeris-ingest">the propagator ABI</a>. Stretching a tile descriptor over a record stream would be an ABI-shaped lie, which is the exact failure this SDK exists to prevent.</p>
+<p>Scope note on the family matrix: <code>docs/harness-family-matrix.md</code> lists data-source as covered by &quot;a conformance kit and a reference module&quot;. No data-source conformance kit exists — <code>src/conformance/index.js</code> freezes <code>CONFORMANCE_FAMILIES</code> to <code>[&quot;propagator&quot;]</code>, which is today the only harnessed family with a kit. Read the matrix row as the reference-module claim only.</p>
 <h2 id="doctrine"><a class="anchor" href="#doctrine" aria-hidden="true">#</a>Doctrine</h2>
 <p>Four rules govern every line below.</p>
 <ol>
@@ -266,7 +270,8 @@ sdm_provider_release(h);</code></pre></div>
           <code>npm run build:docs</code>.
         </p>
       </main>
-<nav class="rail" aria-label="On this page"><h2>On this page</h2><ul><li><a class="depth-2" href="#doctrine">Doctrine</a></li>
+<nav class="rail" aria-label="On this page"><h2>On this page</h2><ul><li><a class="depth-2" href="#what-this-port-is-not">What this port is NOT</a></li>
+<li><a class="depth-2" href="#doctrine">Doctrine</a></li>
 <li><a class="depth-2" href="#capability">Capability</a></li>
 <li><a class="depth-2" href="#the-import-set">The import set</a></li>
 <li><a class="depth-2" href="#tile-descriptor">Tile descriptor</a></li>

package/docs/families/effects.html

@@ -54,7 +54,7 @@
 <li><a href="./effects.html" aria-current="page"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/families/environment.html

@@ -54,7 +54,7 @@
 <li><a href="./effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./estimation.html"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>

package/docs/families/estimation.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <meta name="description" content="Status: EXPERIMENTAL. A production orbit-determination module is shipped and" />
+    <meta name="description" content="Status: RATIFIED. The estimation harness is the measurement-based orbit" />
     <title>Estimation — Space Data Module SDK</title>
     <link rel="stylesheet" href="../styles.css" />
     <!-- SDN_CONSUMER_ASSETS_START -->
@@ -54,7 +54,7 @@
 <li><a href="./effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
 </ul>
 <h2>Estimation, data and logic</h2><ul>
-<li><a href="./estimation.html" aria-current="page"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./estimation.html" aria-current="page"><span>Estimation</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
 <li><a href="./analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
 <li><a href="./scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>
@@ -84,46 +84,54 @@
       <main class="doc" id="main">
       <p class="breadcrumb"><a href="../index.html">Harness families</a> / Estimation, data and logic</p>
         <h1>Estimation</h1>
-      <p class="doc-meta"><span class="pill pill-experimental">experimental</span><span>Experimental. The shape exists in wave-2 form and is expected to change. Do not ship a commercial module against it yet.</span></p>
-<p><strong>Status: EXPERIMENTAL.</strong> A production orbit-determination module is shipped and running, but it is not a ratified harness: it has no generated ABI header, no conformance kit, and no reference module in the harness sense. The broader estimation surface that its headers describe is largely not wired into the shipped path.</p>
-<h2 id="doctrine"><a class="anchor" href="#doctrine" aria-hidden="true">#</a>Doctrine</h2>
-<p>An estimation module turns observations into state. Observations and an initial guess go in; an estimated state, and where the family matures, a covariance, come out. It is the inverse of the propagator family, and it depends on that family: an estimator that cannot take its propagator as a pluggable port is hardwired to one force model and is not a member of this family.</p>
-<p>The pluggable-propagation law applies here with full force. Every propagator-consuming surface — an estimator emphatically included — takes the propagator as a parameter or port, never as a compiled-in choice.</p>
-<h2 id="capability"><a class="anchor" href="#capability" aria-hidden="true">#</a>Capability</h2>
-<p>Ingest observations, fit a state, emit results as standards records. The shipped path emits <code>$OMM</code>-class mean-element results and <code>$OBD</code> observation-derived records. Input ephemerides are transient by rule: they are fitted and discarded, and only the results are stored.</p>
