[devin-ai-integration]

Makes the integrated phase-3 model self-consistent as a design, following the SE review of integration/phase-3: every design value that the review found defined twice (or three times) is now defined once and read by reference, the two maintainer decisions the review leaves open are one-place edits, and the pinned runs are re-recorded. Model, docs, Makefile and scripts/runs.sh only; no OpenSysML change. Base: integration/phase-3 (0b6b353). One commit per item, in the review's order.

Tier split: unchanged. The mission tier is still every model/*.sysml that names no OpenSysML extension package (make tiers lists the same files as before), the tool tier is unchanged, and model/81-physics.kerml is the only KerML file. The mission tier passes the standalone pilot wrapper with the standard library alone; the only pilot-mission change (item 9) adds a second oracle for the .kerml file, it does not move any file between tiers.

Per item

1. One Δv / thrust-time book (c106d77). Review: "the budgets (2 800/150/160/40 m/s, 1 400 d) and the analyses/Monte Carlo/variants/argent doc (2 000 m/s, 350 m/s required, 1 930/1 134/1 100 d) disagree, and the analysis book declares the 507 t case non-returnable while the budget closes it with 21 % margin."

• Before: TethysBudgets 2 800 / 150 / 160 / 40 m/s and 1 400 d; TethysAnalyses::LowThrustTransferAnalysis defaults 2 000 m/s outbound, 350 m/s required return, 1 930 d allowance; TethysMonteCarlo::ReturnDispersion its own copy; TethysVariants and the argent doc a third.
• After: TethysMission::TransferBook / transferBook (model/02-mission.sysml) holds deltaVOutbound = 2 800 m/s, deltaVRendezvous = 150, deltaVReturn = 160, deltaVInsertion = 40, deltaVRequiredReturn = deltaVReturn + deltaVInsertion = 200 m/s, missedThrustMargin = 0.10, thrustingTimeAllowed = 1 400 d, with the rocket-equation derivation in its doc comment (Isp 2 900 s, g₀ 9.806 65 m/s², exhaust speed 28 439 m/s; 6 600 kg loaded, 6 468 kg usable as PropellantBudget defines). TethysBudgets, TethysAnalyses, TethysMonteCarlo, TethysVariants and the argent doc read it by reference.
• Both books now agree on every standard case (fixed build): return Δv 495.7 / 297.2 / 214.3 m/s for small / nominal / large against 200 m/s required; thrust time 600.3 / 823.2 / 1 038.5 d against 1 400 d allowed. The pinned build records 588.5 / 807.1 / 1 018.2 d (F-B01, see "when the pin moves").

2. One target-case set and the return envelope (0d06649). Review: "507 t (budgets) vs 1 010 t (capture envelope) vs 7.7 m (safety) vs the integrated CaptureTargetCase."

• Before: TethysBudgets::TargetCase 217 / 362 / 507 t at 5.7 / 6.8 / 7.6 m, TethysTarget::CaptureTargetCase 181 / 362 / 1 010 t at 5.4 / 6.8 / 8.2 m, TethysSafety::envelopeCases 5.0 / 6.8 / 7.7 m.
• After: one table TethysTarget::targetCases (model/07-target.sysml) — small 5.7 m / 2 200 kg·m⁻³ / 213.3 t / 252 s, nominal 6.8 m / 362.2 t, large 7.6 m / 505.7 t, plus the envelope-edge cases lightest (4.0 m, 1 200 kg·m⁻³, 40.2 t, 600 s), largest (9.5 m, 987.6 t, 100 s), densest (6.8 m, 3 500 kg·m⁻³, 576.2 t), fastSpin (120 s) and tumbling; mass is derived from diameter and density. Budgets, capture envelope, safety and the capture sequence read it; TethysVariants reads it as plain shared parts (F-F02, variant-object evaluation).
• Return envelope, computed and pinned in TethysBudgets: returnableBodyMass = 542 485.8 kg at the 15 % margin, returnableBodyMassNoMargin = 651 928.2 kg (review: "≈ 540 t at 15 % margin / ≈ 650 t at zero margin" — confirmed). captureCommitEnvelope.maximumBodyMass is now the lesser of propellantBudget.returnableBodyMass and the capture mechanism's maximumBodyMass (1 000 t, which the L2 requirements still size against largest), so the commit gates in 60-modes and 61-sequence turn away any body the propellant cannot return — largest (987.6 t) and densest (576.2 t) are retreat cases at commit, the three standard cases pass.

3. One mode vocabulary and one power-by-mode table (ed75fcb). Review: "two enum def TugMode (9 literals in model/31, 15 in model/60) plus CommandedMode; SubsystemConfiguration.busLoad is independent of the unit rollup the budgets use."

