Independent Inventor

Balasore Odisha 756001 India info@sangamdas.com

Internet NTN LEO satellite ISL execution finality RF enable inter-satellite link mega-constellation 3GPP NTN non-terrestrial network TT&C CCSDS phased array beamforming beam steering user terminal gateway PA enable power amplifier overflight epoch spectrum coordination ITU coordination non-bearer authority single-use token replay protection fail-closed zero trust candidate act execution authority authorization architecture A LEO constellation computer can compute a transmit burst, a beam command, an inter-satellite forward, or a user-terminal PA enable faster than any ground reviewer can see it. Today those acts become RF because the scheduler selected them, the command link authenticated, or the flight process had the radio device open. Authentication of TT&C, 3GPP NTN registration, and operator allowlists decide who may talk to the vehicle. They do not decide whether this burst, on this beam, to this next hop, over this territory, in this mission epoch, may leave the aperture. Radiation is not reversible. An ISL hop is not a log line. A phased-array user terminal that is already pointed is one register write away from radiating. If the enable line trusts the last ground "go," a stale, substituted, or autonomy-generated command becomes sky-facing consequence. This document specifies a radio-side execution-finality profile for NTN and mega-constellation control. A proposed RF, ISL, beam, gateway, or payload act remains a Candidate Act. A Protected Enforcement Domain binds vehicle, beam, frequency class, duration, next hop, overflight or jurisdiction epoch, and intended sink, then issues scoped non-bearer authority. The Finality Sink sits at the PA enable, ISL switch, beam driver, feeder gateway, or UT transmit path and verifies that authority immediately before energy leaves the system. RF enable is not transmit authority.

Introduction Mega-constellation and 3GPP NTN stacks now sit on a short path: command or grant -> onboard or UT radio control -> PA / ISL / beam enable -> radiated or forwarded effect ]]> The fourth arrow is the one this document controls. The computer is allowed to compute. The aperture is not allowed to treat that computation as a capability. A proposed service-link burst, feeder-link burst, UT uplink, ISL forward, beam steer, handover-coupled transmit, or payload RF enable remains non-effective until act-specific authority is verified at the component that would actually radiate or forward. This profile uses the two-boundary execution-finality chain in . It does not specify PHY, waveform, or a named operator's flight code. It specifies the predicates a constellation or NTN implementation must bind before radiation or ISL forward: vehicle identity, beam or cell, frequency class, duration or slot set, next-hop, overflight epoch, command provenance, and sink identity. Public LEO systems with electronically steered user terminals, optical or RF inter-satellite links, and gateway-fed service links — including the class of system operated as Starlink and peers such as OneWeb, Kuiper, and Telesat Lightspeed — are the motivating deployment. Vendor names in this document are informative examples of topology, not claims about unpublished internals.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. Failure to establish current RF or ISL authority MUST NOT be converted into permission to enable the aperture or forward the hop.

Problem Space Satellite command fails in a different place than terrestrial session control. A denied 5G PDU session is quiet. A wrongly enabled SSPA, TWTA, or phased-array panel is an ITU event, a neighbor-cell event, and in some bands a safety event. The model's — or the flight computer's — next output is energy. The practical failures look like this:

• A ground operator session was valid at T0. At T1 the vehicle has handed over beams and is over a different administration. The old "transmit OK" is still sitting in a command queue.
• Onboard autonomy recomputes a burst while the command link is faded. The radio stack treats "we usually transmit here" as authority.
• An ISL switch forwards a packet to a next hop that was not the hop bound in the grant, because the mesh route moved and the grant did not.
• A user terminal already has network attachment. The modem writes the PA enable for a grant that was issued to a different beam or duty cycle.
• A hosted payload computer is allowed to talk on the spacecraft bus. That path is used to enable a sensor RF or a secondary emitter the service-link scheduler never authorized.
• A replayed beam-steer command points the array at a gateway or region that is no longer in the current epoch.

In each case some upstream control was satisfied: the vehicle authenticated, the UT registered, the NOC user had the console, or the flight process had device access. The missing question is the one asked at the aperture: may this exact act become RF or ISL now.

Existing Solutions and What They Do Not Bind Constellation and NTN stacks already contain important controls. This profile consumes them. It does not replace waveform security or ITU coordination.