-<h2 id="import-and-export-set"><a class="anchor" href="#import-and-export-set" aria-hidden="true">#</a>Import and export set</h2>
-<p><strong>Not specified as a harness ABI.</strong> No <code>orbpro_od_abi.h</code> or equivalent generated header exists. The shipped module is invoked through the SDK's generic module surface, not through a family-specific export set.</p>
-<p>In the manifest vocabulary the family projects onto <code>PluginFamily.ORBIT_DETERMINATION</code>, which itself carries a known projection gap: Space Data Standards has no dedicated plugin-category member for it yet, so it projects onto the analysis category until one is minted.</p>
-<h2 id="wire-layout"><a class="anchor" href="#wire-layout" aria-hidden="true">#</a>Wire layout</h2>
-<p><strong>Not specified as a public wire.</strong> The internal C++ types describe the intended shape and are useful as a design reference, but they are not a published ABI and their layout is not locked:</p>
-<div class="table-wrap"><table><thead><tr><th>Type</th><th>Fields</th></tr></thead><tbody><tr><td><code>StateVector</code></td><td><code>epoch_jd</code>, <code>x</code>, <code>y</code>, <code>z</code>, <code>vx</code>, <code>vy</code>, <code>vz</code></td></tr><tr><td><code>Observation</code></td><td><code>epoch_jd</code>, <code>type</code>, <code>value</code>, <code>sigma</code>, <code>station_id</code></td></tr><tr><td><code>GroundStation</code></td><td><code>id</code>, <code>name</code>, <code>lat_deg</code>, <code>lon_deg</code>, <code>alt_km</code></td></tr><tr><td><code>Covariance6x6</code></td><td>6×6 array of doubles</td></tr></tbody></table></div>
-<p><code>ObservationType</code> covers right ascension, declination, azimuth, elevation, range, range rate, and position components.</p>
-<p>The SDS <code>$ODW</code> problem record and its runtime wire are unminted; <code>$OBD</code> remains the results record. By explicit ruling, the OD <em>result model</em> decision stays deferred — a future record mint covers the problem and wire side only and must not freeze the result model.</p>
-<h2 id="units-and-frames"><a class="anchor" href="#units-and-frames" aria-hidden="true">#</a>Units and frames</h2>
-<p>The internal types mix conventions and this is a real hazard: epochs are Julian dates, station geodetic position is in degrees with altitude in kilometres, and state components are in the propagator family's units. Any published estimation ABI must state the unit of every field at the field, exactly as the propagator ABI does. Until it does, read the module's own headers rather than assuming.</p>
-<h2 id="sentinels"><a class="anchor" href="#sentinels" aria-hidden="true">#</a>Sentinels</h2>
-<p>Not specified. The shipped path treats a failed fit as a refusal and does not emit a record; there is no ratified sentinel vocabulary for a partially converged solution.</p>
-<h2 id="identity"><a class="anchor" href="#identity" aria-hidden="true">#</a>Identity</h2>
-<p>Objects are addressed by their catalog identity in the shipped path — the same identity the propagator family uses for an entity.</p>
-<h2 id="threading"><a class="anchor" href="#threading" aria-hidden="true">#</a>Threading</h2>
-<p><code>wasm32-wasip1-threads</code>. The shipped fit path is genuinely multi-threaded and runs a full catalog fit inside one composed WASM flow; that is the strongest evidence in this family that the threading model is sound. No harness-level shard-write discipline is specified because no batch ABI is published.</p>
-<h2 id="error-codes"><a class="anchor" href="#error-codes" aria-hidden="true">#</a>Error codes</h2>
-<p>Not specified as a named set.</p>
-<h2 id="lifetime"><a class="anchor" href="#lifetime" aria-hidden="true">#</a>Lifetime</h2>
-<p>The shipped module is instantiated once per flow run and torn down with it.</p>
-<h2 id="parity-envelope"><a class="anchor" href="#parity-envelope" aria-hidden="true">#</a>Parity envelope</h2>
-<p>Cross-runtime parity is exercised for the shipped flow, but the family has no parity envelope statement of its own. Use the generic <a href="../tri-runtime-parity-gate.html">parity gate</a>.</p>
-<h2 id="consumer-seam"><a class="anchor" href="#consumer-seam" aria-hidden="true">#</a>Consumer seam</h2>
-<p>The seam that matters is the propagator port. An estimation module accepts a propagator plugin and calls it; the consumer chooses which propagator is supplied. Any estimation module that internally hardwires a single propagator is non-conforming by the pluggable-propagation law, regardless of how good its filter is.</p>
-<h2 id="guest-c-example"><a class="anchor" href="#guest-c-example" aria-hidden="true">#</a>Guest C++ example</h2>
