Data trust

Clarke is the registry for orbital infrastructure: a public-data registry plus labeled heuristic model. This page is the audit of what a paying operator can trust on Slot Terminal and /api/v1/agents/slots/{slug}.

Clarke v0 is a public-registry view (TLE-primary occupancy, UCS identity, FCC SSAL licenses) plus a transparent heuristic implied-value range. It is not a live exchange, not an ITU deed, and not an appraisal. Curated dollar overlays are hand-checked opinions and do not replace the model. TLE longitude is a tracked-object location, never an FCC assignment or ITU filing.

Product chrome (Sep 2026 design pass)

Registry and Slot Terminal are data surfaces. First screens answer who is on station, rights, and freshness. Dollars are secondary.

Default Terminal quarantine

The default Slot Terminal screen is occupancy + recorded FCC + ingest freshness, plus labeled models: congestion v0 on the page, implied fair value behind one disclosure. Simulated trading UI is not the default.

Pro API still returns bidAsk / full rightsChain / history so agents can inspect the stubs; the HTML default view does not present them as filled primary panels.

GEO Slot Index #1 (/index) is distribution content from the same occupancy / FCC fields: enter/leave vs UCS, dispute flips, license-table mismatches. It does not publish prices.

The machine-readable Slot Index delta feed is GET /api/v1/agents/deltas (see Agent API). It diffs stored registry snapshots. It does not turn the Index method note, or satellite_relocated events, into a weekly tape. A satellite_relocated row is a current station-kept payload whose longitude change exceeds the drift its mean motion predicts. Debris and rocket bodies are not in that list.

Tests: src/lib/terminal-default.test.ts asserts default primary markup does not contain a filled ITU filing panel (data-rights-layer="itu"). The thin Unrecorded chip is allowed. src/lib/operator-identity.test.ts covers alias resolution.

Ranked issues

Position authority (TLE-primary occupancy)

Dual-track. satellites.longitude_geo remains the UCS catalog longitude (wrap-normalized only; 0° placeholders are no longer silently overwritten). Occupancy, congestion, comps, and valuation v0 cluster on a chosen occupancy longitude:

1. Prefer Space-Track / Clarke TLE sub-satellite longitude when all of these hold:

   • Object is a satcat PAYLOAD (or satcat type is missing — UCS GEO identity is kept). Explicit DEBRIS, ROCKET BODY, and UNKNOWN are not moved.

2. Not decayed (decay_date empty) and satcat current is not N.

3. TLE epoch was within 30 days of TLE ingest (the Space-Track query already filters EPOCH > now-30; usability is relative to ingest, so a shipped snapshot does not silently revert to UCS as the wall clock moves).

4. Eccentricity ≤ 0.01 and mean motion in [0.98, 1.02] rev/day when those elements parse (same gates as the GEO TLE feed).

5. Mean motion is inside the station-kept band [1.0013, 1.0041] rev/day. Outside that band the object is drifting (about 0.5 degrees per day or more). It gets no occupancy longitude and no UCS fallback.

6. SGP4 at the TLE epoch (tsince=0) returns a finite longitude in (−180, 180].

7. Else fall back to UCS longitude unless that value is the 0° placeholder (classified/undisclosed pile-up), and unless a stored mean motion says the object is drifting. No TLE and UCS 0 → occupancy null (do not invent a Prime-Meridian station). The three disposal-orbit objects the old 0.99 query never stored (NORAD 23553 MSAT-2, 26608 Intelsat 1R, 20776 Skynet 4C) are filled from CelesTrak GP element sets fetched 17 October 2026, and only when spacetrack_tles has no row. Space-Track was not re-queried on that date.

8. Never interpolate UCS and TLE. Never present TLE longitude as an FCC assignment or ITU filing location. FCC matching stays on the authorization’s own longitude (±0.6°).

9. Flag positionDisputed when both longs exist and circular \|UCS−TLE\| > 2° (tunable POSITION_DISPUTE_DEG).

10. A UCS ghost is a catalog longitude inside the slot window whose occupancy longitude is outside that window and whose \|UCS−TLE\| exceeds 2°. Agreement within 2°, with the track just outside the ±0.4° co-location cut, is the same station-keeping neighborhood, not a stale catalog hit.

11. Occupancy / congestion window remains ±0.4° co-location and ±2° neighborhood, using circular longitude difference. The occupancy window is 0.4 degrees on either side of the slot longitude. A satellite at 0.5 degrees is outside it. On the stored Space-Track TLE, MUOS-1 (NORAD 38093) is 0.42 degrees from 101W. A CelesTrak element set fetched 17 October 2026 places it 0.505 degrees from 101W. Both are outside the window, so MUOS-1 is not an occupant of 101W.

