{"id":"c7eb4f52-7479-4d1a-95b5-2aa021b773f0","arxiv_id":"2607.02128","paper_version":3,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A braking-distance and corridor-erosion test gives a fast safe-start check for approaching a tumbling target, but it is not a sound certificate: 30 of the 152 starts it certified were infeasible in the authors' own sweep.","lead":"This paper proposes two simple rule-of-thumb formulas for deciding whether a spacecraft can safely start an approach to a tumbling satellite and match its rotation. The formulas are about 250 times cheaper than full reachability analysis, but the paper's own closed-loop tests show they sometimes approve starts the controller cannot actually fly.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'sound inner certificate' claim is unsupported: (8)-(9) treat each constraint and co-rotation as independent double-integrator braking, omit CWH coupling in (1), and are contradicted by the 30 false positives in Table 3.","rationale":"The paper's contribution rests on the structural claim that synchronization is strictly stronger than positional reachability and that the closed-form criteria (8)-(9) constitute a sound inner certificate. This is the load-bearing element: the entire onboard go/no-go recommendation depends on it. The derivation, however, never uses the CWH dynamics (1) beyond the prediction matrix; it treats the apparent rotational motion as an exogenous velocity to be braked independently per constraint. That is not a proof of conservatism with respect to the true dynamics: the single thrust vector must simultaneously cancel Coriolis/gravity-gradient terms, maintain all five corridor constraints, and build the required co-rotation. The paper provides no sufficiency proof, and the empirical data actively contradict the soundness claim—Table 3 shows 30 false positives and §7.2 states the criteria are 'not a sufficient certificate.' The paper's explanation of these false positives (post-solve projection, inter-sample violations) attributes them to a particular controller, but this does not restore the theoretical claim; at best it suggests a better controller might recover some cases, but the analytical bound itself is not validated as a subset of the true synchronization set. The additional centripetal-acceleration observation—at r close to r_sync = 2a_max/ω_t^2, the instantaneous centripetal requirement ω_t^2 r reaches 2a_max, exceeding the thrust bound—further illustrates that the braking-distance heuristic is not conservative. Since the central safety claim is unsupported and contradicted in parts by the paper's own results, the reader's REJECT verdict remains appropriate.","tokens_in":12922,"tokens_out":7517,"duration_ms":73667,"concrete_test":"Take the 30 false-positive certified states from Table 3 (e.g., a_max=0.10 m/s^2, ω_t=4 deg/s, r0=30 m) and solve a dense optimal control problem with the full CWH dynamics (1), time-varying LOS corridor constraints (4), and terminal co-rotation condition, using direct collocation with fine time discretization and no controller restrictions. If any such state has no feasible trajectory, then the analytical set is not an inner bound on the true synchronization set. Alternatively, compute the true synchronization backward reachable set via HJ with terminal velocity matching and verify S_analytic ⊆ S_true; containment failure disproves the soundness claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (Conclusions) that (8)-(9) form a sound inner certificate, S_sync ⊊ S_reach, is not established. The erosion margin (8) models each corridor constraint as an independent scalar double-integrator, assuming the chaser can devote full thrust a_max to arresting that constraint's slack rate. The synchronization bound (9) likewise treats co-rotation as one-dimensional braking, ignoring the sustained centripetal acceleration ω_t^2 r needed to track the rotating corridor and the CWH coupling terms (3n^2 x, 2n ydot, -2n xdot) in Eq. (1). No proof is given that any state satisfying (8)-(9) is feasible for the actual CWH dynamics under the rotating corridor; the inclusion chain (12) is asserted, not derived. Moreover, Table 3 reports 30 certified-but-infeasible cases (precision 0.80), and §7.2 explicitly concedes the criteria are 'not a sufficient certificate,' directly contradicting the 'sound inner certificate' language in the abstract and conclusions. Thus the onboard go/no-go claim is at best a heuristic screening test, not a certified safe-start region.