TT&C Authentication and CCSDS Command Links Authenticated telecommand establishes that a ground system may speak to a vehicle. CCSDS Space Data Link and related command-authentication profiles bind frames to a key and often to a counter. They do not, by themselves, bind beam_id, EIRP class, overflight epoch, or the particular PA that will fire. A valid command session can still carry the wrong payload act.

3GPP NTN Registration and NAS Security Rel-17/18 NTN gives a UE a satellite-aware cell and a secured NAS. That answers "this UT may be on this network." It does not hash the burst the scheduled grant will radiate, and it does not sit in the UT PA enable or the satellite service-link enable. A registered UT can still transmit on a grant that is stale relative to beam or timing advance.

Operator Flight Allowlists and Safe Modes Flight software typically refuses unknown command opcodes and can enter a safe mode that drops payload RF. Those are class-level interlocks. They do not consume single-use authority for one burst, and they do not stop a well-formed, in-allowlist command that is wrong for this epoch.

Link Encryption and Gateway ACLs Feeder and service-link encryption protect confidentiality. Gateway ACLs protect who may inject traffic. Encrypted wrong radiation is still radiation. An ACL on the gateway does not control the satellite PA when the vehicle is serving through another gateway or through ISL only.

ITU Filings and National Gateways Coordination and landing-rights constrain where a system is allowed to operate. They are not a per-burst gate. Overflight changes faster than paper. A vehicle that crossed a boundary mid-queue needs an epoch check at the enable line, not a reminder in the license file.

What This Profile Adds

• the radio command remains a Candidate Act after the scheduler or flight computer emits it;
• beam, frequency class, duration, next-hop, and overflight epoch are bindings, not telemetry;
• authority is non-bearer, sink-bound, and consumed at PA, ISL, beam driver, gateway, or UT TX;
• onboard autonomy and faded command links fail closed or escalate rather than inherit the last "go";
• a payload or bus path that can enable an emitter is in scope; and
• the profile does not change PHY. It makes effectuation non-completable without the sink check.

The controls above are bearer-style: possession of a valid session, registration, allowlist entry, or ACL grant is treated as standing authority to act repeatedly until that possession is revoked. The authority this profile issues is the opposite: non-bearer, scoped to one exact act and grant digest, verified again at the sink immediately before effect, and consumed on first use. A stolen or replayed bearer credential keeps working until someone notices and revokes it; a stolen or replayed finality authority does not work a second time and does not work for a different beam, vehicle, or epoch than the one it was issued for.

Industrial Relevance and Constellation Cases These cases are written in the topology a LEO operator already has: user terminal, space vehicle with service and crosslinks, gateway, and a ground or onboard scheduler. Starlink-class systems are the existence proof that this topology is no longer experimental.

Phased-Array User Terminal Uplink A consumer or maritime UT has already acquired, is tracking a moving vehicle, and has a scheduler grant. The modem is one enable away from radiating on Ku or Ka. NTN or proprietary attachment says the terminal is in-network. Injected or stale grant data — wrong duty cycle, wrong beam, wrong vehicle — must not become PA enable. The sink is UT_TX_ENABLE. Authority binds vehicle_id or serving cell, frequency class, grant digest, duration, and epoch. A grant computed for vehicle A at epoch 41 MUST fail on vehicle B or epoch 42. This is the satellite analogue of argument-digest binding in .

Service-Link Radiation on the Vehicle The satellite scheduler (onboard or ground-computed and uplinked) selects a panel, beam, slot, and user set. The irreversible step is enabling the service-link PA or beamformer path. A compromised or merely stale onboard process that can write that register is the incident. The sink is SAT_RF_ENABLE. Authority binds satellite_id, beam_id, frequency class, EIRP class, slot or duration, and overflight_epoch. Autonomy MAY propose the Candidate Act. Autonomy MUST NOT complete enable without current authority. That is the sentence a flight-software reviewer can test.

Optical or RF Inter-Satellite Forward Once a constellation has a mesh, a packet can leave the planet's regulatory picture without touching a gateway. Route computation is cheap. The hop is not. A forward toward a vehicle that will next serve a restricted administration, or a hop that extends a flow the grant did not include, is a consequence class of its own. The sink is ISL_FORWARD. Authority binds this_vehicle, next_hop_id, flow or grant digest, and the epoch in which that next hop is still the intended hop. Mesh churn without epoch advance is how a correct grant becomes a wrong sky path.