-<p>None published. Publishing a skeleton against an unratified ABI would invite exactly the drift this family needs to avoid. Start from the <a href="./propagator.html">propagator guest example</a> for module structure, and consume the propagator through its published ABI from inside your estimator.</p>
-<h2 id="known-gaps-stated-plainly"><a class="anchor" href="#known-gaps-stated-plainly" aria-hidden="true">#</a>Known gaps, stated plainly</h2>
+      <p class="doc-meta"><span class="pill pill-shipped">shipped</span><span>Shipped contract. Generated from a ratified .fbs single source, covered by a conformance kit and a reference module.</span></p>
+<p><strong>Status: RATIFIED.</strong> The estimation harness is the measurement-based orbit determination contract. It covers simulation, batch weighted least squares, sequential filtering, smoothing, process noise, media corrections, and initial orbit determination without selecting a propagator implementation.</p>
+<h2 id="result-model-ruling"><a class="anchor" href="#result-model-ruling" aria-hidden="true">#</a>Result-model ruling</h2>
+<p>The result-model decision previously deferred by this family is final:</p>
 <ul>
-<li>The shipped production path is SGP4 mean-element batch fitting. That is what runs.</li>
-<li>The wider surface described in the module's own headers — Gauss, Laplace, double-r, Gibbs and Herrick-Gibbs initial orbit determination; sequential EKF and UKF; 6×6 covariance with consider parameters and state-transition-matrix propagation — is compiled but audited as dead code, reachable only from a test path and never called by the production entry points. Treat it as design intent, not as available capability.</li>
-<li>The abstract propagator interface inside that module is part of the same dead path. The pluggable-propagation law is satisfied by design in the header and not yet exercised in the shipped flow.</li>
-<li>No conformance kit, no generated header, no negative control.</li>
+<li><code>$ODR</code> is the canonical signed run report. It carries the solver configuration, iteration and editing ledgers, estimated parameters, filter history, residual statistics, and the estimated Cartesian state.</li>
+<li><code>$OCM</code> is the canonical covariance product named by <code>ODR.OCM_CONTENT_ID</code>. Its covariance values are the estimator's computed values; a diagonal placeholder or an <code>N/A</code> solve-for is non-conforming.</li>
+<li><code>Estimation.fbs</code> is the family request/result wire. It may embed the exact <code>$ODR</code> and <code>$OCM</code> bytes for a one-frame invocation result, but it does not replace either standards record.</li>
+<li><code>$MEM</code>, <code>$TRH</code>, and <code>$TDM</code> are supporting input records: measurement error and editing policy, tracking hardware, and observations respectively.</li>
 </ul>
+<p>This split keeps algorithm telemetry out of a covariance interchange record while still giving every reported covariance one immutable run provenance.</p>
+<h2 id="propagator-port"><a class="anchor" href="#propagator-port" aria-hidden="true">#</a>Propagator port</h2>
+<p>The caller supplies <code>propagator_port_id</code> and <code>propagator_capability</code>. The estimator consumes <code>EstimationPropagatorSample</code> values whose states come from <code>plugin_propagate</code> and whose state-transition matrices come from <code>plugin_compute_stm</code>. The STM maps the a-priori epoch to the sample epoch.</p>
+<p>Provider names, provider enums, and a default provider are absent from this family. A host must reject a request whose named port does not provide both capabilities. An estimator that imports or selects a concrete propagator is not an estimation-family module.</p>
+<h2 id="source-of-truth-and-generated-header"><a class="anchor" href="#source-of-truth-and-generated-header" aria-hidden="true">#</a>Source of truth and generated header</h2>
+<p><code>schemas/orbpro/Estimation.fbs</code> is the single layout source. <code>include/orbpro/orbpro_estimation_abi.h</code> is generated from it by the SDK's schema ABI renderer. Its compile-time size and offset assertions are part of conformance; handwritten copies are not.</p>
+<p>All state components use metres and metres per second. Covariance is row-major 6 by 6 in matching SI units. Observation values use their native SI unit: metres, metres per second, hertz, or radians. Epochs use the two-double Julian day representation shared by the propagator family.</p>