• Before: TethysTugStructure::TugMode (9), TethysModes::TugMode (15), TethysOperations::CommandedMode; busLoad hand-entered per configuration.
• After: one TethysTugStructure::TugMode with 16 literals (launch … abortHold), the budget load cases expressed as mode groups (thrustingModes, coastingModes, proximityModes, safeModes); TethysModes::SubsystemConfiguration.busLoad defaults to TugPowerInMode(mode), the same unit rollup TethysBudgets::PowerBudget reads; CommandedMode is gone.

4. DRO stop time and period (dec3bdd). Review: "droRevolution stops at 3.20 TU while the period is 3.2047 TU, so the 934 km 'closure' is 28 minutes of arc."

• Before: stopTime = 3.20 TU, destinationDro.period = 13.9 d, closure 934 km.
• After: stopTime = dro70000.periodTimeUnits, timeStep = periodTimeUnits / 320, destinationDro.period = 13.9155 d; the pinned run (runs/dynamics-standard.txt) shows closure = 0.0 km, periodShown = 1 202 363.57 s (= 13.9155 d). The model's own RungeKutta4 stays (F-F01 depends on it).

5. Magic numbers (ecfffb6). Review: "hotCaseHeat × 1.22, tugMassAtTarget − 700 kg (the budget's own outbound xenon is 1 233 kg)."

• ThermalBudget.hotCaseHeat = TugHeatInMode(TugMode::thrust) * hotCaseSolarFactor, where hotCaseSolarFactor = SolarFlux(perihelionAu) / SolarFlux(aphelionAu) ≈ 1.13 is named and documented (the string processes the array output, so its thrust-mode dissipation scales with the flux); PropellantBudget.tugMassAtTarget = launchMass − outboundAlone − rendezvousAlone − wren.wetMass (the two arcs flown alone, 1 233 kg of xenon, plus the released inspector) and the hydrazine budget reads it, instead of − 700 kg.

6. Stale prose (381dea3). The tethys doc "1 300 days", the argent doc "~650 kg outbound, 5 100 kg, 370 t, 1 100 d at 1.8 N", the heliocentricRange flux range (now 1 200–1 353 W/m² for 150.0–159.3 × 10⁶ km), the earthRange doc, and docs/small-body-domain-list.md O3 / rows 152–153 (9 800 kg xenon, 14.3 t tug, 1 300 d → the budget's 6 600 kg load / 6 468 kg usable, 12 624 kg launch mass, 1 400 d allowance of the 2 200 d mission; its derived rows now read 1 450 d to process the load at 1.69 N and 264 d for the 1 233 kg of the outbound and rendezvous arcs) all read from the single book.

7. Units (fea0c32). Δv, thrust, mass flow, speedOfLight : SpeedValue, standardGravity : AccelerationValue, and the analysis-tier suffix-named reals carry ISQ quantity types (SpeedValue, ForceValue, MassFlowRateValue, DurationValue, PowerValue, AccelerationValue, MassValue, LengthValue); dB in 52-link-budgets stays dimensionless by design. Kept as Real, each with a doc comment naming the finding: the Real-valued orbital helpers (sqrt and ** are defined on Real only in the Kernel Function Library) and the eight CLI-swept / sampled parameters — new finding F-F08 with probe model/probes/F-F08-sweep-quantity-range.sysml: -sweep "speed=1.0..3.0:1.0" on a SpeedValue parameter is refused (cannot write 1.0 (a Real) to a feature typed by SpeedValue) while the same sweep over a Real runs. Mission tier still passes the standalone pilot.

8. Coverage honesty (004efc8). Review §3.2: "rows marked satisfied without evidence (WP-E SE-152 'feeds SE-123', WP-I SE-275 as-flown values that contradict the budgets, WP-F SE-192/194/195, …)".

• SE-152 now states the real coupling (busLoad bound to TugPowerInMode, the rollup SE-123 reads); SE-275 → partial (the imported xenonUsedOutbound = 3 290 kg, xenonUsedReturn = 2 750 kg, earthRange = 10.6 × 10⁶ km contradict the budget's 1 173 kg outbound, 4 233 kg nominal and the cislunar geometry); SE-192/194/195 cite the re-recorded runs (transfer times above; returnOverTargetCases 200 runs, mean 331.6 m/s, outOfSpec = 0; DRO closure 0.0 km); SE-081 reads 5.7 / 6.8 / 7.6 m with margins 0.43 / 0.32 / 0.24; SE-123/124/125/134/145 state what the F-B01-fixed build shows (energy 3 588 Wh of 8 640 Wh, thermal 5 737 W of 7 480 W and mass close; power while thrusting does not, 11.9 % against the 15 % PDR row); SE-128/129 and SE-105 say the link ranges are asserted, not trajectory-derived; SE-156/157 → open pending the matrix owner. SE-263/264, LANG-095/170/532 stay open with the reason stated (an eclipse duration nobody has derived; conscious non-use of the notation).