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes two closed-form safe-start criteria for approach to a tumbling target under a rotating LOS corridor: a directional per-constraint erosion margin, δ_i = (sdot_i^-)^2/(2 a_max) (Eq. 8), and a synchronization radius, r < 2 a_max / ω_t^2 (Eq. 9). These are embedded in a three-regime PD/MPC guidance architecture and benchmarked against backward/forward polytopic reachable sets, Hamilton–Jacobi reachability, and closed-loop Monte Carlo. The central claim is that the closed-form synchronization set is a sound inner certificate, strictly contained in the positional HJ reachable set (S_sync ⊊ S_reach), and that it can serve as a ~10 ms onboard go/no-go test where HJ requires seconds.","tokens_in":13253,"tokens_out":5045,"duration_ms":52213,"significance":"A validated ~10 ms sufficient certificate for safe starts would be a practically valuable contribution to on-orbit servicing and debris removal, and the paper has genuine strengths: it ships reproducible open-source code, uses physically honest CWH truth propagation without state projection or reference blending, and benchmarks against four independent reachability engines over a parametric sweep. However, the advertised certificate claim is not supported. The analytical derivation is double-integrator braking geometry, not a consequence of the CWH dynamics stated in Eq. (1), and the paper's own Table 3 shows 30 certified-but-infeasible cases (precision 0.80), which is incompatible with a sound inner certificate. As an empirical high-recall screening heuristic the results may be useful, but the manuscript as written overclaims its central contribution, and the internal contradiction between the Conclusions and §7.2 is load-bearing.","major_comments":[{"comment":"The closed-form criteria are derived from scalar double-integrator braking geometry, not from the CWH dynamics (1). Eq. (8) credits the full thrust a_max independently to each constraint slack, and Eq. (9) uses the braking distance d_brake = ω_t^2 r^2/(2 a_max) without accounting for the sustained centripetal acceleration ω_t^2 r needed to co-rotate with the hold point or the CWH coupling terms (3 n^2 x, 2 n ydot, -2 n xdot). No theorem states that a state satisfying (8)–(9) is feasible for the dynamics (1) under the rotating corridor. Since the abstract claims these are 'derived from bounded-thrust relative orbital dynamics,' this is a load-bearing gap. The authors should either prove sufficiency under explicit assumptions or abandon the 'sound inner certificate' wording.","section":"§5.1–5.2, Eqs. (8)–(9)"},{"comment":"The numerical sweep directly contradicts the 'sound inner certificate' claim. The confusion matrix reports TP=122, FP=30, TN=336, and the text notes precision 0.80. For example, at a_max=0.10 m/s^2, ω_t=4 deg/s, r0=30 m, the table gives 7/9 certified but 0/9 feasible. A sufficient inner certificate must have zero false positives; 30 certified-but-infeasible cases are concrete counterexamples. The paper itself concedes in §7.2 that the criteria are 'not a sufficient certificate.' This is not a presentation issue; it invalidates the abstract/conclusions claim that the criteria are a sound inner bound.","section":"§7.2, Table 3"},{"comment":"The inclusion chain S_tube ⊆ S_ana ⊆ S_sync ⊆ S_pos_HJ is asserted, not derived. In particular, S_ana ⊆ S_sync requires that every analytically certified state can both reach and co-rotate with the hold point; no such proof is given, and Table 3 suggests the analytical set over-approximates the empirically synchronization-feasible set. The HJ benchmark is a terminal-time position reach set, not a reach-and-co-rotate set, so the IoU numbers in Table 2 do not validate Eq. (12). Each inclusion should be proved under stated assumptions or else explicitly labeled as conjecture.","section":"§7.1, Eq. (12)"},{"comment":"There is an internal contradiction that cannot be ignored: the Conclusions call (8)–(9) a 'sound inner certificate,' while §7.2 states they are 'not a sufficient certificate' and the confusion matrix shows false positives. Because the operational value of the paper is the claimed onboard go/no-go guarantee, this is not a local wording issue. The manuscript should be reframed around the actual result: a high-recall, low-cost screening heuristic with a quantified false-positive rate, not a certified safe-start set.","section":"Conclusions vs §7.2"}],"minor_comments":[{"comment":"The constraint slack s_i and its derivative sdot_i are used before being defined. Please define s_i = b_c,i - A_c,i R_z(-θ) r and give the explicit expression