+<p>Angular and local-plane observations carry the station's inertial east, north and up unit vectors alongside its inertial position and velocity. A runtime uses that explicit topocentric basis when it is present; deriving latitude and longitude from an inertial position rotates the local frame twice and is non-conformant.</p>
+<p>The fixed layouts are:</p>
+<div class="table-wrap"><table><thead><tr><th>Type</th><th>Bytes</th><th>Alignment</th></tr></thead><tbody><tr><td><code>OrbProEstimationEpoch</code></td><td>16</td><td>8</td></tr><tr><td><code>OrbProEstimationObservation</code></td><td>376</td><td>8</td></tr><tr><td><code>OrbProEstimationErrorModel</code></td><td>72</td><td>8</td></tr><tr><td><code>OrbProEstimationConfig</code></td><td>448</td><td>8</td></tr><tr><td><code>OrbProEstimationState</code></td><td>384</td><td>8</td></tr><tr><td><code>OrbProFilterEpoch</code></td><td>696</td><td>8</td></tr><tr><td><code>OrbProEstimationPropagatorSample</code></td><td>352</td><td>8</td></tr><tr><td><code>OrbProInitialOrbitRequest</code></td><td>240</td><td>8</td></tr><tr><td><code>OrbProInitialOrbitResult</code></td><td>80</td><td>8</td></tr></tbody></table></div>
+<p>Call each generated <code>_init</code> helper before filling a struct. Padding is contractual and must remain zero so browser, native, and WasmEdge runtimes hash the same bytes.</p>
+<h2 id="measurement-and-estimator-roster"><a class="anchor" href="#measurement-and-estimator-roster" aria-hidden="true">#</a>Measurement and estimator roster</h2>
+<p>The measurement roster contains range, range rate and Doppler; azimuth and elevation; XEast/YNorth and XSouth/YEast; right ascension and declination; position vectors; sequential and pseudonoise range; time-correlated phase; relay range, Doppler and differenced Doppler; bistatic, skin and crosslink range/range rate; laser range; TDOA; and FDOA.</p>
+<p><code>EstimatorKind</code> distinguishes batch weighted least squares, a covariance-form extended Kalman filter, a sigma-point unscented Kalman filter, and EKF with Rauch–Tung–Striebel smoothing. Chaining one-observation batch solves is not an EKF or UKF and fails conformance. SNC and DMC are explicit process-noise kinds.</p>
+<p>The initial-orbit entry point exposes Gauss, Laplace, Gibbs, and Herrick–Gibbs. It returns the middle-epoch Cartesian state and a typed status.</p>
+<h2 id="result-and-error-contract"><a class="anchor" href="#result-and-error-contract" aria-hidden="true">#</a>Result and error contract</h2>
+<p>Successful estimation produces a populated <code>OrbProEstimationState</code>. A batch result includes convergence, iteration, accepted and rejected counts, RMS, recovered noise sigma, and covariance. A sequential result includes every filtered covariance and, for the smoother kind, every smoothed covariance.</p>
+<p>Batch result wires also carry <code>iteration_covariances</code> as consecutive row-major 6-by-6 blocks. Each block is the normal-matrix covariance from that exact outer iteration, so a convergence visualization uses solver output rather than an interpolated uncertainty.</p>
+<p>The public status vocabulary is:</p>
+<div class="table-wrap"><table><thead><tr><th>Status</th><th>Meaning</th></tr></thead><tbody><tr><td><code>ORBPRO_ESTIMATION_OK</code></td><td>Result is complete.</td></tr><tr><td><code>ORBPRO_ESTIMATION_NOT_CONFIGURED</code></td><td>Required family or propagator configuration is absent.</td></tr><tr><td><code>ORBPRO_ESTIMATION_NULL_OUTPUT</code></td><td>Caller supplied no result destination.</td></tr><tr><td><code>ORBPRO_ESTIMATION_BAD_INPUT</code></td><td>Shape, unit, enum, sigma, or covariance validation failed.</td></tr><tr><td><code>ORBPRO_ESTIMATION_NOT_CONVERGED</code></td><td>A valid iteration history exists but the declared convergence criteria were not met.</td></tr><tr><td><code>ORBPRO_ESTIMATION_BUFFER_TOO_SMALL</code></td><td>Output storage cannot hold the declared result.</td></tr><tr><td><code>ORBPRO_ESTIMATION_PROPAGATOR_PROTOCOL</code></td><td>State/STM response does not match the request.</td></tr><tr><td><code>ORBPRO_ESTIMATION_INTERNAL</code></td><td>Numerical or invariant failure not attributable to input.</td></tr></tbody></table></div>
+<p>No sentinel means success. NaN, an invalid covariance, or a missing required record is an error. A non-converged batch may be reported only with <code>NOT_CONVERGED</code> and its actual iteration history; it may not be relabelled OK.</p>
+<h2 id="lifetime-and-threading"><a class="anchor" href="#lifetime-and-threading" aria-hidden="true">#</a>Lifetime and threading</h2>
