# EDL Heritage and Landing-Success Hazard: Does Reuse of Flight-Proven Entry-Descent-Landing Architecture Reduce Landing-Failure Risk?

**A Doctoral Dissertation**

**Candidate:** JPL_AUTONOMY_EDL_05
**Program:** COLLEGIUM 1st Battalion
**NORTH STAR / JPL category:** Entry Descent & Landing Systems
**Hall-of-Shoulders methodological anchors:** Robert W. Fogel (cliometric counterfactual analysis); Joel Mokyr (economic history of useful knowledge and cumulative innovation), applied alongside Carlota Perez (techno-economic paradigms)
**Date:** 2026-06-15


## Abstract

Few moments in the exploration of other worlds ask so much of so little time as the descent to a planetary surface, where years of labor and the trust of a great many people are committed, in minutes, to a sequence that cannot be recalled. Planetary landing is the highest-risk phase of robotic missions to bodies with or without atmospheres, concentrating a disproportionate share of total mission investment into a few minutes of irreversible, largely autonomous operation. Practitioners assert constantly that reusing a flight-proven entry-descent-landing (EDL) architecture lowers landing-failure risk, yet the claim is almost never tested as a falsifiable quantitative hypothesis against the full historical record of landing attempts. This dissertation specifies and operationalizes that test. The contribution is a single falsifiable proposition: conditional on target body, entry mass, and landed mass, planetary landing attempts that reuse a flight-proven EDL architecture lineage exhibit a lower landing-failure hazard than attempts that introduce novel EDL elements. The null is that EDL architectural novelty has no effect on landing-failure probability. The unit of analysis is the individual landing attempt at the Moon, Mars, or Titan, and the outcome is a binary landing success-or-failure indicator. The principal regressor is an EDL-heritage-reuse index constructed element by element from documented architectural lineage in NASA Technical Reports Server (NTRS) reconstruction reports and TechPort technology-readiness records, scored against the regime in which each element was proven and weighted by the depth of post-flight reconstruction, with program-strength context drawn from U.S. Government Accountability Office (GAO) reports. The estimator is a Firth-penalized discrete-outcome logistic hazard model, with a complementary-log-log discrete-time hazard as a link-robustness check, on a low-parameter, pre-registered specification suited to the small population frame. Following Fogel, the heritage effect is framed as a partial counterfactual: the change in landing-failure probability a given attempt would face if its heritage index were lowered toward the novel end while target, mass, and program strength were held fixed, which is the discrete-outcome analogue of the social saving. Following Mokyr and Perez, the novelty captured in the index is decomposed into propositionally grounded (analytically matured) and ungrounded (trial-based) components to test whether any heritage effect operates through codified, verifiable knowledge rather than through the age of the hardware. The work is presented as a design-stage analysis plan; every expected and illustrative result is labeled as not yet executed on the full dataset, and the central deliverable is the pre-registered, falsifiable design itself. The design fixes in advance the conditions under which the contribution would be falsified: a near-zero or wrong-signed heritage coefficient, a coefficient that collapses once the program-strength control is added (reported as confounded), and inseparability of the heritage index from program strength. The result is decision-relevant whichever way the coefficient falls. A real and unconfounded heritage effect would justify a conservative lineage strategy and set a measurable qualification bar for novelty. A null or confounded effect would redirect NASA and JPL investment from heritage as a goal toward the engineering reserves and verification rigor that heritage merely proxies.


## Table of Contents

**Front Matter**
- Abstract
- Table of Contents
- List of Tables and Figures

**Chapter 1: Introduction**
- 1.0 The chapter's answer, stated first
- 1.1 The problem in full
- 1.2 The gap in the literature
- 1.3 The single falsifiable contribution
- 1.4 Significance for NASA, JPL, and the named stakeholders
- 1.5 Scope, posture, definitions, and roadmap

**Chapter 2: Theoretical Framework**
- 2.0 The chapter thesis
- 2.1 EDL architecture as a decomposable object and the heritage-novelty spectrum
- 2.2 The Fogelian frame: counterfactual, quantitative, falsifiable
- 2.3 Cliometrics as hypothesis-testing science
- 2.4 The Mokyr-Perez frame: propositional versus prescriptive knowledge
- 2.5 Synthesis: how the two anchors jointly specify the estimator and its interpretation
- 2.6 The conceptual model the empirical work tests

**Chapter 3: Literature Review**
- 3.0 The chapter thesis, the problem it addresses, and how it is organized
- 3.1 The Mars EDL record as a population of natural experiments
- 3.2 The lunar record: powered descent, terminal guidance, and hazard avoidance
- 3.3 Titan and the outer-planet context: the external-validity probe
- 3.4 Forward architecture and technology-gap studies: high-mass and crewed-class Mars
- 3.5 Supersonic retropropulsion and decelerator maturation: the grounded-novelty exemplar
- 3.6 Parachute and disk-gap-band qualification: the decelerator-testing throughline
- 3.7 The reliability-and-failure-statistics tradition and the software-failure channel
- 3.8 Synthesis: the heritage claim across the field, the conditional hazard it implies, and the gap

**Chapter 4: Data and Measurement**
- 4.0 The chapter's answer
- 4.1 Named data sources: provenance, access, coverage, and known biases
- 4.2 Unit of analysis and the inclusion frame
- 4.3 The dependent variable: binary landing outcome
- 4.4 The principal regressor: the EDL-heritage-reuse index
- 4.5 Controls
- 4.6 Measurement table
- 4.7 Data quality, validation against known values, and reliability
- 4.8 Coverage, the four limitations, and ethics and access
- 4.9 Carrying the measurement into the design

**Chapter 5: Research Design and Identification**
- 5.0 The chapter's answer
- 5.1 The estimator: a discrete-outcome logistic hazard and why it dominates the alternatives
- 5.2 Small-sample inference: Firth bias reduction, quasi-separation, and exact or permutation tests
- 5.3 Identification: what \( \beta_1 \) is identified off, and the Fogelian counterfactual made operational
- 5.4 The robustness battery
- 5.5 Threats to validity: the four-way matrix and the design response to each
- 5.6 Power and minimum-detectable-effect analysis, pre-registration, and the computational plan
- 5.7 Chapter synthesis: how the design coheres

**Chapter 6: Analysis Plan and Expected Results**
- 6.0 The chapter's answer, stated first
- 6.1 The seven-step estimation procedure
- 6.2 Pre-analysis: blinding, reliability, and the diagnostic gates
- 6.3 The fixed decision rule on the hypothesis
- 6.4 Illustrative, explicitly non-empirical expected results
- 6.5 What a null, confounded, or contrary result would look like
- 6.6 Power, feasibility, and reproducibility
- 6.7 Chapter synthesis: the plan as the contribution's safeguard

**Chapter 7: Discussion**
- 7.0 The chapter's answer, stated first
- 7.1 If H1 survives the robustness set: heritage has independent protective value
- 7.2 If H0 is not rejected, or the coefficient collapses with the control: the Fogelian conclusion
- 7.3 Rival explanations and rebuttals
- 7.4 The Mokyr decomposition reading
- 7.5 Stakeholder implications for NASA, JPL, and the mission portfolio
- 7.6 External validity
- 7.7 Summary and the objective-to-decision endpoint

**Chapter 8: Conclusion**
- 8.0 The answer this dissertation leaves on the table
- 8.1 The contribution restated: one coefficient, two decision-relevant readings
- 8.2 The bridge the contribution builds
- 8.3 How the anchors sharpened the test
- 8.4 Limitations stated honestly
- 8.5 From design to execution: a concrete future-research program
- 8.6 Summary and implications

**References** (149 entries)

**Appendices**
- Appendix A: Landing-Attempt Population Frame and Inclusion/Exclusion Template
- Appendix B: The EDL-Heritage-Reuse Index Rubric
- Appendix C: Partial-Success Outcome-Coding Rule and Boundary-Case Register
- Appendix D: Program-Strength Index Construction
- Appendix E: Pre-Registration of the Primary Specification, Robustness Set, and Decision Rule
- Appendix F: Extended Literature Table


## List of Tables and Figures

**Tables**
- Table 4.1 (Section 4.6): Measurement table: construct, operational definition, source, and scale for every variable
- Table 6.1 (Section 6.4.1): The specified-but-unpopulated primary result template

**Figures**
- No figures. This is a design-stage measurement study; no fitted result, plotted estimate, or executed visualization is presented. The reporting-format illustrations in Chapters 5 and 6 are textual placeholders explicitly labeled as non-empirical, not figures.



# Chapter 1: Introduction

## 1.0 The chapter's answer, stated first

The decision to entrust a landing to a proven design or to a new one is among the quieter responsibilities a space program carries. It is made repeatedly, with real consequence, and it deserves to be settled by evidence rather than by instinct alone. This dissertation delivers the first population-level, conditional estimate of whether reusing a flight-proven entry-descent-landing (EDL) architecture lineage lowers a planetary landing's failure hazard. The deliverable is a single coefficient, or a credible failure to find one, that converts the practitioner intuition "heritage is safer" into a measured, falsifiable, confounding-adjusted EDL portfolio parameter. The estimand is \( \beta_1 \), the coefficient on a constructed EDL-heritage-reuse index in a logistic model of landing failure, fitted across the documented record of landing attempts at the Moon, Mars, and Titan, conditional on target body, entry mass, landed mass, and a program-strength control. The contribution is not a new EDL technology, a new flight reconstruction, or a new architecture concept. It is a quantitative, hypothesis-testing treatment of an assertion the engineering community makes constantly and almost never tests against the full population of attempts.
I lead with this answer rather than with background because the value of the work is the conditional measurement, not the narrative of landing failures that motivates it. That narrative is widely known inside the field; the measurement does not exist. The remainder of this chapter develops the answer in five moves. Section 1.1 frames the problem as a gap between current and desired states and explains why the intuition behind heritage reuse, although plausible, is not self-evidently correct. Section 1.2 isolates the gap in the literature: three mature bodies of work bear on the question, and none of them joins to estimate the conditional effect. Section 1.3 states the single falsifiable contribution as a paired hypothesis on one coefficient, reproducing the notation and decision rule exactly. Section 1.4 establishes why the result is decision-relevant for NASA, the Jet Propulsion Laboratory (JPL), and their named stakeholders whichever way the coefficient falls. Section 1.5 fixes the scope, the design-stage posture, the key definitions, and the roadmap of the dissertation.

A note on register and posture is owed at the outset. This is a design-stage analysis plan. No coefficient is fitted on the assembled population in this document, and every quantitative statement about results is expected or illustrative and is labeled as such. The contribution at this stage is the pre-registered, falsifiable design itself: the dataset, the estimator, the controls, and the conditions under which the proposition would be falsified, all specified in advance so that the eventual headline result cannot be a product of searching over specifications until a coefficient turns significant. That discipline, borrowed directly from the cliometric tradition this work builds on, is the spine of the chapter and of the dissertation.

## 1.1 The problem in full

### 1.1.1 Current state: a high-stakes trade decided on intuition

Entry, descent, and landing concentrates a disproportionate share of total mission risk into a few minutes of irreversible, largely autonomous operation. A vehicle that has been built, tested, and cruised for months or years commits, in a single uninterruptible sequence, to a chain of aerothermal, aerodynamic, propulsive, and control events that ground testing can approximate but cannot fully reproduce. A single architectural element behaving outside its qualified envelope during that window can end a multi-billion-dollar mission. The Mars Science Laboratory (MSL) guided-entry, supersonic-parachute, powered-descent, sky-crane sequence and the Mars 2020 sequence that reused its lineage are the canonical demonstrations that the EDL phase is where an entire program's investment is placed at risk in minutes [\[88\]](#ref-88)[\[74\]](#ref-74). The lunar record of the past decade sharpens the point: several recent soft-landing attempts failed or landed anomalously, and at least one, the loss of the Vikram lander during its landing phase, has been the subject of a formal interpreted investigation report [\[64\]](#ref-64).

Confronted with this concentration of risk, programs make a recurring and consequential choice: reuse a flight-proven EDL architecture, or introduce novel elements. The choice recurs constantly. It is made when a program decides whether to fly an established sky-crane lineage again rather than redesign the terminal descent, when it weighs introducing supersonic retropropulsion or inflatable decelerators to carry heavier payloads beyond the proven mass class, and when it judges a commercial lander's novel architecture against the firm's lack of any flight-proven EDL [\[4\]](#ref-4)[\[58\]](#ref-58). The current state of practice is that this choice is weighted on an engineering intuition: a flown architecture has survived a real descent, so reusing it should be safer. That intuition is tested, when it is tested at all, against curated mission anecdotes rather than against the full population of attempts with physical and program-strength controls. No defensible, reproducible, conditional estimate of the heritage effect exists to inform the trade.

### 1.1.2 The heritage intuition and why it is not self-evident

The intuition behind heritage reuse is straightforward and, on its face, compelling. A flight-proven EDL architecture has survived the full chain of qualification, integration, and at least one real atmospheric or powered descent. Its failure modes have been observed, reconstructed, and in many cases retired. A novel architecture, by contrast, carries irreducible uncertainty, because ground testing cannot fully reproduce the coupled aerothermal, aerodynamic, and control environment of a real descent, and some failure modes are discoverable only in flight. The class of fatal software failures in spaceflight, disproportionately associated with novel or modified flight software, illustrates the channel: much EDL novelty resides not in structures but in guidance and control software whose first true integration test is the descent itself [\[50\]](#ref-50).

Yet the intuition is not self-evidently correct, and three counter-mechanisms keep it from being a settled fact. First, heritage hardware can be flown outside its original envelope, where its proven status is illusory; an element flown well beyond the regime in which it was qualified is, in the dimensions that matter, novel. Second, novel elements are sometimes introduced precisely because the heritage element was known to be inadequate for a new target or mass class, so that novelty and difficulty are entangled at the moment of design choice; mass scaling in particular forces departures from flown heritage toward novel decelerators and retropropulsion as payloads grow [\[4\]](#ref-4). Third, and most consequentially for inference, the missions that can afford extensive heritage reuse may also be the ones with the deepest engineering reserves, the most experienced teams, and the most schedule margin, so that any observed heritage advantage could be confounded by program strength rather than caused by the architecture itself. Each counter-mechanism predicts that a naive comparison of heritage and novel missions would mismeasure the heritage effect, and in different directions, which is exactly why a conditional estimate is required rather than a tally.

### 1.1.3 Desired state, gap, and the consequence of inaction

The desired state is a defensible, reproducible, conditional estimate of whether heritage reuse changes landing-failure probability, and by how much, with the central confounder bounded and the uncertainty stated honestly. The gap between current and desired states is the absence of that estimate. The consequence of leaving the gap unfilled is not merely academic. The EDL heritage-versus-novelty trade continues to be decided by intuition, and "heritage" risks being silently rewarded as a proxy for unmeasured program strength, so that programs may over-invest in the appearance of lineage continuity while under-investing in the engineering reserves and verification rigor that actually carry the reliability. A measured coefficient, with its confounding bounded, is the instrument that tells a portfolio decision-maker which of these the data support.

The recent record itself motivates a conditional estimate rather than an anecdotal reading, because the anecdotes point in opposite directions. On Mars, the United States has assembled an unusually clean chain of near-replications: Phoenix inherited Mars Polar Lander and Mars Surveyor heritage [\[48\]](#ref-48), InSight reused the Phoenix architecture almost without change [\[82\]](#ref-82), and Mars 2020 reused the MSL sky-crane lineage with bounded additions such as terrain-relative navigation [\[74\]](#ref-74). Independent lineages, such as Tianwen-1, reached the same successful outcome class through a largely separate architectural path [\[144\]](#ref-144). The Mars chain looks like evidence that heritage protects. The lunar record, with its mix of heritage-derived government landers and first-flight commercial vehicles and its sequence of losses and anomalies, looks like evidence that novelty is dangerous [\[64\]](#ref-64). The Small Lunar lander SLIM complicates both readings by achieving a pinpoint landing with a novel architecture while ending in a partially anomalous touchdown attitude, demonstrating that novelty and outcome do not map one-to-one [\[109\]](#ref-109). None of these readings controls for the physical difficulty of the target or for the depth of the program behind each attempt. A coefficient estimated against the whole population, with controls, is precisely what a curated set of cases cannot supply, and is what this dissertation specifies.

## 1.2 The gap in the literature

The claim that no conditional estimate of the EDL heritage effect exists is a claim about three mature literatures that bear on the question and do not meet. Stating the gap carefully matters, because the entire contribution rests on it. I treat the three branches in turn and then state the throughline.

The first branch is the EDL reconstruction-and-architecture record. Single-mission reconstruction reports document, in fine detail, how one EDL sequence performed against its predictions, and they are the literal artifacts of the field's accumulated knowledge: the MSL system overview and performance reports [\[88\]](#ref-88), the Phoenix performance reconstruction [\[48\]](#ref-48), the Mars 2020 system overview [\[74\]](#ref-74), the InSight trajectory and atmosphere reconstruction [\[82\]](#ref-82), the Mars Exploration Rovers EDL description [\[143\]](#ref-143), and the Tianwen-1 guidance, navigation, and control account [\[144\]](#ref-144). These reports define each architecture's elements and their measured in-flight behavior with great rigor. What they do not do, individually or as a set, is estimate a cross-mission effect. Each is a study of one descent. The reconstruction literature is therefore the source of the data substrate for coding architectural lineage, but it contains no statistical test of the heritage hypothesis across missions.

The second branch reasons forward rather than backward. The NASA EDL Systems Analysis studies and the high-mass Mars concept work quantify the decelerator and propulsion trade space for payloads beyond the proven MSL class, and they identify supersonic retropropulsion and inflatable aerodynamic decelerators as the principal novel technologies a heavier future fleet would require [\[4\]](#ref-4)[\[60\]](#ref-60). The human-class architecture studies extend this to crewed masses and enumerate the technology development gaps and their mitigations [\[60\]](#ref-60). This literature is invaluable, because it identifies, with citations and technology-readiness assessments, exactly which EDL elements would be novel relative to flown heritage, and it supplies the novelty side of the heritage index this dissertation constructs. But it reasons about a hypothetical future fleet rather than estimating an effect from the historical record. It tells us what novelty would cost in capability terms; it does not estimate what novelty has cost in failure-probability terms.

The third branch addresses spacecraft reliability statistically. Population-level analyses of deep-space and deployable spacecraft estimate failure distributions and infant-mortality effects across launch cohorts [\[127\]](#ref-127), and work on failure prediction from telemetry establishes that discrete-outcome and time-to-failure modeling are accepted tools in the domain [\[117\]](#ref-117). The catalog of fatal software failures in spaceflight identifies a failure class disproportionately tied to novel or modified flight software, which bears directly on the question because EDL novelty often lives in guidance and control software [\[50\]](#ref-50). This literature supplies the statistical precedent for a logistic or hazard treatment of spacecraft outcomes. What it does not do is isolate EDL architectural novelty as a regressor or address the discrete success or failure of a landing event as distinct from the on-orbit longevity of an operating satellite.

The throughline is that the three branches do not join. The reconstruction reports document single missions but estimate no cross-mission effect; the architecture studies reason forward about a hypothetical fleet, not backward from the record; and the reliability statistics model the longevity of operating satellites, not the discrete outcome of a landing event, and isolate no EDL-novelty regressor. No published study, to this candidate's knowledge, estimates a landing-failure hazard as a function of a constructed EDL-heritage-reuse index across the Moon, Mars, and Titan record while controlling for target body and mass. That absence is not a bibliographic weakness to be patched with a missing citation; it is the gap the dissertation fills, and it is stated here as the novelty of the contribution and revisited as the explicit gap statement in the literature review.

The three branches have not joined on their own for a structural reason rather than an accidental one, and that reason explains why the join has waited for a cliometric treatment. The reconstruction community is organized around single missions because that is how the work is funded, staffed, and reviewed: a reconstruction report is a deliverable of one project, accountable to one flight, and its rigor comes from depth on a single descent rather than breadth across many. The forward-architecture community is organized around capability gaps for a future fleet, so its natural object is the technology that does not yet exist rather than the population of attempts that already does. The reliability-statistics community has the methods to pool across missions, but its canonical object, the operating satellite, supplies a time-to-failure clock that a one-shot landing event does not, so its tools have been pointed at longevity rather than at the binary outcome of a descent [\[127\]](#ref-127)[\[117\]](#ref-117). None of the three has an institutional incentive to construct a cross-mission heritage regressor and estimate its conditional effect, and none has the combination of the EDL domain knowledge needed to code the regressor and the discrete-outcome statistical apparatus needed to estimate it. The contribution of this dissertation is to supply exactly that combination: the EDL domain knowledge to build a document-based heritage index and the cliometric, discrete-outcome machinery to estimate its conditional effect with the confounding bounded.

## 1.3 The single falsifiable contribution

The contribution is stated as one pair of hypotheses about one coefficient, carried unchanged from the approved prospectus and the shared bible governing this dissertation. Nothing in this chapter softens or re-scopes it.

- **H1 (contribution):** Conditional on target body, entry mass, and landed mass, the coefficient on the EDL-heritage-reuse index in a logistic model of landing failure is negative and statistically distinguishable from zero (\( \beta_1 < 0 \)). Higher documented reuse of a flight-proven EDL lineage is associated with a lower landing-failure hazard.
- **H0 (null):** Conditional on the same controls, the coefficient on the EDL-heritage-reuse index is zero (\( \beta_1 = 0 \)). EDL architectural novelty has no effect on landing-failure probability.

The estimating equation for landing attempt `i` is

\[ \operatorname{logit} \Pr(\text{failure}_i = 1) = \beta_0 + \beta_1 \, \text{heritage\_index}_i + \boldsymbol{\gamma}' \mathbf{controls}_i + \epsilon_i \qquad\qquad (1) \]

where \( \mathbf{controls}_i \) contains the target-body indicators, entry mass, landed mass, and a program-strength index. The contribution lives entirely in \( \beta_1 \). The dependent variable \( \text{failure} \) equals one if the vehicle did not achieve a survivable surface placement enabling nominal post-landing operations and zero otherwise, coded under a pre-registered partial-success rule whose boundary cases, such as the SLIM anomalous-attitude touchdown, are recoded both ways in sensitivity analysis [\[109\]](#ref-109). The principal regressor \( \text{heritage\_index} \) is a continuous index on the unit interval, built element by element from documented architectural lineage and technology-readiness history, weighted toward elements whose flight history produced codified, reconstructed knowledge. The full operationalization of every variable is the work of the data and measurement chapter; here the point is that the index is constructed from documents rather than from expert opinion, so that it is reproducible from named sources.
The proposition is falsifiable in the strict sense, and the falsification conditions are fixed in advance. The decision rule is that H0 is rejected for H1 if and only if the estimated \( \beta_1 \) is below zero, its exact or permutation-based ninety-five percent interval excludes zero in the pre-registered primary specification (a Firth-penalized logistic regression with the three physical controls and the program-strength control), and the sign is stable across the pre-registered robustness set. A \( \beta_1 \) that is zero, positive, or negative but statistically indistinguishable from zero fails to reject H0 and falsifies the contribution. A \( \beta_1 \) that is negative without the program-strength control but collapses toward zero when it is added is reported as confounded, which is itself a decision-relevant finding rather than a non-result. A demonstration that the heritage index cannot be separated from the program-strength index, because the two are collinear to the point of inseparability, also falsifies the claim that heritage has independent value. Stating these conditions before any model is fitted is what makes the proposition a genuine hypothesis rather than a narrative arranged to confirm the field's prior.

The central claim of this section is that the heritage-versus-novelty trade can and should be expressed as a single falsifiable coefficient. The record of landing attempts at the Moon, Mars, and Titan is, from a statistical standpoint, a population of discrete, well-documented trials with a binary outcome, each with a known architecture, mass class, and result [\[88\]](#ref-88)[\[74\]](#ref-74)[\[48\]](#ref-48)[\[82\]](#ref-82)[\[144\]](#ref-144)[\[109\]](#ref-109). When a population of binary outcomes is available with a measurable treatment and the obvious physical confounders, a conditional discrete-outcome model is the appropriate instrument for estimating the treatment effect, an inference the spacecraft-reliability literature already honors for related questions [\[127\]](#ref-127)[\[117\]](#ref-117), and the cliometric tradition has long shown that historically observed outcomes can be turned into a quantitative, counterfactual estimate of a technology's marginal value [\[121\]](#ref-121). The estimate is conditional and partial. It is identified off a within-stratum heritage-versus-novel contrast, it does not capture general-equilibrium effects such as heritage availability changing which missions are attempted, and its external claim is bounded to the three named bodies. One objection I concede in advance is that if the heritage index proves inseparable from program strength, no independent heritage coefficient can be identified, in which case the design's own falsification condition is triggered and the honest report is confounding, not a measured effect. These conditions are not afterthoughts. They are the protections that keep the claim defensible, and they are carried forward rather than dropped.

## 1.4 Significance for NASA, JPL, and the named stakeholders

The result is decision-relevant whichever way the coefficient falls, and that symmetry is the mark of a contribution worth defending. NASA and JPL make recurring portfolio decisions in which the heritage-versus-novelty trade is explicit. They decide whether to fly an established sky-crane lineage again or to redesign elements of the terminal descent. They decide whether to introduce supersonic retropropulsion or inflatable decelerators to carry payloads beyond the proven MSL mass class, knowing that mass scaling makes some departure from flown heritage unavoidable for heavier missions [\[4\]](#ref-4)[\[58\]](#ref-58)[\[60\]](#ref-60). In an era of commercial lunar delivery, they decide how to weight a commercial lander's novel architecture against the firm's lack of any flight-proven EDL [\[64\]](#ref-64)[\[109\]](#ref-109). Each of these decisions currently rests on an intuition about heritage that has never been measured conditionally.

If the heritage effect is real and large after program strength is controlled, the portfolio implication is concrete: programs should weight reuse heavily, and they should demand measurably more flight-like qualification for novel elements before accepting them. The coefficient, translated into an implied change in failure probability across the range of the heritage index, sets a quantitative bar for how much extra qualification a novel element must earn to offset its excess risk. This would justify, in numbers rather than in lore, the conservative EDL-lineage strategy that programs such as InSight followed in reusing the Phoenix architecture almost without change [\[48\]](#ref-48)[\[82\]](#ref-82). If instead the heritage effect is small or collapses once program strength is controlled, the implication is the opposite and equally actionable: resources are better spent on the underlying engineering reserves, verification rigor, and reconstruction depth than on heritage as a goal in itself. That conclusion sits squarely in the methodological tradition this dissertation draws on, which insists that a technology's value is only ever defined relative to its next-best substitute, so that an apparently indispensable practice can have a small marginal effect once the substitute is correctly specified [\[121\]](#ref-121).

The named stakeholders for this work are the NASA and JPL EDL portfolio decision-makers who own the heritage-versus-novelty trade, the mission proposal and review communities who must defend architecture choices against cost and risk scrutiny, and the broader civil-space and commercial-lander communities for whom the lunar surface has become a contested proving ground for novel EDL [\[64\]](#ref-64)[\[109\]](#ref-109). For each, the value is the same: a measured parameter replaces an unmeasured intuition, and the parameter comes with its confounding bounded and its uncertainty stated. The work supports these stakeholders not by advocating for heritage or for novelty but by clarifying when heritage reuse is genuinely protective and when it is a proxy for unmeasured program strength. That clarification is what a portfolio needs to allocate its qualification dollars where they actually buy reliability.

The causal logic that makes the coefficient decision-relevant deserves to be named explicitly rather than asserted, because a bare correlation would not carry this weight. The proposed mechanism is the following chain. The driver is reuse of a flight-proven EDL architecture lineage. The mechanism is that flight has exposed, reconstructed, and codified the lineage's failure modes into propositional knowledge, and that the element is being operated inside the regime in which it was proven. The observable effect is that fewer in-flight-only-discoverable failure modes are encountered during the irreversible EDL event. The operational consequence is a measurable heritage coefficient \( \beta_1 \) below zero in the conditional logistic hazard. The strategic implication is an evidence-based EDL portfolio parameter: how much extra qualification a novel element must earn, and when "heritage" is merely a proxy for program strength. This is a mechanism, not a correlation, and the design identifies \( \beta_1 \) off a conditional, within-stratum contrast rather than a raw association. Where only correlation survives identification, because heritage proves inseparable from program strength, the dissertation says so and downgrades confidence accordingly rather than dressing a correlation as a cause.

## 1.5 Scope, posture, definitions, and roadmap

### 1.5.1 Scope and delimitations

The unit of analysis is the individual landing attempt at the Moon, Mars, or Titan, defined as a vehicle committing to an EDL or powered-descent sequence intended to place a payload on the surface. Orbital insertions, flybys, and sample-return Earth entries are excluded; Earth entry is a different target body and is noted only as a possible robustness extension. The population frame spans the documented Mars, Moon, and Titan landing attempts from the earliest reconstructed events through 2026, assembled from mission overviews and a consolidated catalog of lunar and Mars exploration missions. The frame is small by statistical standards, on the order of several dozen attempts, with Mars and the Moon contributing most rows and Titan contributing one, and that smallness governs the estimator choice and the inference machinery throughout. The Titan data point matters less for statistical power than for external validity. It tests, but cannot establish, whether any heritage effect estimated mostly on Mars and the Moon generalizes to a chemically and dynamically different target [\[131\]](#ref-131).

Several delimitations are deliberate. Generalization to crewed-class masses is out of scope, because no crewed landing attempts exist in the frame and the architecture studies warn that crewed masses force novel decelerators that have no flight history to code [\[60\]](#ref-60). The contribution's external claim is bounded to landing attempts at the three named bodies within the documented historical mass range. Extension to outer-planet and ocean-world entries is identified as future work [\[131\]](#ref-131). The dissertation does not introduce a new EDL technology, reconstruction, or architecture concept, and it does not adjudicate any single mission's failure; its object is the population-level conditional effect, not the post-mortem of any one descent.

A scope decision on architectural vocabulary is recorded here explicitly. This is an observational, design-stage measurement study whose contribution is a single estimated coefficient, not a real system, capability, or data-service exchange. Accordingly, the dissertation does not force enterprise-architecture traceability vocabulary onto a pure econometric contribution and does not populate an architecture table. The one permitted conceptual use, in plain prose, is to describe the fitted \( \beta_1 \) as an input to an EDL architecture trade: a program weighs the cost of additional qualification for a novel element against the estimated increase in landing-failure probability. That is the objective-to-decision endpoint of the work, and it is stated as prose rather than as a formal architecture artifact.

### 1.5.2 Design-stage posture

The posture of this dissertation is design-stage throughout. No coefficient is fitted on the full population in this document. Every statement about results is framed in the conditional: if the assembled population yields a coefficient of a given form, then a given interpretation follows. The illustrative figures that appear later in the dissertation, such as a move from the lowest to the highest quartile of the heritage index being associated with a drop in modeled failure probability from roughly forty percent to roughly fifteen percent at fixed Mars mass, are reporting-format illustrations chosen to show the intended shape of the output, not estimates from data. They are labeled as such wherever they appear. The central deliverable at this stage is the pre-registered, falsifiable design: the frozen primary specification, the named datasets, the fixed controls, and the conditions under which the contribution would be falsified, committed before the data speak.

### 1.5.3 Definitions of key terms

The following terms carry fixed meanings throughout the dissertation and are defined here so that later chapters can use them without re-derivation.

- **Entry, descent, and landing (EDL):** the sequence by which a vehicle decelerates from its approach trajectory and places a payload on a planetary surface, decomposed for this work into a fixed set of functional elements: aeroshell and thermal protection, entry guidance, supersonic deceleration (parachute or retropropulsion), terminal descent and propulsion, terminal guidance and hazard avoidance, and touchdown mechanism.
- **Landing attempt:** the unit of analysis, defined above, as a vehicle committing to an EDL or powered-descent sequence intended to place a payload on the surface of the Moon, Mars, or Titan.
- **Failure:** the binary dependent variable, equal to one when the vehicle did not achieve a survivable surface placement enabling nominal post-landing operations and zero otherwise, with a pre-registered partial-success rule for boundary cases.
- **EDL-heritage-reuse index (\( \text{heritage\_index} \)):** the continuous principal regressor on the unit interval, the criticality-weighted mean of element-wise heritage scores, where an element scores high if it had been flown successfully in a comparable regime on a prior mission and low if it is introduced for the first time or flown well outside its proven envelope, optionally weighted by the depth of reconstruction documented for the prior flight.
- **Heritage and novelty:** an EDL element is heritage to the degree that it has been flown successfully in a comparable regime; it is novel to the degree that it is new, or is being operated outside the regime in which it was proven. Heritage is therefore coded against the regime of qualification, not merely against whether an element flew before.
- **Propositional and prescriptive knowledge:** following the economic history of useful knowledge, propositional knowledge is the understanding of why a technique works, and prescriptive knowledge is the recipe for doing it; flight history is treated as the mechanism that converts prescriptive EDL recipes into propositional understanding by exposing and codifying failure modes [\[139\]](#ref-139).
- **Program strength:** the index constructed from program cost-and-schedule history and organizational flight experience that serves as the main-specification control against the central confounder, namely that heritage may proxy for unmeasured program strength.
- **Conditional estimate:** an effect estimated within strata of the controls, here the within-target-body, within-mass, within-program-strength contrast between higher- and lower-heritage attempts, as opposed to an unconditional comparison of heritage and novel missions.

### 1.5.4 Roadmap of the dissertation

The dissertation proceeds in eight chapters. This Introduction has framed the problem, isolated the gap, stated the single falsifiable contribution, established its significance, and fixed its scope and definitions. Chapter 2 builds the theoretical framework, developing the two methodological anchors as argument units with explicit causal mechanisms: the Fogelian discipline of the counterfactual, which makes the empirical claim quantitative, counterfactual, and falsifiable and casts \( \beta_1 \) as a social-saving analogue [\[121\]](#ref-121); and the propositional-versus-prescriptive distinction in the economic history of useful knowledge, which reframes any heritage effect as plausibly a knowledge-codification effect and grounds both the reconstruction-depth weighting of the index and the decomposition of novelty into grounded and ungrounded components [\[139\]](#ref-139). Chapter 3 is the literature review, organized along the three branches identified in Section 1.2, each developed as a sustained evidentiary argument and converging on the explicit gap statement. Chapter 4 specifies the data and measurement: the four named sources, the unit of analysis, and the full operationalization of every variable, with the heritage index treated as the most delicate construct because it is the treatment. Chapter 5 sets out the research design and identification strategy: the discrete-outcome logistic hazard, the small-sample inference machinery, the conditioning that operationalizes the counterfactual, and the four-way threats-to-validity matrix. Chapter 6 is the analysis plan: the pre-registered, step-by-step estimation procedure, the fixed decision rule, the explicitly illustrative expected-results block, and what a null or confounded result would look like, all committed in advance. Chapter 7 discusses implications under both outcomes, engages the rival explanations, and bounds the external validity. Chapter 8 concludes by restating the contribution as a single conditional coefficient under either branch of the disjunction and naming the steps that convert the frozen design into an executed estimate.

The logical skeleton that runs through these chapters can be stated in one breath. Landing concentrates mission risk into minutes of irreversible autonomous operation, and recent attempts spanning the full heritage spectrum have failed or landed anomalously [\[88\]](#ref-88)[\[74\]](#ref-74)[\[64\]](#ref-64)[\[109\]](#ref-109)[\[144\]](#ref-144). The trade is consequential rather than academic: NASA and JPL make recurring heritage-versus-novelty EDL portfolio decisions, and mass scaling forces departures from flown heritage toward novel decelerators [\[4\]](#ref-4)[\[58\]](#ref-58)[\[60\]](#ref-60). A conditional Firth-penalized logistic on the heritage index, with physical and program-strength controls, measures the Fogelian counterfactual contrast directly [\[121\]](#ref-121)[\[127\]](#ref-127). The discrete-outcome logistic hazard is the natural one-shot-event estimator, and penalization dominates ordinary maximum likelihood under the small frame, a point defended in the design chapter. The residual risk is acceptable: the small sample, the construct risk in the heritage index, the documentation asymmetry, and the confounding by program strength are bounded by pre-registration, exact or permutation inference, blind and inter-coder coding, low-documentation sensitivity analysis, with-and-without-control bounding, and honest design-stage framing. This skeleton is stated here so that the reader can see, from the first chapter, the shape of the argument the dissertation will defend.



# Chapter 2: Theoretical Framework

## 2.0 The chapter thesis

This chapter builds the conceptual model that the empirical work tests, and it does so by claiming one thing: the proposition that flight-proven entry-descent-landing (EDL) heritage lowers landing-failure risk is not an engineering folk belief to be argued by anecdote but a measurable counterfactual quantity that two established traditions in the economic history of technology already know how to specify, sign, and falsify. Robert Fogel's cliometric program supplies the discipline that turns "heritage is safer" into a quantity, namely the difference between an attempt's realized failure probability and the failure probability the same attempt would have faced under its next-best novel-architecture substitute at the same target and mass. Joel Mokyr's distinction between propositional and prescriptive useful knowledge, with Carlota Perez's complementary account of how isolated inventions consolidate into reliable techniques, supplies the mechanism that explains why such a difference would exist at all and predicts where it should concentrate. Taken together, the two anchors do more than motivate the study. They jointly determine the estimator family (a conditional, discrete-outcome logistic hazard), its identifying contrast (the within-stratum heritage-versus-novelty comparison), and the secondary test that distinguishes a genuine knowledge effect from a hardware-age artifact (the decomposition of novelty into analytically grounded and ungrounded components). The conceptual model the rest of the dissertation operationalizes is the product of forcing the EDL heritage question through these two filters until only a single falsifiable coefficient remains.