Gateway Feeder and Pointing Gateways are the high-power, high-duty terrestrial emitters and the usual landing-rights choke point. Operator ACLs already exist. They do not consume single-use authority when the scheduled vehicle, band, or polarization changes mid-pass. The sink is GW_FEEDER. Authority binds gateway_id, satellite_id, band, and pass_epoch. A feeder burst for yesterday's pass MUST fail. Site diversity — moving the same traffic to another gateway — is a new Candidate Act, not reuse of the first authority.

Beam Steer and Handover-Coupled Transmit Electronic steering is a command, not a side effect. Pointing the array at the wrong gateway, ship, or region is already the incident before the first information bit. Handover that keeps an old beam enable alive across the switch is the replay case. The sink is BEAM_STEER, and any following RF enable MUST see a beam_id that matches the current steer authority. Handover is either a new act or an explicit epoch bump. Silent inheritance is non-conforming.

Hosted Payload and Secondary Emitters Earth-observation, AIS, or compute payloads share the bus with the comms payload. Bus access is not radiation authority. A payload process that can toggle an emitter, a downlink modulator, or a high-rate sensor radio MUST face a PAYLOAD_CMD sink with its own consequence class. This is the spacecraft version of alternate-path closure: do not let the payload computer walk around the comms scheduler.

Faded Command Link and Onboard Autonomy LEO command links fade. Operators still want the network to run. The wrong answer is "use the last approved envelope forever." The right answer is a short-lived hot-path envelope, explicitly bounded in epoch, beam set, and EIRP class, that the sink still checks. When the envelope cannot be proved, the aperture stays dark or in the last safe pattern. Timeout is not transmit.

What a Constellation Team Should Measure The profile is live when production or hardware-in-the-loop logs show: (1) every service-link or UT PA enable has a consumed authority_id; (2) beam or vehicle mismatch is a deny, not a retry that skips the sink; (3) ISL forwards after a route change carry a new epoch; (4) payload and bus paths cannot enable an emitter the comms sink would have refused. Those four tests are more useful than a claim that TT&C is encrypted.

Terminology

Satellite Candidate Act

A scheduler-, flight-, NTN-, or autonomy-generated operation that would radiate, steer, forward on ISL, or enable a payload emitter, but has not been permitted to do so.

RF / ISL Finality Sink

The component that would actually enable the PA, beamformer, ISL switch, feeder chain, UT transmit path, or payload emitter. If that component can be skipped, it is not the sink.

Overflight epoch

A monotonic or attested identifier for the regulatory or mission-phase window in which the act is valid (administration under the footprint, license window, eclipse/safe-mode state, or equivalent).

Grant digest

A hash over the canonical scheduled grant or command body (vehicle, beam, band, slots, next hop, users). Changing a load-bearing field MUST change the digest.

Candidate Act, Non-Effective State, Protected Enforcement Domain (PED), Protected Validation Evidence, scoped non-bearer finality authority, and Finality Sink are used as in .

Architecture A Candidate Act MUST NOT become RF or ISL merely because the scheduler selected it, TT&C authenticated, the UT registered, or onboard autonomy produced a well-formed command.

Aperture-time finality enable once, consume authority | `-- FAIL -> aperture stays non-radiating ]]>

PED MAY run on the ground, in a gateway, in a UT TEE, or in a protected partition on the vehicle. The sink MUST run on the path that can prevent enable. A ground policy server that the PA does not consult is not a sink.

Enable-Path Pseudocode Procedures are normative in behavior. An implementation MAY collocate PED and sink in one protected radio-control service if evidence is committed before authority is usable and the live grant is checked immediately before enable.

Scheduler or Flight Output to Candidate Act

PED Validation

Sink: Verify Then Enable enable_emitter() is unreachable when any check fails. Logging a denial and then keying the PA is non-conforming.

Load-Bearing Bindings Authority issued for SAT_RF_ENABLE / vehicle V / beam B / digest D1 MUST NOT authorize beam B' , vehicle V' , digest D2, an ISL forward, a UT PA enable, or a payload emitter. DISPLAY-equivalent mistakes in this profile are beam substitution, vehicle substitution, and grant substitution. Authority for UT_TX_ENABLE MUST NOT automatically authorize SAT_RF_ENABLE. Authority created under overflight epoch N MUST fail at epoch N+1. Authority for one gateway pass MUST NOT authorize site-diverse feeder radiation at another gateway.