12. A servicing vehicle that shares an element set with a host payload is flagged and left out of the operator mix. satCount still includes the row. MEV-2 shares an element set with Intelsat 10-02. Docking is inferred from that match. A separate docking notice was not checked.

Read-time freshness is separate from the 30 day ingest gate. sourceVintage.tleStale and each occupancy row's tleStale are true when the TLE that supplied occupancy has an epoch older than 45 days (tleStaleAfterDays). A missing epoch is not stale. A UCS fallback row is not given a catalog date as a TLE epoch, and its tleStale stays false. The flag does not move occupancy back to UCS. A shipped snapshot still does not silently revert to UCS as the wall clock moves.

Ingest (npm run ingest:spacetrack, or npm run apply:positions against an existing TLE table) writes audit columns (longitude_ucs, longitude_tle, longitude_occupancy, position_source, position_delta_deg, position_disputed, tle_epoch, …) without replacing the UCS catalog field. Live clustering recomputes from the TLE table at query time so occupancy cannot drift from the audit trail.

Registry row identity

The registry table is one row per slug. Same-slug duplicate rows are shipped as a single row.

UCS satellites outside every curated slot's ±0.4° window are grouped by lonToSlug (occupancy longitude rounded to 0.1°). Satellites that share that slug are one row, not one row per satellite. Different slugs stay separate rows even when they sit inside ±0.4° of each other. A satellite inside a curated slot's ±0.4° window is occupancy on that curated row, not a second table row.

The registry operator is the canonical name with the most satellites in the slug (tie: alphabetical canonical name). Source strings stay on operatorRaw. A UCS operator string that equals that satellite's launch vehicle is not treated as a GEO operator and is not replaced with a guessed owner.

UCS sometimes stores one country-free defense label (Ministry of Defense, Defense Ministry, Armed Forces) for more than one nation. Clarke appends the owner country on display so those rows are not one operator. Unknown US agency stays unknown. Federal Government (Reserved) is not mapped to US DoD.

Post-2023 occupancy and empty licenses

The UCS file vintage is the latest GEO launch in that snapshot (2023-04-07 on the current database). Station-kept GEO payloads launched after that date are missing from a UCS-only occupancy count. Clarke adds them when Space-Track has a PAYLOAD row, the satcat period is 1434 to 1438 minutes, the object is not already in UCS, and the TLE passes the occupancy gates. On this snapshot that set is about 73 satellites. Operator is filled only from a single matching FCC licensee. A country code is not an operator.

An FCC-only registry row requires a real authorization and no satellite or curated slot inside the 0.6 degree license window. Federal Government (Reserved) rows (no spacecraft, public-notice reservations) are not registry rows and are not shown as licensees. A license next to an occupied slot is not a second empty slot. The old 0.4 degree cut plus those reservation rows overstated the empty-licensed set (about 15 rows).

Curated status does not override evidence. 45W (Intelsat 14, FCC S2785) and 169E (Horizons 3e, FCC S2947) are On station. A squatted label remains only when a satellite is in the window and Clarke has no FCC row.

A detail URL can still open for an occupancy slug that the table folded into a nearby row. The label on that URL is the nominal longitude of the slug. The page can still show satellites from the shared ±0.4° window. It is not a second registry row. The live registry size is the positions and on-station line on /docs and /orbital.

Before / after (Space-Track TLE epoch 2026-09-15, apply 2026-09-15)

This table is the cutover snapshot. It is not the live registry and not the live Slot Terminal. Later TLE ingests move occupancy counts, congestion v0, and fair value. Those live figures are not reprinted here, because a hardcoded count goes stale on the next refresh.

Spot checks

Occupancy window is ±0.4° TLE-primary. Satellite counts, congestion v0, and fair value move when TLEs refresh, so this table does not print them. Open the Slot Terminal for the live labeled models.

Satellite identity cross-check (do not invent)

Compared Clarke UCS + Space-Track satcat to CelesTrak SATCAT (/satcat/records.php?CATNR=). Names, COSPAR, launch dates match. Sub-satellite longitude in the last column is from Clarke’s Space-Track TLE at epoch 2026-09-15 (not CelesTrak SATCAT, which does not publish GEO longitude).

These five NORAD IDs did not reproduce the historical UCS mis-ID problem called out on About. Terminal now shows UCS lon, TLE lon, Δ, source, and epoch. The agents slot payload returns those occupancy fields, FCC rows, dispute records, and source vintage. Treat NORAD on that payload as UCS-attributed, Space-Track-joinable, not independently verified for every row.

On that 2026-09-15 snapshot, disagreements were flagged instead of hidden, and occupancy was already TLE-primary. The live disagreement count moves with each TLE ingest and is not reprinted here.