+<p>Request, sample, and result buffers are invocation-owned and remain valid only for the call. Modules copy any state retained between input frames. Family implementations declare their thread model in <code>$PLG</code>; deterministic six-dimensional sequential implementations may use <code>wasi-sequential</code> while still compiling on the sanctioned <code>wasm32-wasip1-threads</code> toolchain. The same artifact and bytes must pass browser, native, and embedded WasmEdge lanes.</p>
+<h2 id="conformance-kit"><a class="anchor" href="#conformance-kit" aria-hidden="true">#</a>Conformance kit</h2>
+<p>The official kit checks:</p>
+<ol>
+<li>generated ABI sizes, offsets, enum values, zeroed padding, and an Estimation.fbs schema-lock regeneration;</li>
+<li>a positive reference module using caller-supplied state and STM samples;</li>
+<li>a negative provider-selection control, which fails if a provider name or a concrete propagator import is introduced;</li>
+<li>batch state, covariance, RMS, recovered sigma, and exact edited-set vectors;</li>
+<li>real EKF and UKF covariance histories, RTS covariance contraction, and SNC/DMC growth;</li>
+<li>the complete measurement roster, light-time and body-rotation corrections, media corrections, hardware delay and turnaround handling;</li>
+<li>deterministic simulation and the four initial-orbit methods; and</li>
+<li>byte-equivalent results in the browser, native, and WasmEdge lanes.</li>
+</ol>
+<p>The kit's reference module is deliberately force-model blind: its propagator fixture arrives through the same required <code>propagator_samples</code> port as a real provider. Replacing that fixture with a compiled-in trajectory is a failing negative control, not a reference implementation.</p>
+<h2 id="manifest-surface"><a class="anchor" href="#manifest-surface" aria-hidden="true">#</a>Manifest surface</h2>
+<p>An estimation module declares the <code>estimation</code> harness family and exposes <code>run_estimation</code>, <code>simulate_tracking</code>, and <code>initial_orbit</code>. <code>run_estimation</code> requires <code>request</code> and <code>propagator_samples</code>; <code>$TDM</code>, <code>$MEM</code>, and <code>$TRH</code> are optional typed ports. It emits the Estimation result wire plus signed <code>$ODR</code> and <code>$OCM</code> records. Signatures are applied by the caller's keyslot capability; private signing material never appears in the estimation module.</p>
       <section class="playground" id="playground-slot" data-family="estimation" data-playground="pending" aria-labelledby="playground-title">
         <h2 id="playground-title">Playground</h2>
         <p>
@@ -139,20 +147,14 @@
           <code>npm run build:docs</code>.
         </p>
       </main>
-<nav class="rail" aria-label="On this page"><h2>On this page</h2><ul><li><a class="depth-2" href="#doctrine">Doctrine</a></li>
-<li><a class="depth-2" href="#capability">Capability</a></li>
-<li><a class="depth-2" href="#import-and-export-set">Import and export set</a></li>
-<li><a class="depth-2" href="#wire-layout">Wire layout</a></li>
-<li><a class="depth-2" href="#units-and-frames">Units and frames</a></li>
-<li><a class="depth-2" href="#sentinels">Sentinels</a></li>
-<li><a class="depth-2" href="#identity">Identity</a></li>
-<li><a class="depth-2" href="#threading">Threading</a></li>
-<li><a class="depth-2" href="#error-codes">Error codes</a></li>
-<li><a class="depth-2" href="#lifetime">Lifetime</a></li>
-<li><a class="depth-2" href="#parity-envelope">Parity envelope</a></li>
-<li><a class="depth-2" href="#consumer-seam">Consumer seam</a></li>
-<li><a class="depth-2" href="#guest-c-example">Guest C++ example</a></li>
-<li><a class="depth-2" href="#known-gaps-stated-plainly">Known gaps, stated plainly</a></li></ul></nav>
+<nav class="rail" aria-label="On this page"><h2>On this page</h2><ul><li><a class="depth-2" href="#result-model-ruling">Result-model ruling</a></li>
+<li><a class="depth-2" href="#propagator-port">Propagator port</a></li>
+<li><a class="depth-2" href="#source-of-truth-and-generated-header">Source of truth and generated header</a></li>
+<li><a class="depth-2" href="#measurement-and-estimator-roster">Measurement and estimator roster</a></li>
+<li><a class="depth-2" href="#result-and-error-contract">Result and error contract</a></li>
+<li><a class="depth-2" href="#lifetime-and-threading">Lifetime and threading</a></li>
+<li><a class="depth-2" href="#conformance-kit">Conformance kit</a></li>
+<li><a class="depth-2" href="#manifest-surface">Manifest surface</a></li></ul></nav>
     </div>
     <section id="stack" class="section" aria-labelledby="stack-title">
       <div class="section-head">