Alternate-Path Closure If the same radiated or forwarded effect can be produced by the comms scheduler, a payload computer, a debug bus, a ground override, or a UT test mode, each path MUST either enforce this profile or be unable to produce the effect. Moving the command from the mission scheduler to a laboratory register poke MUST NOT remove the requirement on an in-orbit or in-field emitter.

JSON Interoperability Profile Objects are UTF-8 JSON. Transport MAY be a spacecraft bus message, a UT driver ioctl, a gateway controller RPC, or a ground-to-board command wrapper. Transport MUST preserve integrity, sink identity, freshness, and non-bearer semantics.

SatelliteCandidateAct

Authority and Sink Verify

Informative Starlink-Class Transaction The identifiers below are examples of topology, not SpaceX protocol fields.

Hot Path, Autonomy Envelope, and Failure Repeated bursts inside a fixed envelope — same vehicle, beam set, band, EIRP class, and overflight epoch — MAY use cached policy and short-lived authority. The sink check remains mandatory. New beams, new next hops, payload provenance, unknown administrations, or command-link fade outside the envelope SHOULD escalate. Timeout is not enable. Illustrative codes: EF-002 NO_FINALITY_AUTHORITY, EF-005 AUTHORITY_ALREADY_USED, EF-006 REPLAY_DETECTED, EF-020 NEXT_HOP_UNRESOLVED, EF-023 OVERFLIGHT_MISMATCH, EF-040 SINK_MISMATCH, EF-041 BEAM_OR_VEHICLE_MISMATCH, EF-070 AUTONOMY_ENVELOPE, EF-080 FAIL_CLOSED.

Security Considerations Threats the sink is intended to make non-completable without current authority include: replay of a prior grant, beam or vehicle substitution, ISL next-hop substitution, gateway site-diversity laundering, payload-bus path around the comms scheduler, stale overflight, faded-link default-open, and ground-session reuse after revocation. The scheduler and the flight computer are not trusted to police these. The property is mechanical: enable_emitter() does not run. Residual risk remains if an unclassified analog path (a strap, a test coupler, an unmodeled amplifier) can radiate. Implementations MUST treat those as profile failures. This profile is explicitly not a trust root. It assumes, and does not itself provide, an uncompromised Protected Enforcement Domain and an uncompromised source of the time and epoch values a Candidate Act is checked against. Three threats fall outside the mechanical replay/substitution model above and deserve separate attention in any deployment:

• PED or key compromise. The sink verifies that an authority is well-formed, current, and unused; it does not independently re-derive whether the PED's decision was correct. A compromised PED, or a compromised signing or HMAC key, can issue authority for an act that should have been denied. Key management, rotation, and hardware protection (HSM or secure element) for the PED and the sink are implementation concerns this document does not specify.
• Spoofed or stale position and time inputs. overflight_ epoch and policy_epoch are only as trustworthy as the ephemeris, GNSS, and clock inputs that advance them. A spoofed or delayed position or time source can make an act that should be denied appear to fall inside a valid epoch, or the reverse. This document treats the epoch value as authoritative once supplied; it does not specify how to secure the source that supplies it.
• Forced fail-closed as a denial-of-service vector. Because this profile is intentionally fail-closed, an adversary who can cheaply trigger epoch mismatches, substitution denials, or authority exhaustion at scale can potentially drive an operationally costly outage rather than an unauthorized transmission. Fail-closed is the correct choice for this document's threat model, but operators MUST separately monitor for denial-of-service patterns in denial telemetry, since a flood of EF-0xx denials is itself a signal, not merely noise.

These three threats, and the reference implementation's further caveats regarding HSM absence, single-node consume state, and the absence of a secure position or time source, are catalogued in the Limitations subsection of . This document does not describe how to disable, jam, or commandeer a satellite. It describes how an operator's own enable path can refuse an unauthorized act.

Privacy and Sovereignty Considerations Grant descriptors can reveal serving beams, gateways, and user-terminal associations. Implementations SHOULD hash raw user maps on untrusted paths and SHOULD treat overflight_epoch as a sovereignty input, not only a radio input. The profile does not create landing rights. It keeps radiation non-completable when those rights, as encoded in the current epoch, say no.