9. pilot-mission gates the KerML file (7b5a8da, F-G01). The standalone wrapper refuses .kerml in SysMLValidator.java:118, not in the pilot; pilot-mission now also runs validate-sysml-batch --root over the mission-tier .kerml files with the standard library alone. .sysml semantics unchanged. Negative control: a copy of 81-physics.kerml with feature bogus : NoSuchType; fails the new step with Couldn't resolve reference to Type 'NoSuchType' (exit 1).

10. Re-adjudicated finding rows (063f546), status column only, ids and probes kept:

• F-D03 — pilot right: KerML 8.3.4.5.3 checkConnectorTypeFeaturing ("Each relatedFeature of a Connector must have each featuringType of the Connector as a direct or indirect featuringType") with SysML 8.3 deriveUsageMayTimeVary ("If isComposite = true, it does not specialize Actions::Action"); perform action is the correct form.
• F-F06 — OpenSysML right: SysML 7.6.3 ("a tighter default of [1..1] is implicitly declared for the usage if … the usage is an attribute usage, an item usage …, or a port usage"); out x : Real is a reference usage.
• F-F04 — under-specified: KerML 8.3.2.4.3 isDistinguishableFrom ("… or neither of the metaclasses of the memberElement … conform to the other"); keep RealFunctions::min.
• F-B03 — pilot right in substance: KerML 8.3.2.4.5 validateNamespaceDistinguishability violated by the library's two redefinitions of Occurrence::this; model note.
• F-G01 — closed by item 9. F-G03 — OpenSysML right, pilot defect (EMF bidirectional-reference pairing, not a KerML constraint; KerML 8.2.2 RelationshipBody / Dependency produce the lines); probe kept.

Pending maintainer decisions — one attribute each

• Thrusting-power closure (PowerBudget.thrustingCloses fails at the fixed build: demand 35 518 W vs 39 757 W array at aphelion EOL, margin 11.9 % < 15 %). Each option is one edit: array size → TethysTugStructure::SolarArrayWing::ratedPowerAtOneAu (24 kW per wing, model/31-tug-structure.sysml); string-draw cap → TethysTugStructure::HallThruster::operatingPower (11 kW; poweredShare 0.75 of 3 beside it); margin policy → TethysMarginPolicy::activePolicy (= pdrPolicy, model/30-margin-policy.sysml). Every budget, the mode table and the Monte Carlo read these through TugPowerInMode / arrayAtAphelionEol, so nothing else moves.
• Fiction distance: DRO radius → TethysEnvironment::destinationDro.radiusAboutMoon (70 000 km, model/01-environment.sysml; destinationDro.period is the propagated value TethysDynamics::droStability checks, so a new radius makes that gate name the new period); array class → the same SolarArrayWing::ratedPowerAtOneAu.

Run diff by category (runs/, 0b6b353..HEAD, recorded with the pinned 0a5fa2d94 build)

• Transfer / analyses (4 files): the three transfer cases and the sweep read the book — thrust times 588.5 / 807.1 / 1 018.2 d, every case returnable (was 1 134 d and the large case non-returnable).
• Monte Carlo (4): returnOverTargetCases outOfSpec 51 → 0 (200 runs, mean 331.6 m/s); capture, missed-thrust and insertion re-sampled over the shared cases.
• Budgets wpb-* (6), trades (1), variants (1), tooling (5), requirements-satisfy / as-flown / documents (8): the typed values print with their units and the shared book's numbers; tugMassAtTarget, hotCaseHeat and the return envelope appear.
• Modes / sequence / FDIR (9): modes-tug-large-target → modes-tug-dense-target (rename, the 576 t densest case is the envelope-edge mode run), new sequence-dense-target; the 16-literal vocabulary and busLoad rollup change every mode table.
• Dynamics (3): DRO closure 934 km → 0.0 km over the full period.
• Safety (2): envelope margins at 5.7 / 6.8 / 7.6 m = 0.43 / 0.32 / 0.24.
• Probes (4): new probe-F-F07, probe-F-F08, probe-F-F08-plain (the F-F08 runs go through runt, which strips the wall-time column like every other sweep).
• tool-version.txt: the pinned source build prints sysml dev / Commit: 0a5fa2d9405e; house-rules, notation, risk, render: one-line value changes.