for sdot_i under the rotation.","section":"§5.1, Eq. (8)"},{"comment":"The QP enforces the axis-aligned box |u_i| ≤ a_max and then projects to the Euclidean disk ∥u∥_2 ≤ a_max. This post-solve projection can destroy optimality and does not guarantee the QP constraints remain feasible. Clarify whether the projection is part of the controller or a heuristic that contributes to the false positives discussed in §7.2.","section":"§4.2"},{"comment":"The table caption says 'Each cell totals 9 unless otherwise noted,' but the 0/8 cell at a_max=0.02, ω_t=1, r0=150 is noted, and the text says it provides 8 of the 12 false negatives. The total of 500 cases requires a full accounting of missing cases; please give an explicit count of cases per cell.","section":"Table 3"},{"comment":"The body-frame rotation is about the LVLH z-axis at rate ω_t, but the tumble of an arbitrary target is generally three-axis. Please clarify whether the analysis is restricted to spin about the orbit normal and state this limitation in the Introduction or problem setup.","section":"§3.2, Eq. (5)"},{"comment":"References [16] and [18] appear to be concurrent submissions to the same proceedings (IAC 2026). If they are not yet published, please provide status or preprint DOIs so the reader can verify the relevant claims; if they are self-citations to work under review, this should be disclosed.","section":"References"},{"comment":"The sentence 'The precision 0.80/recall 0.91 closed-loop agreement ... supports the use of r_sync and the directional-erosion test as onboard go/no-go signals' is too strong given the 30 false positives. A go/no-go signal with 6% false positives may be acceptable for screening, but it should be described as screening, not as a safety certificate.","section":"§8.3"}],"recommendation":"reject","confidential_remarks":"The paper's central advertised contribution — a sound inner certificate with a structural containment relation — is contradicted by the authors' own numerical results and by an explicit concession in §7.2. I do not see a local fix; the manuscript would need to be substantially reframed as an empirical screening heuristic, which changes the contribution and the evaluation criteria. If the authors resubmit with that reframing, a thorough comparison of the heuristic against a properly defined reach-and-co-rotate target (e.g., HJ with velocity-matching terminal cost) would be needed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version: this paper has a useful empirical study and a correct qualitative point, but the headline claim of a \"sound inner certificate\" doesn't hold up. The closed-form criteria (8)-(9) are two braking-distance inequalities from a double integrator, applied to a CWH problem with a rotating corridor, and no proof connects them to feasibility of the actual dynamics. The paper's own Section 7.2 says \"not a sufficient certificate,\" while the abstract and conclusions call it a sound inner bound. That's a direct contradiction on the central safety claim.\n\nWhat's genuinely good: the benchmarking against four reachability engines is careful, and the decision to use CWH truth propagation without reference blending or state projection is the right call — it exposes real physical limits instead of phantom successes. The confusion matrix in Table 3 is transparent, and the structural observation that synchronization (reach the hold point and co-rotate) is strictly stronger than positional reachability is correct and worth saying. The gap widening with tumble rate is intuitive and the sweeps confirm it.\n\nThe soft spots are load-bearing. The erosion margin (8) assumes each corridor constraint can be arrested with full thrust independently. The synchronization radius (9) assumes co-rotation is achieved merely by braking the apparent velocity over the available range. Neither accounts for the CWH coupling terms in (1) nor for the sustained centripetal acceleration needed to track a rotating point. A concrete check: at ω_t = 4 deg/s and r = 30 m, the centripetal acceleration is ω_t² r ≈ 0.146 m/s², which exceeds the a_max = 0.10 m/s² used in Table 3. Yet r_sync = 2 a_max / ω_t² ≈ 41 m, so criterion (9) certifies that cell. That's not a controller artifact; it's a physical impossibility for the exact synchronization task. The inclusion chain (12) is asserted, not derived. The 30 false positives in Table 3 may be partly due to the single-input filter's projection and inter-sample violations, but the paper hasn't shown they are entirely due to those, and the centripetal argument suggests they are not.