Terminus: the unbroken thread

Proposal section 10: the unbroken thread

A word can be lost in four ways between a slate in the twilight band and a mind at 20,000 kilometers. Rain over the village attenuates the Ka beam. The star flares, and the noise floor jumps. A handover, however well choreographed, drops packets in the seam. And once in a long while an anchor fails mid-sentence. The RFP is blunt about all of it: sessions never drop, and a conversation may not stall longer than a tenth of a second at the 99th percentile. This section is how we keep that promise — with two very old ideas that work, here, only together.

Ask again, or say it twice

When part of a message is lost, engineering knows exactly two remedies.

The first is honest and ancient: ask again. The receiver notices a gap, tells the sender, and the sender repeats the missing piece. Engineers call it ARQ — automatic repeat request — and its virtue is certainty: with acknowledgment and repetition, delivery is guaranteed, eventually. Its vice is that one word — eventually.

The second is subtler: say it redundantly, in advance. Before sending sixteen packets, compute two extra "repair" packets — mathematical blends of the sixteen, built so that any sixteen of the eighteen suffice to reconstruct the originals. Lose any two, and the receiver rebuilds them alone, instantly, asking no one. This is forward error correction — FEC — and its virtue is speed: repair travels with the data, so recovery costs zero extra round trips. Its vice is faith: it protects against the losses you budgeted for, and is silent about the ones you didn't.

The tyranny of the round trip

Why not simply ask again? Because of what asking costs on this network. A retransmission takes one full round trip between terminal and anchor — 180 milliseconds in the worst geometry — and the stall budget is 100. Every single loss, under pure ARQ, is a visible freeze, nearly twice the budget, no matter how rare losses are. And they are not rare enough:

cargo run -p terminus-orbits --example unbroken_thread

Token stream 20 packets/s; ARQ retransmission costs one
round trip: 180 ms — 1.8x the 100 ms stall budget.

calm sky (1% residual loss):
  ARQ only:              a 180 ms stall every 5.0 s
  FEC 16+2 (12.5% overhead): residual 7.3e-4 ⇒ a stall every 18.3 min
  FEC 16+4 (25.0% overhead): residual 1.4e-6 ⇒ a stall every 6.8 days

Read the first line the way a child at a slate would experience it: the answer to her question freezing, mid-word, every five seconds, for the rest of her life. That is ARQ alone, on a good day. Now read the second line. Two repair packets riding along with every sixteen — a 12.5% tax on bandwidth — and the freeze retreats from every five seconds to every eighteen minutes: 220 times rarer, bought with arithmetic instead of round trips. Double the repair, and it retreats to once a week.

FEC does not eliminate loss; it relocates the cost — from latency, which the RFP guards jealously, to bandwidth, which the beams of section 7 have in comparative plenty. That trade is the heart of this section.

The ladder

So the design is a ladder, and each rung is slower but surer than the one above:

1. Proactive FEC — repair packets interleaved with the stream heal almost every loss in zero extra round trips. The conversation never notices.
2. More repair, on request — when a generation arrives too broken to rebuild, the receiver does not name the missing pieces; it simply asks for more repair packets — any of them help, which matters when the request itself might cross a shifting sky. One round trip.
3. ARQ — beneath everything, the classic guarantee: whatever is still missing is retransmitted until acknowledged. The floor that cannot fail.

The interactive token stream lives on rung one and seldom descends. Bulk cargo — retrieved documents, model updates, the vault's transcript streams — cares little about a round trip and leans comfortably on rung three. One mechanism, tuned per traffic class.

And the rungs are not static. The repair budget breathes, because this network knows its future: handovers are scheduled, flares are detected within seconds, and the timetable that routes every packet also schedules its protection — lean in calm skies, generous in the minutes before a seam crossing, aggressive when the star is shouting:

flare / handover (5% residual loss):
  ARQ only:              a 180 ms stall every 1.0 s
  FEC 16+2 (12.5% overhead): residual 5.8e-2 ⇒ a stall every 13.8 s
  FEC 16+8 (50.0% overhead): residual 1.3e-6 ⇒ a stall every 7.2 days

A scheduled outage is just erasures you can pay for in advance. When conditions worsen fivefold, the calm-sky budget frays — and the timetable, knowing, has already raised it. The same trick wears a second costume from section 6: repair packets need not even share a band with their sources. Source on Ka, repair on all-weather X — then rain that eats the primary band is, mathematically, just another erasure pattern the repair already covers.