Gates (final head)

$ make validate        # exit 0
$ make pilot-mission   # exit 0  (standalone pilot over mission .sysml + batch KerML oracle over model/81-physics.kerml)
$ make pilot-all       # exit 0
$ make house-rules     # exit 0
$ make runs            # exit 0  (pinned build 0a5fa2d94; git status after: 0 changed files)
$ make runs-check      # exit 0

All six on head 063f546, in that order, from a clean tree.

CI on this PR fails before any model gate: the OpenSysML nightly installer's SHA256SUMS.txt lists the same asset twice, so install.sh refuses the download (does not match SHA256SUMS.txt (expected <hash> <hash>, got <hash>)). The same failure is on the base branch; it is an upstream manifest defect, not worked around here.

When the runs pin advances to a develop containing #1379

F-B01 zeroes the enum-keyed power / energy / thermal rollups in the pinned build. Once the pin contains the evaluator fix, these recorded runs change: wpb-power-budget-*, wpb-unit-power-*, requirements-satisfy, tpm-margins, vv-report / documents (the power, energy and thermal rows), analyses-transfer and analyses-sweep, montecarlo-return / montecarlo-missed-thrust, trades, variants and dynamics-array-sweep — everything downstream of TugPowerInMode(thrust) → thrustAtAphelion → massFlowAtAphelion. Expected values (fixed build): transfer thrust times 600.3 / 823.2 / 1 038.5 d (pinned 588.5 / 807.1 / 1 018.2), return Δv 495.7 / 297.2 / 214.3 m/s, demandThrusting = 35 518 W, thrustingMargin = 0.119, eclipseEnergy = 12 916 800 J, hotCaseHeat = 5 737 W, radiatorCapacity = 7 480 W; thrustingCloses will then report its real (failing) verdict, which is the pending decision above. The DRO, safety, mode, sequence and target-case runs do not move.

Behaviour changes

Verdicts that flipped in the recorded runs, all from the review follow-ups on this PR (the three Devin Review threads), recorded with the pinned 0a5fa2d94 build:

• satisfy resourceMarginPositive by xenonTrend: fails → holds in runs/wpd-operations-satisfy.txt (the run also drops its exit 1), runs/requirements-satisfy.txt, runs/wpb-budgets-satisfy.txt and runs/as-built-satisfy.txt. Cause: TethysOperations::xenonTrend now reads TethysBudgets::propellantBudget (aboard = usable − (outboundAlone + rendezvousAlone) × (1 + missedThrustMargin) = 5 112 kg; rate = massFlowAtAphelion per day = −5.245 kg/day; days = the thrusting days the nominal return and insertion arcs need with the missed-thrust allowance, returnArcsXenon 2 877 kg → 548.6 d) instead of its own 5.2 kg/day × 1 000 d; margin −265 → +1 935 kg (the follow-up thread on current spends the allowance on the flown arcs too, so aboard is 5 112 kg and projected equals propellantBudget.usable − xenonNominal = 2 235 kg).
• No other verdict moves. TS-019 despinCapacity, TS-014 proximityContactEnvironment and ContactSpeedTest now divide the largest case's mass and diameter by its own 100 s period (momentum 222 238 → 560 040 N·m·s, hydrazine 34.3 → 86.5 kg against the 100 kg quarter load; surface speed 0.118 → 0.298 m/s against 0.35 m/s); all three still hold, and the runs print verdicts, not these values.
• runs/wpc-envelope-cases.txt keeps its four failing positive assertions at this PR's pin: the model is spec-correct and the failure is an evaluator defect of 0a5fa2d94 (targetCases.tumbling.spinState == SpinState::tumbling is false there even with an explicit = binding; the recommended explicit binding does not change the verdicts). wp/tool-pin (Pin OpenSysML to develop 5cd37f288 and apply the model follow-ups it unblocks #13) pins 5cd37f288, which evaluates all seven assertions as asserted.
• Non-verdict movement: runs/house-rules.txt 19 188 → 19 191 elements, 172 824 → 172 841 checks (the returnArcsXenon attribute); object ids shift by one in the three -satisfy runs (tethysSystem.ground 25 → 24, argent.eps 30 → 29, argent.rcs 23 → 22, wren 21 → 20, ground.network 26 → 25) and batteryCapacityTrend / extendedMission move from ids 5 / 6 to 152 / 153 in wpd-operations-satisfy because xenonTrend now instantiates the propellant budget first.

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/be546fb3300945ed94da2f7b19824b9e
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/be546fb3300945ed94da2f7b19824b9e?variant=devin
Requested by: @HuiJun

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring