Which Map, Which Clock

Hand a network engineer the prefix 10.1.0.0/16 and ask what it reaches. The honest answer is a question: in which table? The same octets name different networks in different VRFs, and every router ever configured refuses to mix them unless someone explicitly leaks between tables. Provenance is the whole meaning.

Coordinates work the same way, and until recently the geometry code did not enforce it. Here is the mechanism, before the vocabulary. Bolt a map to the planet and a point on the equator stands still while the stars wheel overhead. Fix the map to the stars instead and the same point is tearing along at 465 meters per second while the heavens hold still. Both maps are correct. Both are in daily use. The rotating one is the International Terrestrial Reference System, ITRS, and it is where ground stations live. The inertial one, for Earth, is the Geocentric Celestial Reference System, GCRS, and it is where orbits make sense. Subtract a vector on one map from a vector on the other and you get a number with plausible digits and no meaning at all.

FIG.01 - Two maps of one point PICK WHAT HOLDS STILL

That is what the code did. The SGP4 boundary evaluated each TLE satellite once but exposed only the Earth-fixed result, and the propagation engine relabeled that vector into the slot reserved for the common inertial frame. At the ISS fixture epoch the two frames disagree by 192.7 kilometers. Twelve hours later they disagree by 12,709 kilometers, because the planet kept turning and the error is the turn. Every cross-body range, latency, occlusion, and tracking decision involving a TLE endpoint was quietly poisoned, and nothing crashed, because relabeling a vector does not change its bytes. It only changes its truth.

The clock half

The map is only half the claim; the other half is the instant. Orbital elements are a photograph. Semi-major axis, eccentricity, phase, all of it is true at one timestamp, the epoch, and at no other. Propagation means advancing the photograph from its own instant. The two-body and J2 propagators were advancing phase by time since the session's pacing epoch while reading elements authored at the orbit's own epoch. Those instants coincide only when a session starts exactly at the orbit epoch and never seeks. The first seek re-anchored every orbit-placed satellite back to its photograph, and from then on position stopped being a function of simulation time. The false geometry fed real link latency.

FIG.02 - The seek that rewound the sky POSITION MUST BE A FUNCTION OF TIME

Terrestrial engineers have met this failure in other clothes. Restore a device's counters from a snapshot without recording when the snapshot was taken, and every rate computed afterward is fiction. An element set without its epoch is the same fiction with orbital mechanics attached. The fix made the pairing atomic: working elements carry their validity epoch as one fact, set at construction, and every consumer, live loop, batch, preview, and wire, derives its instant from that owned anchor. Unanchored elements are refused by name.

Provenance, enforced

The frame fix has the same shape, and it is a shape network engineers already believe in.

The boundary now returns both frames from one evaluation: ITRS for same-body work, GCRS for cross-body composition. And the frames are distinct runtime classes, not naming conventions. From lib/nodalarc/frames.py:

class CommonVec3(NamedTuple):
    """A vector in the session's common frame (Earth-relative GCRS).

    A distinct runtime class, not a NewType alias: a body-fixed or
    body-inertial Vec3 cannot pass an isinstance check for it, so the
    frame-relabeling that once fed ITRS into cross-body geometry is
    refused at construction, not just in static checking.
    """

That docstring is the whole policy. The class is the border checkpoint. Composition refuses any input without GCRS provenance, and the original defect no longer type-checks or runs. The resolver goes further: the SGP4 family and the analytic propagators realize the Earth-fixed frame 30.316 kilometers apart at LEO radius, so a session mixing them under one central body is refused outright, with the body, the families, and representative nodes named in the refusal. It does not wait for a mixed link pair, because ground handover ranking compares candidates across satellites, and the frame error reaches a decision the moment both populations merely coexist.

That is a VRF boundary: an address family that will not cross-import without an explicit, checked conversion. The discipline network engineering already applies to routes now applies to vectors, for the same reason.

A vector needs a passport, and so does a timestamp. The lab now checks both at every border.