Field trust matrix (Slot Terminal)

Legend: V = verified from a named public source in this product · M = modeled / heuristic, labeled · S = stub or simulated · B = bug or inconsistency (fixed unless marked open)

Claim language Clarke can use

Safe

• “Normalized public GEO occupancy: Space-Track TLE longitude when the TLE passes published quality gates, otherwise the UCS catalog longitude.”

• “Implied fair value v0 is a documented heuristic ($30M baseline × listed drivers), with a confidence band, not a market price.”

• “Congestion is a 0–100 coordination-risk index from TLE-primary occupancy positions, not an ITU filing count.”

• “Identity of named satellites can be checked against Space-Track / CelesTrak; we do not treat UCS NORAD IDs as authoritative for every row.”

• “UCS vs TLE longitude disagreement is shown (Δ and positionDisputed); TLE longitude is not an FCC or ITU assignment.”

• “ITU filings are not in this product. ituRecorded is not_in_product. ITU Space Explorer is the current ITU source. SNS Online shut down in January 2025.”

• “The registry table is one row per slug.”

• “Congestion v0 and implied fair value are labeled models on the Slot Terminal.”

• “Operator labels are a curated alias map over UCS and FCC strings; source strings remain inspectable.”

• “The public agent record has no headline operator, no valuation, and no congestion score. ituRecorded is not_in_product.”

Do not claim

• Live transponder bids, last trade, or slot appraisal.

• ITU deed / brought-into-use as recorded (BIU is a Clarke hint from UCS occupancy + FCC rows, not SNS).

• That the curated overlay is the model, or that history is a price index.

• That the default Terminal is a live exchange (simulated book is Experimental only).

• That “operator” means exclusive holder of the longitude (it does not).

• That UCS last_run today means 2026 ephemerides.

• That a TLE sub-satellite longitude is the FCC-authorized or ITU-filed location.

• That the operator alias map is a live ownership or sub-lease graph.

• That congestion v0 or fair value is a recorded occupancy or license fact.

• That the agent payload includes a single operator, a valuation, or a congestion score.

• That the Unrecorded chip names an ITU network, proves brought-into-use, or fills a filing row.

Re-ingest

Scheduled ingest.yml runs UCS, Space-Track, SEC, and the FCC workbook re-parse on the 1st of the month, then pushes data/clarke.db once. The Space-Track step applies TLE-primary audit columns. FCC reads committed data/ssal.xlsx and does not download fcc.gov. See FCC SSAL refresh. Against a DB that already has TLEs:

npm run apply:positions    # audit columns; live occupancy also recomputes at query time
npm run ingest:fcc         # parse data/ssal.xlsx; record workbook vintage
npm run vintages           # backfill UCS / TLE / FCC vintages without re-downloading UCS
npm run seed:valuations    # backfill model path (not trades) after occupancy/model changes

Space-Track credentials are required only for a live TLE refresh (npm run ingest:spacetrack), not for apply:positions or ingest:fcc.

Agent slot payload

The field list is Agent API. HTTP GET /api/v1/agents/slots and GET /api/v1/agents/slots/{slug}, and the MCP tools clarke_list_slots, clarke_get_slot, and clarke_get_terminal, return that record. clarke_get_terminal is the same JSON as clarke_get_slot.

The record includes occupancy (TLE-primary, UCS fallback), operatorIdentity (split, single, or none) and operatorMix (canonical name, count, share, raw source strings), per-satellite operators on occupancy rows, FCC rows, disputes, source vintage, and provenance. occupancyAuthority on the slot is tle-primary. Each observation's occupancyAuthority is tle, ucs, or none. There is no slot-level operator or operatorRaw. A split window has no single holder name. The human Terminal can still show its curated registry label. That label is not the agent record. Disputes are in-window TLE vs UCS disagreement plus UCS ghosts (catalog inside the window, occupancy outside, absolute UCS-TLE difference greater than 2 degrees, or no measured delta). ituRecorded is not_in_product on every slot. sourceVintage.fccStale is true when the FCC workbook as-of parses and is older than 45 days. A missing as-of is not marked stale. sourceVintage.tleStale is true when a TLE used for occupancy is older than 45 days. A UCS fallback row does not invent that epoch.

Valuation, congestion, bid/ask, comps, and dollar strings are not in the agent payload. Congestion v0 and implied fair value live only as labeled models on the human Slot Terminal. Agents must not treat them as facts. The Pro Terminal API can still return those labeled models. It is not the agent record.

Not yet shipped

1. ITU BR IFIC when licensed. Replace the empty stub rather than decorating it. SNS stays out of the product until then.

2. Daily valuation job that writes source=model_run only after ingest, still never source=trade until observed trades exist.

3. A real FCC download when the agency publishes a bot-reachable file. Until then, the human replace-xlsx steps in FCC SSAL refresh.