\n\nWho this is for: people working on proximity operations with tumbling targets, especially those who want a quick screening test and a comparison of reachability tools. It deserves a serious referee because the problem matters and the empirical data is honestly reported. But I would not accept the safety claim as stated. A revision needs to either prove sufficiency of (8)-(9) for the CWH + rotating-corridor dynamics (including the centripetal constraint) or explicitly downgrade the claim to a screening heuristic and change the abstract and conclusions accordingly. The omitted high-tumble cell in Table 3 should also be filled in. Send it to peer review, but expect major revision.","headline":"A genuinely useful empirical benchmark and a sensible conceptual distinction, but the 'sound inner certificate' claim is not established: the closed-form criteria are unproved kinematic bounds, the paper's own Table 3 shows 30 false positives, and Section 7.2 contradicts the abstract.","tokens_in":15,"tokens_out":3507,"would_cite":false,"duration_ms":77317,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93B03","70M20"],"pacs":[],"model":"deepseek-v4-flash","headline":"Two closed-form inequalities certify safe starting states for approach to a tumbling target, giving a set strictly contained in the numerical reachable set and computed about 250 times faster.","keywords":["spacecraft rendezvous","tumbling target","line-of-sight corridor","backward reachable set","synchronization radius","Hamilton-Jacobi reachability","model predictive control","go/no-go certification"],"falsifier":"Run the exact closed-loop dynamics (Clohessy-Wiltshire-Hill with sub-stepping, no blending or projection) from a state that passes conditions (8)-(9) near the boundary of the synchronization radius, such as at a_max=0.10 m/s^2, tumble rate 4 deg/s, range 30 m where the paper reports 7/9 certified but 0/9 feasible; if the corridor is violated or co-rotation is not achieved in that test, the claimed soundness is falsified.","tokens_in":12789,"feed_emoji":"🛰️","tokens_out":6258,"duration_ms":53058,"temperature":0.7,"pith_summary":"This paper asks: from which initial states can a spacecraft safely approach a tumbling, uncooperative target while staying inside a line-of-sight docking corridor that rotates with the target's body frame? The authors derive a closed-form answer from bounded-thrust relative orbital dynamics: each corridor constraint is eroded by a margin δ_i = (sdot_i^-)^2/(2 a_max) to account for rotation-induced drift before thrust can arrest it, and the chaser must start within a synchronization radius r < 2 a_max/ω_t^2 over which the apparent rotational velocity can be cancelled. They argue this synchronization set is a sound inner certificate — strictly smaller than the positional reachable set computed by Hamilton-Jacobi reachability, because requiring co-rotation is stronger than merely arriving at the hold point. Across a 500-case sweep with a closed-loop MPC controller, the certificate predicts empirical feasibility with 0.80 precision and 0.91 recall at a fraction of the compute cost, so the authors propose it as an onboard go/no-go bound for pre-mission planning and replanning.","feed_headline":"10 ms check certifies safe starts for docking with a tumbling target","feed_subtitle":"Two simple inequalities replace costly numerical reachability for pre-mission safety, with 92% accuracy in closed-loop tests.","key_machinery":"Two analytical objects do the work. First, the directional per-constraint erosion margin δ_i = (sdot_i^-)^2 / (2 a_max): for each face of the rotating LOS corridor, this is the distance the constraint slack erodes under apparent rotational drift before the thruster at acceleration a_max can arrest it; the initial state is safe only if slack exceeds this margin on every face. Second, the synchronization radius r_sync = 2 a_max / ω_t^2, obtained by requiring that the braking distance ω_t^2 r^2/(2 a_max) to cancel the apparent co-rotation velocity ω_t r be smaller than the range r itself. Together they form a closed-form certificate that the chaser can brake into co-rotation with the hold point","core_discovery":"The paper's central claim is that the safe-start question for approach to a tumbling target under a rotating line-of-sight corridor splits into two distinct notions: positional reachability (whether the chaser can reach the hold point at all, with any terminal velocity) and synchronization (whether it can both reach the hold point and match its co-rotation velocity ω_t r). The