Related Documents (Informative) This document is part of the DAS Protocols family, which applies the same Candidate Act / Protected Enforcement Domain / Finality Sink pattern used in across telecom, AI, payments, industrial control, and regulatory domains. The following are informative pointers to related drafts and are not required to implement this profile. Telecom and network-layer finality:

• - bounded egress control for precision-routed traffic.
• - query-scoped communication handles for 6G.
• - finality for discovery and mapping protocols.
• - the umbrella execution-finality protocol layer synthesizing the shared vocabulary used across this family.

AI, agentic, and model-extraction finality:

• - execution finality for agentic tool dispatch.
• - binding execution finality to tool_use/computer_use/MCP tool calls.
• - execution finality for third-party AI interoperability.
• - agentic AI tool execution finality.
• and - RATS-based control over release of sensitive information from frontier AI systems.
• - attestation binding for execution finality.
• and - execution finality for enterprise AI protocols and output paths.
• - the core Candidate Act finality construct.

Safety, sovereignty, and regulatory finality:

• - finality for child-safe rendering of age-restricted content.
• - execution enforcement under the EU AI Act.
• - execution enforcement for global privacy requirements.
• - digital sovereignty finality.

Industrial and hardware-adjacent finality:

• - finality for operational-technology actuation.
• - hardware-enforced execution finality.

Two related resources outside the Internet-Draft series describe the same architecture applied to European space-regulatory and digital-sovereignty policy: and .

IANA Considerations This document requests no IANA actions.

Intellectual Property Note Certain concepts are associated with pending applications in the DAS Protocols family, including PCT/IB2026/055615 and follow-on NTN-related filings. IETF disclosure should follow BCP 79 .

Conclusion The constellation computer may compute a burst. That computation is not sky-facing authority. RF, ISL, beam, gateway, UT, and payload enable start only after the Candidate Act is validated, evidence is committed, scoped authority is issued, and the aperture-side sink verifies the live grant. RF enable is not transmit authority.

Normative References Informative References Apply AI Alliance, European Commission Futurium Zenodo GitHub repository

Reference Implementation and Test Results (Informative) This appendix summarizes a non-radiating software reference implementation that exercises the finality pattern of this document against seven satellite and NTN consequence paths. The implementation does not radiate RF energy, steer a physical antenna, operate an optical terminal, or transmit through a live satellite network; every external effect is produced by an in-process, non-radiating simulated hardware adapter. Nothing in this appendix constitutes a conformance requirement; it reports what the reference code was observed to do. The reference implementation is published at .

Tested Chain The reference implementation evaluates whether an RF, beam, gateway, user-terminal, inter-satellite, or hosted-payload command can remain technically non-effective until a finality authority is independently verified at the component representing the last controllable boundary before the effect:

System Configuration The tests ran on Linux 6.18.35 (x86-64), glibc 2.39, CPython 3.12.14 (minimum supported: Python 3.10), with an in-memory SQLite 3.53.1 store, HMAC-SHA-256 authentication, SHA-256 digests, base64url encoding without padding, and a deterministic compact UTF-8 JSON canonicalization subset (NTN-EF-JCS-SUBSET-1). No external dependencies beyond the Python standard library were used. Continuous integration also ran the suite on Python 3.10 through 3.13.

Satellite System Variations Tested Seven consequence paths were implemented and tested separately, each with a bound authority and a distinct finality sink:

• SAT_RF_ENABLE - spacecraft PA / service-link controller, binding satellite, beam, cell, pointing reference, downlink band, EIRP class, polarization, duration, slot set, destination, administration, licence profile, and overflight epoch.
• UT_TX_ENABLE - user-terminal PA, binding terminal identity, serving satellite, beam/cell, uplink frequency class, duration, slot set, modem provenance, and overflight epoch; network attachment alone is not treated as transmit authority.
• ISL_FORWARD - optical or RF crosslink switch, binding current spacecraft, crosslink terminal, next-hop spacecraft, flow digest, slot set, and topology/overflight/policy epochs; an unresolved or changed next hop is denied.
• BEAM_STEER - array or beamformer driver; an authority for one beam or pointing reference cannot steer another.
• GW_FEEDER - gateway feeder controller, binding gateway identity, gateway beam, target spacecraft, feeder frequency class, administration, and licence profile; moving traffic to another gateway requires a new Candidate Act.
• HANDOVER_TX - target spacecraft PA/service-link controller; handover is treated as a new act with a new beam, cell, pointing reference, slot set, and epoch rather than silent inheritance of the prior beam authority.
• PAYLOAD_CMD - hosted-payload radio controller; payload provenance cannot be used to invoke a spacecraft service-link act (path laundering), and this attempted transition is explicitly denied.

