v0.8.0

Added

• Inertial velocity is exposed downstream. Propagator::velocity_eci and
  Propagator::state_eci (returning StateEci { r_m, v_m_s }) thread the analytic
  TEME velocity SGP4 already computes — previously discarded — through to callers in
  m/s; Orbit::velocity_eci gives the Keplerian path a consistent velocity. The
  AIAA 2006-6753 verification test now also checks velocity for every reference row
  (worst velocity error 1.85e-9 km/s across all 666 states) and pins the compared
  row count at exactly 666.

• Stricter, panic-free TLE parsing. Lines are required to be ASCII and are
  sliced safely (no more byte-index panics on multi-byte input); elements are
  range-checked (inclination, eccentricity, mean motion); the column-69 checksum
  can be enforced via ParseOpts { strict_checksum } / parse_propagators_opts
  and the new strict_checksum flag on ConstellationCfg (lenient by default).

• Allan-deviation curve in the output. Each clock run now reports an
  adev_curve ([{tau_s, adev, n_samples}]) and the browser playground renders a
  log-log "Clock stability (ADEV)" chart.

• Time-grid input validation. TimeCfg::validate rejects a non-finite, zero,
  negative, or oversized time grid (a step larger than the duration, or more than
  MAX_TIME_STEPS samples) before any allocation, so a malformed scenario returns
  an error instead of panicking or exhausting memory.

• Monte Carlo ensembles for the inertial pack. runs = N on an inertial
  scenario runs N seeds and reports each metric's mean, standard deviation,
  percentiles, and a percentile-bootstrap 95% confidence interval (ensemble).
  Every inertial run now carries a monte_carlo flag, so a single-realisation FoM
  is no longer mistaken for a distribution. (CEP/2DRMS are intentionally not
  reported — they require the 3-axis model on the roadmap.)

• Guided playground mode. The browser playground no longer drops you onto a
  raw TOML wall: a "Start here" strip of one-click scenario cards loads and runs a
  worked example, sliders expose the universal knobs (seed, timing threshold)
  without touching the TOML, a "How to read this" note explains the result, and the
  full TOML is one collapsible away. Every run is shareable — Copy share link
  encodes the whole scenario into the URL fragment (nothing is uploaded) so a link
  reproduces the exact run on load. The codec is unit-tested (web/share.test.mjs,
  run in CI).

• N-dimensional parameter sweeps (src/sweep.rs). nd_sweep evaluates a
  metric over the full Cartesian product of several SweepAxis ranges (the
  multi-parameter trade study), in row-major order, deterministically. Additive —
  the existing 1-D sweep API is unchanged. Per-node bootstrap confidence intervals
  and generalisation beyond the clock pack remain on the roadmap.

• Real snapshot RAIM (src/raim.rs). Genuine position-domain Receiver
  Autonomous Integrity Monitoring: it builds the line-of-sight geometry to the
  visible satellites, forms the least-squares solution and residuals, runs a χ²
  residual fault-detection test (exact threshold from a dependency-free
  incomplete-gamma χ²/non-central-χ²), and computes slope-based horizontal and
  vertical protection levels (HPL/VPL) with the missed-detection bias derived for
  the configured P_fa/P_md. This is distinct from — and is not yet wired into —
  the scenario pipeline's filter-self-consistency Integrity figure; fault
  exclusion, alert-limit/P_HMI budgeting, and ARAIM remain on the roadmap.

• Frequency-stability suite: MDEV, TDEV, HDEV + confidence intervals
  (src/allan.rs). Alongside the overlapping ADEV: the modified Allan deviation
  (separates white from flicker phase noise), the time deviation
  (TDEV = tau/sqrt(3) * MDEV), and the Hadamard deviation (rejects linear
  frequency drift exactly and converges for divergent red-noise types). χ²-based
  confidence intervals (deviation_ci) use a dependency-free normal/χ² quantile
  pair (Acklam + Wilson-Hilferty) with a conservative non-overlapping edf;
  noise-type-specific edf and Stable32 numeric parity remain on the roadmap.

• Reference-frame reduction (src/frames.rs). GMST-based TEME↔ECEF rotation
  (using the same IAU-1982 sidereal time as the propagator), exact WGS-84
  geodetic↔ECEF with a Bowring-seeded iterative inverse (machine-precision at all
  altitudes, including MEO/GEO), and a geodetic ground-station
  observer that returns azimuth / elevation / range in the local East-North-Up
  frame. Polar motion and sub-arcsecond nutation are not applied (GMST-only,
  sub-kilometre on the ground track); an ITRF-precise CIO chain is on the roadmap.

• Time-scale foundation (src/timescales.rs). A dependency-free Julian-date
  API (Gregorian civil ↔ JD, MJD), the full IERS integer leap-second history
  (UTC↔TAI, 10 s in 1972 to 37 s since 2017), the defined TAI→TT offset, the UT1
  correction via a supplied DUT1, and the IAU-2000 Earth Rotation Angle. This is
  the time substrate that Earth-fixed frame reduction (planned) sits on. Instants
  are single-f64 Julian Dates (~50 µs resolution near the present epoch; a
  two-part JD is on the roadmap), and the pre-1972 rubber-second era is not
  modelled — both documented in the module.

• Reproducibility & provenance. A deterministic CycloneDX SBOM generator
  (scripts/gen-sbom.sh) and a SLSA build-provenance attestation on the release
  binary and SBOM; the release toolchain is pinned to match CI. Determinism
  guarantees, the cross-platform libm caveat, and the golden-pinning approach are
  documented in docs/REPRODUCIBILITY.md.

• Property-based and fuzz tests (tests/property.rs). Deterministic
  randomized tests (no new dependency) assert invariants over thousands of inputs:
  the TLE and scenario parsers never panic on garbage, non-ASCII, mutated, or
  truncated input; TimeCfg::validate never panics on NaN/inf/negative grids; the
  TLE checksum is consistent and column-69-only; geodetic↔ECEF round-trips and the
  TEME→ECEF rotation preserves norm across the globe and a wide altitude band.

Changed

• Golden tests now pin the figures of merit field-by-field for the four
  reference scenarios (with a tolerance that absorbs cross-platform libm jitter),
  replacing the earlier inequality-only checks, so a silent numerical regression is
  caught immediately.
• schema_version in result artifacts bumped from 0.1 to 0.7 (it was frozen
  while the engine moved on).
• cargo-deny now denies (not warns on) yanked dependencies.
• New docs: CAPABILITY.md (honest scope map), SCHEMA.md (result-field
  reference), INTEGRITY.md, QUANTUM-MODELS.md, REAL_TLE_GUIDE.md. A CI guard
  fails if the README version badge drifts from Cargo.toml.

---

Full changelog: CHANGELOG.md · Docs: README