I spent two weeks last January in a windowless room at Johnson Space Center, replaying telemetry from the NG-247 docking sequence frame by frame. The autopilot had reported nominal across all thirty-one checkpoints, yet the final approach velocity exceeded safe margins by 0.3 meters per second. On paper, that delta is rounding error. In practice, it compressed a docking ring gasket and triggered a three-day maintenance hold that cost the program $4.2 million.

The failure was not in the algorithm

The guidance code performed exactly as specified. That was the problem. Our acceptance thresholds had been calibrated in 2019 against a vehicle mass model that no longer reflected reality. Two cargo resupply missions had added unexpected ballast, shifting the center of gravity by eleven centimeters along the Z-axis. The autopilot compensated smoothly — it just compensated for a spacecraft that no longer existed.

We had built a system that was precisely wrong. Every sensor reading confirmed the model. Every control input was textbook. The spacecraft flew beautifully into the wrong place.

— Dr. Kwame Asante, GN&C Lead, Artemis III

The fix was not a patch. We rewired the entire validation chain: mass properties now update from on-board load cells every orbit, the approach corridor geometry recalculates with live inertia tensors, and the docking confidence score surfaces raw sensor disagreement rather than hiding it behind a single green indicator. The new protocol took nine months to certify.