authors derive a closed-form synchronization set from two inequalities — the per-constraint directional erosion δ_i = (sdot_i^-)^2/(2a_max) and the synchronization radius r < 2a_max/ω_t^2 — and show, by comparison with Hamilton-Jacobi backward reachable sets, that this set is strictly contained in the positional reacha","pith_inferences":["The erosion formula treats each corridor constraint axis independently and ignores the CWH coupling terms and the centripetal acceleration needed to stay co-rotating. A natural extension would be to tighten δ_i to account for the coupling, or to augment the certificate with a tube based on the CWH dynamics; the paper's own 6% false positives at high tumble rates (concentrated at the handover) hint","The synchronization radius r_sync = 2a_max/ω_t^2 has the same form as a classic acceleration-limited stopping distance, but expressed in angular terms; one could test the conjecture that the true synchronization set in CWH coordinates is obtained by replacing a_max with the minimum singular value of the input map along the co-rotation trajectory, which would give a dynamic, state-dependent version","The confusion-matrix numbers (122 TP, 30 FP, 12 FN) suggest that as a go/no-go screen the certificate is high-recall but not sufficient; a hierarchical scheme could use the 10 ms test for screening and a short-horizon reachability or control-barrier check only for states in the 6% ambiguous band."],"forward_implications":["If the certificate is correct, a spacecraft can run a ~10 ms check on an initial state and decide go/no-go for approach to a tumbling target without solving a 4D Hamilton-Jacobi PDE (which takes ~2.4 s per query).","The strict containment S_sync ⊊ S_reach implies that any mission requiring sustained co-rotation (docking, berthing, capture) must plan from a strictly smaller set than mere reachability would suggest; the gap quantifies the extra cost of insisting on synchronization.","The ∝1/ω_t^2 collapse of r_sync means high tumble rates make co-rotation infeasible beyond very short ranges even with high thrust authority; this gives a mission-design rule for choosing approach geometry or deciding to despin the target.","Because the certificate is conservative by construction (a sound inner bound), a state that passes is provably safe for the modeled dynamics; states that fail may still be feasible, as the 12 false negatives in the sweep show."],"fun_headline_variants":["Two closed-form checks certify safe approach to tumbling targets","Simple inequalities replace costly reachability for tumbling docking","Closed-form safe-start test matches costly reachability at 92%","Safe-start regions for tumbling target via two cheap inequalities","Docking with tumblers: closed-form safety check beats grid methods"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The certificate assumes the chaser's full thrust authority can be applied independently along each corridor constraint and that simply braking the apparent rotational velocity over the range r is enough to co-rotate with the hold point; it never proves this remains feasible under the CWH orbital coupling (the 3n^2x, 2n ydot, -2n xdot terms) and the sustained centripetal acceleration ω_t^2 r needed for co-rotation.","fun_headline_variants_meta":{"raw":{"variants":["Two closed-form checks certify safe approach to tumbling targets","Simple inequalities replace costly reachability for tumbling docking","Closed-form safe-start test matches costly reachability at 92%","Safe-start regions for tumbling target via two cheap inequalities","Docking with tumblers: closed-form safety check beats grid methods"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000184,"raw_usage":{"total_tokens":1214,"prompt_tokens":866,"completion_tokens":348,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":610,"completion_tokens_details":{"reasoning_tokens":263}},"tokens_in":610,"tokens_out":348,"duration_ms":4020,"temperature":1.0,"reasoning_tokens":263,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T09:01:34.669989+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the exact closed-loop dynamics (Clohessy-Wiltshire-Hill with sub-stepping, no blending or projection) from a state that passes conditions (8)-(9) near the boundary of the synchronization radius, such as at a_max=0.10 m/s^2, tumble rate 4 deg/s, range 30 m where the paper reports 7/9 certified but 0/9 feasible; if the corridor is violated or co-rotation is not achieved in that test, the claimed soundness is falsified.","supporting_citations":[],"review_version":2}