Test Summary The suite contains 77 executable tests. Each denial test confirms both the expected execution-finality error code and a simulated-effect count of zero; each successful-path test confirms authority acceptance, exactly one simulated effect, and a final EFFECTED state. Categories covered include: one successful-path test per act type; authority binding tests; live-command substitution across every load-bearing field (act type, vehicle, constellation, orbit shell, beam, cell, pointing reference, frequency class, EIRP class, polarization, duration, next hop, administration, licence profile, provenance, grant sequence, flow digest, slot set, command-link state, and sink); independent advancement of policy, revocation, and overflight epochs; safe-mode rejection; faded-command-link autonomy-envelope tests (inside and outside the permitted envelope); alternate path / provenance-laundering tests (payload-path and unclassified-source denial); ISL route churn; administration and licence-profile substitution; malformed-command rejection; evidence and authority integrity tampering; same-authority replay (EF-005 AUTHORITY_ALREADY_USED); same-grant replay under a new authority; concurrent-consume race tests confirming exactly one winner and one effect; definite hardware-failure and uncertain-hardware-result handling (no automatic retry on an indeterminate result); a persistent (file-backed) store reopen test; and three deterministic cross-language canonicalization vectors (spacecraft RF enable, user-terminal transmit, ISL forwarding).

Latency This document defines no numeric latency requirement. The reference implementation reports the following as repository engineering targets, not as IETF, 3GPP, or flight-safety requirements: sink verification, consume, and simulated effect at or below 1,000 microseconds (p99), and the complete local prepare-PED-sink path at or below 5,000 microseconds (p99). A benchmark of 1,000 measured operations (100 warmup), each with a unique grant sequence and slot set, in-memory SQLite, and software HMAC, measured a complete local-path mean of 484.10 microseconds and p99 of 1,574.27 microseconds, remaining inside the stated targets. The benchmark excludes HSM/secure-element access, remote PED calls, networked/replicated databases, command-link transmission, CCSDS/3GPP processing, beamformer or FPGA register access, RF ramp-up or optical-terminal acquisition, and orbit or geofence computation; it demonstrates local software feasibility only.

Limitations The reference implementation does not radiate or control physical RF, optical, PA, beamformer, modem, gateway, or bus hardware; is not flight-qualified or hard-real-time software; stores its HMAC key in process memory without an HSM, secure element, TEE, certificate chain, threshold signature, or hardware anti-rollback; provides single-node (SQLite) consume-once atomicity without cross-vehicle or multi-region/global consensus; performs no independent orbit, footprint, or landing-rights computation; assumes a trustworthy time and epoch source without addressing clock rollback, GNSS loss or spoofing, or secure boot; does not parse or emit CCSDS or 3GPP NTN protocol data; models no radiation effects (single-event upset or latch-up, bit flips, counter rollback, or power interruption during consume); does not formally prove the absence of an analog or hardware bypass path such as a debug strap or test coupler; provides no atomic coordination across multiple simultaneous effects (for example, a handover spanning two vehicles); and establishes no spectrum, ITU, national landing-rights, or flight-safety certification. The benchmark is local, single-process, in-memory, and software-authenticated, and is not a worst-case execution-time analysis.

Reproducing the Tests The reference implementation, its 77 tests, and its benchmark harness are run with the following commands: Supported benchmark act types are SAT_RF_ENABLE, UT_TX_ENABLE, ISL_FORWARD, BEAM_STEER, GW_FEEDER, HANDOVER_TX, and PAYLOAD_CMD.

What the Results Show and Do Not Show Within the implemented reference environment, the results demonstrate that all seven modeled consequence paths can use the same finality pattern; that a Candidate Act remains non-effective before sink approval; that evidence is committed before authority; that authority is bound to the exact act and grant; that changed live-command fields, stale epochs, replay, and concurrent consume are all handled without a second effect; that payload and unclassified provenance can be denied; that faded-link autonomy can be bounded; and that the local p99 reference path stayed within the stated engineering targets. The results do not demonstrate production readiness, flight qualification, actual RF non-bypassability, HSM security, real-time slot compliance, global distributed consistency, regulatory authorization, absence of every analog or hardware bypass, or the correctness of unimplemented language ports.