Eleven concepts, each three levels deep. Stop wherever it clicks.

Ask where a thrown ball will land and there is one answer. Ask where a steered ball will land and there is only a region — because the answer depends on choices not yet made. A maneuvering vehicle is the steered ball.

Classical impact-point prediction integrates one trajectory forward from the current state. That is valid when the future is determined by the present: an unpowered, unlifting body follows one arc. Add a lift vector the vehicle can roll, and the future branches. The honest output becomes the set of reachable ground points, weighted by how plausible each is.

The shaded cloud is the sampled set. The rings are the ellipses containing 50% and 90% of it. The amber marker is the densest cell, reported with its support — because a mode holding 3% of the samples is not an answer, and showing it without that number would be dishonest precision.

Drop a brick and it falls. Drop a paper aeroplane and it goes somewhere you did not choose. The difference is how much sideways force the shape makes for the drag it pays.

This model needs only two aerodynamic scalars. Ballistic coefficient β = m/(C_dA) sets how fast it sheds speed. Lift-to-drag sets how far it can steer.

Archetypes here span L/D from 0.0 (a classical reentry body) to 3.4 (a high-performance glider). At L/D 0 the footprint is a thin line along track. At 3.0 it is a region hundreds of kilometres wide, and stays wide until the vehicle commits.

Air thins roughly exponentially with height — halving every few kilometres. Almost all the deceleration in a reentry happens in the last thirty seconds, in the last twenty kilometres.

US Standard Atmosphere 1976 defines seven layers to 84.852 km geopotential. Within each, temperature varies linearly and pressure follows either the barometric or the lapse-rate form.

The implementation reproduces published USSA-76 density to 3–4 significant figures at every layer breakpoint. But the layer boundaries have discontinuous derivatives, and that measurably costs integrator accuracy — effective order 2.18 instead of 3.93.

Two different questions get confused. Does the code solve the equations correctly? And do those equations describe reality? The first can be answered on a laptop. The second needs a range.

Three techniques, none needing real data. Compare to a closed form: Allen–Eggers gives an exact velocity profile for unlifted entry into an exponential atmosphere with gravity neglected. Drive the solver into those assumptions and it must agree. Refine the step: a fourth-order method's error should fall sixteenfold when the step halves. Check a conserved quantity: with drag removed, specific mechanical energy must not drift.

All three run against the shipping module. Deviation from Allen–Eggers is 2.26% with production gravity and 0.21% with gravity zeroed — which attributes the gap to the neglected physics rather than the solver. Energy drift is 9.7×10⁻⁹%.

A student who has memorised twenty exam questions will still write a confident answer to the twenty-first. The confidence is not evidence.

Detecting novelty means measuring distance from the training set. The naive approach checks each parameter against its observed range — the marginals. That misses an input whose every value is individually ordinary but whose combination never occurred, which requires a joint test accounting for how the parameters co-vary.

Red-teaming with five constructed attacks caught two with marginal checks alone. A joint test was added in response and now flags a low ballistic coefficient paired with high L/D. What still evades is a familiar vehicle flown in an unfamiliar way — published rather than hidden, because it is the most likely form a deliberate evasion would take.

If a forecaster says 70% and the thing happens 70% of the time, they are calibrated. If it happens 50% of the time, they are overconfident — and the number is not doing the job it claims to.

The Brier score is mean squared error on probabilities. Murphy splits it into three parts.

The backtest scores 0.2034 with a reliability term of 0.0019 — inside the retraining trigger, so automated drift monitoring would call this model healthy. Read the bands above 0.60 alone and it is materially overconfident exactly where alerting happens. Isotonic recalibration cuts reliability to 0.0008 and leaves resolution flat.

Watching an unfamiliar aircraft, you infer a lot from how it moves — how fast it bleeds speed, how tightly it turns. You are classifying, not forecasting.

Ten observable kinematic features are extracted from track history: speed, altitude, their rates, flight path angle, an inferred drag parameter, turn-rate statistics, and dwell. A softmax model maps those to eight archetypes. A confident call narrows the vehicle parameter prior, which collapses the footprint.

Trained on a deliberately different forward model — exponential atmosphere, constant gravity, Mach-varying drag, Heun integration — and evaluated against the shipping propagator. 90.0% cross-model against 12.5% chance. Band narrowing is discounted by that measured accuracy, so a classifier right 90% of the time never collapses a band as if certain.

Predicting where a thrown frisbee lands does not require modelling how it wobbles. Predicting whether it will survive the throw does.

A 3-DOF point-mass model tracks position and velocity. A 6-DOF model adds orientation and the moments driving it, requiring inertia tensors, control-surface effectiveness, and aerodynamic coefficients across the flight envelope — data that does not exist in open sources for these vehicles.

Footprint-level warning needs the trajectory, not the attitude. This build is 3-DOF and says so on every surface. Claiming 6-DOF would require parameters nobody here has, and the resulting precision would be fictional.

Ask ten people what 'a real possibility' means as a percentage and you get answers from 20% to 80%. That spread has caused actual policy failures.

ICD 203 fixes bands: very unlikely 5–20%, unlikely 20–45%, roughly even chance 45–55%, likely 55–80%, very likely 80–95%. It also separates probability from confidence in the reasoning — a high number on thin single-source evidence is a different object from the same number on corroborated evidence.

Every assessment record carries the band, the confidence scored separately, the drivers, the alternatives considered, the assumptions, what would change the judgment, and the seed to reproduce it. Nothing requires this of a model. That is precisely the argument for a model carrying it voluntarily.

Verification: did I build the thing right? Validation: did I build the right thing? Accreditation: will someone with authority accept it for a stated use?

Verification compares code against equations — closed forms, convergence, conservation. Validation compares equations against reality, which needs instrumented measurement. Accreditation is a decision by a named authority, requiring an intended-use statement and published limits.

Verification is closed and published. Validation is open and cannot be closed here — no component has met flight data. Accreditation has no candidate authority because there is no sponsor. That is why the system sits at TRL 4 rather than 6.

A convincing demo is not a readiness level. The scale asks what has been shown, in what environment, with what independence.

TRL 3 is proof of concept. 4 is component validation in a laboratory. 5 is component validation in a relevant environment. 6 is a system prototype demonstrated in a relevant environment. System readiness is the minimum across load-bearing components, not the average — a chain argument.

Propagator 5, classifier 5, novelty detector 4, calibration harness 5, operator interface 4 — and decision rules 3, because thresholds and authorities belong to an operational owner rather than a vendor. So the system is 4. Setting those thresholds ourselves would mean inventing the authority we claim to serve.