Whose job is reliability?

One boundary decision underlies all of this: the reliability domain runs end to end, terminal to anchor, over a transport descended from Earth's QUIC — a connection that carries its identity with it rather than borrowing it from the path, with our FEC woven into it as an extension. The satellites between the endpoints route packets and never retransmit them; they hold no reliability state at all, which is precisely what lets a handover move routes, never minds — the connection does not notice that the sky rearranged itself beneath it. And beneath the transport, each radio hop runs a defense of its own — which deserves its section, because it answers a question a careful reader should already be asking.

The floor below

Everything above treated the radio link as a source of clean erasures — packets that arrive intact or not at all, at some residual rate. Real radio is messier: bits arrive smeared and doubtful, flipped by noise. The layer that turns that analog struggle into our tidy erasure model is the physical layer, and it fights with the same two weapons wielded faster. Every transmission carries its own dense error-correcting code — LDPC, the workhorse of Earth's late standards, decoded in silicon in microseconds — and when a block still fails, the hop retransmits, not the endpoints: a repeat request crossing only the 24-millisecond terminal-to-satellite loop, pipelined dozens deep so the stream never pauses while feedback is in flight.

And here, one layer down, combining finally makes sense. When the radio receiver fails to decode a block, it does not discard the wreckage: it keeps the soft symbols — each bit's measured shade of confidence — and when the retransmission arrives, adds the two receptions together, signal accumulating faster than noise. Two half-heard sentences make one clear one. Earth's engineers call it hybrid ARQ with soft combining, and it belongs precisely and only here: soft symbols live inside one receiver on one hop. Our end-to-end retransmissions, by contrast, may arrive through a different satellite, band, or anchor than the copy they replace — nothing holds both receptions to add. What the transport gains instead is path diversity, and its own kind of combining is the FEC algebra itself: any sixteen of eighteen, from anywhere. Energy combines at the physical layer; information combines at the transport. Each layer sums what it actually possesses.

We will not design the waveform in this proposal, and we say plainly why: our patron manufactures both ends of every radio link and can iterate the physical layer freely with each satellite generation, which makes it the one layer best left to the intelligence that owns its silicon. What the proposal binds instead is the contract: after its own coding and combining, each hop must hand the transport residual erasures of at most 1% in calm skies and 5% under flare or handover stress — the exact loss regime every table in this section was computed against. For the curious, our reference sketch under that contract is deliberately conventional: LDPC data channels, OFDM downlink, single-carrier-shaped uplink so the terminal's power amplifier runs cool for its decade in the meadow. Nothing exotic — and that is a finding, not a compromise. Earth's research imagined elaborate waveforms to survive channels that writhe with Doppler and delay; our beams already hold each spot's channel nearly still. Having engineered away the dynamics, we decline to pay for machinery that exists to survive them. Boring is what ten unattended years look like. Recorded as ADR-0011.

That boundary — and the floor beneath it — is also what makes the last failure survivable.

When the endpoint itself dies

FEC can heal a damaged stream; it cannot heal a dead anchor — the repair packets and the state they protect burned together. Here the ladder's floor and the architecture join hands. The anchor's death is declared in 300 milliseconds of missed keep-alives; the timetable names the backup anchor; the vault at L1/L2 re-seeds it with the conversation's transcript. And then ARQ performs its quiet final duty: everything the terminal sent that was never acknowledged — the question in flight when the light went out — is still sitting in its retransmission buffer, and is sent again, to the new anchor, as if the loss were any other. The conversation heals from both ends: the vault restores what the mind had heard; ARQ restores what it hadn't yet. No session restart, no lost exchange beyond the one the requirement already concedes.

Which mathematical code fills the FEC slot — Earth's RaptorQ lineage, classic Reed-Solomon, sliding-window schemes that suit a stream better than blocks — is deliberately not decided here. The architecture defines the slot; volume 2 will race the candidates through the packet-level simulator, over these same orbits and these same loss patterns, and let the measurements choose. Recorded as ADR-0010.

The thread, then, does not break: not for rain, not for flares, not for the seam, not even for a death in the sky. What remains is only the accounting — and the proposal can rest.