The problem this chapter addresses can be stated in the current-state, desired-state, gap, consequence frame that governs the whole dissertation. The current state is that the heritage-versus-novelty trade is reasoned about either through the language of single-mission reconstruction, which is exquisitely detailed but estimates no cross-mission effect, or through forward-looking architecture studies that reason about a hypothetical future fleet rather than the realized historical record. The desired state is a theory that tells us what quantity to estimate, why that quantity is the decision-relevant one, and under what conditions the estimate should be believed or disbelieved. The gap is that the EDL engineering literature contains no theoretical apparatus for converting a qualitative heritage intuition into a falsifiable conditional effect, while the economic-history literature contains exactly that apparatus but has never been pointed at planetary landing. The consequence of leaving the gap open is that NASA and the Jet Propulsion Laboratory (JPL) continue to weight a recurring multi-billion-dollar portfolio trade on an intuition whose magnitude, sign, and confounding have never been theorized, let alone measured. This chapter closes the theoretical half of that gap. It does not yet fit a coefficient; it specifies, in advance and from first principles, what the coefficient means and why the design that follows is the right way to find it.
## 2.1 EDL architecture as a decomposable object and the heritage-novelty spectrum

The theory begins with an ontological commitment that everything downstream depends on. An EDL architecture is not a monolith that is either "heritage" or "novel" in the aggregate but a composition of functionally distinct elements, each of which sits at its own point on a heritage-novelty spectrum. This commitment makes the heritage construct measurable rather than rhetorical, and it bridges the abstract economic-history anchors and the concrete index the data chapter constructs.

Landing-failure risk attaches to EDL elements, not to architectures in the aggregate, so the analytically correct unit of heritage measurement is the element-by-regime pairing rather than the mission label. The reconstructed Mars record decomposes cleanly into a recurring functional element set, and the documents that reconstruct each flight do so element by element. The Mars Science Laboratory (MSL) system overview and its performance reconstruction describe a guided-entry, supersonic-parachute, powered-descent, sky-crane sequence whose elements were each traced individually to, and in specific places deliberately departed from, Mars Pathfinder and Mars Exploration Rover lineage [\[88\]](#ref-88)[\[92\]](#ref-92). The element set that recurs across these reconstructions is stable: aeroshell and thermal protection, entry guidance, supersonic deceleration (parachute or retropropulsion), terminal descent and propulsion, terminal guidance and hazard avoidance, and the touchdown mechanism. Mars 2020 reused the MSL sky-crane lineage but added terrain-relative navigation and the second-generation entry-descent-landing instrumentation suite as bounded element-level additions rather than an architectural restart [\[71\]](#ref-71). The high-mass Mars concept literature reinforces the decomposition from the forward direction. It does not ask whether a future architecture is heritage or novel as a whole; it identifies exactly which elements (supersonic retropropulsion, inflatable or rigid decelerators) would be new relative to flown hardware, holding the remaining elements at their proven status [\[4\]](#ref-4)[\[9\]](#ref-9).

This matters because if failure modes are element-specific and an element can be flown inside or outside the regime in which it was proven, then a mission-level heritage label discards exactly the information that determines risk. A mission that reuses five of six elements faithfully but flies the sixth far outside its qualified envelope is not "heritage" in any risk-relevant sense; the aggregate label would miscode it. Only an element-by-regime decomposition preserves the variation the hypothesis is about. The fatal-software-failure record confirms that risk localizes within elements rather than spreading uniformly across an architecture: a disproportionate share of catastrophic spaceflight failures trace to novel or modified flight software, which in EDL terms lives in the entry-guidance and terminal-guidance elements rather than in the structures [\[50\]](#ref-50). The Vikram lunar loss, investigated as occurring during the powered-descent and terminal phase, similarly localizes the failure to specific guidance-and-control elements rather than to the vehicle as an undifferentiated whole [\[64\]](#ref-64). The SLIM small lunar lander is the sharpest case. It demonstrated a pinpoint landing (a successful terminal-guidance element) yet touched down at an anomalous attitude (a touchdown-mechanism element behaving off-nominal), so that the same vehicle was simultaneously a success and a partial failure at different elements [\[109\]](#ref-109). An aggregate label cannot represent this; an element decomposition can.

The decomposition is exhaustive of the functional roles but not of every physical interaction. Coupled aerothermal, aerodynamic, and control effects can produce failure at the interface between two nominally proven elements, a mode the element-wise coding may underweight. The framework therefore treats the element set as a strong first-order decomposition rather than a complete causal partition, and the design chapter carries this as a construct-validity limitation rather than a solved problem. One might object further that since the elements are integrated into a single vehicle that either lands or does not, only the mission-level outcome is observable, so element-level heritage is an unobservable fiction. That objection fails on its own terms. The outcome is indeed mission-level, which is precisely why the dependent variable is a single binary indicator per attempt, but the regressor is constructed from the documented architecture, which is observable element by element in the reconstruction and technology-readiness record. The asymmetry is the point. A mission-level binary outcome regressed on an element-decomposed heritage index is exactly the structure that lets a single landing event speak to element-level heritage without pretending the elements failed independently.

The heritage-novelty spectrum the index measures therefore runs continuously from an element flown successfully in a comparable regime on a prior mission (high heritage) to an element introduced for the first time, or flown well outside its proven envelope (low heritage). The worked example that anchors the spectrum for the reader is the Mars near-replication chain. The InSight lander reused the Phoenix EDL architecture almost without change, so its element scores sit near the high-heritage pole; the lunar commercial first-flights whose EDL software and propulsion had never executed a real powered descent sit near the low-heritage pole; and Mars 2020, with its faithful sky-crane reuse plus bounded terrain-relative-navigation addition, sits between, near but not at the high pole [\[82\]](#ref-82)[\[71\]](#ref-71). The conceptual contribution of this section is that the spectrum is a property of elements-in-regimes, which makes the Fogelian counterfactual of the next section computable and the Mokyr knowledge mechanism of section 2.4 localizable.

## 2.2 The Fogelian frame: counterfactual, quantitative, falsifiable

The decision-relevant heritage quantity is not the success rate of heritage missions but the counterfactual difference between an attempt's realized failure probability and the failure probability it would have faced under its next-best novel-architecture substitute at the same target and mass. The logistic heritage coefficient \( \beta_1 \) is the discrete-outcome analogue of Fogel's social saving, and conditioning on the physical and program-strength controls is how the counterfactual is built into the design rather than asserted after the fact. Fogel's cliometric program rests on one methodological rule that he applied most famously to the social value of the railroad: to measure the value of an innovation you must specify and quantify the world without it, the explicit counterfactual, not merely observe the world with it [\[121\]](#ref-121). His railroad study constructed an alternative transport system, a canal-and-wagon counterfactual, and computed the social saving as the difference between realized national income and the income that the counterfactual system would have supported. The central, counterintuitive result was that an apparently indispensable technology had a modest marginal social saving once the next-best substitute was correctly specified, because the economy was never dependent on rail in the absolute; it was dependent on rail only relative to the alternative [\[121\]](#ref-121). The social-savings tradition that grew from this work formalized the method and surveyed its application across technologies, establishing it as a repeatable estimator of an innovation's marginal value rather than a one-off historical argument [\[133\]](#ref-133).

If an innovation's value is defined only relative to its next-best substitute, then the heritage question inherits the same logic exactly. The quantity that matters for a portfolio decision is not "do heritage-reuse missions succeed?" (they mostly do, which on its own says nothing about heritage, since the easy missions are also disproportionately the heritage ones) but "do they succeed more than the same mission would have succeeded under a novel architecture at the same target and mass?" That difference is a counterfactual, and \( \beta_1 \) in the conditional logistic model is its estimator: holding target body, entry mass, landed mass, and program strength fixed, \( \beta_1 \) measures the change in modeled failure probability as an attempt's heritage index is moved toward the novel end. The canonical estimating equation,

\[ \operatorname{logit} \Pr(\text{failure}_i = 1) = \beta_0 + \beta_1 \, \text{heritage\_index}_i + \boldsymbol{\gamma}' \mathbf{controls}_i + \epsilon_i \qquad\qquad (1) \]

is therefore not a generic regression chosen for convenience. It is the discrete-outcome translation of Fogel's social-saving difference, with the conditioning set playing the role of Fogel's "hold everything else fixed" construction of the counterfactual world.

The translation from Fogel's continuous social saving to a binary landing outcome is licensed by the discrete-outcome reliability tradition, which establishes that probability-of-failure for a discrete spacecraft event is an accepted, well-defined estimand and that population-level failure analysis is a legitimate inferential target rather than a category error [\[127\]](#ref-127). Fogel's own econometric-history corpus and the social-savings survey establish that a counterfactual difference can be estimated from observational records when the conditioning is specified in advance [\[121\]](#ref-121)[\[133\]](#ref-133). The pairing is deliberate: the economic-history anchor supplies the meaning of the quantity, and the reliability literature supplies the statistical object (a discrete failure probability) that carries that meaning into the spaceflight domain.

The railroad parallel is worth making concrete because it disciplines the interpretation of the heritage coefficient in a way that a generic regression intuition does not. Fogel's contemporaries treated the railroad as obviously indispensable because they observed an economy saturated with rail and could not picture its absence; the methodological scandal of the social-saving estimate was that the indispensability was an artifact of failing to specify the substitute [\[121\]](#ref-121). The EDL heritage debate contains the identical error in miniature. An observer who surveys the clean Mars near-replication chain, in which the Phoenix lineage was reused by InSight almost without change and the sky-crane lineage was reused by Mars 2020 with bounded additions, and concludes that heritage is obviously protective, is reasoning exactly as Fogel's contemporaries reasoned about rail [\[82\]](#ref-82)[\[71\]](#ref-71). The chain of heritage successes is observed; the counterfactual, the same missions flown with novel architectures at the same targets and masses, is not, and so the apparent indispensability of heritage may be an artifact of never specifying the substitute. The social-savings survey's central lesson, accumulated across the technologies it reviews, is that the unspecified-substitute error systematically *overstates* an innovation's marginal value, which in the EDL frame predicts that the naive heritage advantage should shrink once the counterfactual is built in through conditioning [\[133\]](#ref-133). The heritage coefficient is the apparatus that forces the substitute to be specified, and the social-savings tradition gives a prior on its likely direction of correction: toward, not away from, zero.

The counterfactual \( \beta_1 \) estimates is explicitly a *partial* counterfactual in Fogel's sense, and this limit must be protected rather than buried. Fogel's later writing warned that a single-coefficient social saving omits induced and general-equilibrium effects: the availability of the innovation changes the entire pattern of what is attempted. The EDL analogue is direct and material. The availability of a proven heritage lineage may change *which missions are attempted at all*, so that the population of heritage-reuse attempts is not a random draw from the space of possible missions but a selected one. \( \beta_1 \) conditions away the measurable part of this selection (through the target, mass, and program-strength controls) but cannot capture the part that operates through unattempted missions, because unattempted missions leave no row in the frame. The framework states this limit in advance: the contribution is the conditional partial counterfactual, not the full general-equilibrium value of heritage, and the discussion chapter is bound to report it as such.

A reader might object that Fogel's method was built for aggregate economic quantities measured in dollars across millions of transactions, and that importing it to a frame of several dozen landing attempts is a category stretch that the small sample cannot bear. This concedes the scale difference but is answered at the level of logic rather than magnitude. Fogel's contribution was never the dollar figure; it was the *discipline* of refusing to value a technology except against its substitute, and of specifying that substitute before looking at the outcome. That discipline is scale-free. It applies with equal force to a frame of forty attempts as to a continental economy, and it is arguably *more* necessary in the small frame, where the temptation to read a curated chain of successful heritage missions as proof of heritage's value is strongest. The smallness of the frame is handled by the estimator (the design chapter's Firth-penalized likelihood and exact or permutation inference), not by abandoning the counterfactual discipline that makes the estimate interpretable in the first place.

The Fogelian frame also tells the design how to *sign* the central confounding threat, and this is a substantive theoretical contribution rather than a procedural footnote. The dominant rival explanation is that well-funded, organizationally experienced programs both reuse heritage and execute better, so that a raw heritage-success correlation reflects program strength rather than heritage. Fogel's counterfactual logic specifies the remedy precisely: the counterfactual must hold fixed everything that is not the innovation under study, which here means conditioning on a program-strength index. When that index is included, \( \beta_1 \) is the heritage effect net of program strength; when it is omitted, \( \beta_1 \) absorbs the program-strength channel and is therefore biased toward a more negative (more protective-looking) value. The framework thus predicts the *direction* of the omitted-variable bias in advance: dropping the program-strength control should make heritage look more protective, not less. A \( \beta_1 \) that is strongly negative without the control but collapses toward zero with it is exactly the signature of confounding, and the design's with-and-without comparison is built to detect that signature. Signing the bias before estimation is the Fogelian discipline doing analytical work, not the rhetoric of a literature review.

## 2.3 Cliometrics as hypothesis-testing science

Cliometrics is not a style of historical narration but a hypothesis-testing science whose distinctive move is to state a proposition quantitatively, build its counterfactual into the design, and let the data falsify it. This is the methodological posture the entire dissertation adopts, and it is why the contribution is a single signed-and-tested coefficient rather than a synthesis. The cliometric revolution that Fogel led replaced the qualitative assertion of historical importance with the quantitative estimation of marginal effect against an explicit counterfactual [\[121\]](#ref-121). The social-savings survey documents that this became a *program*: a sequence of studies across transport, agriculture, and industry that each specified a quantity, specified a substitute, and reported a magnitude with a sign, so that the field accumulated falsifiable estimates rather than competing narratives [\[133\]](#ref-133). The defining feature the survey isolates is that a cliometric claim can be wrong in a way a narrative claim cannot. A social saving can come out small, or zero, or pointed the wrong way, and the discipline commits in advance to reporting that outcome [\[133\]](#ref-133).

If a methodological tradition's distinctive virtue is that it produces claims capable of being false, then adopting that tradition imposes a specific obligation on this dissertation: the heritage proposition must be stated so that a determinate empirical pattern would falsify it, and that pattern must be specified before the data are examined. The decision rule discharges this obligation literally. H1 is rejected in favor of the contribution only if the estimated \( \beta_1 \) is below zero, its exact or permutation ninety-five percent interval excludes zero in the pre-registered primary specification, and the sign is stable across the pre-registered robustness set; an interval including zero fails to reject the null. The proposition is falsifiable in the strict sense the cliometric tradition demands: a \( \beta_1 \) that is zero, positive, or negative-but-statistically-indistinguishable-from-zero falsifies the contribution, and a \( \beta_1 \) that is negative without the program-strength control but collapses with it is reported as confounded. This insistence on pre-specifying the counterfactual is the historical precedent for the design's pre-registration of the estimator, the controls, the dataset, and the falsification conditions [\[121\]](#ref-121)[\[133\]](#ref-133), while the reliability literature establishes on the spaceflight side that a discrete failure probability is a legitimate quantitative estimand whose value can come out null, so that the falsification is not merely a logical possibility but a statistically representable one [\[127\]](#ref-127). The convergence of these two precedents is what makes the cliometric posture portable into EDL: the economic-history side guarantees the discipline, the reliability side guarantees the measurable object.

The hypothesis-testing posture is constrained by the realized sample size to a degree the framework must state honestly. With a frame on the order of several dozen attempts, the power to reject a null is limited, so a failure to reject H0 can mean either that heritage truly has no independent effect or that the frame is too small to detect a real effect. The cliometric commitment here is not to pretend the frame is larger than it is, but to report the minimum detectable effect size alongside the coefficient, so that a non-rejection is interpreted as the disjunction it genuinely is rather than collapsed into a false claim of "no effect." This is the cliometric discipline applied to its own limits: state the quantity, state the substitute, and state the resolution at which the test can see.

The standing objection to cliometrics, raised since its origin, is that quantifying a historical question imposes a false precision on a process that is irreducibly qualitative, and that an EDL heritage effect in particular is a matter of engineering judgment that no coefficient can capture. This does not deny that engineering judgment is essential; it denies that judgment and measurement are substitutes. The coefficient does not replace the engineer's reasoning about why a particular novel element is risky; it tests whether, across the whole population and net of physics and program strength, that reasoning aggregates into a detectable difference in outcomes. If it does not, the engineering judgment may still be locally correct on individual missions while being collectively unsupported as a portfolio rule, and that distinction is precisely the decision-relevant one for NASA and JPL. The cliometric move is to make the portfolio-level claim testable without pretending the mission-level judgment is dispensable.

The deeper reason the cliometric posture fits this problem is that the EDL record is, structurally, a population of natural experiments: discrete, well-documented trials with a binary outcome, a known architecture, a known mass class, and a known target [\[121\]](#ref-121) as method; [\[88\]](#ref-88)[\[71\]](#ref-71) as exemplar records. Cliometrics is the science built to extract a conditional effect from exactly this kind of observational population when controlled experimentation is impossible, which for planetary landing it permanently is. One cannot randomly assign heritage to half a fleet of Mars landers. The conditional, pre-registered, counterfactual estimate is the closest approach to an experiment the domain permits, and cliometrics is the tradition that knows how to make that approach rigorous rather than anecdotal.

## 2.4 The Mokyr-Perez frame: propositional versus prescriptive knowledge

Heritage protects against landing failure, where it protects at all, not because the hardware is chronologically old but because flight converts prescriptive recipes into propositional understanding (the failure modes become *understood*, not merely *avoided*). This mechanism predicts that the protective effect concentrates in elements whose flight history produced codified, reconstructed knowledge, and that novelty grounded in strong analysis carries less excess risk than ungrounded novelty. Mokyr's economic history of useful knowledge distinguishes propositional knowledge, the understanding of *why* a technique works, from prescriptive knowledge, the recipe for *doing* it; techniques resting on deep propositional understanding are extensible and self-correcting, while techniques discovered by trial without underlying theory tend to stagnate and to fail unpredictably outside their tested range (Mokyr, *The Gifts of Athena*, 2002; *A Culture of Growth*, 2017, the monographic anchors). Perez's account of how isolated inventions consolidate into reliable techno-economic paradigms formalizes the same logic: reliability is earned through accumulation and codification across a maturation period, not conferred by a single demonstration [\[139\]](#ref-139). The EDL record contains the literal artifact of this mechanism. The NASA Technical Reports Server reconstruction reports are the documents in which a flown EDL sequence's measured behavior is reconciled against its predictions, which is exactly the conversion of a prescriptive recipe (it flew and worked) into propositional knowledge (we now understand the margins, the off-nominal sensitivities, and the retired failure modes) [\[92\]](#ref-92)[\[71\]](#ref-71)[\[82\]](#ref-82).

If the protective content of heritage is codified understanding rather than hardware age, then two specific predictions follow that a hardware-age theory could not generate. First, the heritage effect should be *stronger* for elements whose prior flight was instrumented and reconstructed in fine detail than for elements that flew but were poorly characterized, because the former produced propositional knowledge and the latter only a prescriptive precedent. This is the theoretical justification for weighting the heritage index by the depth of reconstruction documented in the reports rather than treating all prior flights as equivalent; the instrumentation suites that produced the deepest reconstructions are the literal source of the weighting [\[71\]](#ref-71). Second, novelty grounded in extensive propositional analysis should carry *less* excess risk than ungrounded novelty, because grounded novelty has been partially de-risked through understanding before flight even though it has no flight precedent. Supersonic retropropulsion is the framework's exemplar of grounded novelty: it has no operational Mars flight heritage, yet it has been matured through a documented program of wind-tunnel campaigns and computational and conceptual modeling that built propositional understanding of its flow interactions and performance relationships before any flight [\[36\]](#ref-36)[\[9\]](#ref-9)[\[111\]](#ref-111)[\[28\]](#ref-28)[\[66\]](#ref-66). A hardware-age theory would code supersonic retropropulsion as maximally novel and therefore maximally risky; the Mokyr-Perez theory predicts its excess risk should be attenuated by its propositional grounding.
The supersonic-retropropulsion maturation literature establishes that propositional grounding is a real, documentable property of a novel element rather than a retrospective rationalization. The survey of the technology shows the breadth of the analytical and ground-test base [\[9\]](#ref-9); the performance-characterization and conceptual-modeling work shows the depth of propositional understanding of the flow physics and system relationships [\[111\]](#ref-111)[\[28\]](#ref-28); the development summary and recent-developments introduction show that the maturation was a sustained, codified program rather than a single test [\[36\]](#ref-36)[\[66\]](#ref-66). On the heritage side, the reconstruction reports establish that flight produces codified propositional knowledge, with the second-generation instrumentation suite as the explicit case of a flight engineered to maximize the propositional yield of the descent [\[71\]](#ref-71)[\[82\]](#ref-82). Perez confirms that this codification-driven reliability is a recognized pattern of technological maturation across domains, not an EDL peculiarity [\[139\]](#ref-139).

Perez's cumulative-innovation account supplies a second, dynamic prediction that the static heritage-versus-novelty contrast alone would miss. The reliability dividend of a lineage is not a one-time step conferred by a single demonstration but a function of how thoroughly each prior flight was reconstructed and codified, so a lineage deepens its protective value with each well-instrumented reuse rather than holding it constant [\[139\]](#ref-139). The Mars chain is the corpus exemplar of this dynamic. Each reuse in the Pathfinder-to-MSL-to-Mars-2020 progression did not merely re-fly proven hardware; it added instrumented reconstruction that converted residual prescriptive margin into propositional understanding, with the instrumentation suites engineered specifically to maximize the propositional yield of the descent [\[92\]](#ref-92)[\[71\]](#ref-71). A purely hardware-age theory would treat the second reuse of an architecture as no more proven than the first, since the hardware is equally old in both. The Perez-Mokyr theory predicts the second reuse is *more* protective, because the codified knowledge base behind it is deeper. This is the theoretical content of the reconstruction-depth weighting: it operationalizes cumulative codification rather than mere repetition, and it is why the heritage index is weighted by documented reconstruction depth rather than by a count of prior flights. The prediction is testable in principle, since a lineage's protective effect should rise with reconstruction depth, not merely with flight count, though the small frame may not resolve it. The framework states that resolution limit honestly rather than promising a test the sample cannot support.

The propositional-versus-prescriptive distinction is a spectrum rather than a binary, and the framework treats it as such with calibrated confidence. The reconstruction-depth weighting is a *proxy* for propositional knowledge, not a direct measurement of understanding, and the grounded-versus-ungrounded split of novelty is an analyst coding of the analytical base behind each novel element, which carries its own construct risk. Confidence in the Mokyr mechanism is therefore moderate at the design stage. The supersonic-retropropulsion case is strong and well-documented, but the general claim that reconstruction depth tracks propositional knowledge across the whole element set rests on the theory and the exemplar rather than on an independent measurement of understanding. Confidence would rise if the predicted concentration pattern actually appeared in the novelty decomposition, with excess risk loading on ungrounded novelty. It would fall if excess risk loaded equally on grounded and ungrounded novelty, which would be consistent with a hardware-age reading and would weaken, though not refute, the codification interpretation.

A reader might object that the Mokyr mechanism makes the heritage index a proxy for knowledge maturity rather than for heritage itself, so the dissertation is no longer testing the heritage hypothesis it claims to test. This is the most serious theoretical objection, and the framework answers it by *embracing* the reframing as a sharpening rather than a refutation. If the protective effect is driven by codified knowledge rather than hardware age, the headline hypothesis (that documented reuse of a flight-proven lineage lowers failure hazard) still holds, because reconstructed flight history is the principal generator of codified EDL knowledge. What changes is the *interpretation* of why reuse helps, from "the hardware is proven" to "the failure modes are understood." The novelty decomposition is the instrument that surfaces this distinction explicitly. A finding that all novelty carries equal excess risk regardless of analytical grounding is still consistent with H1 but weakens the Mokyr reading; a finding that excess risk loads on ungrounded novelty confirms both H1 and the codification mechanism. Either way the contribution survives. The Mokyr frame determines which *explanation* of a confirmed effect is warranted, which strengthens the design rather than threatening it.

Mokyr's account also supplies a directional correction to a naive heritage theory, and the framework builds that correction into the index coding. Mokyr stresses that technological progress is fragile and that institutions can mishandle even proven techniques. In EDL the danger runs in a specific direction: an institution that over-weights heritage can fly a proven element *outside* its qualified regime, where its proven status is illusory and its propositional knowledge does not apply. The framework therefore codes heritage against the *regime in which an element was proven*, not merely against whether it flew before, so an element flown well outside its envelope receives a low rather than a high heritage score. This is the Mokyr insight that propositional knowledge is regime-bounded, operationalized as a coding rule. It is also the theoretical reason the heritage index is not simply a flew-before indicator: a flew-before-but-outside-regime element has prescriptive precedent without applicable propositional knowledge, the configuration the theory predicts should be most dangerous.

## 2.5 Synthesis: how the two anchors jointly specify the estimator and its interpretation

Fogel and Mokyr-Perez are not two decorative lenses applied to the same problem. They are complementary specifications that jointly determine the estimator family, the identifying contrast, and the secondary test, such that changing either anchor would change the design. Fogel fixes *what to estimate and how to identify it*; Mokyr-Perez fixes *what the estimate means and where it should concentrate*. The Fogelian requirement that an innovation be valued only against its next-best substitute, conditioned on everything else, maps onto exactly one estimator structure: a conditional model of the discrete landing outcome on the heritage index with physical and program-strength controls, where the heritage coefficient is the counterfactual difference [\[121\]](#ref-121)[\[133\]](#ref-133). The Mokyr-Perez requirement that the protective content be codified knowledge rather than hardware age maps onto exactly two design features: the reconstruction-depth weighting of the index and the decomposition of the novelty term into grounded and ungrounded components [\[139\]](#ref-139)[\[36\]](#ref-36)[\[9\]](#ref-9). Neither anchor alone yields the full design. Fogel without Mokyr would estimate a heritage coefficient but could not say whether it reflected hardware age or understanding, and would have no reason to weight by reconstruction depth or to decompose novelty. Mokyr without Fogel would explain why codified knowledge protects but would have no discipline for isolating the effect from program-strength confounding and no falsifiable quantity to test.

Because the two anchors each pin down distinct, non-overlapping features of the design, and removing either leaves the design underdetermined, the design is the joint product of both. It inherits the falsifiability of the first and the mechanism-specificity of the second. The conditional logistic hazard is falsifiable because Fogel demands a signed, counterfactual, pre-specified quantity; it is *interpretable as a knowledge effect* because Mokyr-Perez supplies the mechanism and the decomposition that distinguishes the knowledge reading from the hardware-age reading. The estimating equation is therefore overdetermined in the healthy sense: every term in it is required by one anchor or the other, and none is free. The discrete-outcome reliability tradition supports the choice of a probability-of-failure estimand as the carrier of the Fogelian counterfactual into the spaceflight domain [\[127\]](#ref-127); the supersonic-retropropulsion maturation literature anchors the grounded-novelty pole of the Mokyr decomposition with a documented, codified analytical base [\[36\]](#ref-36)[\[9\]](#ref-9)[\[111\]](#ref-111)[\[28\]](#ref-28)[\[66\]](#ref-66); the reconstruction reports establish the reconstruction-depth weighting as a real, document-based property rather than an analyst's invention [\[92\]](#ref-92)[\[71\]](#ref-71)[\[82\]](#ref-82). The convergence of these three sources on a single estimating equation is the evidentiary content of the synthesis. The design is not assembled from convenience but compelled by the two anchors operating jointly on a domain whose records happen to supply exactly the artifacts each anchor requires.

The synthesis lets the chapter state the full causal chain the empirical work tests, with each link named rather than asserted as a bare correlation. Reuse of a flight-proven EDL architecture lineage is the driver. The mechanism is that flight has exposed, reconstructed, and codified the lineage's failure modes into propositional knowledge, and that the element operates inside its proven regime, so the prescriptive recipe has become understanding rather than mere precedent. The observable effect is that fewer in-flight-only-discoverable failure modes are encountered during the irreversible EDL event, because the modes that would have been discovered the hard way have already been retired in the prior flight's reconstruction. The operational consequence is a measurable heritage coefficient \( \beta_1 \) below zero in the conditional logistic hazard, net of physics and program strength. The strategic implication is an evidence-based EDL portfolio parameter: how much extra qualification a novel element must earn to offset its excess risk, and equivalently when "heritage" is genuinely protective versus when it is merely a proxy for program strength. The framework keeps correlation and causation distinct at every link. \( \beta_1 \) is identified off a *conditional within-stratum contrast*, not a raw correlation. Where only correlation survives, most importantly if the heritage index proves inseparable from the program-strength index, the design is bound to say so and to downgrade confidence accordingly rather than narrate a mechanism the data cannot support.

The framework's confidence in the *conceptual model* is high: the two anchors are well-established, their primary sources are real and resolvable, and their joint mapping onto the estimator is tight. Confidence in any *particular empirical pattern* is, correctly, withheld, because no coefficient has been fitted on the full population. The design-stage posture is binding, and every result statement in the dissertation is conditional and illustrative. The evidence that would raise confidence in the model's *empirical relevance* is a fitted \( \beta_1 \) that is negative, survives the program-strength control, and shows the predicted concentration of excess risk on ungrounded novelty. The evidence that would lower it is a \( \beta_1 \) indistinguishable from zero, a collapse of \( \beta_1 \) when program strength is added, or a heritage index found collinear with program strength to the point of inseparability. Each of these is a pre-registered falsification condition, the cliometric discipline of section 2.3 closing the loop with the mechanism of section 2.4.

What this chapter contributes to the dissertation's argument is the theoretical guarantee that the design measures the right quantity for the right reason. It establishes that the conditional Firth-penalized logistic on the heritage index, with physical and program-strength controls, addresses the causal mechanism, because the estimator is the direct operationalization of Fogel's counterfactual contrast and Mokyr's knowledge mechanism rather than a generic statistical convenience. It also states in advance the construct risks in the heritage index, the regime-bounded coding, the reconstruction-depth proxy, and the grounded-versus-ungrounded analyst coding, which the design and measurement chapters bound through pre-registration, blind and inter-coder coding, and sensitivity analysis. That theoretical guarantee is the load-bearing claim on which the empirical chapters rest.

One scope decision is recorded explicitly. Architecture-traceability vocabulary (capability, system function, data-service exchange, enterprise outcome) is out of scope for this dissertation and absent from this chapter by design. This is an observational, design-stage measurement study whose contribution is a single estimated coefficient, not a real system, capability, or data-service exchange, and forcing architecture-framework vocabulary onto a pure econometric contribution would misrepresent what is being built. The one permitted conceptual endpoint, reserved for the discussion chapter and stated here only to mark the boundary, is that the fitted \( \beta_1 \) is an *input to* an EDL architecture trade in plain prose: a program weighs the cost of additional qualification for a novel element against the estimated increase in landing-failure probability. That is an objective-to-decision statement in ordinary language, not a populated architecture table, and the framework leaves it at the boundary rather than crossing it.

## 2.6 The conceptual model the empirical work tests

The chapter closes by stating the conceptual model in the compact form the rest of the dissertation operationalizes, so the data, design, and analysis chapters inherit a single object rather than a loose set of motivations.

An EDL architecture is a composition of six functional elements, each occupying a point on a heritage-novelty spectrum defined by whether the element flew successfully in a comparable regime on a prior reconstructed mission. The heritage index is the fixed-weight, criticality-weighted mean of those element scores, weighted additionally by the depth of reconstruction documented for each element's prior flight, with elements flown outside their proven regime scored low regardless of flight precedent. A landing attempt either survives to nominal surface operation or does not, giving a single binary outcome per attempt. The Fogelian frame fixes the estimand: the conditional, counterfactual difference in failure probability associated with moving an attempt's heritage index toward the novel end, holding target body, entry mass, landed mass, and program strength fixed, which is the heritage coefficient \( \beta_1 \) in the conditional logistic hazard. The Mokyr-Perez frame fixes the interpretation and the secondary test: \( \beta_1 \) is read as a knowledge-codification effect to the extent that it concentrates in deeply reconstructed elements and that excess risk loads on ungrounded rather than grounded novelty, the latter exemplified by the analytically matured but unflown supersonic-retropropulsion element [\[36\]](#ref-36)[\[9\]](#ref-9)[\[66\]](#ref-66). The model is falsifiable in the strict cliometric sense: a \( \beta_1 \) that is zero, positive, indistinguishable from zero, confounded away by program strength, or inseparable from program strength falsifies the contribution under pre-registered conditions decided before the data speak.

This model is the chapter's deliverable. It is not a fitted result, and the framework states once more that no coefficient has been estimated on the full population; the figures that illustrate the reporting format elsewhere in the dissertation are reporting-format illustrations, not estimates. What the chapter has built is the theoretical machine that converts NASA and JPL's constant heritage intuition into a single measurable, signed, and falsifiable quantity, together with the mechanism that says why that quantity should be non-zero and where it should concentrate if the intuition is right. The data chapter now constructs the index and the frame; the design chapter specifies the estimator and bounds the threats; the analysis chapter executes the pre-registered procedure. Each inherits from this chapter the same object: a counterfactual heritage coefficient whose meaning is fixed by Fogel and whose interpretation is fixed by Mokyr, ready to be measured or, with equal decision value, credibly not found.



# Chapter 3: Literature Review

## 3.0 The chapter thesis, the problem it addresses, and how it is organized

The literature on planetary entry, descent, and landing is large, technically excellent, and almost entirely silent on the one question this dissertation asks. That is the chapter thesis, stated first and developed afterward. Three mature bodies of work surround the heritage-versus-novelty question without ever meeting on it. The first is the reconstruction-and-architecture record: a deep, mission-by-mission documentation of how individual EDL sequences were designed and how they actually performed, from Mars Pathfinder through Mars 2020, Tianwen-1, the Chang'e landers, SLIM, and the Huygens descent at Titan [\[83\]](#ref-83)[\[88\]](#ref-88)[\[74\]](#ref-74)[\[144\]](#ref-144)[\[31\]](#ref-31)[\[33\]](#ref-33). The second is the forward-looking architecture and technology-gap literature, which reasons about a hypothetical future fleet of higher-mass and crewed-class landers and enumerates the novel decelerators and propulsion that fleet would require [\[43\]](#ref-43)[\[4\]](#ref-4)[\[58\]](#ref-58)[\[57\]](#ref-57). The third is the spacecraft reliability-and-failure-statistics tradition, which estimates failure distributions across populations of spacecraft and establishes discrete-outcome and time-to-failure modeling as accepted domain tools [\[127\]](#ref-127)[\[117\]](#ref-117)[\[40\]](#ref-40)[\[50\]](#ref-50). Each branch is internally rigorous. None of the three estimates a conditional landing-failure hazard as a function of a constructed EDL-heritage-reuse index across the Moon, Mars, and Titan record while controlling for target body and mass. That unmet intersection is the gap this dissertation fills, and the purpose of this chapter is to demonstrate, source by source, that the gap is real rather than merely unsearched.

The problem this chapter addresses can be framed in the four-part form the dissertation uses throughout. The current state of knowledge is that the heritage intuition is asserted constantly in practice and illustrated abundantly in the literature, but tested nowhere as a falsifiable, population-level, confounding-adjusted proposition. The desired state is a literature in which the heritage claim has been converted from an engineering maxim into a measured coefficient with an honest confidence interval and a bounded confounder. The gap is the absence of any study that joins the three branches above into a single conditional estimate. The consequence of leaving the gap unfilled is that NASA and the Jet Propulsion Laboratory continue to weight the heritage-versus-novelty trade on intuition and curated anecdote, and that "heritage" continues to be silently rewarded as a proxy for unmeasured program strength rather than evaluated on its own causal merit. This chapter does not close the gap. It establishes, against the literature, that the gap exists and that it is worth closing.

The chapter is organized along the three branches just named, with each branch developed as a sustained evidentiary argument rather than an annotated list. Section 3.1 treats the Mars EDL record as a population of well-documented natural experiments. Section 3.2 treats the lunar record, where the EDL problem is dominated by powered descent, terminal guidance, and hazard avoidance rather than aerothermal entry. Section 3.3 treats Titan and the outer-planet context, retained for external-validity reasons rather than statistical power. Sections 3.4 through 3.6 treat the forward architecture and technology-gap literature: high-mass and crewed-class Mars studies (3.4), supersonic retropropulsion and decelerator maturation as the grounded-novelty exemplar (3.5), and parachute and disk-gap-band qualification as the decelerator-testing throughline (3.6). Section 3.7 treats the reliability-and-failure-statistics tradition and the software-failure channel. Section 3.8 synthesizes the field, states the heritage claim as it appears qualitatively across the literature, converts it into the testable conditional hazard, and closes with an explicit gap statement and the propositions that follow. Throughout, the standard of discussion is substantive: each major source is interpreted for what it found, how it found it, what it could not show, and what its convergence with neighboring sources means for the heritage argument. The recurring interpretive move is to ask of each branch the same question and to record the same answer: the branch documents or predicts EDL behavior in fine detail, but it does not estimate the conditional effect of heritage reuse on landing-failure probability.

A note on confidence and on the design-stage posture is owed before the evidence begins. This is a design-stage dissertation; no coefficient is fitted in this chapter or anywhere in the document, and the literature review's role is to establish the warrant for the design, not to anticipate its result. Where this chapter assigns a confidence level to a claim, the claim is about the state of the literature (for example, that the reconstruction record is unusually complete for U.S. Mars missions), not about the eventual sign or magnitude of the heritage coefficient. The strongest claims in this chapter are bibliographic and are held at high confidence because they rest on the corpus itself; the claim that no prior study estimates the conditional heritage hazard is held at high confidence within the assembled corpus and at moderate confidence as a universal statement, since absence of evidence in a large but finite corpus is not proof of universal absence. That distinction is carried explicitly into the gap statement in Section 3.8.

## 3.1 The Mars EDL record as a population of natural experiments

The central claim of this section is that the Mars landing record is, from a statistical standpoint, an unusually clean sequence of documented trials in which architectural lineage can be traced element by element, and that this very completeness is what makes the absence of a cross-mission heritage estimate conspicuous rather than excusable. The evidence for the claim is the depth and consistency of the reconstruction literature, and the reasoning that follows is that a field able to reconstruct each mission's architecture and outcome in this much detail has assembled every ingredient of a population-level test except the test itself.
The earliest anchor in the record is the Mars Pathfinder atmospheric entry. Spencer's reconstruction of the Pathfinder entry, descent, and landing established the template for post-flight EDL reconstruction by recovering the vehicle's trajectory and the atmosphere it encountered from onboard accelerometry, and it did so for an architecture that combined a Viking-heritage 70-degree sphere-cone aeroshell with a disk-gap-band parachute and an airbag landing system [\[83\]](#ref-83). Magalhaes, Schofield, and Seiff complemented the trajectory reconstruction with an analysis of the Pathfinder atmospheric structure investigation, deriving the nighttime density and temperature profile over the 161-to-9-kilometer altitude band and, for the heritage argument, comparing the result against the Viking 1 site some 850 kilometers away and 21 years earlier [\[129\]](#ref-129). The methodological lesson of these two papers is that the field's reconstruction discipline was, from the beginning, comparative across missions: Pathfinder's atmosphere was read against Viking's, and Pathfinder's architecture was read as a partial reuse of Viking's. The comparison, for present purposes, was scientific (was the atmosphere the same?) and not statistical (did the heritage architecture fail less?). These early reconstructions converge on a single point: the raw material for a heritage analysis, namely element-level lineage plus a documented outcome, existed in the literature from the late 1990s onward.

The Mars Exploration Rover missions deepened the record. Steltzner, Desai, Lee, and Bruno gave the MER EDL system overview, describing the hypersonic ablative aeroshell, the supersonic disk-gap-band parachute, and the airbag landing system, and stating plainly that these were aerodynamic decelerators carrying forward a recognizable lineage [\[143\]](#ref-143). Desai and Knocke then performed the MER trajectory analysis, using a Monte Carlo dispersion study to assess the sensitivity of the entry design to off-nominal conditions and comparing six-degree-of-freedom against three-degree-of-freedom results to characterize the entry [\[81\]](#ref-81). The communications-and-signal-processing literature for MER, in Hurd and colleagues and in Satorius and colleagues, documented the extreme Doppler dynamics of the X-band signal during the deceleration and parachute phases. That work matters here because it shows how thoroughly the field instruments and reconstructs even the telecommunications behavior of an EDL event, again supplying the kind of fine-grained per-mission record that a heritage study would draw on but never itself aggregating across missions [\[30\]](#ref-30)[\[37\]](#ref-37). The MER thermal-perspective and validation reports extend the same point into the thermal and verification domains [\[80\]](#ref-80). The interpretation is consistent: MER produced a documented architecture, a documented dispersion analysis, and a documented outcome (two successes), but the analysis stayed within the mission.

The Mars Science Laboratory is the most thoroughly reconstructed EDL event in the record, and it is also the clearest case of deliberate departure from heritage, which makes it the pivot of the entire heritage-versus-novelty discussion. The MSL system overviews by Steltzner and by Prakash and colleagues describe a guided-entry, supersonic-parachute, powered-descent, sky-crane architecture whose elements were traced to, and deliberately departed from, Pathfinder and MER heritage [\[88\]](#ref-88)[\[87\]](#ref-87). Way's preliminary assessment and the Way, Davis, and Shidner simulation assessment characterize the end-to-end six-degree-of-freedom Monte Carlo simulation that underwrote the landing, and they are candid that the sky crane was a "novel and untested" landing system at the time of flight, the largest supersonic parachute ever flown at Mars, and the first guided entry at Mars [\[118\]](#ref-118)[\[16\]](#ref-16). The MSL parachute decelerator subsystem overview and the Cruz parachute-models paper document the 19.7-meter mortar-deployed Viking-type disk-gap-band parachute, a heritage-derived element flying alongside the novel sky crane [\[104\]](#ref-104)[\[110\]](#ref-110). This juxtaposition is the empirical heart of the heritage question: a single architecture in which one element (the DGB parachute) carried deep Viking lineage while another element (the sky crane) was a first flight, both succeeding. The dissertation draws from the MSL case the inference that heritage and novelty are not mission-level attributes but element-level attributes, which is why the heritage index in Chapter 4 is constructed element by element rather than as a binary mission label. A study that coded MSL simply as "heritage" or "novel" would discard the most informative feature of the case.

The MSL reconstruction was made unusually deep by the Mars Entry, Descent, and Landing Instrumentation suite, and the resulting body of work is the literal artifact of the Mokyr propositional-knowledge mechanism the dissertation invokes. Gazarik and colleagues described the MEDLI project's objectives: to measure aerothermal environments, sub-surface heat-shield response, vehicle orientation, and atmospheric density during entry [\[105\]](#ref-105). The trajectory-and-atmosphere reconstruction by the MSL reconstruction team, the statistical performance reconstruction by Dutta and Braun, the aerodynamic reconstruction by Schoenenberger and colleagues, and the aerothermal-environment and heat-shield-response reconstruction by Bose and colleagues together convert the MSL flight from a single successful event into a reconstructed, codified understanding of why the architecture behaved as it did [\[89\]](#ref-89)[\[134\]](#ref-134)[\[17\]](#ref-17)[\[125\]](#ref-125). The supporting MEDLI instrumentation and calibration literature, including the heat-shield sensor and arc-jet characterization work and the isotherm-sensor calibration program, documents the measurement chain that made the reconstruction trustworthy [\[91\]](#ref-91)[\[67\]](#ref-67)[\[120\]](#ref-120). The flyaway guidance, navigation, and control design by Acikmese and colleagues completes the picture on the control side [\[90\]](#ref-90). The interpretation that matters for the dissertation is precise: this is the densest example in the corpus of flight converting a prescriptive recipe into propositional understanding, and it is the kind of reconstruction depth the heritage index is designed to reward through the reconstruction-depth weighting. All of this depth is intramission; it explains MSL beautifully and says nothing quantitative about whether MSL-class reuse lowers failure probability relative to a novel counterfactual.

Phoenix and InSight supply the cleanest near-replication cases in the record, and they are therefore the strongest anecdotal support for the heritage hypothesis and the clearest illustration of why anecdote is insufficient. Desai and colleagues reconstructed the Phoenix EDL performance, and the Phoenix architecture is documented as a reuse of Mars Polar Lander and Mars Surveyor 2001 heritage, with the architecture-overview report tracing the lineage and noting the specific changes, such as the removal of hypersonic guidance, that distinguished the flown system from its ancestors [\[48\]](#ref-48)[\[108\]](#ref-108). The Phoenix operations, simulation, and multibody-modeling reports round out the reconstruction [\[47\]](#ref-47)[\[1\]](#ref-1)[\[84\]](#ref-84)[\[99\]](#ref-99). InSight then reused the Phoenix EDL architecture almost without change, and the InSight reconstruction literature is explicit about it: Grover, Skulsky, and Russell introduced the InSight reconstruction collection, Maddock and colleagues reported the pre-flight performance predictions, and the supersonic-parachute reconstruction by Clark and the comparison of the InSight parachute against Phoenix by O'Farrell document the near-identical decelerator behavior across the two missions [\[65\]](#ref-65)[\[63\]](#ref-63)[\[124\]](#ref-124)[\[123\]](#ref-123). This Phoenix-to-InSight chain is the single most heritage-favorable sequence in the corpus: a nearly unchanged architecture flown twice, succeeding twice. The dissertation's reasoning is that precisely because the chain is so clean, it tempts the field into reading heritage as causal without a control, and the InSight communications reconstruction by Krasner and colleagues, while excellent, does nothing to rule out the rival explanation that the same well-resourced institution executed both missions well for reasons unrelated to the architecture's age [\[126\]](#ref-126). The near-replication is evidence, but it is uncontrolled evidence, and the gap is the absence of the control.

Mars 2020 closes the U.S. Mars chain by reusing the MSL sky-crane lineage with bounded, well-documented additions, the incremental-novelty case the heritage index must score in the middle of its range. Way and colleagues gave the Mars 2020 EDL system overview, and the software-implementation reports are explicit that the system "largely leveraged heritage from the Mars Science Laboratory EDL System while employing targeted technological advancements," chiefly terrain-relative navigation and the MEDLI2 instrumentation [\[74\]](#ref-74)[\[75\]](#ref-75)[\[73\]](#ref-73). The terrain-relative-navigation test results, the engineering-camera and microphone description by Maki and colleagues, and the EDL communications design document the new elements [\[122\]](#ref-122)[\[142\]](#ref-142)[\[46\]](#ref-46). The MEDLI2 reconstruction literature, including the Karlgaard, Schoenenberger, Dutta, and Way trajectory-and-atmosphere reconstruction, the Tang and colleagues transition assessment, and the Mischna and colleagues pre- and post-EDL atmosphere assessment, reconstructs the Mars 2020 entry to the same depth as MSL and extends the codified-knowledge base [\[77\]](#ref-77)[\[95\]](#ref-95)[\[116\]](#ref-116). Mars 2020 is therefore the canonical "heritage plus bounded novelty" point: most of the architecture is reused, a few elements are new, and the new elements are themselves well analyzed. The Mars Sample Retrieval Lander aerothermal analysis by Muppidi and colleagues shows the same lineage reasoning being applied forward to the next mission, inheriting MSL and Mars 2020 design and MEDLI findings while introducing a higher entry velocity [\[13\]](#ref-13). Across the whole U.S. Mars chain, the pattern is consistent and the omission is consistent: each mission is reconstructed in depth, each architecture's lineage is traceable, and no paper estimates the cross-mission effect of that lineage on outcome.

Tianwen-1 is the indispensable independent-lineage data point, the case that prevents the heritage analysis from being a study of a single institutional tradition. Yu and colleagues described the Tianwen-1 guidance, navigation, and control for Mars EDL; Huang and colleagues reported the powered-descent landing GNC system design and flight results; and Xu and colleagues documented the end-to-end EDL modeling and simulation that supported the mission [\[144\]](#ref-144)[\[115\]](#ref-115)[\[42\]](#ref-42). The architecture reached the same successful outcome class as the U.S. landers through a substantially separate development path, with its own backshell-parachute separation, divert maneuver, and hazard-avoidance sequence. The dissertation draws two conclusions. First, Tianwen-1 demonstrates that successful Mars EDL is achievable through an architecture with little or no U.S. heritage, which is itself a caution against treating heritage as necessary. Second, and more subtly, Tianwen-1's own internal heritage (its reuse of Chinese lunar Chang'e descent-and-landing experience, discussed in Section 3.2) is the kind of lineage the heritage index must be able to score even when the lineage is non-U.S. and less completely reconstructed in the English-language corpus. This is where the documentation-asymmetry limitation, flagged in the prospectus and operationalized in Chapter 4, first becomes visible in the literature: the U.S. reconstruction record is deeper than the record for other programs, and a heritage index built naively from documentation depth alone would conflate "well-reconstructed" with "high-heritage." The literature thus motivates the regime-aware, documentation-flagged coding rule rather than supplying it.

A methodological feature of the Mars reconstruction literature deserves explicit interpretation because it directly conditions how the heritage index can be built from these sources. The reconstructions are not uniform in their inferential power. The pre-MEDLI missions, including Pathfinder, MER, and Phoenix, were reconstructed from inertial measurement unit accelerometry, radar altimetry, and orbit-determination initial conditions, which means the atmospheric reconstruction and the aerodynamic-database knowledge could not be separated because the vehicles carried no direct measurement of free-stream conditions [\[78\]](#ref-78)[\[83\]](#ref-83)[\[48\]](#ref-48). MSL and Mars 2020 broke that confound by adding flush atmospheric data system pressure sensors on the aeroshell forebody, which allowed the free-stream atmosphere and the aerodynamics to be estimated independently, as Dutta and colleagues demonstrated in comparing statistical estimation techniques for MEDLI-like data and as the MEADS measurement chain made possible [\[25\]](#ref-25)[\[85\]](#ref-85)[\[98\]](#ref-98). The interpretation that matters for the heritage index is that reconstruction depth is not a binary "reconstructed or not" attribute but a graded one: a mission instrumented to separate atmosphere from aerodynamics yields a deeper, more propositional understanding of why its architecture behaved as it did than a mission reconstructed from inertial data alone. This is the empirical justification, drawn from the literature itself rather than asserted, for weighting the heritage index by reconstruction depth rather than by mere prior flight. The atmospheric-density-model comparison literature reinforces the point by showing that pre-flight Mars density models systematically over-predicted density at the actual landing sites of Pathfinder, the MER rovers, and Phoenix, a systemic modeling gap that only the instrumented reconstructions could expose and partially close [\[23\]](#ref-23)[\[38\]](#ref-38)[\[45\]](#ref-45). A heritage element flown on a mission that exposed and codified such a gap carries more propositional knowledge forward than the same element flown on a mission that did not, which is the Mokyr mechanism the index is built to capture.

The synthesis of Section 3.1 is that the Mars record is a population of natural experiments in everything but name. The architectures are decomposable and documented; the outcomes are known; the lineages are traceable; the reconstruction depth varies in a way that itself carries information about codified knowledge. What the record lacks is the aggregation step. Confidence in this claim is high, because it rests directly on the corpus, and the interpretive payoff is that the Mars chain alone supplies enough heritage-rich and novelty-rich attempts, at varying mass, to populate the within-target stratum that the conditional estimator in Chapter 5 will exploit.

## 3.2 The lunar record: powered descent, terminal guidance, and hazard avoidance

The claim of this section is that the lunar landing record extends the heritage question into a regime where aerothermal entry is absent and the EDL problem reduces to powered descent, terminal guidance, navigation, and hazard avoidance, and that this regime is where architectural novelty most often resides in software and sensing rather than in structures. The evidence is the recent run of lunar landers spanning the full heritage spectrum, and the reasoning is that the lunar cases sharpen the heritage question precisely because several novel-architecture attempts failed or landed anomalously while at least one novel-architecture attempt succeeded, so that novelty and outcome do not map one-to-one.

The Chinese Chang'e landers establish a genuine lunar heritage lineage and are the lunar analogue of the Phoenix-to-InSight chain. Yu and colleagues documented the autonomous hazard-avoidance control for the Chang'e-3 soft landing, describing the relay hazard-avoidance method that combined coarse grayscale-based avoidance with fine altitude-and-position avoidance using onboard imagery, and reporting that the flown system selected a safe landing site successfully [\[18\]](#ref-18). Liu and colleagues reconstructed the Chang'e-4 powered-descent trajectory and located the landing site on the lunar far side using descent imagery, the first successful far-side soft landing [\[31\]](#ref-31). Zhang and colleagues then described the Chang'e-5 powered-descent GNC and stated explicitly that the Chang'e-3 and Chang'e-4 GNC provided the baseline design for the Chang'e-5 lander-ascender module, with new challenges introduced by larger mass and liquid sloshing [\[55\]](#ref-55). This is a documented, three-mission heritage lineage with explicit baseline reuse and bounded modification, structurally identical to the Mars near-replication chain and equally uncontrolled. The lunar record, like the Mars record, contains its own clean heritage sequence, and the heritage index must be able to score it from sources that are somewhat less reconstructed than the U.S. Mars reports but still document the lineage clearly.

SLIM is the decisive lunar case for the partial-success coding rule, and it is the clearest demonstration in the entire corpus that novelty and outcome are not the same thing. The SLIM overview reports the lander's pinpoint landing with a novel vision-based navigation architecture and a partially anomalous touchdown attitude [\[109\]](#ref-109). Ishida and colleagues reported the vision-based navigation and obstacle-detection flight results, documenting the novel terminal-guidance approach and the anomaly [\[147\]](#ref-147). Ito and colleagues described the development and flight results of the SLIM guidance, navigation, and control, emphasizing that the onboard algorithm corrected a large initial state dispersion while honoring thrust-pointing and subsurface-flight-avoidance constraints, and Sugimoto and colleagues provided the orbit determination and analysis [\[33\]](#ref-33)[\[103\]](#ref-103). The supporting SLIM component-reliability and camera-package literature, including the thermal-cycle testing of the imaging-sensor solder joints by Fukuda and colleagues, documents the engineering substrate of the novel navigation system [\[145\]](#ref-145). The reasoning the dissertation draws is decisive for the outcome variable: SLIM achieved a survivable, pinpoint landing (a success on the precision objective) while suffering an anomalous touchdown attitude that degraded but did not eliminate function. This is the boundary case the pre-registered partial-success rule must adjudicate, and the rule, recoded both ways in sensitivity analysis, is calibrated against this attempt. SLIM also shows that a wholly novel terminal-guidance architecture can substantially succeed, direct evidence against any naive reading in which novelty is simply dangerous.

The lunar record also contains the failure cases that motivate the entire inquiry, and the corpus carries the formal investigation of one of them. The interpreted investigation report on the loss of the Vikram lander during the lunar landing phase documents a novel-architecture lunar EDL failure and is the corpus's clearest coded failure outcome [\[64\]](#ref-64). The lunar record, unlike the U.S. Mars record, contains a meaningful number of failures and anomalies across a wide novelty range, which is statistically valuable because a population with no failures cannot identify a failure-hazard coefficient at all. The lunar branch therefore supplies much of the outcome variation that makes the estimand estimable. The failure investigations vary enormously in depth and independence, from formal interpreted reports to brief mission statements, which is the lunar face of the documentation-asymmetry problem and a direct motivation for the low-documentation sensitivity analysis specified in Chapter 5.

The lunar GNC and terminal-guidance literature, finally, shows where lunar architectural novelty actually lives. The NASA Lunar Pallet Lander GNC report describes a precision-landing concept targeting delivery within 100 meters of a target near the lunar pole, with novel precision-landing sensors as the enabling technology [\[56\]](#ref-56). The broader planetary terminal-guidance literature, including the optimal landing-site-selection method of Cui, Ge, and Gao, the terrain-shadow self-position estimation of Kashioka and colleagues, the curve-matching visual navigation work, the reinforcement-learning onboard GNC of Wilson and Riccardi, and the adversarial-attack detection for deep-reinforcement-learning landing GNC of Wang and Aouf, together document that the novelty frontier for airless-body landing is overwhelmingly in sensing, navigation, and autonomy software [\[56\]](#ref-56)[\[102\]](#ref-102)[\[132\]](#ref-132)[\[148\]](#ref-148)[\[41\]](#ref-41)[\[39\]](#ref-39). This bears on the heritage index's element decomposition: on the Moon, the terminal-guidance and hazard-avoidance elements carry most of the architectural novelty, and these are precisely the elements whose failure modes are, per the software-failure literature in Section 3.7, disproportionately discoverable only in flight. The comparison of autorotation and propulsive landing for planetary exploration adds an architecture-alternatives study at the terminal-descent element, the kind of heritage-versus-novel trade the index is built to capture [\[22\]](#ref-22).

The synthesis of Section 3.2 is that the lunar record contributes the outcome variation, the novel-architecture failures, and the clearest partial-success boundary case that the Mars record lacks, while also containing its own clean heritage lineage in the Chang'e sequence. The lunar branch thus complements the Mars branch: Mars supplies heritage-rich successes with deep reconstruction, the Moon supplies novelty-rich attempts with a meaningful failure rate. Neither branch, and no paper within them, estimates the conditional heritage effect. Confidence in this synthesis is high on the bibliographic claim, and the chapter carries forward, into the gap statement, the specific observation that the lunar branch is where the documentation-asymmetry and partial-success threats are most acute.

## 3.3 Titan and the outer-planet context: the external-validity probe

The claim of this short section is narrow and is held at correspondingly modest confidence: the single Titan descent in the record matters for the external validity of any heritage estimate, not for its statistical power, and the outer-planet entry literature establishes Titan as a chemically and dynamically distinct target whose inclusion tests, but cannot establish, generalization beyond Mars and the Moon. The evidence is thin by design, because there is one in-frame Titan attempt, and the reasoning is that one data point can probe whether a Mars-and-Moon-dominated estimate travels to a third body without being able to confirm that it does.

The Huygens probe descent at Titan is the in-frame data point, and the corpus situates it through the in-situ exploration literature rather than through a dedicated Huygens reconstruction. Mousis and colleagues set out the scientific rationale for Saturn's in-situ exploration, providing the target-distinct context for a Titan descent as an EDL event at a body with a dense, hazy atmosphere, low gravity, and high-altitude winds [\[131\]](#ref-131). Lunine's review of ocean-worlds exploration extends the context to the broader class of icy-moon and ocean-world in-situ entry-and-descent missions, of which Titan is the most mature example [\[101\]](#ref-101). The NASA terrain-relative-navigation study for guided descent on Titan documents the specific EDL challenge: Titan's atmosphere produces descent times exceeding 90 minutes and large unguided landing ellipses, on the order of 110 by 110 kilometers, so that precision landing requires novel guided-descent architecture adapted to a hazy atmosphere that defeats Mars-heritage optical terrain-relative navigation [\[140\]](#ref-140). McRonald's analysis of a lightweight inflatable hypersonic drag device for planetary entry, which explicitly spans missions to Mars, Venus, Earth, Saturn, Titan, Neptune, and Pluto, shows the decelerator-technology literature already reasoning across targets including Titan [\[7\]](#ref-7).

The interpretation is that Titan is the external-validity stress test for the heritage hypothesis. An EDL element that counts as flight-proven for Mars (a disk-gap-band parachute, an optical terrain-relative navigator) may be effectively novel for Titan because Titan's atmosphere and surface differ enough to move the element outside its proven regime. This is the regime-aware coding rule made concrete: heritage is relative to the environment in which an element was proven, and Titan is the body most likely to expose an element flown outside its envelope. The limitation is unavoidable and is stated as such in the dissertation's external-validity discussion: with one Titan attempt, the heritage estimate cannot be validated on Titan, and the contribution's external claim is therefore bounded to the three named bodies with the explicit caveat that generalization beyond Mars and the Moon is probed rather than established. No paper in this branch estimates a heritage hazard either; the outer-planet literature reasons forward about future missions, like the high-mass Mars literature treated next.

## 3.4 Forward architecture and technology-gap studies: high-mass and crewed-class Mars

The claim of this section is that the forward-looking architecture literature is rigorous, quantitative, and decision-relevant, but that it reasons about a hypothetical future fleet rather than estimating an effect from the historical record, and that its primary contribution to this dissertation is to define, with technology-readiness assessments and citations, exactly which EDL elements count as novel relative to flown heritage. The evidence is the NASA EDL Systems Analysis studies and the high-mass and human-class Mars architecture work, and the reasoning is that these studies are the source of the novelty side of the heritage index even though they never estimate a failure hazard.

The NASA EDL Systems Analysis study is the foundational forward study. The Phase 1 report quantified the decelerator and propulsion trade space for Mars payloads beyond the proven MSL mass class and identified which technologies are novel for high-mass entry, and the companion overview enumerated the technology gaps and their readiness [\[43\]](#ref-43)[\[107\]](#ref-107). The Phase 2 exploration feed-forward report by Dwyer Ciancolo and colleagues extended the analysis to payloads of 10 to 50 metric tons and found that inflatable decelerators, rigid aeroshells, and supersonic retropropulsion emerged as the top candidate technologies, while the feed-forward overview proposed a smaller robotic demonstrator to mature two of the three [\[44\]](#ref-44)[\[106\]](#ref-106). The supporting EDL-SA modeling literature, including the aerodynamic and aerothermal environment models of Kinney and the aerocapture guidance-and-performance study for high-mass systems, documents the analytical apparatus behind the technology-gap conclusions [\[12\]](#ref-12)[\[11\]](#ref-11). The EDL-SA studies are, in effect, a catalog of novelty: they state, element by element, which technologies a higher-mass Mars lander would have to introduce and how mature each one is. That catalog is what the heritage index needs to classify an element as heritage or novel, and the TechPort TRL records named in Chapter 4 are the operational form of the same maturity information.

The mass-scaling argument is the causal core of the forward literature, and it is what physically forces departures from heritage. Korzun, Dubos, Iwata, and colleagues analyzed a concept for the EDL of high-mass payloads at Mars and showed that mass scaling forces departures from flown heritage toward novel decelerators and retropropulsion [\[4\]](#ref-4). Steinfeldt and colleagues made the mechanism explicit in their high-mass Mars EDL architecture assessment, stating that Viking-heritage technologies, namely the 70-degree sphere-cone aeroshell, the SLA-561V thermal protection system, and the supersonic disk-gap-band parachute, "do not provide sufficient capability to land such large payload masses" beyond roughly two metric tons [\[57\]](#ref-57). This is the mechanism named in the dissertation's causal chain: increasing landed mass drives the ballistic coefficient up, the proven decelerators run out of capability, and the architecture is compelled toward novelty. The forward literature thus supplies the physical justification for the entry-mass and landed-mass controls in the estimating equation: mass is not merely a nuisance covariate, it is the variable that mechanically determines how much novelty an attempt is forced to carry. A heritage estimate that did not condition on mass would confound the protective effect of heritage with the simple fact that heritage-rich attempts tend to be lighter.

The human-class Mars studies bound the external validity of the whole enterprise and confirm that novelty is unavoidable at crewed mass. Polsgrove and colleagues surveyed human-class Mars EDL architectures and the novel decelerators they require; Cianciolo and colleagues assessed rigid-decelerator options and detailed the technology-development gaps and mitigations; the deployable-decelerator and mid-lift-to-drag studies extended the analysis to inflatable and rigid deployable concepts; and the high-heritage blunt-body concept for human Mars exploration proposed a deliberately heritage-maximizing crewed architecture centered on a blunt-body entry vehicle and throttled supersonic retropropulsion [\[58\]](#ref-58)[\[60\]](#ref-60)[\[59\]](#ref-59)[\[96\]](#ref-96)[\[5\]](#ref-5). The Korzun powered-descent-aerodynamics study for low and mid lift-to-drag human Mars vehicles and the hypersonic-inflatable-decelerator ground-test and ADEPT deployable-technology reports document the maturation of the specific novel elements [\[113\]](#ref-113)[\[61\]](#ref-61)[\[141\]](#ref-141). Two conclusions follow. First, the crewed literature confirms that at high enough mass, heritage simply cannot be maintained, which bounds the dissertation's claim to the documented historical mass range and places crewed-class EDL explicitly out of frame. Second, the existence of a "high-heritage" crewed concept is itself evidence that practitioners treat heritage as a design virtue worth maximizing even at crewed scale, the practitioner assertion the dissertation sets out to test rather than assume.
The synthesis of Section 3.4 is that the forward architecture literature is the authoritative source for the novelty side of the heritage index and the physical justification for the mass controls, but that it is, by its nature, prospective: it reasons about missions not yet flown and effects not yet observed. It cannot estimate a heritage hazard because it studies a fleet that does not yet exist. This is the second of the three branches, and it shares with the first the same structural omission. Confidence in the bibliographic claim is high; the substantive contribution carried forward is the element-level novelty taxonomy that Chapter 4 operationalizes.

## 3.5 Supersonic retropropulsion and decelerator maturation: the grounded-novelty exemplar

The claim of this section is that supersonic retropropulsion is the corpus's best-documented example of novelty matured through deep analytical and experimental grounding, and that it therefore serves as the exemplar for the Mokyr propositional-versus-ungrounded novelty decomposition. Not all novelty is equally risky. Novelty backed by extensive wind-tunnel and computational campaigns should, on the dissertation's mechanism, carry a smaller risk premium than novelty introduced without such grounding. The evidence is the sustained retropropulsion maturation literature, and the reasoning is that this literature lets the dissertation distinguish, within the novelty term, between elements that are new-but-well-understood and elements that are simply new.

The retropropulsion survey-and-development literature establishes the technology's trajectory from concept to flight-relevant maturity. Korzun, Cruz, and Braun surveyed supersonic retropropulsion technology for Mars EDL and showed that its relevance increases with ballistic coefficient to the point of being likely required for human Mars exploration [\[9\]](#ref-9). Edquist, Korzun, Dyakonov, and colleagues documented the development of supersonic retropropulsion through wind-tunnel and analysis campaigns, and the Edquist, Chang, and McDaniel introduction surveyed the recent developments across the program [\[36\]](#ref-36)[\[66\]](#ref-66). The Berry and colleagues experimental results from the NASA Ames 9-by-7-foot supersonic wind tunnel, referenced in the prospectus seed list, and the Palaszewski wind-tunnel-testing report provide the experimental backbone [\[49\]](#ref-49). The interpretation is that retropropulsion is the clearest corpus case of prescriptive knowledge being converted into propositional understanding through deliberate ground testing rather than through flight, which is the mechanism the dissertation argues normally requires flight. Retropropulsion thus tests a sharp sub-implication: if the protective effect of heritage is really a knowledge-codification effect, then a novel element matured to deep analytical understanding on the ground should behave more like heritage than like raw novelty.

The conceptual-modeling and configuration literature deepens the grounding and shows the technology approaching design usability. Korzun and Braun characterized retropropulsion performance for high-mass Mars EDL and developed an approximate flowfield model relating configuration to static aerodynamics and system performance; the Skeen thesis and the Skeen and Starkey drag-augmented-retropropulsion modeling quantified the potential to preserve or augment aerodynamic drag during powered descent; Blette and Braun studied the supersonic configuration transitions needed to enable retropropulsion during entry; and Benito and colleagues developed the powered-descent guidance strategy and algorithms for Mars landing using retropropulsion [\[111\]](#ref-111)[\[28\]](#ref-28)[\[26\]](#ref-26)[\[27\]](#ref-27)[\[138\]](#ref-138)[\[114\]](#ref-114). The NASA retropropulsion-testing developments report and the OVERFLOW computational-versus-experimental comparison for a blunt-body Mars entry vehicle under retropropulsion document the continuing CFD-and-test validation [\[100\]](#ref-100)[\[24\]](#ref-24). The interpretation is that retropropulsion has accumulated the analytical and experimental backing that, on the Mokyr mechanism, should down-weight its excess risk relative to an ungrounded novelty. The limitation, candidly, is that retropropulsion has not yet flown an operational Mars descent, so its place in the decomposition is as a worked exemplar of grounded novelty rather than as a flown heritage element. This is a feature, because the decomposition's purpose is to predict how grounded novelty should behave, not to assume it.

The inflatable and deployable decelerator literature provides the complementary novelty class and shows that not all novelty is equally matured. The hypersonic inflatable aerodynamic decelerator ground-test development, the Skolnik and colleagues HIAD design, the Del Corso and colleagues advanced flexible thermal protection for inflatable decelerators, and the ADEPT deployable-technology work document a technology family being matured deliberately but still less flight-proven than the disk-gap-band parachute lineage [\[61\]](#ref-61)[\[32\]](#ref-32)[\[10\]](#ref-10)[\[141\]](#ref-141). The interpretation is that the decelerator-technology literature spans a maturity gradient, from the deeply flight-proven DGB parachute through the heavily-ground-tested retropropulsion to the less-proven inflatables, and that this gradient is exactly what the heritage index's element scoring must capture. The synthesis of Section 3.5 is therefore that the grounded-novelty literature supplies the empirical content of the propositional-versus-ungrounded distinction: it identifies which novel elements have earned analytical grounding and which have not, and it does so without ever estimating a landing-failure hazard. Confidence is high that retropropulsion is the corpus's grounded-novelty exemplar; the carried-forward implication is the testable prediction that excess risk should load on ungrounded rather than grounded novelty.

## 3.6 Parachute and disk-gap-band qualification: the decelerator-testing throughline

The claim of this section is that the disk-gap-band parachute is the single most flight-proven and most thoroughly qualified EDL element in the corpus, and that its qualification literature is the heritage anchor against which decelerator novelty is measured. The evidence is the sustained DGB qualification and testing record, and the reasoning is that the DGB lineage is the clearest example of an element whose flight history and ground qualification together produced the codified, propositional understanding that the heritage index is designed to reward.

The DGB design history establishes the lineage. Clark and Tanner's historical summary of the design, development, and analysis of the disk-gap-band parachute traces the technology from its late-1960s origins through the Viking precursor test programs to its modern Mars applications, documenting the accumulated design knowledge behind the element [\[6\]](#ref-6). The MSL supersonic qualification literature shows that lineage being requalified for a larger vehicle. Sengupta and colleagues reported the MSL parachute decelerator system supersonic qualification program and the findings from it, and the supporting subscale wind-tunnel testing in the wake of a 70-degree sphere-cone entry vehicle characterized the supersonic canopy-breathing and area-oscillation phenomena that govern DGB behavior above Mach 1.5 [\[128\]](#ref-128)[\[51\]](#ref-51)[\[136\]](#ref-136). The fluid-structure-interaction studies of parachutes in supersonic planetary entry, including the Sengupta, Hall, and Wernet work and the Huang and colleagues high-fidelity inflation simulation, deepened the propositional understanding of the inflation and collapse physics [\[54\]](#ref-54)[\[97\]](#ref-97). The interpretation is that the DGB is the heritage end of the decelerator spectrum: an element with decades of flight history and an unusually complete ground-qualification and physics-modeling record, which is exactly the kind of deep codification the reconstruction-depth weighting rewards.

The modern parachute-test programs show the lineage being carried forward to the next missions and probed at its limits. The Zumwalt and colleagues wind-tunnel test of subscale ringsail and DGB parachutes compared the heritage DGB against a new ringsail design under the Low Density Supersonic Decelerator project; the O'Farrell and colleagues development of DGB models deployed supersonically in the wake of a slender body and the ASPIRE program prepared full-scale flight tests of the MSL and Mars 2020 DGB; the Lingard and colleagues supersonic tests of a double-gap DGB explored a design variant; and the ASPIRE2 and Siegel and colleagues work designed and tested the supersonic DGB for the Mars Sample Retrieval Lander [\[149\]](#ref-149)[\[35\]](#ref-35)[\[137\]](#ref-137)[\[15\]](#ref-15)[\[119\]](#ref-119). The interpretation is that even the most heritage-rich element is continually requalified when the vehicle changes, which is direct support for the dissertation's regime-aware coding rule: a DGB parachute is heritage only within the mass, Mach, and dynamic-pressure regime in which it was proven, and flying it outside that regime is a form of novelty that the index must score low rather than high. The bow-shock-instability and high-enthalpy entry literature reinforces the same point on the aerothermal side, showing that even well-understood entry physics carries residual uncertainty that flight can expose [\[20\]](#ref-20).

The synthesis of Section 3.6 is that the decelerator-qualification literature anchors the heritage end of the index just as the forward-architecture and retropropulsion literature anchors the novelty end, and that together Sections 3.4 through 3.6 supply the full heritage-to-novelty maturity gradient for the deceleration element. Like every other branch, this literature documents and qualifies elements in exquisite detail without ever estimating their effect on landing-failure probability across missions. The planetary-protection literature on MSL is noted here as a reminder that the EDL system is documented across yet further dimensions, including biological contamination control, again at the single-mission level [\[62\]](#ref-62). Confidence is high on the bibliographic claim; the carried-forward content is the regime-aware heritage anchor for the deceleration element.

## 3.7 The reliability-and-failure-statistics tradition and the software-failure channel

The claim of this section is that the spacecraft reliability-and-failure-statistics literature supplies the statistical precedent for treating landing outcomes as discrete events to be modeled, but that it has been applied to on-orbit longevity of operating spacecraft rather than to the discrete success or failure of a landing event, and that it isolates no EDL-architectural-novelty regressor. The evidence is the population-reliability and failure-prediction literature plus the software-failure taxonomy, and the reasoning is that this branch supplies the estimator family and the software-risk mechanism but leaves the specific EDL-heritage question untouched.

The population-reliability literature establishes that discrete-outcome and population-level modeling are accepted domain tools. Grile and Bettinger analyzed the reliability of deep-space satellites launched between 1991 and 2020, estimating failure distributions and infant-mortality effects across launch cohorts and treating deployable-subsystem performance separately [\[127\]](#ref-127). The satellite-telemetry failure-prediction work demonstrated failure prediction and time-to-failure estimation from telemetry, establishing hazard and discrete-outcome modeling as accepted reliability tools [\[117\]](#ref-117). The electric-propulsion reliability study by its authors performed a statistical analysis of on-orbit propulsion anomalies and a comparative analysis of electric-versus-chemical propulsion failure rates, a direct example of discrete-outcome reliability modeling of a spacecraft subsystem [\[40\]](#ref-40). The interpretation is that the reliability tradition has already done, for on-orbit subsystems, the methodological thing the dissertation proposes to do for landing events: it treats failures as discrete outcomes, estimates failure probabilities across a population, and distinguishes subsystem classes. The limitation, and it is the decisive one, is that the unit of analysis is wrong for the heritage question. On-orbit longevity is a time-to-failure process for an operating satellite; a landing is a one-shot, irreversible event with a binary outcome. The reliability literature supplies the precedent for discrete-outcome modeling but not the model for the specific one-shot landing event, which is why the dissertation adopts a discrete-outcome logistic hazard rather than a longevity or survival model for operating systems.

The entry-risk and re-entry-safety literature is the closest the corpus comes to applying statistical methods to entry events themselves, and it confirms both the feasibility and the gap. The reduced-order safety analysis for shallow controlled re-entries quantified entry-event risk through reduced-order modeling and input statistics, demonstrating that entry events can be subjected to statistical risk quantification [\[130\]](#ref-130). The Amato treatment of Mars EDL guidance under dynamic uncertainty framed the EDL guidance problem in explicitly probabilistic terms, propagating atmospheric and vehicle uncertainty through the descent [\[76\]](#ref-76). The interpretation is that statistical risk quantification of entry events is an established and accepted practice, which removes any methodological objection to modeling landing outcomes statistically. The limitation is that these studies quantify the risk of a single entry under parametric uncertainty, not the cross-mission effect of architectural heritage on the probability of loss. They model within-mission dispersion, not between-mission heritage.

The software-failure literature identifies the mechanism by which novelty most often produces failure, and it is the branch most directly relevant to the lunar terminal-guidance novelty of Section 3.2. Wander's catalog of fatal software failures in spaceflight documents a class of failure modes disproportionately associated with novel or modified flight software [\[50\]](#ref-50). The interpretation matters mechanistically: EDL novelty frequently resides not in structures but in guidance, navigation, and control software, and software failure modes are among the most likely to be discoverable only in flight because ground testing cannot fully reproduce the coupled descent environment. This is the precise mechanism the dissertation's causal chain names: heritage protects because flight has exposed and codified the lineage's failure modes, and the failure modes most resistant to ground discovery are exactly the software ones the Wander taxonomy catalogs. The reinforcement-learning and adversarial-robustness GNC literature of Section 3.2 reinforces that the autonomy software frontier is where novelty and its attendant in-flight-only failure modes increasingly concentrate [\[41\]](#ref-41)[\[39\]](#ref-39). The satellite-telemetry failure-prediction and entry-risk literature together with the software-failure taxonomy thus supply the full mechanistic and statistical backing for the dissertation's outcome model, without any of them isolating the EDL-heritage regressor.

A further interpretive point connects the reliability literature to the small-sample inferential problem that governs the entire dissertation, and it belongs here because the literature review is where the design constraints first become visible. The population-reliability studies operate on cohorts of hundreds of spacecraft, which is what permits conventional maximum-likelihood estimation of failure distributions and infant-mortality effects [\[127\]](#ref-127). The landing-attempt frame is categorically smaller, on the order of several dozen attempts across three bodies, with Titan contributing a single row. The reliability literature thus supplies the conceptual precedent for discrete-outcome modeling while simultaneously, by contrast, exposing why the landing application cannot simply import the same maximum-likelihood machinery: with few events the maximum-likelihood logistic estimator is biased, can fail to converge under separation, and produces unstable coefficients, problems that the methods literature carried in the corpus and developed fully in Chapter 5 addresses through penalized likelihood [\[130\]](#ref-130). The interpretation is that the reliability tradition is a precedent to be adapted rather than copied: it validates treating a landing as a discrete event with a modeled failure probability, but the small frame forces a different estimator and a more conservative inferential posture than the large-cohort reliability studies employ. This is not a weakness imported from the literature; it is a design constraint the literature makes legible, and the dissertation's response to it, namely pre-registration, a deliberately low-parameter specification, and exact or permutation inference, is the subject of the research-design chapter rather than this one.

The synthesis of Section 3.7 is that the reliability branch is the third of the three and shares the structural omission of the other two from the opposite direction. Where the reconstruction branch has the missions but not the cross-mission model, and the forward-architecture branch has the novelty taxonomy but not the historical effect, the reliability branch has the discrete-outcome statistical model but not the EDL-heritage application and the right unit of analysis. The three branches are complementary and non-overlapping, and the heritage estimand sits precisely in the empty intersection of all three. Confidence in this synthesis is high; the carried-forward content is the discrete-outcome estimator precedent and the software-failure mechanism that the design in Chapter 5 will combine.

## 3.8 Synthesis: the heritage claim across the field, the conditional hazard it implies, and the gap

The synthesis returns to the chapter thesis and establishes it carefully, because the gap statement is the chapter's principal claim and a dissertation chapter must protect the limits of that claim rather than overclaim.

No existing study estimates a conditional landing-failure hazard as a function of a constructed EDL-heritage-reuse index across the Moon, Mars, and Titan record while controlling for target body and mass, and this specific intersection is the gap the dissertation fills. The evidence is the three branches reviewed above. The reconstruction-and-architecture record documents individual missions in fine detail and traces architectural lineage element by element, from Pathfinder and MER through the MSL, Phoenix-to-InSight, and Mars 2020 chains, the independent Tianwen-1 and Chang'e lineages, the SLIM partial success, and the Huygens Titan descent, but it estimates no cross-mission effect [\[83\]](#ref-83)[\[143\]](#ref-143)[\[88\]](#ref-88)[\[48\]](#ref-48)[\[65\]](#ref-65)[\[74\]](#ref-74)[\[144\]](#ref-144)[\[31\]](#ref-31)[\[109\]](#ref-109)[\[131\]](#ref-131). The forward architecture-and-technology-gap literature quantifies the decelerator and propulsion trade space and names the novel elements that higher-mass and crewed-class missions would require, but it reasons about a future fleet and observes no historical effect [\[43\]](#ref-43)[\[4\]](#ref-4)[\[57\]](#ref-57)[\[58\]](#ref-58). The reliability-and-failure-statistics tradition establishes discrete-outcome and population-level modeling as accepted tools and supplies the software-failure mechanism, but it models on-orbit longevity of operating spacecraft and isolates no EDL-architectural-novelty regressor [\[127\]](#ref-127)[\[117\]](#ref-117)[\[40\]](#ref-40)[\[50\]](#ref-50). A literature that has independently produced all three ingredients, a documented population of decomposable architectures with known outcomes, a taxonomy of which elements are novel, and an accepted discrete-outcome statistical apparatus, and has nonetheless never combined them into a conditional heritage estimate, has left a real and locatable gap rather than an artifact of incomplete searching. The structure of the corpus itself bears this out: 149 verified references spanning all three branches, with the heritage-versus-outcome intersection empty across every one of them.

The boundary of the claim is essential and is protected rather than buried. The claim of total absence is held at high confidence within the assembled corpus and at moderate confidence as a universal statement about all literature everywhere, because absence of a result in a large but finite corpus is strong but not conclusive evidence of its absence in the entire field. The dissertation therefore states the gap as a contribution-defining novelty rather than as a proven nonexistence theorem, and it invites refutation by any prior study that does estimate the conditional heritage hazard. The conditions that would unsettle it are stated plainly: the gap claim would be weakened or overturned if a prior study were found that estimates landing-failure probability as a function of a documented EDL-heritage measure with target-body and mass controls across multiple bodies, or if the heritage construct were shown to be so entangled with program strength in the existing literature that no separate heritage question is coherent. Neither condition is met in the corpus, but both are named so that the claim remains falsifiable.

The qualitative heritage claim, as it appears across the field, can now be stated precisely and then converted. Throughout the reconstruction literature, heritage reuse is treated as a design virtue: the Phoenix-to-InSight near-replication is presented as a deliberate conservatism [\[65\]](#ref-65)[\[63\]](#ref-63); the Mars 2020 software reports describe the system as reusing MSL heritage while employing targeted advancements [\[75\]](#ref-75); the Chang'e-5 GNC is described as taking Chang'e-3 and Chang'e-4 as its baseline [\[55\]](#ref-55); and a crewed concept is built explicitly around being "high-heritage" [\[5\]](#ref-5). At the same time, the forward literature shows mass mechanically forcing departures from heritage toward novelty [\[57\]](#ref-57)[\[4\]](#ref-4), and the lunar and software-failure literature shows novel-architecture attempts failing or landing anomalously [\[64\]](#ref-64)[\[109\]](#ref-109)[\[50\]](#ref-50) while at least one novel architecture substantially succeeds [\[33\]](#ref-33). The field, in other words, asserts that heritage is protective and illustrates the assertion abundantly, but it never tests the assertion as a falsifiable proposition with controls. The conversion this dissertation performs is to take that qualitative, anecdote-illustrated claim and restate it as a single conditional hazard: conditional on target body, entry mass, landed mass, and program strength, does a higher documented EDL-heritage-reuse index lower the probability that the vehicle is lost during the landing event? In the dissertation's fixed notation, this is the sign and significance of the coefficient \( \beta_1 \) in the logistic model \( \operatorname{logit} \Pr(\text{failure}_i = 1) = \beta_0 + \beta_1 \, \text{heritage\_index}_i + \boldsymbol{\gamma}' \mathbf{controls}_i + \epsilon_i \), with H1 predicting \( \beta_1 \) below zero and statistically distinguishable from zero and H0 predicting \( \beta_1 \) equal to zero. The conditional framing is what the literature lacks and what makes the estimate decision-relevant: it asks not whether heritage missions succeed, which the record shows they mostly do, but whether they succeed more than they would have under the next-best novel-architecture counterfactual at the same target, mass, and program strength, which is the Fogelian social-saving analogue the theoretical framework establishes.

Three propositions follow directly from the gap and carry into the remainder of the dissertation. The first proposition is that heritage and novelty are element-level rather than mission-level attributes, established by the MSL case in which a Viking-heritage DGB parachute flew alongside a first-flight sky crane and by the Chang'e and Mars 2020 cases of bounded modification over a reused baseline [\[88\]](#ref-88)[\[104\]](#ref-104)[\[55\]](#ref-55)[\[74\]](#ref-74); this proposition justifies the element-wise construction of the heritage index in Chapter 4 and forbids any binary mission-level heritage label. The second proposition is that heritage is regime-relative: an element counts as proven only within the mass, Mach, dynamic-pressure, and environmental regime in which it was demonstrated, established by the continual requalification of even the heritage DGB parachute when the vehicle changed and by Titan's capacity to render a Mars-proven element effectively novel [\[128\]](#ref-128)[\[149\]](#ref-149)[\[140\]](#ref-140); this proposition justifies the regime-aware coding rule that scores an element flown outside its envelope low rather than high. The third proposition is that any heritage protective effect, if it exists, is plausibly a knowledge-codification effect concentrated in elements whose flight history produced deep, reconstructed, propositional understanding, established by the contrast between the densely reconstructed MEDLI and MEDLI2 missions and the more thinly documented attempts, and testable through the grounded-versus-ungrounded novelty decomposition for which supersonic retropropulsion is the worked exemplar [\[125\]](#ref-125)[\[77\]](#ref-77)[\[36\]](#ref-36)[\[9\]](#ref-9); this proposition justifies the reconstruction-depth weighting of the index and the novelty decomposition in the analysis plan, and it is the mechanism that keeps the dissertation's causal claim distinct from a bare correlation.

The chapter closes by drawing its threads together. Landing concentrates mission risk into minutes of irreversible autonomous operation, and the recent record contains novel-architecture failures, anomalies, and near-replication successes that span the full heritage spectrum [\[109\]](#ref-109)[\[64\]](#ref-64)[\[65\]](#ref-65). NASA and JPL make recurring heritage-versus-novelty EDL portfolio decisions, and the mass-scaling literature shows those decisions are forced rather than optional as payloads grow [\[4\]](#ref-4)[\[57\]](#ref-57)[\[58\]](#ref-58). The apparatus to address the problem exists in pieces, decomposable documented architectures, a novelty taxonomy, a discrete-outcome statistical precedent, but has never been assembled into the conditional estimate, which is the gap [\[88\]](#ref-88)[\[43\]](#ref-43)[\[127\]](#ref-127). The conditional logistic hazard is the natural estimator for this one-shot binary event, a design argument developed in Chapter 5 against the same reliability precedent [\[127\]](#ref-127)[\[117\]](#ref-117). And the residual risks of the enterprise, namely the small frame, the construct risk in the heritage index, the documentation asymmetry that this chapter has shown to be most acute in the lunar and non-U.S. records, and the central confounding-by-program-strength threat, are real and are bounded by the design rather than ignored, which Chapters 4 through 6 specify. The literature, reviewed substantively across all three of its branches, converges on a single conclusion: the heritage claim is everywhere asserted, nowhere tested as a falsifiable conditional proposition, and ready to be measured. That convergence is what licenses the rest of the dissertation.
# Chapter 4: Data and Measurement

## 4.0 The chapter's answer

The measurement apparatus of this dissertation stands or falls on one constructed variable, the EDL-heritage-reuse index. This chapter's answer is that the index can be built reproducibly from documents rather than opinion, scored against the regime in which each EDL element was proven, and weighted by the depth of post-flight reconstruction. It is, on these terms, a defensible operationalization of the unobservable construct it stands for: the true architectural similarity of a landing attempt to flown systems. The remaining variables, the binary landing outcome, the physical controls of target body and entry and landed mass, and the program-strength control, are comparatively low-risk to measure, but each carries a specific construct threat that the design names and addresses in advance. The chapter does two things at once. It documents four real, named data sources with their provenance, access paths, coverage, and known biases, and it converts the prospectus data section into a full operationalization of every variable, with a measurement table that fixes, for each construct, its operational definition, its source, and its scale. The claim defended here is not that the measurement is perfect. It is that the measurement is honest, pre-registered, reproducible from the named sources, and bounded by inter-coder checks and sensitivity analyses, so that the headline coefficient \( \beta_1 \) estimated in later chapters measures the intended quantity rather than an artifact of coding latitude.

The problem this chapter addresses is twofold: whether the conditional logistic hazard of failure on the heritage index actually measures the causal mechanism it claims to, and whether the residual measurement risk is acceptable. Neither holds unless the variables are well constructed. A heritage index contaminated by knowledge of outcomes, an outcome variable coded by an ambiguous rule, or a program-strength control built from arbitrary inputs would each silently determine the sign of \( \beta_1 \) before any model was fitted. The current state of the EDL literature offers no constructed heritage variable at all; reconstruction reports describe single architectures in fine detail but never code them onto a comparable scale across missions [\[88\]](#ref-88)[\[48\]](#ref-48)[\[82\]](#ref-82). The desired state is a single, comparable, document-grounded score per attempt that places every Moon, Mars, and Titan landing on the same heritage-to-novelty continuum. The gap is the absence of any such scoring rule in the published record. Leaving it open means the heritage-versus-novelty debate continues to be settled by anecdote, and that any quantitative claim about heritage would rest on a measurement no one could reproduce. This chapter closes the measurement gap; Chapter 5 closes the estimator gap that depends on it.

## 4.1 Named data sources: provenance, access, coverage, and known biases

The analysis draws on four named, real data sources, and these are treated at the outset as a **data substrate**, not as a bibliography. The NASA Technical Reports Server reconstruction reports, the global record of landing attempts, the TechPort technology-readiness records, and the U.S. Government Accountability Office program-history reports are sources of measured quantities that populate the dataset, in the same way that a census file or an administrative register populates a dataset in econometric work. They are cited where their published documentation is the warrant for a coding decision, but their primary role is to supply the values of variables, not to support claims in prose. The distinction matters for two reasons. First, it sets the standard against which data quality must be judged: the question is not whether these sources are authoritative publications, which several plainly are, but whether they yield reproducible values for the specific variables defined here. Second, it explains why two of the four sources, TechPort and the GAO archive, appear nowhere as rows in the corpus: they are accessed as data through their public portals and APIs, and the corpus instead carries the NASA Technology Taxonomy as the classification framework that organizes the TechPort records [\[2\]](#ref-2). The plan flags this as expected for a measurement study rather than as a missing citation.

### 4.1.1 NTRS EDL reconstruction reports

The first and most important source is the body of post-flight EDL reconstruction reports hosted on the NASA Technical Reports Server. These documents are the authoritative record of how a given EDL sequence actually performed against its predictions, and they are the literal artifact through which flight converts prescriptive recipes into propositional understanding, the conceptual hinge of the Mokyr-grounded weighting introduced in Chapter 2. The Mars segment of this record is unusually deep. It includes the Phoenix EDL performance reconstruction [\[48\]](#ref-48)[\[108\]](#ref-108), the Mars Science Laboratory trajectory and atmosphere reconstruction and its statistical performance reconstruction [\[78\]](#ref-78)[\[134\]](#ref-134), the InSight EDL trajectory, atmosphere, and communications reconstructions [\[82\]](#ref-82)[\[65\]](#ref-65)[\[126\]](#ref-126), and the Mars 2020 instrumentation-based reconstruction carried by the MEDLI and MEDLI2 sensor suites [\[71\]](#ref-71)[\[77\]](#ref-77)[\[105\]](#ref-105). The aerothermal and heat-shield response reconstructions associated with the MEDLI program extend this record into the thermal-protection element specifically [\[125\]](#ref-125)[\[120\]](#ref-120), and the reconstructed-aerodynamics assessment closes the loop on the entry element [\[17\]](#ref-17). For each architecture these documents define the functional elements and report their measured in-flight behavior, which is what the heritage index requires to score an element against the regime in which it was proven.

The access path is the NTRS public citation-search application programming interface at the documented endpoint, supplemented by the NTRS web interface for full-text retrieval. The API returns structured citation metadata and, for unrestricted reports, links to the full document; the coding protocol records the NTRS citation identifier for every report used, so that each heritage score is traceable to a retrievable source. Coverage is the dominant known bias of this source and must be stated plainly. The reconstruction record is densest for U.S. Mars missions, thinner for U.S. lunar missions, thinner still for non-U.S. attempts, and effectively absent for several early or unsuccessful attempts whose telemetry was never reconstructed in the open literature. The Chang'e descent-trajectory reconstruction is a non-U.S. counterexample that does enter the record [\[31\]](#ref-31), and the Tianwen-1 and SLIM flight results provide architecture documentation for two further independent lineages [\[147\]](#ref-147), but the asymmetry is real and it has a direct measurement consequence: attempts with rich reconstruction can be scored with high confidence and weighted up under the propositional-knowledge rule, while attempts with poor reconstruction must be scored conservatively and flagged. Section 4.6 makes the documentation-asymmetry response explicit.

### 4.1.2 The global record of Mars, Moon, and Titan landing attempts

The second source is the population frame itself: every documented attempt to land a vehicle on Mars, the Moon, or Titan, with its outcome. This is assembled from a consolidated mission catalog [\[94\]](#ref-94) cross-checked against the peer-reviewed and agency mission overviews that document individual attempts [\[88\]](#ref-88)[\[74\]](#ref-74)[\[48\]](#ref-48)[\[143\]](#ref-143)[\[144\]](#ref-144)[\[109\]](#ref-109). Each attempt contributes exactly one row. The access path is the catalog's public repository together with the cited mission literature; where the catalog and a mission overview disagree on a date or outcome, the protocol records both and resolves the discrepancy by the more authoritative agency reconstruction, logging the resolution. The unit and inclusion frame are specified in Section 4.2, so the relevant point here is provenance and bias. The catalog is a grade-B consolidated secondary source, which means it is suitable for assembling the frame but not for adjudicating contested outcomes on its own authority; the design treats it as a starting roster to be verified row by row against primary documentation rather than as a final dataset. Its principal bias is the same documentation asymmetry that affects the reconstruction reports, compounded by the survivorship-style problem that successful, well-funded attempts generate more catalog detail than failed or obscure ones. Because the outcome variable is binary and the failures are precisely the events of interest, any tendency of the catalog to under-record marginal or early failures would bias the event count and must be checked against independent mission records. The frame is intrinsically small, on the order of several dozen attempts, which is a coverage limitation rather than a bias and which governs the statistical-power discussion deferred to Chapter 5.

### 4.1.3 TechPort EDL-technology readiness records

The third source is NASA TechPort, the agency's public repository of technology-project records including technology-readiness-level histories. TechPort records when a given EDL technology, such as a disk-gap-band parachute, a guided-entry capability, supersonic retropropulsion, terrain-relative navigation, or landing radar, first reached and then advanced through readiness levels, including flight demonstration. The access path is the TechPort public portal and its associated API. These records are the basis for classifying an EDL element as heritage or novel for a given attempt, because they date the point at which an element became flight-proven and in what regime. TechPort does not appear as a corpus row because it is consumed as data; the classification framework that organizes its technology areas, the 2020 NASA Technology Taxonomy, supplies the controlled vocabulary against which each EDL element is mapped to a technology area [\[2\]](#ref-2). The known bias of TechPort is granularity and coverage drift: it is most complete for recent, formally tracked NASA technology projects and less complete for legacy elements whose readiness history predates the system, or for non-U.S. technologies that it does not track at all. The coding protocol therefore uses TechPort as the primary readiness source where it covers an element and falls back to the dated reconstruction and architecture literature for elements it does not cover, recording which source supplied each readiness date. This fallback is itself a documented coding rule, not an ad hoc substitution.

### 4.1.4 GAO program-history reports

The fourth source is the archive of U.S. Government Accountability Office reports on NASA major projects and on specific Mars and lunar programs. These reports supply independent, audit-grade program-level context, principally cost performance, schedule performance, and organizational and technical-maturity assessments, which are the raw inputs to the program-strength control that guards against the central confounding threat. The access path is the GAO public report archive. Like TechPort, GAO is consumed as data and does not appear as a corpus row. Its coverage is the sharpest of the four biases: GAO oversight is a U.S. instrument, so program-strength inputs are richly available for NASA and JPL attempts and largely unavailable, in comparable form, for non-U.S. programs. This is a serious measurement asymmetry because the program-strength control is the main-specification defense against the claim that heritage merely proxies for program strength, and an asymmetric control could itself introduce bias. Section 4.5 sets out the response: a coarse, ordinal program-strength index that can be populated for non-U.S. attempts from public organizational and flight-experience information, with the richer GAO-based cost-and-schedule inputs used where available and the index's sensitivity to their absence reported. The design's candor about this asymmetry is part of the argument, not an afterthought.

The convergence of these four sources is what makes the heritage index reproducible. An analyst given the same four sources and the same coding rubric would assign materially the same heritage score to the same attempt, because each scoring input, an element's identity, the regime in which it was proven, the depth of its reconstruction, and the program behind it, is read from a documented source rather than inferred from reputation [\[48\]](#ref-48)[\[82\]](#ref-82)[\[2\]](#ref-2). The methodological principle at work is that a constructed treatment variable in an observational study must be reproducible from named data to be credible, and the inter-coder reliability check specified in Section 4.6 is what tests that reproducibility in practice. Reproducibility is nonetheless bounded by documentation: where a source is thin, two analysts may diverge, and those rows are flagged. The design concedes that no document fully fixes a judgment about whether an element was flown inside or outside its proven regime; that residual judgment is the construct risk this chapter manages rather than eliminates.

## 4.2 Unit of analysis and the inclusion frame

The unit of analysis is the individual landing attempt at the Moon, Mars, or Titan, defined as a vehicle committing to an entry-descent-landing or powered-descent sequence intended to place a payload on the surface of one of those three bodies. The operational test for inclusion is commitment to the descent sequence: an attempt enters the frame at the point of irreversible commitment to EDL, typically atmospheric entry interface or powered-descent initiation, regardless of whether it subsequently succeeded. This definition is chosen so that the frame is a population of discrete, comparable trials with a binary outcome, which is what the discrete-outcome hazard estimator requires.

The exclusions follow from the definition and are fixed in advance. Orbital insertions and flybys are excluded because they involve no surface-placement attempt. Sample-return Earth-entry vehicles are excluded from the primary population because Earth is a different target body with a different atmosphere, and the contribution's external claim is bounded to the three named bodies; Earth-return systems are noted only as a possible robustness extension, never as primary rows. Attempts that failed before commitment to the descent sequence, for example a spacecraft lost in cruise or in orbit insertion before any EDL attempt, are excluded because they never entered the EDL phase that the heritage index measures; including them would conflate launch and cruise reliability with EDL reliability and would corrupt the very mechanism under study. Crewed landing attempts are absent from the frame entirely because none exist in the historical record at these bodies, which is why the design states explicitly that generalization to crewed-class masses is out of scope [\[58\]](#ref-58)[\[60\]](#ref-60). Each boundary rule is recorded so that the assembled frame is reconstructible from the rules plus the named sources.

The choice of the landing attempt as the unit, rather than the mission or the vehicle, has a measurement rationale worth making explicit. A single mission may carry more than one landed element, and a single architecture may be flown more than once; treating the attempt as the unit lets the dataset record, for instance, an architecture's repeated flights as separate trials with potentially different heritage scores if an element was modified between flights. This is the granularity at which the Mokyr cumulative-reliability prediction is testable, because it is at the level of the individual attempt that the protective effect of prior reconstruction either appears or does not. The cost of this granularity is statistical: the attempts are not fully independent, since repeated flights of one lineage share architectural DNA, and Chapter 5 addresses the resulting dependence in the inference strategy. The data chapter's responsibility is only to record the unit cleanly and to log, for every row, the lineage to which it belongs, so that the dependence is visible in the data rather than hidden.

## 4.3 The dependent variable: binary landing outcome

The dependent variable is a binary landing outcome, \( \text{failure} \), coded one if the vehicle did not achieve a survivable surface placement enabling nominal post-landing operations, and zero otherwise. The construct the variable stands for is mission-ending EDL failure, the loss of the vehicle or of its primary surface function during the descent event. The operational definition turns on the phrase survivable surface placement enabling nominal post-landing operations, and the pre-registered coding rule resolves the partial-success cases that this phrase leaves open. The rule is: loss of the mission's primary surface function is coded as failure; a survivable landing with degraded but operable function is coded as success. The boundary case that defines the rule is the SLIM lunar lander, which achieved a pinpoint touchdown but came to rest in an anomalous attitude that compromised, but did not eliminate, its surface operation [\[109\]](#ref-109)[\[147\]](#ref-147). Under the rule, SLIM is coded as a success because it retained operable primary function despite the attitude anomaly, and this coding is then recoded in both directions in the sensitivity analysis so that the headline result cannot hinge on the treatment of a single ambiguous row.

The measurement reasoning here is that the outcome construct has a hard core and a soft boundary, and the design must be honest about both. The hard core is uncontroversial: a vehicle that struck the surface and was destroyed, or that lost contact during descent and never operated, is a failure, and a vehicle that landed intact and conducted its primary surface mission is a success. The Vikram lunar lander, lost during the landing phase and the subject of a formal investigation, is a clear failure [\[64\]](#ref-64); the InSight lander, which executed a near-replication of the Phoenix architecture and operated nominally, is a clear success [\[82\]](#ref-82)[\[65\]](#ref-65). The soft boundary is the set of attempts that landed survivably but degraded, and the pre-registered rule plus the two-way sensitivity recoding is the entire defense of the construct at that boundary. A second, subtler outcome-coding threat is that knowledge of the outcome can contaminate the heritage coding, since an analyst who knows an attempt failed may unconsciously score its architecture as more novel. The defense is sequencing: architecture is coded for heritage before outcome is coded, and outcome is coded blind to the heritage score, a protocol specified in Section 4.6 and carried into the analysis plan. Because reverse causation in element selection (novelty introduced precisely because heritage was inadequate) would attenuate any true heritage effect toward zero, the outcome construct's residual noise biases the test against H1 rather than toward it, which makes a rejection of H0 conservative. This is stated not as a convenience but as a property of the measurement that the later inference relies on.

## 4.4 The principal regressor: the EDL-heritage-reuse index
The principal regressor is the EDL-heritage-reuse index, a continuous variable on the closed interval from zero to one, and it is the treatment whose coefficient \( \beta_1 \) carries the entire contribution of the dissertation. Being the treatment makes it the most delicate construct in the design, so its construction is presented here as an explicit construct-validity argument rather than as a definition to be accepted.

### 4.4.1 Element decomposition

The architecture of each attempt is decomposed into a fixed set of six EDL functional elements: aeroshell and thermal protection; entry guidance; supersonic deceleration, whether by parachute or retropropulsion; terminal descent and propulsion; terminal guidance and hazard avoidance; and touchdown mechanism. This element set is fixed in advance and applied identically to every attempt, which is what allows architectures as different as the MSL sky-crane and a lunar powered-descent lander to be scored on a common frame. The decomposition is not arbitrary. It tracks the functional partition used in the EDL reconstruction and architecture literature, where these are the elements whose performance is separately reconstructed and separately traded [\[88\]](#ref-88)[\[74\]](#ref-74)[\[43\]](#ref-43). For bodies without a meaningful atmosphere, the aeroshell, entry-guidance, and supersonic-deceleration elements are coded as not-applicable rather than as missing, and the index weighting renormalizes over the applicable elements, so that an airless-body lander is scored fairly on the elements it actually has. This not-applicable handling is a coding rule, recorded in the rubric, not a discretionary judgment.

### 4.4.2 Element scoring against the proven regime

For each applicable element, a heritage score is assigned from two documented inputs: the TechPort technology-readiness history, which dates when the element reached flight-proven status and in what regime, and the NTRS lineage documentation, which establishes whether the present attempt's element is the same as, a modification of, or a departure from a previously flown element [\[2\]](#ref-2)[\[88\]](#ref-88)[\[48\]](#ref-48). The decisive feature of the scoring rule, carried verbatim from the bible, is that it is regime-aware. An element scores high only if it had been flown successfully in a comparable regime on a prior mission; it scores low if it is introduced for the first time **or if it is flown well outside the envelope in which it was proven**. This regime-aware rule is the measurement embodiment of a Mokyr proposition: an institution that over-weights heritage can fly a proven element outside its qualified regime, converting an apparent strength into a hidden hazard, so the index must not reward mere prior flight. A disk-gap-band parachute proven at one dynamic-pressure and Mach regime but deployed well outside that regime on a heavier vehicle is therefore scored low on the supersonic-deceleration element despite its nominal heritage, because the regime in which it was proven does not match the regime in which it is being used [\[46\]](#ref-46)[\[57\]](#ref-57). The forward architecture studies are the source for identifying when mass scaling pushes a heritage element outside its proven regime, since they quantify exactly where the flown envelope ends [\[43\]](#ref-43)[\[107\]](#ref-107)[\[5\]](#ref-5).

### 4.4.3 Aggregation and reconstruction-depth weighting

The index is the criticality-weighted mean of the applicable element scores, with the element weights fixed in advance and recorded in the rubric. The weights reflect the share of EDL risk concentrated in each element, informed by the reconstruction literature's accounting of where failures occur, and they are frozen before any model is fitted so that the index cannot be tuned to produce a desired coefficient. On top of the criticality weighting, the index is optionally weighted by the depth of post-flight reconstruction documented in NTRS for the heritage source of each element. This is the Mokyr propositional-knowledge weighting. Its rationale is that a prior flight that was instrumented and reconstructed in fine detail, such as those carrying the MEDLI and MEDLI2 suites, yields strong, codified, verifiable knowledge of the element's behavior, whereas a prior flight that flew but was poorly reconstructed yields weak propositional knowledge and should confer a smaller protective credit [\[71\]](#ref-71)[\[77\]](#ref-77)[\[105\]](#ref-105)[\[125\]](#ref-125). The reconstruction-depth weight is therefore a measured quantity, read from the existence and granularity of the reconstruction reports for each heritage source, not a subjective rating. Because the weighting is optional, the analysis reports the index both with and without it, so that any heritage effect can be attributed to the reconstruction-depth channel or shown to be independent of it.

The construct-validity case for the index can now be stated in full. The index validly measures architectural similarity to flown systems because it is built element-wise from documented readiness histories and lineage reconstructions, scored against the proven regime, and aggregated with frozen weights [\[2\]](#ref-2)[\[48\]](#ref-48)[\[82\]](#ref-82). A treatment variable assembled from named, retrievable inputs by a fixed rule is reproducible and therefore not a vehicle for analyst discretion, and the inter-coder reliability check on a random subsample together with the pre-registration of every weight and rule is what holds it to that standard. Confidence is moderate. The index is a proxy for an unobservable, and its validity is bounded by documentation depth and by the residual judgment in the regime-match assessment. The design concedes that the index may, despite every safeguard, partly capture program strength rather than architecture, because well-documented heritage tends to belong to strong programs. This is precisely why the program-strength control and the with-and-without sensitivity analysis are in the main specification, and why inseparability of the two indices is itself a pre-registered falsification condition.

## 4.5 Controls

Four controls enter the main specification, three physical and one program-level, and each is operationalized from a named source.

The first physical control is target body, a categorical variable taking the values Moon, Mars, and Titan. It absorbs the gross difficulty differences among an airless body dominated by powered descent, a thin-atmosphere body where aerothermal entry and supersonic deceleration matter but the atmosphere is too thin to do all the deceleration work, and the thick-atmosphere Titan case. Target body is read directly from the mission record and carries no measurement ambiguity. Its inclusion is essential because heritage and target are correlated in the record: the Mars near-replication chain is a high-heritage cluster at one body, and the recent lunar attempts include a novelty-heavy cluster at another, so without the target-body control a raw heritage-outcome correlation would partly reflect which body was being attempted rather than the architecture's heritage.

The second and third physical controls are entry mass and landed mass, both continuous, read from the mission record and the EDL reconstruction documentation. They absorb the well-documented scaling of EDL difficulty with mass, which is the entire motivation of the high-mass Mars architecture studies: as mass rises, flown heritage elements become inadequate and novel decelerators or retropropulsion become necessary [\[4\]](#ref-4)[\[43\]](#ref-43)[\[58\]](#ref-58)[\[57\]](#ref-57)[\[9\]](#ref-9). Mass is therefore both a difficulty control and the physical reason that heritage and novelty are not freely assignable: a heavier payload forces departures from heritage. Measuring mass cleanly matters because if mass were omitted, the index might absorb a mass effect, since novel elements cluster at high mass, and the heritage coefficient would be contaminated. The masses are recorded with their documented uncertainty where the reconstruction reports report it, and rows with poorly documented mass are flagged.

The fourth control is the program-strength index, the main-specification guard against the central confounder that heritage proxies for program strength. It is constructed from GAO cost-and-schedule performance data and from organizational flight experience, the latter operationalized as the depth of the institution's prior EDL flight record at the time of the attempt. Because GAO oversight is a U.S. instrument, the index is built to a coarse ordinal scale that can be populated for non-U.S. attempts from public organizational and flight-experience information, with the richer GAO inputs used where available. The deliberate coarseness is a measurement decision: a finely scaled program-strength index that could only be computed for U.S. attempts would be worse than a coarse one computable for all, because the control must be present on every row to do its confounding-adjustment job. The index construction is pre-registered in full so that it cannot be reverse-engineered to weaken or strengthen the heritage coefficient, and the main specification is reported both with and without it to bound the confounding it targets, as set out in Chapter 5. The honest limitation, restated here as a data-quality matter, is that an asymmetrically measured control is an imperfect control, and the design's response is transparency about the asymmetry plus the with-and-without bounding rather than a false claim of symmetry.

## 4.6 Measurement table

The following table fixes, for each variable, its construct, its operational definition, its source, and its scale. It is the consolidated operationalization that the rest of the dissertation refers back to; nothing in the analysis chapters may redefine a variable away from this table.

| Variable | Construct | Operational definition | Source | Scale |
|----------|-----------|------------------------|--------|-------|
| \( \text{failure} \) | Mission-ending EDL failure | 1 if the vehicle did not achieve a survivable surface placement enabling nominal post-landing operations; 0 otherwise; partial successes coded by the pre-registered rule (loss of primary surface function = failure; survivable-but-degraded = success), boundary cases recoded both ways | Global landing-attempt record cross-checked against agency reconstructions [\[94\]](#ref-94)[\[82\]](#ref-82)[\[64\]](#ref-64)[\[109\]](#ref-109) | Binary {0,1} |
| \( \text{heritage\_index} \) | Architectural similarity to flown EDL systems | Criticality-weighted mean of six element heritage scores, each scored high if flown successfully in a comparable regime on a prior mission and low if first-flight or flown outside its proven envelope; optionally weighted by NTRS reconstruction depth | TechPort TRL history + NTRS lineage reconstructions, organized by the NASA Technology Taxonomy [\[2\]](#ref-2)[\[48\]](#ref-48)[\[82\]](#ref-82)[\[71\]](#ref-71) | Continuous [0,1] |
| `target_body` | Gross EDL difficulty by body | Categorical body of the attempt | Mission record [\[88\]](#ref-88)[\[144\]](#ref-144)[\[31\]](#ref-31) | Categorical {Moon, Mars, Titan} |
| `entry_mass` | Entry-phase difficulty scaling | Vehicle mass at entry interface or powered-descent initiation, with documented uncertainty where reported | EDL reconstruction reports + mission record [\[48\]](#ref-48)[\[134\]](#ref-134)[\[4\]](#ref-4) | Continuous (kg) |
| `landed_mass` | Terminal-phase difficulty scaling | Delivered surface payload mass | EDL reconstruction reports + mission record [\[74\]](#ref-74)[\[57\]](#ref-57) | Continuous (kg) |
| `program_strength` | Program engineering reserve / maturity | Coarse ordinal index from GAO cost-and-schedule performance plus organizational EDL flight experience at the time of the attempt | GAO program-history archive + public organizational/flight-experience record | Ordinal index |
| `reconstruction_depth` (index weight) | Depth of codified propositional knowledge of a heritage element | Granularity of available NTRS post-flight reconstruction for the element's heritage source (e.g., instrumented MEDLI/MEDLI2 reconstruction vs. none) | NTRS reconstruction reports [\[71\]](#ref-71)[\[77\]](#ref-77)[\[105\]](#ref-105)[\[125\]](#ref-125) | Ordinal weight |
| lineage identifier (bookkeeping) | Architectural family of the attempt | The flown lineage to which the attempt's architecture belongs, recorded for dependence handling | Mission record + NTRS lineage docs [\[88\]](#ref-88)[\[48\]](#ref-48)[\[82\]](#ref-82) | Categorical (nominal) |

The table is the operational core of the chapter, and its discipline is that every cell names a real source and a defined scale. The reasoning that licenses the table is that a measurement is only as credible as its weakest source-and-scale pair, and the weakest pairs here, the heritage index and the program-strength control, are exactly the ones the chapter has spent the most space defending. The strongest pairs, target body and the masses, are low-ambiguity quantities read from the record, and their role is to absorb the physical confounders so that the contested heritage coefficient is estimated on a within-stratum contrast.

## 4.7 Data quality, validation against known values, and reliability

Data quality for a constructed, analyst-coded dataset of this kind cannot be asserted; it has to be demonstrated through a validation protocol, and the protocol has four components.

First, validation against known values. The heritage index and the outcome variable can be checked against cases whose classification is not in serious dispute, which functions as a face-validity test on known values. The InSight attempt, a near-direct reuse of the Phoenix EDL architecture, must score high on the heritage index and must be coded a success; if the rubric produced any other result on InSight, the rubric would be wrong [\[82\]](#ref-82)[\[65\]](#ref-65)[\[48\]](#ref-48). A first-flight commercial lunar lander with novel propulsion and guidance must score low on the heritage index, and the Vikram loss must be coded a failure [\[64\]](#ref-64). The Mars 2020 attempt, an incremental-novelty case that reused the MSL sky-crane lineage with bounded additions such as terrain-relative navigation, must score in the upper-middle of the index, neither at the InSight ceiling nor near the novel floor, and must be coded a success [\[74\]](#ref-74)[\[77\]](#ref-77). These anchor cases are validated first, before the contested middle of the distribution is coded, so that any systematic miscalibration of the rubric is caught against known values rather than discovered after the fact.

Second, inter-coder reliability. A second coder independently codes a random subsample of attempts for the heritage index, blind to the first coder's scores, and the agreement is quantified. The reliability target and the treatment of disagreements are pre-registered. The methodological precedent for treating coding reliability as a measurable, correctable property of the dataset, rather than as an unexamined assumption, is the broader statistical literature on bias correction and stability in classification and logistic settings, which establishes that small-sample and rare-event coding requires explicit reliability accounting [\[3\]](#ref-3)[\[19\]](#ref-19). Where the two coders diverge, the rows are adjudicated against the documentation and the divergence is logged; rows that cannot be reconciled because the documentation is genuinely thin are flagged as low-documentation rows.

Third, the low-documentation flag and its sensitivity test. Every row whose heritage coding rests on thin documentation, typically a non-U.S. or early attempt without an open reconstruction report, is flagged at coding time. The analysis is then run both on the full frame and with the low-documentation rows excluded, and the heritage coefficient is reported for both. If the coefficient is stable across this exclusion, the documentation asymmetry is shown not to drive the result; if it is not stable, the design reports the instability rather than suppressing it. This directly addresses the most serious data-quality threat identified in Section 4.1, the documentation asymmetry that favors U.S. attempts.

Fourth, the audit log. Every coding decision, the element scores, the regime-match judgments, the reconstruction-depth weights, the outcome codings, and the program-strength inputs, is recorded with its source citation in a retained coding log, so that the entire dataset is reconstructible from the rules plus the named sources by a third party. This is the reproducibility commitment that makes the measurement falsifiable in practice and not merely in principle. The convergence of these four components, validation against anchor cases, inter-coder agreement, the low-documentation sensitivity test, and the audit log, is the evidence that the dataset measures what it claims to. The confidence this warrants is moderate, appropriate to a design-stage measurement plan: the protocol is specified and defensible, but it has not yet been executed on the full frame, so the reliability statistics that would raise confidence to high do not yet exist. What would raise confidence is an executed inter-coder check yielding high agreement and anchor-case validations that pass; what would lower it is anchor cases that the rubric miscodes or inter-coder agreement that is poor on the contested middle of the heritage distribution.

## 4.8 Coverage, the four limitations, and ethics and access

### 4.8.1 Coverage and the four limitations
Coverage spans the documented Mars, Moon, and Titan landing attempts from the earliest reconstructed events through 2026, and four limitations follow directly from the data, each carried forward from the prospectus and elaborated here as a measurement matter.

The first is the small frame. The total number of qualifying attempts is on the order of several dozen, with Mars and the Moon contributing most rows and Titan contributing a single row in Huygens [\[131\]](#ref-131)[\[101\]](#ref-101). This is a coverage fact, not a coding bias, and its consequence is limited statistical power, which is why the design commits in advance to a low-parameter specification and to small-sample inference, both deferred to Chapter 5. The data chapter's responsibility is to be honest that the frame is small and to resist any temptation to inflate it by relaxing the inclusion rules.

The second is documentation asymmetry. As established in Section 4.1, U.S. and European attempts are far better reconstructed than several others, which can bias the heritage index where lineage is poorly documented. The response is the low-documentation flag and the exclusion sensitivity test of Section 4.7, together with the regime-aware scoring rule that forces conservative scores where evidence is thin.

The third is analyst-coded construct risk. Both the treatment, the heritage index, and the outcome are coded by the analyst from documents, which introduces the construct and contamination risks addressed by the pre-registered rules, the blind sequencing of outcome after architecture, and the inter-coder check. The design does not pretend these are eliminated. It bounds them and makes them auditable.

The fourth is the Titan single row. Titan contributes one attempt, which adds essentially nothing to statistical power and which the design retains for external-validity probing rather than for estimation. A heritage effect estimated almost entirely on Mars and the Moon may not generalize to a chemically and dynamically different target, and the single Titan row tests, but cannot establish, that generalization [\[131\]](#ref-131)[\[101\]](#ref-101). The honest framing is that the contribution's external claim is bounded to the three named bodies in the documented mass range, and that the Titan row is a probe, not a proof.

### 4.8.2 Ethics and access

The ethics posture of this study is straightforward because the data are exclusively about machines and programs, not about human subjects. There are no individuals, no personal data, and no protected populations, so there is no human-subjects ethical exposure. The relevant obligations concern provenance, attribution, and the responsible interpretation of failure. On provenance and access, all four data sources are public: the NTRS reconstruction reports are openly retrievable through the NTRS API and web interface; the landing-attempt catalog and the mission overviews are published; TechPort is a public portal; and the GAO archive is a public-record repository. No proprietary, export-controlled, or access-restricted data are used, and the coding log cites a retrievable source for every value, so the dataset can be independently reconstructed without privileged access. This is both an ethics commitment and a reproducibility commitment, and it is one reason the design deliberately avoids any input that would require non-public access.

On the responsible interpretation of failure, the study codes landing failures that are, in several cases, the subject of formal national investigations and of substantial institutional and financial loss [\[64\]](#ref-64)[\[50\]](#ref-50). The obligation here is to treat those outcomes as data points in a structured comparison, not as occasions for blame attribution to particular teams or nations, and to be scrupulous that the documentation-asymmetry bias does not silently become a bias against the programs that happen to be less openly documented. The design's commitment to coarse, all-rows controls and to reporting low-documentation sensitivity is partly an ethical safeguard against an unfair implicit ranking of programs, not only a statistical one. The design-stage honesty that governs the whole dissertation is itself an ethical stance toward the reader: the chapter has specified a measurement apparatus and a validation protocol, but it has not executed them on the full frame, and it says so, so that no reader mistakes a specified plan for a completed measurement.

## 4.9 Carrying the measurement into the design

The measurement apparatus specified here is the input to everything that follows, and it is worth closing by stating exactly what it hands to the next chapter. It hands a dataset whose unit is the landing attempt, whose dependent variable is a binary outcome coded by a pre-registered rule, whose treatment is a document-grounded, regime-aware, reconstruction-weighted heritage index, and whose controls are three clean physical variables plus one deliberately coarse program-strength index, all assembled from four named public sources with a retained audit log. The chapter has argued that this apparatus is reproducible, that its weakest constructs are the ones it has defended most carefully, and that its known biases, chiefly documentation asymmetry and the small Titan-thin frame, are bounded by named sensitivity tests rather than ignored.

Two of the dissertation's central commitments are now supported at moderate confidence. The dataset measures the causal mechanism the dissertation claims to test, because the heritage index is constructed to capture exactly the propositional-knowledge-and-proven-regime channel that the mechanism specifies, and the residual measurement risk is acceptable because every threat is named, pre-registered, and bounded. What the chapter cannot yet deliver, and does not claim to, is an executed reliability statistic or a fitted coefficient; those belong to the analysis plan. The measurement is the foundation on which the estimator in Chapter 5 is built, and a foundation is judged by whether it can bear the weight placed on it, not by whether the building is finished. On that standard the apparatus is sound: the heritage index is the right kind of variable, measured the right way, from the right sources, with its uncertainty honestly carried forward.


# Chapter 5: Research Design and Identification

## 5.0 The chapter's answer

This chapter's answer is that a single, pre-registered, Firth-penalized logistic hazard model, estimating the conditional coefficient \( \beta_1 \) on a constructed EDL-heritage-reuse index against a stratified population of Moon, Mars, and Titan landing attempts, is the correct and defensible instrument for the dissertation's falsifiable contribution, and that its principal weaknesses, the small frame and the program-strength confounder, are bounded rather than fatal. The design is not chosen for elegance. It is chosen because each of its parts answers a specific threat that a simpler choice would leave open: the logistic link because the outcome is a one-shot binary event and not a duration; the Firth penalization because a frame of several dozen attempts with rare-event structure produces small-sample bias and quasi-separation that ordinary maximum likelihood mishandles; the conditioning on physical and program-strength controls because that conditioning is the operationalized form of Fogel's counterfactual contrast; and the complementary-log-log link, the low-documentation exclusions, the boundary recodes, and the Mokyr novelty decomposition because a single specification on a small frame can always be an artifact, and only a pre-registered robustness battery distinguishes a real coefficient from a lucky one.

The current state of EDL portfolio reasoning is that the heritage-versus-novelty trade is decided on an engineering intuition tested against curated mission anecdotes, with no conditional estimate and no explicit counterfactual. The desired state is a reproducible, confounding-adjusted estimate of whether and how much heritage reuse changes landing-failure probability, with honest uncertainty attached. The gap is that no estimator has been specified, written down in advance, and matched to the peculiar features of this frame: a binary one-shot outcome, a few dozen rows, a documentation asymmetry across spacefaring programs, and a treatment variable that is itself analyst-coded. Leaving the gap open means that any number produced after the fact would be unfalsifiable, because the analyst could have searched over links, controls, and coding rules until the heritage coefficient turned the desired sign. This chapter closes the gap by fixing the estimator, the identifying assumptions, the threats and their mitigations, the robustness set, the power computation, and the pre-registration commitment, all before a single coefficient is fitted. Everything that follows is design-stage. No \( \beta_1 \) is estimated on the full population anywhere in this dissertation, and every numerical value used to illustrate the reporting format is labeled as illustrative and not as a finding.

The estimating equation carried from the bible, used unchanged everywhere in this chapter, is

\[ \operatorname{logit} \Pr(\text{failure}_i = 1) = \beta_0 + \beta_1 \, \text{heritage\_index}_i + \boldsymbol{\gamma}' \mathbf{controls}_i + \epsilon_i \qquad\qquad (1) \]

for landing attempt `i`, where \( \mathbf{controls}_i \) contains the target-body indicators, `entry_mass`, `landed_mass`, and `program_strength`. The contribution lives entirely in \( \beta_1 \). H1 predicts \( \beta_1 < 0 \) and statistically distinguishable from zero; H0 predicts \( \beta_1 = 0 \). The decision rule, also fixed, rejects H0 for H1 if and only if the estimated \( \beta_1 \) is below zero, its exact or permutation 95% interval excludes zero in the primary specification, and the sign is stable across the pre-registered robustness set.

## 5.1 The estimator: a discrete-outcome logistic hazard and why it dominates the alternatives

The logistic regression of the binary landing-failure indicator on the heritage index and controls is the natural and the best estimator for the contribution, and it dominates the two families a reader might otherwise propose, a continuous mean-based model and a satellite-longevity survival model, for reasons intrinsic to the structure of a landing attempt rather than reasons of convenience.

The reasoning is structural. A planetary landing attempt is a single, irreversible, terminal trial. The vehicle commits to an entry, descent, and landing sequence intended to place a payload on the surface, and within minutes the trial resolves into one of two states: a survivable surface placement enabling nominal post-landing operations, or its absence. There is no repeated draw, no continuous accumulation of operating time, and no second attempt by the same vehicle. The outcome is, by the bible's definition, a binary indicator \( \text{failure} \), equal to one when the primary surface function is lost and zero otherwise. The probability of interest is therefore `Pr(\( \text{failure}_i \) = 1)` conditional on the covariates, and the canonical model for a conditional probability of a binary one-shot event is the logistic regression. The logit link maps the linear predictor `\( \beta_0 \) + \( \beta_1 \) * \( \text{heritage\_index}_i \) + gamma' * \( \mathbf{controls}_i \)` to the unit interval and yields coefficients interpretable as log-odds shifts, so that \( \beta_1 \) reads directly as the change in the log-odds of landing failure per unit change in the heritage index, holding the controls fixed.

What connects this structure to the logistic choice is that the discrete-outcome literature in spacecraft reliability has already validated logistic and discrete-hazard treatments of exactly this kind of binary event. Population-level reliability analyses of deep-space and deployable spacecraft estimate failure distributions across launch cohorts and treat the success-or-failure of a subsystem as a discrete event amenable to logistic and hazard modeling [\[127\]](#ref-127). Failure-prediction work from satellite telemetry establishes that discrete-outcome and time-to-failure modeling are accepted, published tools in the domain rather than an importation from an alien field [\[117\]](#ref-117). Beneath that precedent lies the broader econometric standing of the logistic model as the default for binary response, a standing so settled that the methodological debate in the relevant literature is not whether to use logistic regression for rare binary outcomes but how to correct its small-sample bias, which is the subject of Section 5.2 [\[52\]](#ref-52)[\[68\]](#ref-68)[\[112\]](#ref-112).

One assumption must be defended rather than assumed: the logistic model treats each landing attempt as an independent draw conditional on the covariates. Two attempts by the same program in the same lineage, such as InSight reusing the Phoenix architecture, are not independent in their architectures; that dependence is precisely what the heritage index is built to capture, so it enters the model as signal in the regressor rather than as a nuisance correlation in the errors. A residual concern is temporal or programmatic clustering of the errors, addressed in the robustness battery through a sensitivity check that clusters by program lineage. The objection a reader might raise, that landing attempts are too heterogeneous to pool into one logistic model, is answered by the controls: target body absorbs the gross airless-versus-thin-versus-thick-atmosphere difficulty, and entry and landed mass absorb the documented scaling of EDL difficulty with mass, so the pooling is conditional pooling within physically comparable strata, not naive pooling across incomparable events.

Against the first alternative, a continuous mean-based model, the objection is decisive: there is no continuous landing-success magnitude to regress. A landing either places a functioning payload on the surface or it does not. Forcing a continuous outcome, for example a graded landing-quality score, would manufacture a dependent variable that the historical record does not supply at the needed resolution and would introduce a fresh construct-validity problem larger than the one it solved. The binary outcome is the variable the population frame actually contains, coded under the pre-registered partial-success rule that handles the genuinely intermediate cases such as the SLIM anomalous-attitude touchdown [\[109\]](#ref-109).

Against the second alternative, a satellite-longevity survival model, the objection is that the survival literature it would borrow from models the wrong quantity. Satellite-longevity and reliability survival models estimate time-to-failure of an operating system accumulating service life on orbit [\[127\]](#ref-127)[\[117\]](#ref-117). A landing attempt accumulates no service life; it is resolved at a single instant. Time-to-failure of a continuously operating asset and success-or-failure of a one-shot terminal event are different estimands, and importing a duration model would impose a hazard-over-time structure that the data do not have. The one legitimate borrowing from the duration tradition is the discrete-time complementary-log-log hazard, retained not as the primary estimator but as a link-robustness check in Section 5.4, precisely because it lets the design confirm that the headline conclusion is not an artifact of the logit link rather than because the event has any genuine duration.
A subtlety in the estimator's interpretation deserves explicit treatment, because the contribution is a single coefficient and the way that coefficient is read into a portfolio-relevant quantity matters. The logit coefficient \( \beta_1 \) is a log-odds shift. That is the natural scale for estimation and inference, but it is not the scale on which an EDL portfolio decision is taken. A program does not weigh log-odds; it weighs the change in landing-failure probability that a heritage decision implies. The design therefore reports \( \beta_1 \) on three scales: the raw log-odds coefficient with its exact or permutation interval, the corresponding odds ratio for a readership accustomed to that summary, and, as the decision-relevant quantity, the average marginal effect, the change in modeled failure probability across the interquartile range of the heritage index evaluated at the covariate values actually present in the frame rather than at an artificial average vehicle. The interquartile-range framing is chosen over a one-unit change because the heritage index is bounded in the unit interval, and a one-unit change spans the entire range from a wholly novel to a wholly heritage architecture, a contrast no real attempt realizes; the interquartile contrast is between attempts that actually exist in the record. Because the Firth penalty shifts predicted probabilities toward one-half, the marginal-effect computation uses the intercept-corrected predictions discussed in Section 5.2 rather than the raw penalized predictions, so the reported probability change is not artificially compressed [\[52\]](#ref-52). This three-scale reporting is the operational form of the bible's stipulation that the contribution is the measurement: a fitted, sign-and-significance-decided coefficient together with the implied change in failure probability across the index's interquartile range.

The one-shot-event interpretation also fixes how the model's quantities are described, and the design uses the language the structure licenses. The model estimates a conditional failure probability for a single trial, so its output is read as the probability that a given vehicle, with a given architecture at a given target and mass and program strength, is lost during its EDL event. It is not a rate per unit time, not a frequency over repeated attempts by the same vehicle, and not a population mean of a continuous quantity. Calling the model a hazard is therefore a deliberate but bounded usage: it is a hazard in the discrete-outcome sense of the probability of a terminal event conditional on covariates, the sense in which the spacecraft-reliability literature uses discrete-outcome and time-to-failure models interchangeably for one-shot and accumulating events [\[127\]](#ref-127)[\[117\]](#ref-117), and not a hazard in the continuous-time sense of an instantaneous rate. Holding this distinction precisely is what keeps the complementary-log-log link in Section 5.4 a link-robustness check rather than a claim that the landing event has a duration.

Confidence in this estimator choice is high. It rests on structural features of a landing attempt that are not in dispute and on a published precedent for discrete-outcome modeling of spacecraft events, and the two rival families fail on the estimand rather than on tuning. The evidence that would lower this confidence would be a demonstration that landing attempts carry a meaningful continuous success magnitude the binary coding discards, or that the events are so serially dependent that the conditional-independence assumption collapses even after conditioning. The boundary-case recoding and the program-clustering sensitivity check are the instruments that would surface either problem.

## 5.2 Small-sample inference: Firth bias reduction, quasi-separation, and exact or permutation tests

Ordinary maximum-likelihood logistic regression is not safe on this frame; Firth's bias-reduced penalized likelihood is the right primary estimator; and inference on \( \beta_1 \) must be exact or permutation-based rather than asymptotic, because the frame is small, the failure events are relatively rare, and quasi-separation is a live possibility.

Three properties of the population frame, established in the data chapter and the prospectus, drive these choices. First, the frame is intrinsically small: the total number of documented Moon, Mars, and Titan landing attempts is on the order of several dozen, with Mars and the Moon contributing most rows and Titan contributing one [\[94\]](#ref-94). Second, the outcome is a rare-event structure in the technical sense that one of the two classes is sparse within strata, because successful landings dominate some target-mass cells while failures dominate others, so the events-per-variable ratio is low. Third, quasi-separation is plausible: if, for example, every very-low-heritage attempt at a given target failed and every very-high-heritage attempt succeeded within a stratum, the maximum-likelihood estimate of \( \beta_1 \) would diverge toward infinity and the standard error would explode, producing an uninformative or undefined estimate.

What connects these properties to the Firth choice is the penalized-likelihood literature, developed for exactly this combination of small samples, rare events, and separation. Firth's bias-reduced logistic regression penalizes the likelihood by the Jeffreys invariant prior, which removes the first-order small-sample bias of the maximum-likelihood estimator and, as a structural by-product, guarantees finite estimates even under complete or quasi-complete separation [\[68\]](#ref-68). The convergence properties are not a heuristic claim. Puhr and colleagues show in a controlled study that Firth's method with rare events produces accurate effect estimates and predictions where ordinary logistic regression is biased, and they characterize when the accuracy holds and when it needs the further correction of intercept recalibration [\[52\]](#ref-52). Rahman and Sultana compare Firth-type and logF-type penalized methods for risk prediction on small or sparse binary data and find the penalized estimators outperform ordinary maximum likelihood in precisely the small-or-sparse regime this frame occupies [\[112\]](#ref-112). A simulation comparison of maximum likelihood, Firth, and ridge methods reports that Firth improves bias, calibration, and stability relative to unpenalized maximum likelihood in the small-sample setting, which is the triple of properties the design needs from its primary estimator [\[19\]](#ref-19). Shen and Gao show that penalized logistic regression resolves both separation and multicollinearity in multiple logistic regression, which matters here because the design must guard against the heritage index and the program-strength index being collinear [\[8\]](#ref-8).

This choice is reinforced by the maturity and reproducibility of the tooling. Firth penalization is implemented in stable, peer-reviewed software across the statistical ecosystem: the `logistf` package documents the bias-reduced estimator and its profile-penalized confidence intervals [\[68\]](#ref-68); the `brglm2` package provides bias reduction in generalized linear models through a general adjusted-score-function framework that subsumes the Firth correction [\[21\]](#ref-21); and a Stata module implements the same bias reduction for users in that ecosystem [\[53\]](#ref-53). The existence of independent, validated implementations in at least three software families means the primary estimate is reproducible by any reviewer and does not depend on a bespoke routine the candidate alone can run. Recent methodological work continues to refine the penalization, including conjugate-prior reformulations of bias reduction for logistic models [\[29\]](#ref-29) and applications of Firth penalization to demanding small-sample detection problems such as differential item functioning, which establishes that the method performs in settings even more adverse than this one [\[146\]](#ref-146)[\[3\]](#ref-3).

One caveat is stated rather than hidden. Firth penalization corrects the point estimate's bias and tames separation, but the penalty shifts predicted probabilities toward one-half, so when the design reports an implied failure probability across the interquartile range of the heritage index it will use the intercept-corrected predictions that Puhr and colleagues recommend rather than the raw penalized predictions, to avoid overstating the failure probability of low-heritage attempts and understating that of high-heritage attempts [\[52\]](#ref-52). A further caveat is that the penalty is informative under the Jeffreys prior, so the design reports the penalized estimate as what it is, a regularized estimate, and does not pretend it is the unpenalized maximum-likelihood estimate the frame cannot support.

Inference on \( \beta_1 \) is the second half of this section's argument. Because the frame is small and the events are sparse, the asymptotic Wald and likelihood-ratio intervals that logistic regression usually reports are not trustworthy: their nominal coverage degrades when the sample is small and the outcome is rare. The design therefore commits in advance to exact or permutation-based inference on the heritage coefficient. The penalized profile-likelihood confidence interval that `logistf` produces is the default reported interval because it is the natural companion to the Firth point estimate and behaves well under separation [\[68\]](#ref-68). As a check that does not rely on any parametric link, the design also reports a permutation test of \( \beta_1 \): the heritage-index labels are permuted across attempts within target-body strata a large number of times, the penalized model is refit on each permutation, and the observed coefficient is compared to the permutation null distribution to obtain an exact p-value that requires no asymptotic approximation. The permutation is stratified by target body so that it respects the conditioning structure of the identification and does not destroy the within-stratum contrast that carries the causal interpretation. The decision rule's reference to an exact or permutation 95% interval is satisfied by whichever of the penalized profile interval or the permutation-derived interval is the more conservative, and both are reported.

Confidence in the inference plan is high. It rests on the documented small-sample and separation behavior of ordinary logistic regression, on a deep and convergent penalized-likelihood literature spanning bias correction, calibration, and separation, and on reproducible tooling in three software families. The evidence that would lower confidence would be a realized frame so small or so completely separated that even the penalized estimate is unstable, which the pre-analysis separation diagnostics in Section 5.6 are designed to detect before the headline model is interpreted.

## 5.3 Identification: what \( \beta_1 \) is identified off, and the Fogelian counterfactual made operational

\( \beta_1 \) is identified off the within-stratum contrast between higher-heritage and lower-heritage attempts at the same target body, similar mass, and similar program strength, and this conditioning is the operationalized form of Fogel's counterfactual rather than a generic regression adjustment. The identification is partial in Fogel's exact sense, and the design states the boundary of what it can and cannot claim.

The controls are what make the identification possible. Identification rests on conditional comparison: among attempts that share a target body and lie near each other in entry and landed mass, do those with higher documented heritage reuse fail less often, after the program-strength index is held fixed? The physical controls remove the most obvious confounders. Target body absorbs the gross difficulty gap between an airless body, a thin-atmosphere body, and a thick-atmosphere body, a gap so large that an unconditioned comparison of lunar and Martian attempts would conflate heritage with target difficulty. Entry and landed mass absorb the scaling of EDL difficulty with mass that is the entire motivation for the high-mass and human-class architecture studies [\[58\]](#ref-58)[\[60\]](#ref-60). The program-strength index, built from GAO cost-and-schedule data and organizational flight experience, removes the most dangerous confounder, the possibility that well-funded and experienced programs both reuse heritage and execute better for reasons independent of the architecture.

What connects the conditioning to a counterfactual interpretation is Fogel's cliometric rule. Fogel's program rests on the discipline that an innovation's value is defined only relative to the next-best substitute, so that to measure the value of a technology you must specify and quantify the world without it rather than merely observe the world with it [\[121\]](#ref-121). The social-savings tradition that grew from this rule formalizes the counterfactual as the explicit comparison between the observed system and a constructed alternative that does the same job by the next-best means [\[133\]](#ref-133). Applied here, the rule says the question is not whether heritage-reuse missions succeed, which they mostly do, but whether they succeed more than the same mission would have under the next-best counterfactual, which is that mission carried out with a novel architecture at the same target and mass. The conditioning in the logistic model is the apparatus that estimates that counterfactual difference: \( \beta_1 \) estimates the change in failure probability that would occur if a given attempt's heritage index were lowered toward the novel end while target, mass, and program strength were held fixed. The within-stratum contrast is the Fogelian counterfactual made operational, not a metaphor for it.

This is the same logic the dissertation's theoretical chapter develops as the bridge between cliometric method and the EDL record, and the social-savings literature has applied the same partial-counterfactual reasoning across decades of econometric history [\[121\]](#ref-121)[\[133\]](#ref-133). The estimate is a partial counterfactual: it omits general-equilibrium effects, in particular the possibility that the availability of heritage changes which missions are attempted at all. If heritage availability induces programs to attempt missions they would otherwise have deferred, the population frame is itself shaped by heritage in a way the within-stratum contrast does not capture, and \( \beta_1 \) would estimate the conditional failure-probability difference without the induced-attempt channel. The design is candid that it does not capture this channel and flags it as a boundary of the contribution rather than papering over it.

Two further features sharpen the identification. The first is the direction of the reverse-causation bias. Novel EDL elements are sometimes introduced not because novelty is desirable but because the heritage element was known to be inadequate for the new target or mass [\[58\]](#ref-58)[\[60\]](#ref-60). When this happens, the most demanding missions carry the most novelty, which pushes high-novelty attempts toward failure for reasons of mission difficulty rather than novelty per se, and the mass controls absorb the measurable part. The residual effect of this selection is to attenuate \( \beta_1 \) toward zero, because some of the heritage that protects is being reused on easier missions while some of the novelty that appears to harm is being forced onto harder ones. This biases against H1, which means a rejection of H0 under this bias is conservative: if the design finds a negative and significant \( \beta_1 \) despite a selection mechanism that pushes the estimate toward zero, the true protective effect is at least as large as the estimate. Stating the bias direction in advance converts a potential weakness into an interpretive strength.

The second feature is the Mokyr decomposition's role in identification. The novelty captured in the heritage index is split into propositionally grounded novelty, elements with extensive analytical and ground-test maturation, and ungrounded novelty, elements flown first with thin analytical backing [\[139\]](#ref-139). Supersonic retropropulsion is the exemplar of grounded novelty, matured through documented wind-tunnel and computational campaigns before any flight use, and is the natural test case for the decomposition [\[36\]](#ref-36)[\[135\]](#ref-135)[\[9\]](#ref-9)[\[66\]](#ref-66). If the heritage effect operates through codified knowledge rather than through the mere age of the hardware, the excess risk should load on ungrounded novelty and grounded novelty should carry a smaller risk premium. This is a testable sub-implication that strengthens or weakens the causal interpretation without changing the headline hypothesis: a finding that grounded and ungrounded novelty carry equal excess risk would be consistent with H1 but would weaken the knowledge-codification reading, while a finding that the excess risk concentrates on ungrounded novelty would corroborate the mechanism the theory names.

Confidence in the identification is moderate, and the modality is calibrated to that grade deliberately. The conditioning and its counterfactual rationale are strong, but identification in an observational frame of several dozen rows cannot reach the confidence of a randomized design, and the partial-counterfactual caveat and the unobserved-difficulty residual are genuine limits. The evidence that would raise confidence is a stable \( \beta_1 \) that survives the with-and-without-program-strength bounding in Section 5.4 with little movement, indicating the confounder is not driving the result; the evidence that would lower it is a \( \beta_1 \) that collapses toward zero when the program-strength control enters, which the design commits to reporting as a confounded and therefore decision-relevant result rather than burying.

## 5.4 The robustness battery

The headline coefficient is credible only if its sign survives a pre-registered battery of robustness analyses, five substantive specifications plus a calendar-time control and an influence-and-clustering safeguard, each targeting a specific way the primary specification could be an artifact, and the battery is reported in full regardless of whether it strengthens or weakens H1. A contribution that survives only the primary specification but collapses across the battery is reported as fragile, not as confirmed. The battery is fixed before any model is fitted, so it cannot be a post hoc search for a specification that rescues the result.

Each member of the battery answers a distinct threat. The first is the link-robustness check. The primary estimator uses the logit link, and a reader could object that the conclusion is an artifact of that link's symmetric shape. The design refits the model with a discrete-time complementary-log-log link, an asymmetric link standard in discrete-hazard analysis, and confirms that the sign and approximate magnitude of the heritage effect persist [\[127\]](#ref-127)[\[117\]](#ref-117). If the conclusion held under logit but reversed under \( \operatorname{cloglog} \), the design would report the result as link-sensitive and downgrade confidence accordingly.

The second member is the low-documentation exclusion. The heritage index is coded from documents, and some attempts, particularly non-U.S. and non-European ones, are far less thoroughly reconstructed than the Mars near-replication chain, so their heritage coding carries more uncertainty [\[94\]](#ref-94). The design flags every low-documentation row in advance and refits the model with those rows excluded, reporting whether the heritage coefficient is robust to dropping the attempts whose treatment values are least certain. A coefficient that holds only when uncertainly-coded rows are included is reported as documentation-dependent.

The third member is the boundary recoding of partial successes. The pre-registered outcome rule codes loss of the primary surface function as failure and a survivable landing with degraded-but-operable function as success, but genuinely intermediate cases exist, of which the SLIM anomalous-attitude touchdown is the explicit exemplar [\[109\]](#ref-109). The design refits the model with each boundary case recoded in both directions and reports whether the heritage coefficient is sensitive to the coding of the handful of intermediate outcomes. Because boundary cases are few, a coefficient that flips on a single recode would signal that the result is being carried by one ambiguous row, which the design must surface.

The fourth member is the with-and-without program-strength bounding, the most consequential robustness analysis because it directly addresses the central confounder. The design reports \( \beta_1 \) from the primary specification that includes the program-strength control and from an otherwise identical specification that omits it. The pattern is diagnostic: if \( \beta_1 \) is stable across the two, the heritage effect is not being driven by program strength; if \( \beta_1 \) is large and negative without the control but collapses toward zero with it, the apparent heritage effect is largely confounded by program strength, which is itself a decision-relevant finding that the design commits to reporting with equal prominence rather than discarding [\[8\]](#ref-8). This bounding is the empirical content of the identification argument in Section 5.3.
The fifth member is the Mokyr novelty decomposition described in Section 5.3, refit as a robustness analysis that splits the heritage index's novelty term into grounded and ungrounded components and reports whether the excess risk loads on ungrounded novelty as the knowledge-codification mechanism predicts [\[139\]](#ref-139)[\[36\]](#ref-36)[\[135\]](#ref-135)[\[66\]](#ref-66). This member does not test H1 directly; it tests the mechanism the theory attributes to a confirmed H1, and its result reframes rather than refutes the contribution.

A sixth member is the calendar-time and launch-cohort control. The landing-attempt record spans roughly six decades, and the broader spacecraft-reliability literature documents that technology generations, quality-assurance norms, and component availability all shift across launch cohorts in ways that correlate with both heritage availability and failure rates [\[40\]](#ref-40). An agency that has executed planetary landings for longer has by definition accumulated more heritage to reuse, so any secular improvement in success rates across cohorts could masquerade as a heritage effect in an uncontrolled pooled regression. The design addresses this threat by augmenting the primary specification with a continuous calendar-year covariate for the date of each attempt, and separately by replacing that continuous trend with a categorical variable distinguishing three program-generation epochs broadly consistent with the generation structure the spacecraft-reliability literature uses: the early robotic era through the mid-1990s, the decade of Mars Pathfinder through the Mars Exploration Rovers, and the period from Phoenix onward in which the current MSL sky-crane lineage and commercial lunar programs dominate [\[40\]](#ref-40). Both augmented specifications are pre-registered and run as sequential robustness checks. The design commits to reporting \( \beta_1 \) from each, alongside its primary-specification value, so that any movement in the heritage coefficient once the temporal trend or epoch indicators enter the model is made visible rather than absorbed silently into a specification chosen after the results were seen. A heritage coefficient that survives with comparable sign and approximate magnitude across the continuous-trend and epoch-categorical augmentations will be reported as temporally robust: the evidence will show that \( \beta_1 \) is not a disguised cohort trend but a within-generation contrast that holds when temporal confounding is accounted for. A heritage coefficient that collapses or reverses when the calendar-time control enters will be reported as temporally fragile, which is itself a decision-relevant finding because it would imply that the apparent heritage advantage tracks the secular maturation of EDL technology rather than the architectural choice to reuse a specific proven lineage.

A seventh member, an influence-and-clustering diagnostic, guards against two failure modes peculiar to a small frame. The first is that a single high-leverage attempt could be carrying the entire coefficient: on a few dozen rows, one unusual observation, for example the single Titan attempt or one anomalously-coded lunar lander, can move \( \beta_1 \) enough to flip a conclusion. The design therefore computes leave-one-out estimates, refitting the penalized model with each attempt deleted in turn and reporting the range of \( \beta_1 \) across the deletions, so that a coefficient driven by one row is exposed rather than presented as a population result. Standardized influence statistics flag the attempts whose deletion moves the estimate most, and those attempts are examined to confirm their coding is defensible rather than an error. The second failure mode is residual dependence among attempts from the same program lineage, the dependence the conditional-independence assumption of Section 5.1 sets aside. Because InSight reuses the Phoenix architecture and Mars 2020 reuses the MSL sky-crane lineage, attempts cluster by program in a way that could correlate their errors even after the heritage index captures their shared architecture. The design refits the model with errors clustered by program lineage and reports whether the inference on \( \beta_1 \) is sensitive to the clustering, treating a result that holds only under the independence assumption as dependence-sensitive. Neither diagnostic tests H1 directly; both test whether the headline estimate is a property of the population or an artifact of a single row or an unmodeled correlation, which is exactly the kind of fragility a small frame is prone to and a credible design must rule out [\[52\]](#ref-52)[\[19\]](#ref-19)[\[8\]](#ref-8).

What connects the battery to credibility is the standard logic of specification robustness in small-frame observational work: a real effect should be insensitive to defensible variations in link, sample, coding, and temporal conditioning, while an artifact should not. The members are not arbitrary; each maps to a named threat in the validity matrix of Section 5.5, so the battery is the validity matrix's empirical realization rather than a grab-bag of extra regressions. The calendar-time and launch-cohort member addresses the internal-validity threat that secular technological improvement across program generations could be disguised as a within-attempt heritage effect when the two are conflated in an uncontrolled pooled model. The battery cannot test threats that leave no variation to exploit, in particular an unobserved confounder uncorrelated with either program strength or the temporal trend, which the design must address by argument rather than by a robustness regression. The objection that the battery multiplies tests and invites a multiple-comparisons problem is answered by the structure of the decision rule: the rule requires sign stability across the battery rather than significance in each member, so the battery is a consistency check on a single pre-specified coefficient, not a search for significance across many.

The confidence that the battery is the right one is high, because each member is tied to a documented threat and the set is closed in advance. The evidence that would lower confidence is the discovery, during pre-analysis, of a threat the battery does not address, in which case the pre-registration permits a documented amendment with the addition flagged as such rather than presented as original.

## 5.5 Threats to validity: the four-way matrix and the design response to each

The design has identified and mitigated the threats to internal, external, construct, and statistical-conclusion validity; the residual risk after mitigation is acceptable for a design-stage contribution; and the threats are stated honestly with their mitigations attached rather than minimized. The four-way matrix is where the case for acceptable residual risk, the final link in the chapter's argument, is made in detail.

### 5.5.1 Internal validity

The dominant internal-validity threat is confounding by program strength: well-funded, experienced programs both reuse heritage and execute better, so an unconditioned heritage effect could be program strength in disguise. The mitigation is the program-strength index in the main specification and the with-and-without bounding in the robustness battery, which together estimate \( \beta_1 \) with the confounder held fixed and report how much the coefficient moves when the confounder is removed [\[8\]](#ref-8). The design does not claim to eliminate the confounder; it claims to bound it, and it commits to reporting a confounded result as such.

The second internal threat is secular technological confounding: success rates have improved across six decades of EDL practice as manufacturing tolerances, quality-assurance standards, and guidance software matured, and heritage availability has grown in step with that improvement, so an uncontrolled pooled regression could mistake a generational capability trend for a within-generation heritage advantage [\[40\]](#ref-40). The mitigation is the calendar-time and launch-cohort robustness check described in Section 5.4, which enters a continuous calendar-year covariate and, separately, categorical epoch indicators to absorb secular trends before the heritage coefficient is evaluated. The design commits to showing that \( \beta_1 \) survives these augmented specifications with comparable sign, so that the reported heritage effect reflects an architectural contrast rather than the passage of time.

The third internal threat is reverse causation in element selection: novelty is sometimes introduced because heritage was inadequate for the target, so novelty correlates with mission difficulty [\[58\]](#ref-58)[\[60\]](#ref-60). The mitigation is the mass controls, which absorb the measurable part of mission difficulty, and the explicit recognition that the residual bias attenuates \( \beta_1 \) toward zero and therefore makes any rejection of H0 conservative, as argued in Section 5.3.

The fourth internal threat is coding endogeneity: knowledge of an attempt's outcome could contaminate the heritage coding, so an analyst who knows a mission failed might unconsciously code its architecture as more novel. The mitigation is twofold. The heritage-index rules are pre-registered before any coding, so the index is computed from a fixed rubric rather than from whole-mission impression, and the architecture is coded blind to the outcome, with the outcome coded separately and joined only after both are fixed. An inter-coder reliability check on a random subsample, with a second coder applying the same rubric independently, quantifies the residual coding noise. The software-failure channel is relevant here because EDL novelty often resides in guidance and control software rather than in structures, and the literature on fatal software failures in spaceflight documents that novel or modified flight software carries a distinct failure mode the heritage coding must capture in the entry-guidance and terminal-guidance elements rather than only in the hardware elements [\[50\]](#ref-50).

### 5.5.2 External validity

The external-validity threat is that estimates dominated by Mars and the Moon may not generalize to Titan or to outer-planet entries. The mitigation is honest scoping rather than a statistical fix. The single Titan data point, Huygens, is retained precisely to probe generalization, and the design states that the contribution's external claim is bounded to landing attempts at the Moon, Mars, and Titan within the documented historical mass range. The Titan row tests, but cannot establish, generalization beyond Mars and the Moon, because a single observation cannot anchor an out-of-sample claim; it can only reveal a gross inconsistency if one exists. Generalization to crewed-class masses is out of scope, because no crewed landing attempts exist in the frame and the architecture studies warn that crewed-class EDL requires novel decelerators that have no flight heritage at all [\[58\]](#ref-58)[\[60\]](#ref-60). The comparison of autorotation and propulsive landing for planetary exploration illustrates that the architectural trade space extends to options outside the historical frame, which further bounds the external claim to the architectures actually flown [\[22\]](#ref-22).

### 5.5.3 Construct validity

The construct-validity threat is that the heritage index is a constructed proxy for an unobservable, the true architectural similarity of an attempt to flown systems, and that the proxy could measure something other than what it claims. The mitigation is the element-wise, document-based construction defended at length in the data chapter: the index decomposes each architecture into a fixed element set, scores each element from TechPort TRL history and NTRS lineage documentation against the regime in which it was proven, and weights the elements by the depth of reconstruction documented in NTRS, which is the Mokyr propositional-knowledge weighting [\[139\]](#ref-139)[\[2\]](#ref-2). Coding an element low when it is flown well outside its proven envelope, rather than high merely because it flew before, defends the construct against the most obvious failure, mistaking the presence of heritage hardware for the presence of proven reliability. The inter-coder reliability check on a subsample quantifies how much of the index is reproducible across coders and how much is analyst-specific noise [\[3\]](#ref-3)[\[19\]](#ref-19). The outcome construct is defended by the pre-registered partial-success rule and its boundary-recoding sensitivity analysis [\[109\]](#ref-109).

A second construct concern is that the program-strength index is itself a proxy, built from GAO cost-and-schedule data and organizational flight experience rather than from a direct measure of engineering rigor. The mitigation is to treat the program-strength index as a control whose only job is to absorb confounding variation, not as a quantity to be interpreted in its own right, so its construct need only be good enough to capture the program-strength channel that would otherwise contaminate \( \beta_1 \), a lower bar than an interpretable structural parameter would require.

### 5.5.4 Statistical-conclusion validity

The central statistical-conclusion threat is the small sample, which raises three distinct risks: small-sample bias in the point estimate, quasi-separation that breaks ordinary maximum likelihood, and low power that could produce a failure to reject H0 that is mistaken for a true null. The mitigations are the Firth penalization that corrects bias and tames separation, the exact or permutation inference that does not rely on asymptotics, the single pre-registered primary specification that prevents specification search, and, decisively, the minimum-detectable-effect computation of Section 5.6 that lets a failure to reject H0 be correctly interpreted as either a true null or insufficient power rather than conflating the two [\[52\]](#ref-52)[\[68\]](#ref-68)[\[112\]](#ref-112)[\[19\]](#ref-19). The design treats the distinction between a true null and an underpowered null as a first-class deliverable: reporting the minimum detectable effect alongside any null result is what keeps the failure to reject honest.

A second statistical-conclusion threat is specification search itself, the risk that an analyst tries many links, controls, and codings until the heritage coefficient turns significant. The mitigation is the pre-registration of a single primary specification, a fixed robustness battery, and a fixed decision rule, all written down before the model is fitted, which is the statistical analogue of Fogel's insistence that the counterfactual be specified explicitly rather than chosen to fit the conclusion [\[121\]](#ref-121).

The confidence that the residual risk is acceptable is moderate to high, and the modality is calibrated to the design stage. The internal, construct, and statistical-conclusion threats have concrete mitigations whose efficacy can be checked in pre-analysis; the external threat is bounded by honest scoping rather than removed; and the one threat the design cannot dispatch, an unobserved confounder uncorrelated with program strength, is acknowledged as the limit of an observational design. The evidence that would raise confidence is a stable coefficient across the with-and-without bounding and a clean inter-coder reliability result; the evidence that would lower it is heritage-program-strength collinearity severe enough that the two cannot be separately identified, which the bible names as a falsifying condition for the claim of independent heritage value.

## 5.6 Power and minimum-detectable-effect analysis, pre-registration, and the computational plan

### 5.6.1 Power and minimum detectable effect

The realized small frame, not the choice of estimator, governs the design's power, and the design therefore commits to computing and reporting the minimum detectable effect so that a null result is interpretable rather than ambiguous. The honest posture is that power is the binding constraint of this study, and the design is built to report that constraint transparently rather than to obscure it.

This follows from the frame's size and event structure. With a population on the order of several dozen attempts and a sparse failure count within strata, the events-per-variable ratio is low, and the precision of \( \beta_1 \) is bounded by the number of failure events rather than by the total number of attempts [\[94\]](#ref-94). Logistic-regression power depends in a well-established way on the number of events and the effect size: for a fixed number of events, only effects above a threshold magnitude can be detected at conventional significance, and that threshold is the minimum detectable effect. The design computes the minimum detectable effect by simulation under the realized frame: holding the covariate distribution and event count fixed at their assembled values, it simulates outcomes under a range of true \( \beta_1 \) values, refits the Firth-penalized model with permutation inference on each simulated dataset, and records the smallest true \( \beta_1 \) whose 95% interval excludes zero in a pre-specified majority of simulations. The penalized estimator is used in the simulation because it is the estimator that will be used on the real data, so the power computation reflects the actual analysis rather than an idealized unpenalized one [\[52\]](#ref-52)[\[112\]](#ref-112).
Simulation-based power for penalized logistic regression on small frames is standard practice in the methodological literature the estimator is drawn from, and the reduced-order-modeling tradition in entry-risk analysis establishes the precedent for assessing the statistical sensitivity of rare-event entry analyses through simulation rather than closed-form approximation [\[130\]](#ref-130). The minimum detectable effect is itself a design-stage quantity computed on the assembled frame's covariate structure, so it is reported as a property of the realized data once the frame is frozen, not assumed in advance. The objection that a small frame makes the whole exercise futile is answered directly: a precisely-reported minimum detectable effect converts a small frame from a fatal weakness into a quantified limit, because a null result accompanied by a minimum detectable effect tells the reader exactly which effect sizes the study could and could not have detected. If the minimum detectable effect exceeds the heritage effect that EDL portfolio reasoning would consider material, the design says so, and the honest conclusion is that the frame cannot resolve the question at the needed resolution, which is a more useful result than a falsely confident one.

The confidence in the power plan is high as a plan and deliberately reserved as to its outcome. The method and its rationale are sound, but the realized minimum detectable effect is unknown until the frame is frozen, so the design commits to the computation and to reporting whatever it yields, including the possibility that the study is underpowered for a portfolio-material effect. The illustrative figures the prospectus uses to show the reporting format, a move from the lowest to the highest heritage-index quartile associated with a drop in modeled failure probability from roughly forty percent to roughly fifteen percent at fixed Mars mass, are reporting-format illustrations and not estimates, and whether an effect of that magnitude falls above or below the realized minimum detectable effect is exactly what the power computation will determine.

### 5.6.2 Pre-registration commitment

The claim of this subsection is that the entire design is pre-registered before any model is fitted, and that the pre-registration is the mechanism that makes the contribution a genuine hypothesis test rather than a narrative fitted to the data after the fact. The small frame makes this commitment non-negotiable, because on a few dozen rows the difference between a pre-specified test and a post hoc search is the difference between evidence and storytelling.

The pre-registration fixes, in advance, every degree of freedom that could otherwise be exploited. It fixes the primary specification: a Firth-penalized logistic regression of the binary failure indicator on the heritage index, the three physical controls, and the program-strength control, with exact or permutation inference on the heritage coefficient [\[68\]](#ref-68)[\[52\]](#ref-52). It fixes the heritage-index rubric, the element set, the regime-aware scoring rule, the fixed element weights, and the reconstruction-depth weighting [\[139\]](#ref-139)[\[2\]](#ref-2). It fixes the partial-success outcome-coding rule and the boundary-case register [\[109\]](#ref-109). It fixes the program-strength index construction. It fixes the robustness battery of Section 5.4 in full, including the calendar-time and launch-cohort augmented specifications and the pre-committed requirement that \( \beta_1 \) survive them with comparable sign. And it fixes the decision rule: reject H0 for H1 if and only if \( \beta_1 \) falls below zero, its exact or permutation 95% interval excludes zero in the primary specification, and the sign is stable across the robustness set, including under calendar-time conditioning. The number of estimated parameters is kept deliberately low relative to the number of attempts to avoid overfitting a few dozen rows, a discipline that follows from the events-per-variable constraint of Section 5.6.1.

Pre-registration is the only protection against the specification search that a small frame invites, and it rests on the Fogelian methodological standard the dissertation adopts: the counterfactual, and by extension the test of it, must be specified explicitly before the data speak rather than chosen to fit the conclusion [\[121\]](#ref-121)[\[133\]](#ref-133). Pre-registration permits documented amendments when pre-analysis reveals a problem the original plan did not anticipate, such as a separation pattern requiring an additional diagnostic, but every amendment is flagged as such and dated, so the distinction between the original plan and any change to it is preserved in the record. The robustness set is reported in full regardless of whether it strengthens or weakens H1, and a result that survives only the primary specification is reported as fragile, which is the operational meaning of letting the data falsify.

The pre-analysis steps that precede the headline fit are themselves part of the registration. Before the primary model is interpreted, the design runs separation diagnostics to detect complete or quasi-complete separation, computes the realized events-per-variable ratio for feasibility, and conducts the inter-coder reliability check on the heritage coding [\[3\]](#ref-3)[\[19\]](#ref-19)[\[8\]](#ref-8). These diagnostics are reported whatever they show, so a frame that turns out to be too separated or too sparse for a stable estimate is disclosed rather than silently worked around.

### 5.6.3 Computational and software plan

The analysis is fully reproducible from the named data substrate through validated, open software, and the reproducibility is a deliverable of the design rather than an afterthought. Every input is a named, accessible source and every estimation step has an independent, peer-reviewed implementation.

The data substrate is assembled from the four named sources documented in the data chapter: the NTRS EDL reconstruction reports accessed through the NTRS citation-search interface, the global Moon-Mars-Titan landing-attempt record assembled from the mission overviews and the consolidated catalog [\[94\]](#ref-94), the TechPort EDL-technology TRL records, and the GAO program-history reports, with the NASA Technology Taxonomy supplying the TRL-classification framework [\[2\]](#ref-2). The population frame is assembled and frozen as a versioned dataset before any model is fitted, so the rows the analysis runs on are fixed and auditable.

The estimation is implemented in Firth-penalized logistic regression through any of the three validated software families the methodological literature documents: the `logistf` package for the bias-reduced estimator and its penalized profile confidence intervals [\[68\]](#ref-68), the `brglm2` package for bias reduction through the adjusted-score-function framework [\[21\]](#ref-21), or the Stata `firthlogit` module for users in that ecosystem [\[53\]](#ref-53). The design commits to running the primary fit in at least two of these independent implementations and confirming the estimates agree, which guards against an implementation-specific bug being mistaken for a finding. The complementary-log-log link check is implemented through the standard generalized-linear-model machinery of the same ecosystem [\[127\]](#ref-127)[\[117\]](#ref-117). The permutation inference and the simulation-based minimum-detectable-effect computation are implemented as scripted procedures that draw a fixed, seeded set of permutations and simulations, so the exact p-value and the minimum detectable effect are reproducible to the seed.

The reproducibility claim rests on the fact that independent implementations agreeing on the same frozen frame is the strongest practical guarantee a computational study can offer short of formal verification, supported by the documented existence and validation of the three implementations [\[68\]](#ref-68)[\[21\]](#ref-21)[\[53\]](#ref-53). Reproducibility guarantees the analysis can be rerun and audited, not that the heritage and outcome coding are free of analyst judgment, which is why the coding log, the inter-coder reliability result, and the versioned frame are retained alongside the code so that a reviewer can audit the construction of the inputs as well as the estimation on them [\[3\]](#ref-3)[\[19\]](#ref-19). The full reproducibility package, the frozen frame, the coding log and rubric, the seeded permutation and simulation scripts, and the multi-implementation estimation code, is the design-stage deliverable that converts the pre-registered plan into an executable, auditable study.

## 5.7 Chapter synthesis: how the design coheres

The design assembled in this chapter is a single, coherent answer to the dissertation's question, and its parts close in a chain. The problem is real: landing concentrates mission risk into minutes of irreversible autonomous operation, recent attempts span the full heritage spectrum, and several novel-architecture attempts have failed or landed anomalously, so the heritage-versus-novelty trade is a live and consequential question [\[109\]](#ref-109)[\[64\]](#ref-64)[\[50\]](#ref-50). The problem is material: NASA and JPL make recurring heritage-versus-novelty EDL portfolio decisions, and mass scaling forces departures from flown heritage toward novel decelerators and retropropulsion that no flight has proven [\[58\]](#ref-58)[\[60\]](#ref-60)[\[9\]](#ref-9)[\[66\]](#ref-66). The design addresses the causal mechanism: a conditional Firth-penalized logistic regression of the binary failure indicator on the heritage index, with physical and program-strength controls and exact or permutation inference, measures Fogel's counterfactual contrast directly, estimating the within-stratum heritage-versus-novel failure difference at matched target, mass, and program strength [\[121\]](#ref-121)[\[133\]](#ref-133)[\[52\]](#ref-52)[\[68\]](#ref-68). The design beats the alternatives: the discrete-outcome logistic hazard is the natural one-shot-event estimator, Firth penalization dominates ordinary maximum likelihood under the small frame and quasi-separation, and the complementary-log-log link confirms the conclusion is not a logit artifact [\[52\]](#ref-52)[\[68\]](#ref-68)[\[8\]](#ref-8)[\[112\]](#ref-112)[\[127\]](#ref-127). The residual risk is acceptable for a design-stage contribution: small sample, construct risk in the heritage index, documentation asymmetry, and confounding by program strength are bounded by pre-registration, exact or permutation inference, blind and inter-coder coding, low-documentation sensitivity, with-and-without-control bounding, the minimum-detectable-effect computation, and honest design-stage framing [\[52\]](#ref-52)[\[19\]](#ref-19)[\[3\]](#ref-3)[\[94\]](#ref-94)[\[2\]](#ref-2)[\[50\]](#ref-50).

The chapter has kept correlation and causation distinct throughout. The design identifies \( \beta_1 \) off a conditional within-stratum contrast, not a raw correlation, and where only correlation could survive, in particular if the heritage index proves inseparable from the program-strength index, the design commits in advance to saying so and to treating that inseparability as a falsifying condition for the claim of independent heritage value rather than as a result to be salvaged. The estimator, the identification, the threats and their mitigations, the robustness battery, the power computation, the pre-registration, and the computational plan are now fixed. What remains is execution: assembling and freezing the population frame, coding the heritage index and the outcomes under the registered rubric and rule, fitting the primary model and running the full robustness set, and reporting the minimum detectable effect alongside whatever the coefficient turns out to be. The next chapter sets out that execution as a pre-registered, step-by-step analysis plan, so that the design specified here becomes a procedure that any reviewer could run and audit.

The confidence in the design as a whole is high for its internal coherence and moderate for what it can ultimately resolve, and the calibration is deliberate. The estimator and inference choices are strong and well-grounded; the identification is as good as an observational frame of several dozen rows allows; and the binding constraint, power, is not hidden but quantified and reported. That combination, a defensible design that states its own limit, is the mark of a contribution worth defending, because whichever way the coefficient falls, a real and unconfounded heritage effect justifies a conservative lineage strategy and sets a measurable qualification bar for novelty, while a confounded, null, or underpowered result redirects attention from heritage as a goal to the engineering reserves and verification rigor that heritage merely proxies, which is the Fogelian conclusion the design was built to reach honestly.


# Chapter 6: Analysis Plan and Expected Results

## 6.0 The chapter's answer, stated first

This chapter specifies, in advance and in full, exactly what will be done to the assembled population of landing attempts, exactly what decision will be taken on the hypothesis once the coefficient is in hand, and exactly what the output will look like in either direction the evidence can fall. The answer it delivers is procedural rather than empirical: a frozen, seven-step estimation pipeline; a single fixed decision rule on \( \beta_1 \) that is written down before any model is fitted; a labeled, explicitly non-empirical statement of the form the expected results would take if the contribution holds and the form they would take if it does not; and an honest accounting of the power the small frame can and cannot deliver. Nothing in this chapter is an executed estimate. Every number is a reporting-format illustration, and the chapter's contribution is precisely that it commits the analysis to a course of action that the data, once they speak, cannot be talked out of.

A chapter of this kind is load-bearing rather than ceremonial because the central methodological risk in this dissertation is not measurement error in any single variable; it is the temptation, on a frame of only a few dozen attempts, to search across specifications until the heritage coefficient turns the desired sign and size. Fogel's cliometric discipline is unforgiving on exactly this point: the value of an innovation is defined only against a counterfactual that is specified before the comparison is run, never chosen to fit the conclusion [\[121\]](#ref-121). The pre-registration in this chapter is the operational form of that discipline. It fixes the estimator, the controls, the inference procedure, the robustness battery, and the falsification conditions, so that the headline result is a function of the world and not of the analyst's degrees of freedom.

### 6.0.1 Problem frame for the chapter (current state, desired state, gap, consequence)

**Current state.** The prior chapters have specified a population frame (Chapter 4), a measurement scheme for the EDL-heritage-reuse index and the outcome (Chapter 4), and an estimator with its identification logic and threat matrix (Chapter 5). What does not yet exist is the connective tissue: the ordered sequence of operations that turns the frozen frame into a single reported coefficient, the rule that converts that coefficient into a verdict on H0 versus H1, and the pre-committed description of what a confirming, null, confounded, or contrary result each looks like.

**Desired state.** A reader, a committee, or a replication team should be able to take this chapter alone and execute the study without any further adjudication by the analyst. Every choice that could bias the headline result toward the contribution must be removed from the post-data discretion of the analyst and placed in advance. The desired state is a study that is, in the strict sense, falsifiable on its own pre-registered terms.

**Gap.** Chapter 5 stops at the estimator and its supporting argument; it does not lay out the operational order of work, the blinding and inter-coder mechanics that protect the treatment variable, the diagnostic gates that must pass before the primary model is even fitted, or the disjunctive expected-results block that gives a null finding equal prominence with a confirming one. The gap is the analysis plan itself, including its calibration of how confidently each result can be stated.
**Consequence of leaving the gap.** Without a frozen plan, the small frame guarantees that some specification, somewhere, will produce a significant negative coefficient, and the study would then report it as the finding. That is the specification-search failure mode that has rendered much small-sample empirical work non-replicable. For a result intended to inform NASA and JPL EDL portfolio decisions, an un-pre-registered coefficient is not merely weak; it actively misleads, because it dresses a degrees-of-freedom artifact in the authority of a population-level estimate. Closing the gap produces a result whose credibility does not depend on trusting the analyst.

This chapter therefore develops, in order: the seven-step estimation procedure (6.1); the pre-analysis blinding, reliability, and diagnostic gates that must clear before estimation (6.2); the fixed decision rule on the hypothesis (6.3); the labeled illustrative expected-results block and the Mokyr novelty decomposition specified in advance (6.4); the symmetric treatment of null, confounded, and contrary outcomes (6.5); and the power, feasibility, and reproducibility commitments (6.6). Each major claim is developed with its limits and the objections it must answer kept intact, and each causal statement names its mechanism rather than resting on correlation.


## 6.1 The seven-step estimation procedure

The analysis executes as a fixed, ordered sequence of seven steps, each frozen before the data are touched, so that the path from raw record to reported coefficient contains no analyst discretion that could be exercised in light of the outcome. The estimator, the controls, the heritage-index rubric, the outcome-coding rule, and the robustness battery are all specified in Chapters 4 and 5 and in the shared design specification. The seven steps below chain those specifications into an execution order, with explicit gates between them.

When the order of operations is itself pre-registered, the analyst cannot reorder, re-code, or re-specify after seeing intermediate results in a way that nudges the coefficient. This is the operational meaning of Fogel's rule that the counterfactual comparison be fixed before the data speak [\[121\]](#ref-121), transposed from the design of the comparison (Chapter 5) to the conduct of the estimation (this chapter). The penalized-likelihood and rare-events literature that motivates the estimator also motivates a disciplined pipeline: Firth-type penalization is the tool one reaches for when separation or sparse events make ordinary maximum likelihood unstable, and its stability advantage is forfeited if the analyst is free to re-tune the sample or covariate set after inspecting the fit [\[52\]](#ref-52)[\[68\]](#ref-68)[\[112\]](#ref-112). A frozen procedure is what lets the penalization do its intended job on a frame this small.

The procedure is fixed; the realized event count is not, and step seven conditions the interpretive weight placed on the result on the power the realized frame supports. The plan is rigid about process and honest about what process can buy on a few dozen rows. One could object that freezing the pipeline forecloses legitimate, data-driven refinements, for example discovering mid-analysis that an element-scoring rule is ambiguous for a class of attempts. The plan answers this not by allowing post hoc changes to the primary specification but by routing any such discovery into a pre-named sensitivity analysis whose result is reported alongside, never in place of, the primary result. Discovery is permitted; silent substitution of the headline is not.

### 6.1.1 Step one: assemble and freeze the population frame

The first step assembles the population frame of every documented Moon, Mars, and Titan landing attempt that meets the inclusion definition fixed in Chapter 4, namely a vehicle committing to an EDL or powered-descent sequence intended to place a payload on the surface, with orbital insertions, flybys, and Earth-return entries excluded. The frame is built from the consolidated mission catalog [\[94\]](#ref-94) cross-checked against the individual mission overviews and reconstruction reports that define each architecture [\[92\]](#ref-92)[\[82\]](#ref-82)[\[109\]](#ref-109)[\[64\]](#ref-64). Once assembled and reconciled, the frame is frozen: the row set is committed to a versioned file, and no attempt is added or removed after the heritage or outcome coding begins. Freezing the frame before coding prevents the population itself from becoming a degree of freedom; a study that could quietly drop an inconvenient attempt after seeing its outcome would not be estimating a population parameter at all.

### 6.1.2 Step two: code the six EDL elements and assemble the heritage index

The second step decomposes each attempt's architecture into the fixed six-element set defined in Chapter 4 (aeroshell and thermal protection, entry guidance, supersonic deceleration, terminal descent and propulsion, terminal guidance and hazard avoidance, and touchdown mechanism) and assigns each element a heritage score from the TechPort technology-readiness history and the NTRS lineage documentation, coded against the regime in which the element was proven rather than against the bare fact that it flew. The index is the fixed-weight, criticality-weighted mean of the element scores, optionally weighted by the depth of NTRS reconstruction documented for the source flight, which is the Mokyr propositional-knowledge weighting. A second coder independently codes a random subsample of attempts using the same rubric, with no access to the first coder's scores, so that inter-coder reliability can be quantified before the index is used. The reconstruction-depth weighting is the operational trace of the Mokyr mechanism: flight converts a prescriptive recipe into propositional understanding only to the extent that the flight was instrumented and reconstructed, of which the MEDLI and MEDLI2 instrumentation reconstructions are the literal artifact [\[71\]](#ref-71)[\[92\]](#ref-92).

### 6.1.3 Step three: code outcomes blind to the heritage coding

The third step codes the binary outcome for every attempt under the pre-registered partial-success rule fixed in Chapter 4, in which loss of the mission's primary surface function is coded as failure and a survivable landing with degraded but operable function is coded as success, with the boundary cases (the SLIM anomalous-attitude touchdown being the canonical example) coded per the rule and flagged for both-way recoding in sensitivity analysis [\[109\]](#ref-109). Outcome coding is performed blind to the heritage index: the coder works from the landing-event record without the architecture scores in view. Blinding here is not a nicety. It severs the channel through which knowledge of the outcome could contaminate the treatment variable, which Chapter 5 identifies as the coding-endogeneity threat to internal validity. A heritage index coded with the outcome already known would mechanically manufacture the correlation the study claims to test.

### 6.1.4 Step four: run pre-estimation diagnostics

Before any model is fitted, the fourth step runs the diagnostic gates specified in 6.2: the inter-coder reliability statistic on the heritage subsample, a separation and quasi-separation check on the heritage index against the outcome, an events-per-variable count against the parameter budget, and a collinearity diagnostic between the heritage index and the program-strength control. These gates are not pass-fail switches that abort the study; they are pre-committed determinants of which estimator variant is primary and how the result will be qualified. They decide, on grounds fixed in advance, whether the frame can support the primary specification as written or whether a pre-named fallback governs.

### 6.1.5 Step five: fit the primary specification

The fifth step fits the single pre-registered primary specification: a Firth-penalized (bias-reduced) logistic regression of the binary failure indicator on the EDL-heritage-reuse index, the three physical controls (target-body indicators, entry mass, landed mass), and the program-strength control, in the canonical form carried unchanged from the bible:

\[ \operatorname{logit} \Pr(\text{failure}_i = 1) = \beta_0 + \beta_1 \, \text{heritage\_index}_i + \boldsymbol{\gamma}' \mathbf{controls}_i + \epsilon_i \qquad\qquad (1) \]

The Firth penalty is the primary, not a fallback, because the frame is small and quasi-separation is a live possibility on a treatment variable that ranges from near-novel to near-fully-heritage; bias-reduced penalized likelihood gives accurate effect estimates and predictions in the rare-events and sparse-data regime this study occupies [\[52\]](#ref-52)[\[68\]](#ref-68). The penalized fit is paired with exact or permutation-based inference on \( \beta_1 \) rather than relying on the asymptotic Wald interval, because Wald inference is untrustworthy under separation and small samples [\[8\]](#ref-8)[\[112\]](#ref-112).

### 6.1.6 Step six: report the heritage coefficient and the IQR-implied effect

The sixth step reports \( \beta_1 \), its exact or permutation-based ninety-five percent confidence interval, and the substantively interpretable quantity derived from it: the implied change in modeled landing-failure probability across the interquartile range of the heritage index, computed at fixed target body and mass. Reporting the interquartile-range effect rather than only the coefficient on the logit scale makes the result legible to an EDL portfolio decision, because the decision-relevant question is not the log-odds slope but how much the modeled failure probability moves between a low-heritage and a high-heritage attempt that are otherwise matched. This is the Fogelian social-saving analogue made concrete: the difference in failure probability a matched attempt would face at the novel versus the heritage end of the index [\[121\]](#ref-121)[\[133\]](#ref-133).

### 6.1.7 Step seven: run the robustness battery and the power assessment

The seventh step runs the entire pre-registered robustness battery and the power and minimum-detectable-effect assessment, reporting all of it regardless of whether it strengthens or weakens the contribution. The battery comprises the complementary-log-log discrete-time hazard link as the alternative to the logit; exclusion of low-documentation rows whose heritage coding is uncertain; both-way recoding of the boundary partial-successes; estimation with and without the program-strength control to bound the central confounder; and the Mokyr grounded-versus-ungrounded novelty decomposition. The power assessment reports the minimum detectable effect size given the realized event count, so that a failure to reject H0 can be read correctly as either a true null or insufficient power, never conflated. A contribution that survives only the primary specification and collapses across the battery is reported as fragile, not as confirmed.

### 6.1.8 The ordering of the seven steps is itself load-bearing

The order matters and cannot be permuted. Freezing the frame (step one) before coding the index (step two) prevents the population from being a degree of freedom; coding the index (step two) before coding outcomes (step three) is irrelevant to blinding, but coding outcomes blind to the index is the irreducible constraint, and the plan satisfies it by maintaining the firewall regardless of which coder works first. Running the diagnostics (step four) before fitting (step five) is non-negotiable, because the diagnostics determine whether the primary specification can be fitted as written or whether a pre-named fallback governs; a study that fit first and diagnosed afterward would be tempted to treat a separation problem as license to drop the offending rows. Reporting the coefficient (step six) before running the battery (step seven) fixes the headline before the robustness checks, so that the battery is read as a stress test of an already-stated result rather than as a menu from which the most flattering specification is selected as primary. The sequence encodes the same anti-search logic at every joint: each step commits a quantity that later steps are not permitted to renegotiate. This is the procedural analogue of the cliometric rule that the comparison be specified before the data speak [\[121\]](#ref-121).
## 6.2 Pre-analysis: blinding, reliability, and the diagnostic gates

Four pre-estimation procedures, all fixed before the data are examined, protect the study from its most dangerous internal threats: outcome-contaminated treatment coding, unreliable construct measurement, small-sample separation, and treatment-control inseparability. Each procedure targets a named threat from the Chapter 5 validity matrix and is operationalized as a concrete, reportable quantity rather than a verbal promise. A threat addressed only in prose can be asserted away. A threat converted into a pre-committed diagnostic with a reported value either passes the gate or visibly fails it, and the failure becomes part of the honest record. Converting validity threats into measured gates is what gives the argument its evidential teeth.

### 6.2.1 Blind outcome coding and the severing of the contamination channel

The mechanism of the coding-endogeneity threat is direct: if the analyst codes the heritage index while already knowing which attempts failed, even unconscious bias will tend to score the failed attempts as more novel and the successful ones as more heritage, manufacturing \( \beta_1 < 0 \) as a coding artifact rather than a finding. The driver is shared analyst knowledge; the mechanism is outcome-informed scoring of the treatment; the observable effect is an inflated negative heritage coefficient; the operational consequence is a falsely rejected null; the strategic implication for a NASA portfolio reader is a heritage premium that is real only on paper. Blinding outcome coding from heritage coding severs the driver at its root. The plan commits to coding architecture before outcome, to maintaining separate coders or separate coding sessions with a documented firewall, and to logging the coding order so the firewall is auditable. Confidence that this channel is closed is **high**, because the procedure is mechanical and verifiable; what would lower it is any evidence that the firewall leaked, which the retained coding log is designed to detect.

### 6.2.2 Inter-coder reliability on the heritage index

The heritage index is the treatment, it is analyst-constructed, and so its reliability is the construct-validity linchpin. The plan has a second coder independently score a random subsample of attempts on the full six-element rubric and reports an inter-coder agreement statistic on both the element scores and the assembled index. A high agreement statistic supports the claim that the index measures a property of the architecture rather than the idiosyncrasy of the coder. A low statistic is itself a reportable finding that downgrades confidence in the headline coefficient and triggers the pre-named rubric-clarification sensitivity analysis. The simulation literature on logistic-model stability under measurement variability backs the decision to quantify rather than assume coding reliability, since instability in a key regressor propagates directly into the coefficient's bias and calibration [\[19\]](#ref-19)[\[3\]](#ref-3). Confidence that the construct is measurable reliably is **moderate** at the design stage and is explicitly conditioned on the realized agreement statistic, the evidence that would raise or lower it.

### 6.2.3 Separation and quasi-separation diagnostics

On a frame of a few dozen rows with a treatment that spans the heritage spectrum, it is entirely possible that no high-heritage attempt failed, or that no fully-novel attempt succeeded, producing complete or quasi-complete separation. Under separation, ordinary maximum-likelihood logistic estimates diverge and Wald intervals are meaningless [\[8\]](#ref-8). The plan runs an explicit separation check before estimation and pre-commits to the Firth-penalized estimator as primary precisely because it remains well-behaved under separation, delivering finite, bias-reduced estimates where ordinary likelihood fails [\[52\]](#ref-52)[\[68\]](#ref-68)[\[112\]](#ref-112). Detecting separation does not abort the study; it confirms that the pre-chosen estimator was the correct primary, and it switches inference to the exact or permutation procedure already specified. The penalized-likelihood detection-and-correction literature gives this gate its backing [\[146\]](#ref-146)[\[21\]](#ref-21).

### 6.2.4 Collinearity between heritage and program strength

The most consequential diagnostic is the collinearity check between the heritage index and the program-strength control, because the entire claim of independent heritage value rests on the two being separately identifiable. If the heritage index and the program-strength index are collinear to the point of inseparability, then the data cannot distinguish a heritage effect from a program-strength effect, and the contribution's claim of an independent heritage premium cannot be sustained regardless of the coefficient's sign. The plan reports a collinearity diagnostic between these two regressors and pre-commits, per the bible's decision rule, to treating inseparability as a falsification of the independent-value claim rather than as a nuisance to be regularized away. This gate is the operational form of the most honest thing the study can say: if heritage cannot be told apart from program strength in the historical record, then the practitioner intuition that heritage is independently protective is, on this evidence, not testable, which is itself a decision-relevant result for NASA portfolio reasoning.

The plan is deliberate about the response to a marginal rather than extreme collinearity reading, because this is where an undisciplined analysis would be tempted to improvise. A common reflex when two regressors correlate is to regularize them jointly (ridge-type shrinkage) or to drop one, but both moves would destroy the very contrast the study exists to estimate: dropping program strength reintroduces the confounder the control was added to bound, and shrinking the two together would attribute their shared variance arbitrarily. The plan therefore commits in advance to neither remedy. Instead, a marginal collinearity reading is reported as a quantified caveat on the program-strength sensitivity comparison (the with-and-without-control coefficients of 6.4.1), and the width of the gap between those two coefficients is read directly as the evidence on how much of any heritage effect is separable from program strength. The collinearity diagnostic and the sensitivity comparison are two views of the same underlying question, and reporting both is what lets a reader judge separability for themselves rather than trusting a single regularized number.

### 6.2.5 Event-count feasibility against the parameter budget

A fifth pre-estimation check, subordinate to but distinct from the separation diagnostic, counts the realized landing-failure events against the number of estimated parameters. The primary specification estimates one treatment coefficient, two or three target-body indicators depending on whether Titan is pooled or kept distinct, two mass controls, and one program-strength control, for a parameter budget on the order of six to seven coefficients. On a frame of a few dozen attempts with a failure rate that the historical record suggests is far from trivial, the events-per-variable ratio is the binding feasibility constraint, and the plan reports it before fitting. A low ratio does not abort the study but determines, on grounds fixed in advance, how aggressively the parameter budget must be trimmed: the pre-named contingency is to collapse the target-body control to a binary atmosphere-present indicator and to consider folding entry and landed mass into a single mass term, in that order, with each reduction reported as a deviation from the maximal specification rather than concealed. Keeping the parameter budget low relative to the row count is the design's first defense against overfitting a small frame, and the events-per-variable report is what makes that discipline auditable [\[52\]](#ref-52)[\[112\]](#ref-112).

A critic could argue that four gates on a small frame is over-engineering that will simply produce a study reporting "insufficient power" and "uncertain coding" rather than an answer. The plan accepts this risk openly: it is better to report a credibly bounded non-answer than a falsely confident one, and the power assessment in 6.6 is designed to label exactly which of those two the study has produced. The gates do not weaken the study; they prevent it from over-claiming.


## 6.3 The fixed decision rule on the hypothesis

The verdict on H0 versus H1 is governed by a single decision rule, fixed in advance, that no post-data analysis can renegotiate. It is stated below exactly as carried from the prospectus and the expansion plan, with no softening of the conjunction it requires.

Reject H0 in favor of H1 if and only if, in the pre-registered primary specification (Firth-penalized logistic with the three physical controls and the program-strength control):

1. the estimated \( \beta_1 \) is below zero; **and**
2. its exact or permutation-based ninety-five percent confidence interval excludes zero; **and**
3. the sign of \( \beta_1 \) is stable across the entire pre-registered robustness set (complementary-log-log link; dropping low-documentation rows; recoding the boundary partial-successes both ways; estimation with and without the program-strength control; and the Mokyr grounded-versus-ungrounded novelty decomposition).

An interval that includes zero fails to reject H0. A \( \beta_1 \) that is negative and interval-excludes-zero without the program-strength control but collapses to an interval including zero once the control is added is reported not as a rejection of H0 but as a **confounded** effect, which the bible designates a decision-relevant finding in its own right. Inseparability of the heritage index from the program-strength index, detected at the 6.2.4 gate, falsifies the claim of independent heritage value irrespective of any coefficient.

A decision rule fixed before the data are seen is what distinguishes a hypothesis test from a narrative fitted after the fact. Fogel's insistence that the counterfactual be specified in advance is this discipline transposed to the inferential verdict: the rule that converts the coefficient into a conclusion must be written before the coefficient exists, or the conclusion is not earned [\[121\]](#ref-121). The conjunctive structure (sign **and** interval **and** robustness-stability) is deliberately demanding, because a frame this small can produce a single significant coefficient by chance or by one fragile specification, and the robustness-stability clause guards against promoting such an artifact to a finding. The requirement that inference rest on exact or permutation procedures rather than asymptotic Wald intervals follows from the small-sample logistic literature, which documents that Wald inference is unreliable under separation and sparse events while penalized and exact methods retain calibration [\[8\]](#ref-8)[\[112\]](#ref-112)[\[52\]](#ref-52)[\[146\]](#ref-146), and the robustness-stability clause follows from the reliability-statistics precedent that a discrete-outcome conclusion should survive a change of link and a perturbation of the sample before it is trusted [\[127\]](#ref-127)[\[117\]](#ref-117).

The rule decides the direction of the verdict; it does not by itself certify that the verdict is well-powered. A failure to reject H0 under this rule is reported jointly with the minimum-detectable-effect statistic from 6.6, so that the reader can distinguish a genuinely null heritage effect from a real effect the frame was too small to detect. The rule is decisive on sign and significance; it is silent on, and therefore must be read alongside, power.

One could object that a conjunctive rule this strict will almost never reject H0 on a few dozen rows, biasing the study toward a null. The plan's answer is that this asymmetry is the correct one: in a portfolio context where treating heritage as protective when it is not would waste qualification effort and entrench possibly-misplaced conservatism, a conservative test that rejects H0 only on robust, well-identified, sign-stable evidence is the responsible default. The cost of a false null (continued investigation) is lower than the cost of a false rejection (institutionalizing a heritage premium that is really a program-strength proxy).


## 6.4 Illustrative, explicitly non-empirical expected results

**This section is a design-stage statement of the form the output would take. No coefficient is fitted on the full population. Every number below is a reporting-format illustration chosen to show the intended shape of a table or sentence, not an estimate from data. The result tables are specified-but-unpopulated by design.**
The expected-results block states, in advance and with explicit labeling, what a confirming result would look like, what the Mokyr novelty decomposition would be expected to show under the knowledge-codification reading, and the exact reporting format each will take, so that the eventual populated output cannot be reshaped to flatter the contribution. Pre-specifying the reporting format, including the illustrative magnitudes, removes the analyst's freedom to choose, after the fact, the presentation that makes the result look strongest. Calibrating the modal language to the design-stage evidence grade is what keeps this section honest: it speaks entirely in the conditional and never in the indicative of an executed finding.

### 6.4.1 The specified-but-unpopulated primary result table

The primary result will be reported in the following fixed template. The cells are left as placeholders by design; populating them is the work of execution, not design.

| Quantity | Symbol | Specified reporting form | Status |
|----------|--------|--------------------------|--------|
| Heritage coefficient | \( \beta_1 \) | point estimate on the logit scale | to be estimated |
| Inference | exact/permutation 95% CI on \( \beta_1 \) | interval, lower and upper bound | to be estimated |
| Substantive effect | IQR effect | change in modeled failure probability across the interquartile range of the heritage index, at fixed target and mass | to be estimated |
| Program-strength sensitivity | \( \beta_1 \) with vs without control | two coefficients and intervals | to be estimated |
| Realized frame | N attempts, N failures | counts | to be assembled |
| Power | minimum detectable effect | effect size detectable at the realized N | to be computed |

The table is the contract: whatever the execution yields is reported in exactly these rows, with no row added or removed to manage the narrative.

### 6.4.2 The illustrative form of a confirming result

If the assembled population yields a result consistent with H1, it would take the following illustrative form. A fitted \( \beta_1 \) below zero whose exact confidence interval excludes zero, corresponding to an interquartile-range effect of the form "a move from the lowest to the highest quartile of the heritage index is associated with a reduction in modeled landing-failure probability from roughly forty percent to roughly fifteen percent at fixed Mars mass," would support H1. These figures are the reporting-format illustration carried from the prospectus; they are placeholders that demonstrate the shape of a confirming sentence, not estimates from any fit. The Fogelian reading of such a result would hold that the heritage-versus-novel counterfactual contrast at matched target, mass, and program strength is real and material: a matched attempt at the novel end of the index would face a higher modeled failure probability than the same attempt at the heritage end [\[121\]](#ref-121)[\[133\]](#ref-133).

### 6.4.3 The Mokyr grounded-versus-ungrounded novelty decomposition, specified in advance

The Mokyr decomposition is specified before estimation as a sub-implication that sharpens, but does not replace, the headline test. What it probes is whether the protective effect of heritage operates through codified, propositional knowledge rather than through the mere age of the hardware. The driver is the conversion of prescriptive recipe into propositional understanding by flight and reconstruction; the mechanism is that elements whose novelty rests on strong analytical and ground-test grounding (supersonic retropropulsion matured through wind-tunnel and computational campaigns being the canonical exemplar) carry less irreducible in-flight-only uncertainty than ungrounded first-flight novelty [\[36\]](#ref-36)[\[135\]](#ref-135)[\[9\]](#ref-9)[\[66\]](#ref-66); the observable effect is that, if the heritage effect is knowledge-based, the excess landing-failure risk should load disproportionately on the ungrounded-novelty component when the novelty term is split. The expected illustrative pattern under the knowledge-codification reading is that the ungrounded-novelty component carries a larger excess-risk loading than the propositionally grounded-novelty component. A result in which all novelty carries equal excess risk regardless of analytical grounding would remain consistent with H1 on the headline coefficient but would weaken the Mokyr interpretation, reframing the heritage premium as an age effect rather than a knowledge effect. Confidence in being able to estimate this decomposition cleanly is **low to moderate** at the design stage, because splitting an already-scarce novelty signal into two components strains the small frame's power; the decomposition is therefore reported as suggestive and its interval treated with the same minimum-detectable-effect honesty as the headline.

### 6.4.4 The complementary-log-log result as the event-study confirmation

The complementary-log-log discrete-time hazard is reported in the same template as the primary logistic, and its role is to confirm that the conclusion is a property of the data rather than of the link function. The interpretation of the \( \operatorname{cloglog} \) coefficient differs slightly from the logit: rather than a symmetric log-odds slope, the \( \operatorname{cloglog} \) models the hazard of loss during the one-shot EDL event with an asymmetric link natural to a discrete-time survival reading of a single irreversible trial. The plan pre-commits to reporting the \( \operatorname{cloglog} \) \( \beta_1 \) and its interval beside the logistic result, and to treating a sign reversal or a collapse of the interval across the two links as evidence that the headline is link-fragile, which under the decision rule of 6.3 prevents rejection of H0. The substantive reading of a confirming \( \operatorname{cloglog} \) result is the event-study one: at matched target, mass, and program strength, the per-event hazard of loss is lower for the heritage end of the index than for the novel end, the same Fogelian counterfactual contrast stated on the hazard scale rather than the odds scale [\[127\]](#ref-127)[\[117\]](#ref-117)[\[121\]](#ref-121). Because the two links encode the same conditional comparison through different functional forms, their agreement is the minimal robustness any single-coefficient claim on a small frame should be required to clear.

### 6.4.5 Why the illustrative figures are bounded interpretive aids, not forecasts

The illustrative magnitudes serve one purpose: to bound the interpretive range so that a reader knows in advance how a confirming result would be phrased and at what scale it would be material. They are not forecasts of the coefficient, and the plan commits to flagging them as illustrations every time they appear, in the chapter and in any derived artifact, so that no downstream reader can mistake a reporting-format placeholder for an executed estimate. This labeling discipline is the design-stage guardrail made explicit at the level of the individual number. It matters most precisely because the illustrative figures are vivid: a reader who skims will remember "forty percent to fifteen percent" and forget the surrounding caveat unless the caveat is attached to the number itself every time it appears. The plan therefore treats the labeling not as a one-time disclaimer but as a property the number carries wherever it travels.


## 6.5 What a null, confounded, or contrary result would look like

The plan commits in advance to reporting a null result, a confounded result, and a contrary (wrong-signed) result with the same prominence as a confirming one, and it specifies the interpretation each carries for NASA and JPL portfolio reasoning. The decision rule in 6.3 already defines the three non-confirming outcomes; this section attaches a pre-committed interpretation to each so that the analyst cannot, after the fact, bury or re-spin an unwelcome result. A study that specifies in advance what it will say if its hypothesis fails is a genuine test; a study that describes only the confirming case is a narrative waiting for confirmation. Equal-prominence pre-commitment to the null is what makes the contribution falsifiable in the strict sense the prospectus claims, and it is the source of the design's symmetric decision value: the study is worth running because every branch of the disjunction informs a real decision.

### 6.5.1 The clean-null branch

If the fitted \( \beta_1 \) is indistinguishable from zero in the primary specification after controlling for program strength and physics, H0 is not rejected and the contribution is falsified. The interpretation, stated in advance, is that heritage carries no independent protective effect once program strength and target-body and mass difficulty are accounted for. The mechanism implied is that the apparent safety of heritage missions is fully explained by the physical ease of their targets and by the engineering reserves of the programs that fly them, not by architectural reuse as such. For a NASA portfolio reader, the operational consequence is that qualification effort and investment are better directed at the underlying engineering reserves and verification rigor than at heritage reuse treated as a goal in itself, a conclusion squarely in the Fogelian spirit that a technology's value is only ever relative to its substitute [\[121\]](#ref-121). This branch must be reported with a paired minimum-detectable-effect statement (6.6) so the null is not read as more decisive than the power supports.

### 6.5.2 The confounded branch

If \( \beta_1 \) is large and negative with an interval excluding zero when the program-strength control is omitted, but collapses toward zero (interval including zero) when the control is added, the honest conclusion fixed in advance is that the apparent heritage effect is largely confounded by program strength. The mechanism is that well-funded, experienced programs both reuse heritage and execute better across the board, so that the raw heritage advantage is a proxy for program strength rather than a property of the architecture. This is not a failed study; it is a decision-relevant finding, because it tells NASA and JPL that "heritage" in their trade studies may be silently rewarding program maturity, and that the trade should be reframed around the program-strength variable that is doing the real work. The plan reports the with-and-without coefficients side by side precisely so this collapse, if it occurs, is visible rather than hidden in a single preferred specification.

### 6.5.3 The contrary branch

If \( \beta_1 \) is positive with an interval excluding zero, the result is contrary to the contribution: higher heritage would be associated with higher, not lower, landing-failure risk. The plan does not treat this as impossible and specifies its candidate mechanism in advance. The leading explanation, consistent with both the design's reverse-causation discussion and the failure literature, is that heritage elements are sometimes flown outside their proven envelope, so that an architecture coded as high-heritage on lineage is in fact operating in an unqualified regime where its proven status is illusory; a secondary channel is that heritage flight software, carried forward and modified, can import latent defects that surface in a new mission's descent [\[50\]](#ref-50). The regime-aware coding of the heritage index in Chapter 4 is the design's first-line defense against the first channel, and a contrary result would prompt a pre-named diagnostic re-examination of whether the regime coding adequately captured envelope departures. A contrary result, like the null, falsifies the contribution and is reported as such.

### 6.5.4 The inseparability branch

If the 6.2.4 collinearity gate finds the heritage index and the program-strength index inseparable, the plan reports that the data cannot distinguish a heritage effect from a program-strength effect, and that the claim of an independent heritage premium is therefore untestable on the historical record as assembled. The interpretation, fixed in advance, is that the practitioner intuition is neither confirmed nor refuted but shown to be non-identified given the available data, which directs future work toward either a larger frame or an instrument that breaks the collinearity. This is the most epistemically humble of the four branches and is given equal prominence with the rest.

### 6.5.5 The asymmetry of decision value across the branches

The five branches are not equally probable, and they are not equally costly to a NASA or JPL portfolio decision, and the plan is explicit about both asymmetries so that the eventual result is interpreted against the right backdrop. On probability, the confounded branch is, on prior reasoning, the most likely single outcome, because the historical record strongly couples heritage reuse with program maturity: the programs that can afford to fly a proven lineage again are disproportionately the deep, experienced ones. The plan's emphasis on the with-and-without-control comparison and the collinearity gate is calibrated to this prior, since the most probable failure mode of the contribution is not a clean null but a confounded effect that the program-strength control reveals. On cost, the four non-confirming branches differ sharply in their implications. A clean null redirects investment from heritage to engineering reserves, a reallocation that is reversible if later evidence overturns it. A confounded result reframes the trade around program strength, which is informative but leaves the heritage question formally open. A contrary result is the most consequential, because it would imply that heritage reuse, as practiced, sometimes imports rather than retires risk (through envelope-exceedance or inherited software defects), and would demand immediate scrutiny of how programs verify that a heritage element remains inside its proven regime [\[50\]](#ref-50). The inseparability branch is the least actionable but the most honest, and it points squarely at the data limitation that future work must overcome. Stating this asymmetry in advance is what keeps the eventual interpretation proportionate: the study does not treat all five outcomes as interchangeable, and it tells the reader, before the data arrive, which outcome would carry which weight.
A skeptic might say that pre-committing to four non-confirming interpretations is a hedge that lets the study claim success no matter what. The plan rejects this reading. Only the confirming branch rejects H0; the other four are explicit falsifications or non-identifications of the contribution, and the study's value lies in its willingness to report them as such rather than in any guarantee of a positive finding. A test that is honest about its failure modes is stronger than one that only describes its hoped-for success.


## 6.6 Power, feasibility, and reproducibility

The small frame governs the study's power, the Firth-penalized estimator is the correct primary precisely because of that constraint, and the plan reports the minimum detectable effect rather than over-interpreting whatever interval the data yield; the entire pipeline is committed to a reproducibility standard that lets an independent team re-execute it from the frozen artifacts. The realized frame is, by the Chapter 4 coverage assessment, on the order of several dozen attempts, with Mars and the Moon contributing most rows and Titan contributing one. This is small by the standards of any logistic analysis, and the events-per-variable count against the parameter budget (the heritage index, three physical controls, and the program-strength control) is correspondingly tight. When the frame is small, the binding constraint on what can be concluded is power, not point estimation, and a plan that reports the minimum detectable effect alongside every non-rejection is the only way to keep a null result from being over-read. Reporting power rather than suppressing it is what lets the reader distinguish "heritage does not protect" from "the frame was too small to tell."

### 6.6.1 Why Firth penalization is the primary, not a robustness afterthought

The mechanism by which the small frame threatens the study is twofold: sparse events make ordinary maximum-likelihood logistic estimates biased away from zero, and a treatment spanning the heritage spectrum on a few dozen rows invites separation that makes ordinary estimates diverge entirely. Firth's bias-reduced penalized likelihood addresses both at once, delivering finite, less-biased estimates and well-calibrated predictions in exactly the rare-events and sparse-data regime this study occupies [\[52\]](#ref-52)[\[68\]](#ref-68). The choice is not a defensive add-on; it is the load-bearing estimator decision, backed by simulation evidence that penalized methods outperform ordinary likelihood for risk prediction in small or sparse samples [\[112\]](#ref-112)[\[146\]](#ref-146) and by the broader account of separation handling in logistic regression [\[8\]](#ref-8)[\[21\]](#ref-21). Confidence that the estimator is the right primary is **high**, grounded in convergent methodological literature; what would lower it is a realized frame so degenerate that even penalized likelihood cannot identify the coefficient, which the separation and collinearity gates are designed to detect before estimation.

### 6.6.2 The minimum-detectable-effect report

The plan computes and reports, for the realized event count, the minimum detectable effect size: the smallest heritage-coefficient magnitude the frame could distinguish from zero at the pre-specified level. This statistic is reported jointly with the decision-rule verdict so that the two are never read in isolation. A non-rejection accompanied by a large minimum detectable effect is correctly read as an underpowered test, not as evidence for the null; a non-rejection accompanied by a small minimum detectable effect is a more genuinely informative null. The simulation literature on logistic-model bias, calibration, and stability under sparse data backs the decision to characterize detectable-effect bounds rather than report only a point estimate and an interval [\[19\]](#ref-19)[\[3\]](#ref-3). The plan is explicit that on a frame this small the honest deliverable may be a credibly bounded non-answer, and it commits to labeling such an outcome as exactly that rather than dressing a wide interval as a finding.

### 6.6.3 Feasibility of the Mokyr decomposition under the power constraint

The grounded-versus-ungrounded novelty decomposition is the most power-hungry component of the analysis, because it splits an already-scarce novelty signal into two parts. The plan acknowledges in advance that the decomposition may be underpowered even when the headline coefficient is estimable, and it pre-commits to reporting the decomposition's minimum detectable effect separately and to treating a non-significant decomposition as uninformative about the Mokyr reading rather than as evidence against it. This is the calibrated-modality discipline applied to the sub-hypothesis: the confidence attached to the decomposition is **low to moderate** and is conditioned explicitly on the realized event split between grounded and ungrounded novelty.

### 6.6.4 Reproducibility and the retained coding log

The study is reproducible from its frozen artifacts by an independent team without recourse to the original analyst's judgment. The plan retains, in versioned form: the frozen population frame; the full heritage-index rubric with the six-element decomposition, the regime-aware scoring rule, the fixed weights, and the reconstruction-depth weighting; the inter-coder coding log including the order of coding and the firewall record that establishes outcome-blinding; the partial-success outcome-coding rule and the boundary-case register; the program-strength index construction from GAO cost-and-schedule data and organizational flight experience; and the pre-registration document fixing the primary specification, the robustness set, the decision rule, and the planned power computation. The named-source documentation streams (the NTRS reconstruction reports, the consolidated landing-attempt catalog, the TechPort technology-readiness records under the NASA Technology Taxonomy, and the GAO program-history archive) are the data substrate, accessed through their public APIs and archives, so that the row set and the coding are independently regenerable [\[94\]](#ref-94)[\[2\]](#ref-2).

Reproducibility is what converts a single analyst's study into a community-checkable result, and on a frame small enough that every coding decision matters, the retained log is what lets a replication team verify that the coefficient is a property of the record rather than of the coder. This is the Mokyr principle of codification applied to the study's own conduct: the value of the analysis, like the value of a reconstructed flight, is realized only to the extent that its procedure is written down and publicly verifiable [\[139\]](#ref-139). Reproducibility of procedure does not eliminate the documentation asymmetry in the underlying record: attempts with thin public reconstruction will be coded less confidently than well-reconstructed ones, and the low-documentation sensitivity analysis bounds but does not erase this. The residual risk is acceptable at the design stage because it is named, bounded by a pre-registered sensitivity analysis, and reported transparently rather than concealed.


## 6.7 Chapter synthesis: the plan as the contribution's safeguard

This chapter has converted the estimator and identification logic of Chapter 5 into an executable, frozen analysis plan whose every discretionary choice is fixed before the data are seen. The seven-step procedure orders the work from frame-freezing through robustness reporting; the four pre-analysis gates convert the most dangerous validity threats into measured, reportable quantities; the fixed decision rule binds the verdict on H0 to a demanding conjunction of sign, interval, and robustness-stability; the illustrative expected-results block states the reporting format and the conditional shape of a confirming result while labeling every number as a non-empirical placeholder; the symmetric treatment of null, confounded, contrary, and inseparable outcomes gives each branch of the disjunction a pre-committed interpretation and equal prominence; and the power and reproducibility commitments keep the study honest about what a small frame can and cannot deliver.

The chapter's argument coheres at every joint. Specification search on a small frame is a documented failure mode that the pre-registration directly forecloses, and an un-pre-registered coefficient intended to inform EDL portfolio decisions would lend a degrees-of-freedom artifact the authority of a population estimate. Each gate severs a specific channel (outcome-contaminated coding, unreliable construct measurement, separation-driven divergence, treatment-control inseparability) rather than asserting the threat away. The frozen, conjunctive, robustness-checked rule dominates the ad hoc reporting of whichever specification happens to please. And the irreducible limits (documentation asymmetry, the power ceiling of a few dozen rows, the strained decomposition) are named, bounded by pre-registered sensitivity analyses, and reported with calibrated rather than inflated confidence.

In keeping with the dissertation's standing scope decision, no architecture-traceability vocabulary is forced onto what is a pure design-stage measurement study; the only objective-to-decision endpoint invoked is conceptual and in plain prose, namely that the fitted \( \beta_1 \), once it exists, becomes an input a program can weigh against the cost of additional qualification for a novel EDL element. What this chapter delivers is not that coefficient but the guarantee that, whatever the coefficient turns out to be, it will have been earned under a rule the data could not renegotiate. That guarantee is the analysis plan's contribution, and it is what makes the eventual estimate, in either direction it falls, decision-relevant for NASA and JPL.


# Chapter 7: Discussion

## 7.0 The chapter's answer, stated first

Whichever way the heritage coefficient \( \beta_1 \) falls when the frozen analysis plan is executed, the result is decision-relevant, and this chapter shows why by interpreting both branches of the disjunction in advance. If, conditional on target body, entry mass, landed mass, and program strength, the estimated \( \beta_1 \) is negative and its exact or permutation interval excludes zero, and the sign survives the pre-registered robustness set, then flight-proven EDL heritage carries an independent protective effect against landing failure, the conservative lineage strategy that programs such as InSight followed is quantitatively vindicated, and a measurable qualification bar can be set for how much extra verification a novel element must earn before it is flown [\[108\]](#ref-108)[\[82\]](#ref-82). If instead \( \beta_1 \) is indistinguishable from zero in the primary specification, or is negative without the program-strength control but collapses toward zero once that control is added, then the practitioner intuition that "heritage is safer" is, at the population level and after physical and program-strength conditioning, either false or confounded, and NASA and JPL should redirect investment from heritage as an end in itself toward the engineering reserves and verification rigor that heritage merely proxies [\[121\]](#ref-121)[\[133\]](#ref-133). The chapter's thesis is therefore not a prediction of which branch holds; it is the claim that the design has been constructed so that **either** branch delivers a usable EDL portfolio parameter, and that the value of the contribution does not depend on the coefficient coming out negative.

This is a deliberate structural choice, and it sets the register for everything below. A weaker dissertation would interpret only the favorable outcome and treat the null as a disappointment to be explained away. The cliometric tradition this work inherits forbids that posture. Fogel's discipline is that an innovation's value is defined only relative to the next-best substitute, and that an apparently indispensable technology can have a small marginal effect once the counterfactual is correctly specified [\[121\]](#ref-121)[\[133\]](#ref-133). A finding that heritage confers no independent advantage once program strength is held fixed is not a failure of the study; it is the cliometric result in its purest form, the EDL analogue of Fogel's demonstration that the railroad's social saving was far smaller than the rhetoric of indispensability implied. The chapter is organized to honor that symmetry: Section 7.1 interprets the H1-survives branch, Section 7.2 the H0-not-rejected and confounded branches, Section 7.3 engages the rival explanations in full, Section 7.4 reads the Mokyr novelty decomposition, Section 7.5 fixes the external-validity envelope, and Section 7.6 draws the chapter's argument together and states the conceptual objective-to-decision endpoint in plain prose without forcing an architecture vocabulary onto a measurement study.

### 7.0.1 The problem this chapter addresses

The **current state** of EDL practice is that the heritage-versus-novelty trade is decided on engineering intuition and a curated set of mission anecdotes. A program reasons that the Mars sky-crane has flown twice successfully and should be flown again, or that a commercial lander's first-flight propulsion and guidance software carry irreducible uncertainty, and it weights the trade accordingly [\[88\]](#ref-88)[\[74\]](#ref-74)[\[64\]](#ref-64). The **desired state** is a defensible, reproducible, conditional estimate of whether and by how much heritage reuse changes landing-failure probability, with the dominant confounder bounded and the uncertainty stated honestly. The **gap** is that the prior chapters have established that no study estimates this conditional hazard; the reconstruction literature documents single missions without estimating a cross-mission effect, the forward architecture studies reason about a hypothetical future fleet, and the spacecraft-reliability literature models on-orbit longevity rather than the discrete success or failure of a landing event and isolates no EDL-novelty regressor [\[127\]](#ref-127)[\[117\]](#ref-117)[\[50\]](#ref-50). The **consequence** of leaving the gap unfilled is that "heritage" continues to be rewarded in portfolio reasoning as a possibly spurious proxy for unmeasured program strength, so that resources are misallocated either by over-investing in lineage continuity or by under-qualifying genuinely novel elements. This chapter's job is to convert the eventual coefficient, of whatever sign, into the interpretation that closes that gap. It does not report results, because none have been executed; it specifies, in advance, what each possible result would mean, so that the interpretation cannot be retrofitted to the number after the number is seen.

A note on confidence calibration governs the entire chapter. Every interpretive claim below is conditioned on an as-yet-unexecuted estimate, so the epistemic modality is uniformly that of a design-stage analysis plan. Where this chapter says "would imply" or "would justify," it means precisely that: a conditional consequence of an outcome that has not occurred. No fitted coefficient is reported as a finding, and the illustrative quartile figures carried from the prospectus reporting format (a modeled drop from roughly forty to roughly fifteen percent across the heritage-index interquartile range at fixed Mars mass) are reporting-format illustrations, not estimates. The confidence attached to the design itself is high: the estimator, controls, dataset, and falsification conditions are fixed in advance and the falsification conditions are strict. The confidence attached to any particular substantive conclusion about heritage remains, by construction, suspended until execution.
## 7.1 If H1 survives the robustness set: heritage has independent protective value

The conclusion of this section is conditional and precise. **If** the executed primary specification returns a negative \( \beta_1 \) whose exact or permutation 95% interval excludes zero, **and** the sign is stable across the complementary-log-log link, the exclusion of low-documentation rows, the recoding of boundary partial-successes in both directions, the inclusion and exclusion of the program-strength control, and the Mokyr novelty decomposition, **then** reuse of a flight-proven EDL architecture lineage lowers the landing-failure hazard independently of the program strength with which heritage is correlated. The evidence for that conclusion would be the coefficient itself, estimated off the within-stratum contrast between higher-heritage and lower-heritage attempts at matched target body and mass. Reading the coefficient as protective is licensed by the identification logic established in Chapter 5: conditioning on the physical controls and the program-strength index removes the most obvious spurious sources of correlation, so that a surviving negative coefficient is interpretable as the conditional counterfactual difference Fogel's framework demands rather than as a raw association [\[121\]](#ref-121)[\[133\]](#ref-133)[\[127\]](#ref-127). That identification logic is in turn supported by the argument carried across the design: the problem is real, the problem is material, the conditional logistic hazard addresses the causal mechanism, the Firth-penalized estimator dominates the alternatives under the small frame, and the residual risk is bounded by pre-registration [\[52\]](#ref-52)[\[68\]](#ref-68).

The limits on this conclusion must be protected and stated, not buried. Even under a surviving negative coefficient, the claim is bounded to the documented Moon, Mars, and Titan record within the historical mass range; it does not extend to crewed-class masses for which no in-frame data exist; and it remains a partial counterfactual in Fogel's sense, omitting the general-equilibrium possibility that the very availability of heritage changes which missions are attempted at all [\[121\]](#ref-121). The objection that would defeat the conclusion despite a surviving coefficient is residual confounding by a program-strength dimension the GAO-based index fails to capture; Section 7.3 treats this directly. With those limits in place, the H1-survives interpretation can be developed without overclaiming.

### 7.1.1 The mechanism the surviving coefficient would confirm

A surviving negative \( \beta_1 \) is not a bare correlation and must not be reported as one. The design names a specific causal mechanism, and the section's interpretive work is to show that a surviving coefficient is consistent with that mechanism operating. The driver is reuse of a flight-proven EDL architecture lineage. The mechanism is that flight has exposed, reconstructed, and codified the lineage's failure modes into propositional knowledge, and that the reused element is operated inside the regime in which it was proven rather than outside it. The observable effect is that fewer failure modes discoverable only in flight are encountered during the irreversible EDL event. The operational consequence is a negative coefficient in the conditional hazard. The strategic implication is an evidence-based EDL portfolio parameter [\[36\]](#ref-36)[\[135\]](#ref-135). This chain is a mechanism and not a correlation because the design identifies \( \beta_1 \) off a conditional within-stratum contrast, holding target, mass, and program strength fixed, so the surviving coefficient is the change in failure probability attributable to lowering the heritage index toward the novel end and not to any of the conditioned-out covariates. Where the conditional contrast cannot be cleanly separated from program strength, the chapter's standing instruction, repeated in Section 7.3, is to say so and downgrade confidence rather than assert the mechanism.

The Mars near-replication chain is the worked illustration of what the mechanism looks like in the record, and it disciplines the interpretation. The Phoenix lander reused Mars Polar Lander and Mars Surveyor heritage with documented lineage, and InSight reused the Phoenix EDL architecture almost without change, producing one of the cleanest near-replication pairs in the population [\[82\]](#ref-82)[\[108\]](#ref-108). Mars 2020 reused the Mars Science Laboratory sky-crane lineage with bounded additions such as terrain-relative navigation and the MEDLI2 instrumentation suite, and the in-flight reconstruction of those events is the literal artifact of the codification the mechanism invokes [\[74\]](#ref-74)[\[71\]](#ref-71)[\[88\]](#ref-88)[\[92\]](#ref-92). If \( \beta_1 \) survives negative, the interpretation is that these near-replications failed less often than matched novel-architecture counterparts would have, and that the reconstruction reports are the medium through which prescriptive recipes became propositional understanding. The interpretation is careful not to read the Mars chain as proof; the Mars chain is a small number of correlated rows, and the coefficient, if it survives, draws its force from the whole conditioned population, not from these cases alone. The cases illustrate the mechanism; the coefficient, were it to survive, would estimate it.

### 7.1.2 The measurable qualification bar for novelty

The most directly actionable consequence of a surviving negative coefficient is that it converts into a qualification bar. If higher heritage lowers the modeled failure hazard by a measured amount, then introducing a novel element raises it by a measured amount, and a program can ask how much additional flight-like qualification a novel element must receive to buy back the excess risk it adds. This is the conceptual objective-to-decision endpoint the bible permits in plain prose: a program weighs the cost of additional qualification for a novel element against the estimated increase in landing-failure probability that the novel element carries. The illustrative reporting format from the prospectus, a modeled move from roughly forty to roughly fifteen percent failure probability across the heritage-index interquartile range at fixed Mars mass, is the shape such a bar would take; it is an illustration of the output format, not an estimate, and it is repeated here only to show how a surviving coefficient would be read into a trade. The substance is that a surviving coefficient turns the heritage-versus-novelty argument from a qualitative engineering judgment into a quantity that can be entered into a trade study, and that this holds even though the coefficient itself remains unexecuted at this stage.

The qualification-bar reading sharpens an existing practice rather than inventing one. The supersonic retropropulsion maturation campaign already behaves as if a novel element must earn its flight readiness through analytical and ground-test grounding before it is trusted on an irreversible descent, and the wind-tunnel and development literature documents exactly that earning process [\[36\]](#ref-36)[\[135\]](#ref-135)[\[66\]](#ref-66)[\[9\]](#ref-9). A surviving negative coefficient would give that practice a number: it would say how large a verification investment a given novel element needs to be risk-neutral relative to its heritage substitute. The high-mass and human-class Mars architecture studies, which establish that mass scaling eventually forces departures from flown heritage toward novel decelerators and retropropulsion, are the setting in which the bar would bite hardest, because there the novelty is not optional and the question is purely how much qualification it must carry [\[4\]](#ref-4)[\[58\]](#ref-58)[\[60\]](#ref-60). The interpretation under H1 is therefore not "always reuse heritage." It is "when you must depart from heritage, here is the measured risk premium you are accepting, and here is the qualification investment that offsets it."

## 7.2 If H0 is not rejected, or the coefficient collapses with the control: the Fogelian conclusion

The conclusion of this section mirrors the last, and it is interpreted with equal prominence because the design committed in advance to doing so. **If** the executed \( \beta_1 \) is indistinguishable from zero in the primary specification, **then** H0 is not rejected and the contribution's central proposition is falsified: heritage carries no independent protective effect against landing failure once physics and program strength are accounted for. **If**, separately, \( \beta_1 \) is large and negative without the program-strength control but collapses toward zero when the control is added, **then** the honest conclusion is that the apparent heritage effect is largely confounded by program strength, which is itself a decision-relevant finding rather than a non-result. The evidence for either conclusion would be the coefficient and its interval; the same identification logic licenses the reading, making the with-and-without-control comparison interpretable as a bound on confounding; and the same supporting argument holds, with the load-bearing addition that the design reports the minimum detectable effect so that a failure to reject H0 can be distinguished from a true null only insofar as power permits [\[52\]](#ref-52)[\[68\]](#ref-68)[\[127\]](#ref-127)[\[117\]](#ref-117).

The qualifier here is the one that most disciplines the null interpretation: a failure to reject H0 in a frame of several dozen attempts may reflect either a genuine absence of effect or insufficient statistical power, and the two must not be conflated. The design's commitment to reporting the minimum detectable effect size is the apparatus that keeps this qualifier honest. If the realized power is low, the correct conclusion is not "heritage does not matter" but "the population frame cannot distinguish a moderate heritage effect from zero," which is a weaker and more accurate claim. The objection that would overturn a too-quick null reading is therefore a power objection, and the chapter accepts it in advance: a wide interval that includes zero is reported as inconclusive, not as confirmation of H0.

### 7.2.1 What the confounded branch would mean for NASA and JPL

The confounded branch is the most instructive of the three outcomes because it is the one the Fogelian framework predicts is most likely and most useful. If heritage reuse lowers the raw failure odds but the effect dissolves once program strength is conditioned, the mechanism is not that heritage hardware protects the vehicle but that the kinds of programs able to afford extensive heritage reuse are also the kinds with the deepest engineering reserves, the most experienced teams, and the most rigorous verification, and it is those underlying strengths, not the lineage, that do the protecting. This is the EDL instantiation of Fogel's central lesson: the apparently indispensable factor turns out to be a stand-in for substitutable strengths, and the marginal value of the factor itself is small once the substitute is specified [\[121\]](#ref-121)[\[133\]](#ref-133). The policy implication is direct and is the opposite of the H1 implication. Under confounding, NASA and JPL should not reward heritage per se in portfolio decisions, because doing so would be paying for a label rather than for the engineering substance the label correlates with. They should instead invest in the substance: independent verification, flight-like qualification, organizational EDL experience, and the reconstruction depth that converts flights into knowledge.

This reading does not denigrate heritage; it relocates the value. Even under confounding, the reconstruction reports remain valuable, because the mechanism that does the protecting, deep engineering reserves and codified failure-mode knowledge, is partly constituted by the very reconstruction activity that heritage missions generate [\[71\]](#ref-71)[\[92\]](#ref-92). The InSight near-replication strategy would, under the confounded branch, be re-described not as "reuse protected us" but as "the program strength that let us reuse also let us execute," and the recommendation would be to ensure that novel-architecture programs are resourced to the same depth rather than penalized for lacking lineage [\[82\]](#ref-82). The confounded finding would thus redirect rather than abolish the heritage conversation, and it would do so in a way more defensible than the intuition it replaces, because it would name the substitutable strengths explicitly instead of hiding them inside the word "heritage."

### 7.2.2 Why a null is a contribution, not a disappointment

A study that can only interpret its favorable outcome is not a hypothesis test; it is advocacy. The design's symmetric commitment to interpreting the null is what makes the proposition a genuine hypothesis rather than a narrative, and the discussion honors that by treating the null as a finding with its own implications rather than as a void. If heritage has no independent protective effect, the field has learned that a constant practitioner assertion does not survive a conditional population-level test, which is exactly the kind of result cliometric method was built to deliver and which the railroad counterfactual exemplifies [\[121\]](#ref-121). The decision value is real: a credible null tells a program that the heritage label should not by itself buy down the qualification budget for a novel element, because the label carries no measured protection once program strength is matched. That is a different and arguably more disciplined posture than the intuition it replaces, and it is available only because the design pre-committed to reporting the null with the same prominence as a rejection. The chapter therefore declines to treat any of the three outcomes, rejection, null, or confounded, as a preferred result; each is reported as decision-relevant, the property that justified the dissertation in the first place.

## 7.3 Rival explanations and the design's response

Every causal claim in this chapter is exposed to rival explanations, and a credible design must beat the alternatives rather than merely assert its own. This section engages the four principal rivals in turn, states the design's response to each, and is candid about the residual each leaves. The rivals are not strawmen; each is a live account that could, if unaddressed, explain a negative raw association between heritage and failure without any genuine protective mechanism.

### 7.3.1 Confounding by program strength

The first and most dangerous rival is that well-funded, experienced programs both reuse heritage and execute better, so that any heritage advantage is a program-strength artifact. This rival is why the program-strength index, built from GAO cost-and-schedule data and organizational flight experience, sits in the main specification rather than in a robustness check. The design's response is the with-and-without-control comparison: \( \beta_1 \) is reported both with and without the program-strength control, and the movement between the two estimates bounds the confounding. The design must concede that the GAO-based index is an imperfect proxy for the full construct of program strength; it captures cost, schedule, and flight experience but cannot capture every dimension of organizational competence. The chapter therefore states the residual: if \( \beta_1 \) survives the control, the surviving effect could still reflect a program-strength dimension the index misses, and confidence in the protective interpretation is bounded by the quality of the index. This is the rival that most justifies the chapter's standing instruction to downgrade confidence to "moderate" rather than "high" even under a surviving coefficient, because the program-strength confounder can be bounded but not eliminated with the available data.

### 7.3.2 Target-difficulty selection

The second rival is that heritage is reused mainly on easier missions, so that the heritage rows are systematically less physically demanding than the novel rows and the apparent advantage is a difficulty artifact. The design's response is the set of physical controls: target-body indicators absorb the gross difficulty differences among an airless body, a thin-atmosphere body, and a thick-atmosphere body, and entry mass and landed mass absorb the documented scaling of EDL difficulty with mass that motivates the entire high-mass architecture literature [\[4\]](#ref-4)[\[58\]](#ref-58)[\[60\]](#ref-60). Within a target-and-mass stratum, the heritage-versus-novel contrast is between attempts of comparable physical difficulty, which is what conditioning is for. The residual the chapter concedes is that the controls absorb only the measurable part of difficulty; an unmeasured difficulty dimension correlated with both heritage and outcome would remain. The lunar record is the relevant stress case, because lunar attempts span the full heritage spectrum at broadly comparable target difficulty, from heritage-derived government landers to first-flight commercial architectures, and several novel-architecture lunar attempts failed or landed anomalously [\[64\]](#ref-64)[\[109\]](#ref-109). If the heritage effect were pure difficulty selection, it should weaken sharply within the lunar stratum where difficulty is more nearly held constant; the design's stratified reporting is what would reveal whether it does.

### 7.3.3 Documentation bias

The third rival is that well-documented heritage missions are coded more favorably than poorly documented ones, so that the heritage index rewards documentation rather than genuine architectural similarity, and the U.S. and European attempts that dominate the reconstruction record receive systematically higher heritage scores for reasons of paperwork rather than engineering. This is a construct-validity threat to the treatment variable itself, and the design's response is twofold: an inter-coder reliability check on a subsample, and a low-documentation sensitivity analysis that flags every poorly documented row and re-estimates with those rows excluded. The chapter must concede that documentation asymmetry is real and structural; the Mars and U.S. lunar attempts are reconstructed in far finer detail than some others, and the reconstruction-depth weighting that gives the index its Mokyr propositional grounding is itself correlated with documentation availability [\[71\]](#ref-71)[\[92\]](#ref-92)[\[94\]](#ref-94). The honest position is that the heritage index is most trustworthy in the well-documented core of the population and least trustworthy at its sparsely documented edges, and that the sensitivity analysis is what bounds the influence of the uncertain rows. A coefficient that survives the exclusion of low-documentation rows is more credible than one that depends on them.
### 7.3.4 The Mokyr reframing: codified knowledge, not hardware

The fourth rival is the most interesting because it does not refute the contribution but reinterprets it. Following Mokyr, the real driver of any heritage advantage may be codified propositional knowledge rather than heritage hardware as such, in which case the heritage index is a proxy for knowledge maturity and the protective effect operates because flight converts prescriptive recipes into propositional understanding [\[139\]](#ref-139). The design treats this not as a threat to be defeated but as a sub-hypothesis to be tested, and the novelty decomposition described in the next section is the apparatus. If the rival holds, the contribution is not falsified; it is sharpened into a knowledge-codification claim, and the recommendation shifts from "reuse heritage" to "invest in the reconstruction and codification that make any architecture, heritage or novel, propositionally understood." This reframing is consistent with a surviving negative coefficient and changes its interpretation rather than its sign. That is why the chapter treats it separately from the three confounding rivals: those three could explain away the coefficient, whereas the Mokyr rival explains it differently.

## 7.4 The Mokyr decomposition reading

The novelty term in the heritage index can be split into propositionally grounded and ungrounded components, and the pattern of excess risk across that split is a testable sub-implication that strengthens or weakens the knowledge-codification interpretation without altering the headline hypothesis. This rests on the Mokyr and Perez distinction between propositional knowledge, the understanding of why a technique works, and prescriptive knowledge, the recipe for doing it; techniques resting on deep propositional understanding are extensible and self-correcting, while techniques discovered by trial without underlying theory fail unpredictably outside their tested range [\[139\]](#ref-139). Flight history, captured in the NTRS reconstruction reports, is the conversion mechanism that turns recipes into understanding, so the protective effect of heritage should concentrate in elements whose flight produced codified knowledge. The supersonic retropropulsion literature is the corpus's clearest example of novelty grounded in extensive analytical and ground-test maturation rather than in trial alone [\[36\]](#ref-36)[\[135\]](#ref-135)[\[66\]](#ref-66)[\[9\]](#ref-9).

The decomposition generates a specific expected pattern, stated here as a sub-implication and not a finding. If the heritage effect is knowledge-based rather than age-based, the excess risk should load on ungrounded novelty, while propositionally grounded novelty such as supersonic retropropulsion, matured through wind-tunnel and computational campaigns, should carry a smaller risk premium. A finding that all novelty carries equal excess risk regardless of analytical grounding would still be consistent with H1 but would weaken the Mokyr interpretation, pushing the reading back toward "age and flight count, not codification." A finding that the excess risk loads heavily on ungrounded novelty and only lightly on grounded novelty would be the strongest available evidence that the mechanism is codified knowledge, and it would carry the practical lesson that a novel element backed by deep analysis is closer to a heritage element in risk than its lack of flight history alone would suggest [\[36\]](#ref-36)[\[66\]](#ref-66). The decomposition is estimated on the same small frame as the headline coefficient, so its power to distinguish grounded from ungrounded loading is limited, and the result is reported as suggestive rather than decisive. One concern remains: the grounded-versus-ungrounded coding is itself a construct that the analyst imposes, and the design treats it with the same pre-registration and inter-coder discipline as the heritage index proper, to guard against post hoc sorting of elements into whichever bin fits the result.

The decomposition also clarifies what the dissertation's two anchors jointly buy. Fogel supplies the counterfactual discipline that makes \( \beta_1 \) a measured contrast rather than a raw association, and Mokyr supplies the reading that tells us what the contrast is a contrast in: not hardware age, but the depth of propositional knowledge that flight and reconstruction have produced. The two are complementary rather than redundant. A Fogelian estimate without the Mokyr reading would tell us heritage matters but not why; a Mokyr reading without the Fogelian estimate would assert a knowledge mechanism without measuring it. Together they specify both the estimator family, a conditional counterfactual logistic hazard, and its interpretation, a knowledge-codification effect with a testable novelty decomposition. This is the synthesis the theoretical framework chapter built and which the discussion now cashes out interpretively.

### 7.4.1 Why the regime-aware coding of heritage matters to the reading

A subtle but consequential feature of the heritage index is that an element is scored against the regime in which it was proven, not merely against whether it flew before, and the Mokyr reading is what makes this coding choice intelligible rather than arbitrary. An element flown well outside its qualified envelope receives a low heritage score even though it has flight history, because the propositional knowledge that flight produced applies to the regime in which the element was exercised and not to a regime it has never seen. The interpretive consequence is that a surviving negative \( \beta_1 \) should not be read as "old hardware is safe" but as "hardware operated inside its codified-knowledge envelope is safe," and the two are different claims with different policy content. Mokyr's account of why trial-based techniques fail unpredictably outside their tested range justifies this distinction: a heritage element pushed outside its proven regime is, epistemically, closer to ungrounded novelty than to grounded heritage, because the understanding that protected it no longer covers the conditions it now faces [\[139\]](#ref-139). The chapter therefore reads any surviving heritage effect as a statement about operating elements within their understood envelope, and it reads the failure of an over-confident reuse, an element flown outside its regime on the strength of its label, as the mechanism by which heritage can become a hidden hazard rather than a protection.

This regime-aware reading bears directly on how the confounded branch would be interpreted as well. If \( \beta_1 \) collapses with the program-strength control, one plausible component of the collapse is that strong programs are precisely the ones disciplined enough to keep reused elements inside their proven envelopes, while weaker programs are the ones tempted to fly a heritage element outside its regime to save cost or schedule. On that account the protective value attributed to heritage is partly the value of the organizational discipline that keeps heritage honest, which is itself a program-strength dimension. The chapter flags this as a reason the heritage and program-strength constructs are conceptually entangled even after the GAO-based index does its work, and it is one of the considerations that keeps the confidence on any surviving coefficient at moderate rather than high. The regime-aware coding does not dissolve the entanglement; it makes the entanglement legible, which is the most the design can honestly claim.

### 7.4.2 The interaction the design does not estimate, and why that is honest

A natural question a reader will press is whether the heritage effect varies by target body, so that heritage protects more on Mars, where aerothermal entry dominates and reconstruction is deepest, than on the Moon, where powered descent and terminal hazard avoidance dominate and the reconstruction record is thinner [\[92\]](#ref-92)[\[64\]](#ref-64). The honest answer is that the small frame does not support a well-identified heritage-by-target interaction term: adding interactions to a few dozen rows with a handful of events would overfit and inflate the very small-sample pathologies the Firth penalization is meant to control [\[52\]](#ref-52)[\[68\]](#ref-68). The design therefore does not estimate the interaction in the primary specification, and the chapter is candid that this is a power-driven omission rather than a substantive judgment that no interaction exists. The interpretive cost is real: a single pooled heritage coefficient averages over any genuine target-specific heterogeneity, so the reported \( \beta_1 \) is a population-average heritage effect and not a target-conditional one. The chapter states this as a limitation on the granularity of the decision-relevance rather than as a flaw in the headline test, and it notes that a target-stratified heritage effect is exactly the kind of refinement a larger future frame, enriched by additional lunar attempts as the current cadence of commercial and government landers continues, would eventually permit [\[109\]](#ref-109)[\[94\]](#ref-94).

## 7.5 Stakeholder implications for NASA, JPL, and the mission portfolio

The contribution, under either branch, changes how three identifiable groups of stakeholders should reason, and this section names the change for each rather than leaving "decision-relevance" abstract. The recurring portfolio decisions in which the heritage-versus-novelty trade is explicit are where a measured coefficient, or a credible failure to find one, enters in place of an intuition, and the architecture and reconstruction literature documents the decisions actually being made [\[4\]](#ref-4)[\[58\]](#ref-58)[\[82\]](#ref-82)[\[74\]](#ref-74).

For **EDL system architects and mission formulators at JPL**, the implication under H1 is that the heritage-versus-novelty trade acquires a price: a novel element's excess risk can be quoted, and the qualification investment needed to offset it can be budgeted at formulation rather than discovered in flight. Under the null or confounded branch, the implication reverses. Architects should not let a heritage label substitute for qualification, because the label carries no measured protection once program strength is matched, and a reused element still requires verification that it is operating inside its proven regime. In both branches the contribution gives architects a more disciplined vocabulary than "flight-proven," which the regime-aware reading has already shown to be ambiguous between "proven in this regime" and "flown at all" [\[139\]](#ref-139)[\[36\]](#ref-36).

For **NASA portfolio and investment decision-makers**, the implication concerns where to put technology-maturation dollars. If heritage has independent protective value concentrated in codified, reconstructed elements, then the reconstruction activity itself, the instrumented entry and the detailed post-flight analysis exemplified by the MEDLI and MEDLI2 suites, is a portfolio investment with measurable downstream return, because it is the mechanism that converts a flight into the propositional knowledge that protects the next mission [\[71\]](#ref-71)[\[92\]](#ref-92). If instead the effect is confounded, the dollars are better directed at the engineering reserves, independent verification, and organizational EDL experience that the analysis identifies as the substantive driver. Either way the decision-maker gains a defensible basis for an allocation that is currently made on intuition, and the Fogelian discipline ensures the allocation is justified by a marginal effect relative to a substitute rather than by an absolute reverence for heritage [\[121\]](#ref-121)[\[133\]](#ref-133).

For **commercial lander providers and the programs that evaluate them**, the implication is the most pointed. A first-flight commercial architecture, whose EDL software and propulsion have never executed a real powered descent, sits at the novel end of the heritage index by construction, and the recent lunar record shows that several such attempts failed or landed anomalously [\[64\]](#ref-64)[\[109\]](#ref-109). Under H1, the contribution would quantify the excess risk such an architecture carries and the qualification it would need to buy that risk down, giving both the provider and the evaluating program a number to negotiate against rather than a reputational impression. Under the confounded branch, the contribution would caution against penalizing a commercial provider for lacking lineage when the operative protective factor is program strength, and would instead direct attention to whether the provider is resourced to the verification depth that strength implies. The chapter is careful that neither reading is a verdict on any specific provider; the contribution is a population-level parameter, and its stakeholder value is in pricing a class of architectural choices, not in adjudicating an individual vehicle.

## 7.6 External validity

The contribution's external reach is bounded, in advance and explicitly, to landing attempts at the Moon, Mars, and Titan within the documented historical mass range, and that bound is a feature of intellectual honesty rather than a limitation to be apologized for. The boundary follows from the population frame itself: the unit of analysis is the individual landing attempt at these three bodies, and no crewed-class attempt exists in the record, so any estimate is silent about crewed EDL by construction [\[94\]](#ref-94). An estimate identified on a population cannot be assumed to transport to a population with different physics, mass classes, or organizational conditions without an explicit transport argument. The architecture-study literature's own warning sharpens the point: crewed-class Mars EDL will require novel decelerators and retropropulsion that have no flown heritage, so the heritage-versus-novelty trade at crewed mass is qualitatively different from the trade in the historical frame and cannot be read off the historical coefficient [\[58\]](#ref-58)[\[60\]](#ref-60).

The Titan data point carries a specific and limited evidentiary role that this section states precisely, so it is neither overclaimed nor dismissed. Huygens contributes a single row whose architecture was effectively novel for its target, and Titan is chemically and dynamically different from both Mars and the Moon, so the Titan row tests whether a heritage effect estimated mostly on Mars and the Moon shows any sign of generalizing to a third, different body [\[131\]](#ref-131). It tests but cannot establish generalization; one row has no statistical power to confirm transport, and its value is as a probe that could falsify a strong universality claim rather than as evidence that could confirm one. The honest external-validity statement is therefore asymmetric: a heritage effect that vanished or reversed at Titan would be a warning that the Mars-and-Moon estimate does not generalize, whereas a Titan row consistent with the Mars-and-Moon pattern would be reassuring but not conclusive. Extension to outer-planet and ocean-world entries is identified as future work, and the ocean-worlds exploration literature is the setting in which such an extension would eventually be framed, but it is outside the present frame and the contribution makes no claim there [\[101\]](#ref-101)[\[131\]](#ref-131).

The mass-range bound deserves one further sentence of interpretation, because it is the one most likely to be misread by a practitioner eager for a crewed-EDL answer. The historical frame spans robotic masses, and within that frame entry mass and landed mass are controls that absorb the scaling of difficulty; but the controls interpolate within the observed range and do not extrapolate beyond it. A program contemplating a payload an order of magnitude heavier than anything in the frame cannot use the estimated coefficient to price its heritage-versus-novelty trade, because the coefficient was never identified at that mass and the physics of decelerator performance changes qualitatively with scale [\[4\]](#ref-4)[\[58\]](#ref-58). The contribution is candid that its decision-relevance is greatest for missions inside the historical envelope and weakest at its frontier, which is precisely where the forward architecture studies, not this dissertation, are the appropriate guide.

## 7.7 Summary and the objective-to-decision endpoint

The chapter closes by drawing its argument together and stating, in plain prose only, the conceptual endpoint at which a fitted coefficient becomes an input to an EDL portfolio decision. The five strands of that argument have been engaged across the design and are now interpreted in their discussion form. Landing concentrates mission risk into minutes of irreversible autonomous operation, and recent attempts span the full heritage spectrum with several novel-architecture losses [\[88\]](#ref-88)[\[64\]](#ref-64)[\[109\]](#ref-109). NASA and JPL make recurring heritage-versus-novelty EDL portfolio decisions, and mass scaling forces departures from flown heritage that the high-mass studies enumerate [\[4\]](#ref-4)[\[58\]](#ref-58)[\[60\]](#ref-60). The estimator addresses the mechanism: a conditional Firth-penalized logistic on the heritage index, with physical and program-strength controls, measures the Fogelian counterfactual contrast directly [\[121\]](#ref-121)[\[133\]](#ref-133)[\[52\]](#ref-52). It is the natural one-shot-event estimator, Firth penalization dominates ordinary maximum likelihood under the small frame and quasi-separation, and the complementary-log-log link confirms the conclusion is not a logit artifact [\[52\]](#ref-52)[\[68\]](#ref-68)[\[8\]](#ref-8). The residual risk is acceptable: small sample, construct risk in the heritage index, documentation asymmetry, and confounding by program strength are bounded by pre-registration, exact or permutation inference, blind and inter-coder coding, low-documentation sensitivity, with-and-without-control bounding, and honest design-stage framing [\[52\]](#ref-52)[\[19\]](#ref-19)[\[3\]](#ref-3)[\[94\]](#ref-94)[\[2\]](#ref-2)[\[50\]](#ref-50). This section's role is to confirm that each of those strands holds at the discussion level.

The objective-to-decision endpoint is stated conceptually and in plain prose, consistent with the dissertation's standing scope decision, and no architecture table is populated because this is an observational measurement study and not a real DoDAF or BEA system, capability, or data-service exchange. The endpoint is this: a program weighs the cost of additional qualification for a novel EDL element against the estimated increase in landing-failure probability that the novel element carries, and the fitted \( \beta_1 \), under the H1-survives branch, is the input that prices that increase. Under the H0-not-rejected or confounded branch, the same endpoint is reached with the opposite content: the program learns that the heritage label does not by itself lower the qualification it should demand, and that the resources it might have spent buying lineage continuity are better spent on the verification rigor and engineering reserves that the analysis identifies as the substantive driver. In both branches the coefficient is an input to a trade, not a system to be architected, and the chapter declines to force capability or data-exchange vocabulary onto a contribution that is a single estimated number. That restraint is itself a methodological commitment consistent with the dissertation's anchors: Fogel's counterfactual is a number with a confidence interval, not an enterprise architecture, and the honest discussion of what the number means stops exactly where the number's identification stops.

The chapter's final interpretive posture, then, is the one it announced at the outset. The dissertation does not need the coefficient to be negative to be worth defending. It needs the coefficient to be **estimated against the whole population with controls, pre-registered, and falsifiable**, so that whichever branch the data select, NASA and JPL gain a defensible EDL portfolio parameter where before they had only an intuition tested against anecdotes. A surviving negative coefficient would justify a conservative lineage strategy and set a measurable qualification bar for novelty. A null or confounded coefficient would redirect investment from heritage as a goal toward the engineering reserves and codified knowledge that heritage proxies. The Mokyr decomposition would, in either case, tell the field whether the operative mechanism is hardware age or codified propositional knowledge, and the external-validity envelope keeps every one of these claims bounded to the Moon, Mars, and Titan record within the documented mass range. The discussion's contribution is to have specified all of this before the data spoke, so that the interpretation that follows execution will be the one written here and not one retrofitted to a coefficient already seen.


# Chapter 8: Conclusion
## 8.0 The answer this dissertation leaves on the table

This dissertation delivers a single conditional coefficient, or a credible failure to find one, and either result is the contribution. The proposition under test is narrow and falsifiable: conditional on target body, entry mass, and landed mass, planetary landing attempts that reuse a flight-proven entry-descent-landing architecture lineage exhibit a lower landing-failure hazard than attempts that introduce novel EDL elements. In the canonical estimating equation, the contribution lives entirely in \( \beta_1 \), the coefficient on the EDL-heritage-reuse index in the Firth-penalized logistic hazard model

\[ \operatorname{logit} \Pr(\text{failure}_i = 1) = \beta_0 + \beta_1 \, \text{heritage\_index}_i + \boldsymbol{\gamma}' \mathbf{controls}_i + \epsilon_i \qquad\qquad (1) \]

where \( \mathbf{controls}_i \) contains target-body indicators, entry mass, landed mass, and the program-strength index. H1 predicts \( \beta_1 \) below zero with an exact or permutation interval that excludes zero and a sign stable across the pre-registered robustness set; H0 predicts \( \beta_1 \) equal to zero. The decision rule was fixed before any model was fitted, so the answer the dissertation produces does not depend on which specification was searched for last.

This conclusion can be stated as an answer rather than a hope because the design is symmetric in its value. Most dissertations grow anxious about confirming their hypothesis, since a disconfirmation feels like wasted effort. This one does not, because the object of the contribution is the measurement and not the sign. A negative, unconfounded \( \beta_1 \) tells NASA and the Jet Propulsion Laboratory how much a flight-proven lineage is worth in failure-probability terms, and it sets a measurable bar for how much extra qualification a novel element must earn to offset its excess risk. A \( \beta_1 \) indistinguishable from zero, or one that is negative without the program-strength control but collapses toward zero once that control is added, tells the same institutions something equally actionable and arguably more surprising: that "heritage" has been silently rewarded as a proxy for unmeasured program strength, and that the resources spent chasing lineage continuity would be better spent on engineering reserves and verification rigor. The disjunction is the deliverable. That is what it means to convert a constant practitioner intuition into a falsifiable parameter rather than a narrative, and it is the spine of everything the preceding seven chapters built.

This closing chapter restates the contribution under both branches of that disjunction, states honestly what the work does and does not establish at the design stage, names the limitations that bound any future estimate, lays out a concrete program for converting the frozen design into an executed result on the full population, and draws together the argument that has run through the dissertation: the problem is real, the problem is material, the design addresses the causal mechanism, it beats the alternatives, and the residual risk is acceptable.

## 8.1 The contribution restated: one coefficient, two decision-relevant readings

The current state of EDL portfolio reasoning is that programs weight the heritage-versus-novelty trade on an engineering intuition. A flown architecture has survived a real descent and had its failure modes observed, tested only against curated mission anecdotes and never against the full population of attempts with physical and program-strength controls. The desired state is a defensible, reproducible, conditional estimate of whether heritage reuse changes landing-failure probability, and by how much, with the program-strength confounder explicitly bounded and the uncertainty stated honestly. The gap between those states is the absence of any study that estimates a landing-failure hazard as a function of a constructed EDL-heritage-reuse index across the Moon, Mars, and Titan record while conditioning on target body and mass. Leaving that gap unfilled means the recurring EDL trade, fly the sky-crane lineage again, introduce supersonic retropropulsion or an inflatable decelerator for a higher mass class, weight a commercial lander's novel architecture against its lack of flight-proven EDL, is decided by intuition that may be measuring the wrong thing. The dissertation's contribution is the instrument that closes the gap: the heritage index, the conditional logistic hazard, the pre-registered specification, and the falsification conditions, together producing one coefficient with two readings.

The first reading is the confirmatory branch. If the assembled population yields a \( \beta_1 \) that is negative, whose exact or permutation interval excludes zero, and whose sign survives the robustness set, then heritage reuse carries an independent protective effect beyond the program strength it correlates with. This reading rests on the conditional comparison the design enforces: among attempts at the same target body and similar mass, those with higher documented heritage reuse would, under this branch, fail less often even after the program-strength index is held fixed. The within-stratum contrast itself carries the interpretation, because it is the operationalized form of Fogel's counterfactual discipline: an innovation's value is defined only relative to its next-best substitute, and \( \beta_1 \) estimates exactly the change in failure probability that would occur if a given attempt's heritage index were lowered toward the novel end while target, mass, and program strength were held constant [\[121\]](#ref-121). Behind it stands the cliometric tradition that established conditional, counterfactual estimation as a hypothesis-testing science rather than a descriptive one [\[121\]](#ref-121), reinforced by the social-savings literature that taught the field to read a single conditional coefficient as a policy-relevant magnitude [\[133\]](#ref-133). One limit is essential and must be protected: this is a partial counterfactual in Fogel's own sense, and it does not capture general-equilibrium effects such as the availability of heritage changing which missions are attempted at all. The account that would defeat the protective reading is confounding by program strength, which the with-and-without sensitivity analysis is built to surface.

The second reading is the null or confounded branch, and the design commits in advance to reporting it with equal prominence. If \( \beta_1 \) is indistinguishable from zero in the primary specification, H0 is not rejected and the contribution is, in the strict sense, falsified: heritage would be shown to carry no independent protective effect once physics and program strength are accounted for. If instead \( \beta_1 \) is large and negative without the program-strength control but collapses toward zero when that control is added, the honest conclusion is that the apparent heritage effect is largely confounded. This is not a failure of the dissertation; it is a finding, and a consequential one. It would mean that a generation of portfolio reasoning has been crediting lineage continuity for outcomes actually produced by the funding, schedule reserve, and institutional experience that tend to travel with heritage. The confidence attached to this reading at the design stage is necessarily provisional, because no coefficient has been fitted. What the design can promise is that the reading will be reported truthfully and that the mechanism by which confounding would manifest, a coefficient that moves under the program-strength control, is named in advance so the result cannot be reinterpreted after the fact.

Both readings share one property that justifies the entire enterprise: each is decision-relevant. A contribution whose only valuable outcome is confirmation is fragile, because it gives the analyst an incentive to find the confirmation. A contribution that is valuable whichever way the coefficient falls resists that incentive, and it is the kind of contribution worth defending before a doctoral board.

## 8.2 The bridge the contribution builds

What stands even if the hypothesis is not confirmed is the bridge between three literatures that have never been joined, and that bridge is itself a permanent contribution independent of the sign of \( \beta_1 \). The EDL field has, on one side, a rich body of single-mission reconstruction. The Mars Science Laboratory system overview and its performance and reconstruction reports trace a guided-entry, supersonic-parachute, powered-descent, sky-crane architecture whose elements were deliberately inherited from and deliberately departed from prior heritage [\[88\]](#ref-88)[\[81\]](#ref-81); the Phoenix and InSight reconstructions document one of the cleanest near-replication chains in the record [\[82\]](#ref-82)[\[108\]](#ref-108); the Mars 2020 overview and its instrumentation suite extend the sky-crane lineage with bounded additions [\[71\]](#ref-71). On a second side, the field has forward-looking architecture studies that quantify the decelerator and propulsion trade space for payloads beyond the proven mass class and name the novel technologies, supersonic retropropulsion and inflatable aerodynamic decelerators, that higher mass forces [\[4\]](#ref-4)[\[58\]](#ref-58)[\[60\]](#ref-60). On a third side, it has a spacecraft-reliability tradition that models failure distributions across launch cohorts and demonstrates that discrete-outcome and time-to-failure estimation are accepted tools in the domain [\[127\]](#ref-127)[\[117\]](#ref-117).

None of these three literatures estimates the conditional heritage effect. The reconstruction reports document single missions in fine detail but estimate no cross-mission coefficient. The architecture studies reason forward about a hypothetical future fleet rather than backward from the historical record. The reliability statistics model the on-orbit longevity of operating satellites, not the discrete success or failure of a landing event, and they isolate no EDL-architectural-novelty regressor [\[127\]](#ref-127). The dissertation's standing contribution, prior to and independent of any fitted result, is the apparatus that makes the three speak to one another: it takes the architectural lineage documented in the reconstruction reports, the novelty taxonomy supplied by the architecture studies, and the discrete-outcome estimation precedent supplied by the reliability tradition, and it fuses them into a single hazard model of landing failure on a heritage index. That fusion is reusable. Even a null result leaves behind a frozen population frame, a documented heritage-index rubric, a pre-registered estimator, and a reproducible coding protocol that any future analyst can extend as the record grows. The instrument outlives the first estimate.

## 8.3 How the anchors sharpened the test

The two methodological anchors are not decoration. Each does specific work that a bare statistical model would leave undone, and naming that work is part of the conclusion.

Fogel's cliometric counterfactual discipline supplied three requirements that shaped the design and that survive whatever the data say [\[121\]](#ref-121). First, state the proposition quantitatively: the contribution is a coefficient with a sign and an interval, not a qualitative assertion that heritage helps. Second, build the counterfactual into the design rather than choosing it to fit the conclusion: conditioning on target body, mass, and program strength is the counterfactual, because \( \beta_1 \) is identified off the within-stratum contrast between heritage and novel attempts that are otherwise matched. Third, let the data falsify: the pre-registered decision rule and the symmetric reporting commitment mean the design can disconfirm itself. Fogel's own caution about partial counterfactuals also survives as a permanent limitation on interpretation, which Section 8.4 carries forward: a single-coefficient estimate omits the induced effect by which the availability of heritage may change which missions are attempted, and the design is candid that it does not capture that channel. The mechanism here is explicit and not a bare correlation. The driver is reuse of a flight-proven EDL architecture lineage; the mechanism is that flight has exposed, reconstructed, and codified that lineage's failure modes into understanding while the element operates inside its proven regime; the observable effect is that fewer in-flight-only-discoverable failure modes are encountered during the irreversible EDL event; the operational consequence is a measurable \( \beta_1 \) below zero in the conditional hazard; and the strategic implication is an evidence-based qualification bar for novelty. Where only correlation survives, for instance if the heritage index proves inseparable from the program-strength index, the design requires that this be stated and the causal confidence downgraded, not papered over.

Mokyr's distinction between propositional and prescriptive useful knowledge sharpened the test in a way Fogel alone could not [\[139\]](#ref-139). It reframes any heritage effect as plausibly a knowledge-codification effect: heritage may protect not because the hardware is old but because flight converts prescriptive recipes into propositional understanding, so that failure modes become understood rather than merely avoided. This reframing has two concrete consequences in the design that endure regardless of outcome. The first is the reconstruction-depth weighting of the heritage index: a mission that flew but was poorly reconstructed yields weak propositional knowledge and is weighted to confer a smaller protective effect than a mission whose EDL was instrumented and reconstructed in fine detail, of which the MEDLI and MEDLI2 suites are the literal artifact [\[71\]](#ref-71). The second is the novelty decomposition: the design splits the novelty captured in the heritage index into propositionally grounded novelty, elements matured through extensive analytical and ground-test campaigns such as supersonic retropropulsion [\[36\]](#ref-36)[\[135\]](#ref-135)[\[66\]](#ref-66)[\[9\]](#ref-9), and ungrounded novelty, elements flown first with thin analytical backing. If the heritage effect operates through codified knowledge rather than mere age, the excess risk should load on ungrounded novelty. This is a testable sub-implication that can strengthen or weaken the causal interpretation without changing the headline hypothesis, and it is the most distinctive analytical move the dissertation makes. Even if the headline \( \beta_1 \) is null, the Mokyr decomposition leaves behind a defensible way to ask whether the field's intuition is about hardware lineage at all, or about the codification that flight produces.

## 8.4 Limitations stated honestly

A design-stage dissertation earns its credibility by naming what would bound or defeat its eventual estimate, and four limitations are structural rather than incidental.

The first and most consequential is the size of the population frame. The total number of documented landing attempts at the Moon, Mars, and Titan is on the order of several dozen, with Mars and the Moon contributing most rows and Titan contributing one. This is small by any statistical standard, and it is the reason the estimator is a Firth-penalized logistic regression rather than ordinary maximum likelihood: penalization is required to handle small-sample bias and any quasi-separation, and exact or permutation inference is required because asymptotic intervals are untrustworthy at this event count [\[52\]](#ref-52)[\[68\]](#ref-68)[\[8\]](#ref-8). The honest consequence is that a failure to reject H0 must be interpreted carefully, because it can mean either a true null or insufficient power, and the design commits to reporting the minimum detectable effect size so the two are never conflated. The frame cannot be enlarged by methodological cleverness; it can only grow as the record itself grows, which is why the execution program in Section 8.5 treats the frame as a living object.

The second limitation is documentation asymmetry. United States and European attempts are far more thoroughly reconstructed than some others, and because the heritage index is coded from documents, lineage that is poorly documented is coded with more uncertainty. This can bias the index where the architectural record is thin. The design's response is to flag every low-documentation row and to report a sensitivity analysis that excludes them, but the asymmetry is real and limits how confidently the index can be treated as a uniform measurement across the full population.

The third limitation is construct risk in the two analyst-coded variables. The heritage index is a constructed proxy for an unobservable, the true architectural similarity of an attempt to flown systems, and the outcome variable requires a coding rule for partial successes such as a survivable landing with anomalous attitude [\[109\]](#ref-109). Both are defended by pre-registration, by blind coding of architecture before outcome, by an inter-coder reliability check on a random subsample, and by the partial-success sensitivity recoding in both directions. These defenses bound the risk; they do not eliminate the fact that the treatment and the outcome are both measured by the analyst from text, which is a different epistemic position than reading them off an instrument.

The fourth limitation is external validity. Estimates dominated by Mars and the Moon may not generalize to Titan or to outer-planet entries, and the single Titan data point is retained precisely to probe, not to establish, that generalization [\[101\]](#ref-101)[\[131\]](#ref-131). Generalization to crewed-class masses is explicitly out of scope, because no crewed landing attempts exist in the frame and the architecture studies warn that crewed masses force novel decelerators for which no flown heritage exists [\[58\]](#ref-58)[\[60\]](#ref-60). The contribution's external claim is therefore bounded in advance to landing attempts at the three named bodies within the documented historical mass range, and the conclusion does not stretch past that boundary.

One scope decision deserves explicit restatement because it bears on how the contribution should and should not be read. This is an observational, design-stage measurement study; the contribution is a single estimated coefficient, not a system, capability, or data-service exchange. Architecture-traceability vocabulary is therefore deliberately absent from the dissertation, and the one permitted bridge to portfolio practice is conceptual and in plain prose: the fitted \( \beta_1 \) is an input to an EDL architecture trade, in which a program weighs the cost of additional qualification for a novel element against the estimated increase in landing-failure probability. That is the proper and only claim the coefficient licenses; it does not license a formal architecture model, and the dissertation does not assert one.
## 8.5 From design to execution: a concrete future-research program

The central deliverable at this stage is the pre-registered, falsifiable design itself, and the next step is execution of the frozen analysis plan on the assembled population. The path from design to executed result is sequenced and specific, and stating it precisely is part of the contribution, because it makes the work reproducible by someone other than its author.

The execution program proceeds in seven committed steps. First, assemble the population frame from the four named sources, the NTRS reconstruction reports, the global Moon-Mars-Titan landing-attempt record built from the mission overviews and the consolidated mission catalogue [\[94\]](#ref-94), the TechPort EDL-technology readiness-level records, and the GAO program-history reports, then freeze it so that no row is added or dropped after modeling begins. Second, code each attempt's six EDL elements, aeroshell and thermal protection, entry guidance, supersonic deceleration, terminal descent and propulsion, terminal guidance and hazard avoidance, and touchdown mechanism, for heritage using the TechPort readiness history and the NTRS lineage documentation, assemble the index with the fixed weights and the reconstruction-depth weighting, and have a second coder independently code a random subsample so an inter-coder reliability statistic can be reported. Third, code outcomes under the pre-registered partial-success rule, blind to the heritage coding, so that knowledge of an attempt's architecture cannot contaminate its outcome classification. Fourth, build the program-strength index from the GAO cost-and-schedule data and the organizational flight-experience record, since that index is the main-specification guard against the central confounder. Fifth, fit the primary Firth-penalized logistic model with the three physical controls and the program-strength control, and report \( \beta_1 \), its exact or permutation confidence interval, and the implied change in failure probability across the interquartile range of the heritage index [\[52\]](#ref-52)[\[68\]](#ref-68). Sixth, run the full pre-registered robustness set: the complementary-log-log link as an alternative to the logit, exclusion of low-documentation rows, recoding of the boundary partial-successes in both directions, estimation with and without the program-strength control to bound confounding, and the Mokyr grounded-versus-ungrounded novelty decomposition. Seventh, report the minimum detectable effect size and a power assessment so that the result is read against what the small frame could in principle have detected.

Three reproducibility commitments accompany those steps and outlast the first execution. The heritage-index rubric, the partial-success coding rule, the program-strength index construction, the primary specification, the robustness set, and the fixed decision rule are all written down in advance and retained, so the headline result cannot be a product of searching over specifications until a coefficient turns significant. The coding log is retained so that every element score and every outcome classification can be traced to its documentary source. The frozen population frame is versioned, because the frame is a living object: the record of landing attempts grows with every new mission, and a contribution of this kind gains power as the population enlarges. The reliability-statistics precedent confirms that discrete-outcome estimation of this kind is extensible as cohorts accumulate [\[127\]](#ref-127)[\[117\]](#ref-117), so the execution is not a one-time exercise but the first iteration of a model that should be re-fit as the Moon and Mars records lengthen.

Three substantive extensions are identified as future work beyond the first execution, each bounded so it does not quietly enlarge the contribution. The first is the Earth-entry extension. Sample-return Earth-entry vehicles are excluded from the primary frame because Earth is a different target body, but they constitute a documented population of EDL events that could be folded into a robustness specification to test whether the heritage effect, if any, survives the addition of a fourth body. The second is the outer-planet and ocean-world extension. The Titan data point tests but cannot establish generalization beyond Mars and the Moon, and as in-situ entry concepts for the giant-planet moons mature, the frame could be extended to probe external validity directly rather than by inference from a single row [\[101\]](#ref-101)[\[131\]](#ref-131). The third is the propositional-knowledge deepening. The Mokyr decomposition would be strengthened by a more granular coding of the analytical and ground-test maturation history of each novel element, drawing on the supersonic-retropropulsion and decelerator-qualification literature that already exists, so that grounded and ungrounded novelty are separated by a measured maturation depth rather than a binary judgment [\[36\]](#ref-36)[\[135\]](#ref-135)[\[66\]](#ref-66). Each extension is named here so the dissertation's boundaries are explicit and so a successor knows exactly where the frontier sits.

## 8.6 Summary and implications

The dissertation's argument has carried a coherent spine from its first chapter, and the conclusion draws it together by restating each element against the evidence the preceding chapters assembled.

The problem is real. Entry, descent, and landing concentrates a disproportionate share of total mission risk into a few minutes of irreversible, largely autonomous operation, and the recent record spans the full heritage spectrum, with several novel-architecture attempts that failed or landed anomalously, from the loss of the Vikram lander during its powered descent to the anomalous touchdown attitude of the SLIM small lunar lander [\[64\]](#ref-64)[\[109\]](#ref-109)[\[88\]](#ref-88)[\[74\]](#ref-74)[\[144\]](#ref-144). The problem is material. NASA and JPL make recurring heritage-versus-novelty EDL portfolio decisions, and the documented scaling of EDL difficulty with mass forces departures from flown heritage toward novel decelerators and retropropulsion, so the trade is not academic but a standing feature of the program [\[4\]](#ref-4)[\[58\]](#ref-58)[\[9\]](#ref-9). The design addresses the causal mechanism. A conditional Firth-penalized logistic regression on the heritage index, with physical and program-strength controls, directly measures Fogel's counterfactual contrast between heritage and novel attempts matched on target, mass, and program strength, which is the mechanism by which codified flight knowledge would lower the landing-failure hazard if it does [\[121\]](#ref-121)[\[133\]](#ref-133)[\[127\]](#ref-127). The design beats the alternatives. The discrete-outcome logistic hazard is the natural estimator for a one-shot event, Firth penalization dominates ordinary maximum likelihood under the small frame and quasi-separation, and the complementary-log-log link confirms that the conclusion is not an artifact of the logistic link [\[52\]](#ref-52)[\[68\]](#ref-68)[\[8\]](#ref-8). And the residual risk is acceptable. The small sample, the construct risk in the heritage index, the documentation asymmetry, and the confounding-by-program-strength threat are each bounded by pre-registration, exact or permutation inference, blind and inter-coder coding, low-documentation sensitivity analysis, with-and-without-control bounding, and the honest design-stage framing that labels every illustrative figure as a reporting format rather than an estimate [\[52\]](#ref-52)[\[94\]](#ref-94)[\[50\]](#ref-50)[\[2\]](#ref-2).

The work is presented honestly as a design-stage analysis plan. The illustrative figures that appear in the analysis chapters, of the form that a move from the lowest to the highest quartile of the heritage index is associated with a drop in modeled landing-failure probability from roughly forty percent to roughly fifteen percent at a fixed Mars mass, are placeholders chosen to show the reporting format, and they are not estimates from data. No coefficient has been fitted on the full population. The central deliverable is the pre-registered, falsifiable design, and the next concrete act is its execution.

For NASA and JPL the value is symmetric and therefore robust. A real and unconfounded heritage effect would justify, in quantitative terms, the conservative lineage strategy that programs such as InSight followed in reusing the Phoenix architecture almost without change [\[82\]](#ref-82)[\[108\]](#ref-108), and it would set a measurable bar for how much additional qualification a novel element must earn to offset its excess risk. A confounded or null effect would redirect investment from heritage as a goal in itself toward the engineering reserves and verification rigor that heritage merely proxies, a conclusion squarely in the Fogelian spirit that a technology's value is only ever relative to its substitute [\[121\]](#ref-121)[\[139\]](#ref-139). Whichever way the coefficient falls, the field will be able to say something it cannot say today: not that heritage feels safer, but how much safer it is, conditional on the physics and the program, and with the confounding bounded. Converting that intuition into a measured, falsifiable, decision-relevant parameter is the whole of the contribution, and it is what this dissertation, once executed on the frozen frame, is built to deliver. The deeper aim is one of stewardship: to leave those who weigh these landings a clearer instrument than the one they hold today, and to do so in a form that any successor can inspect, question, and carry forward.
# References

This back matter discharges the reproducibility obligation that the rest of the dissertation incurs. The argument of the body is that a constant practitioner assertion, that flight-proven entry-descent-landing (EDL) heritage lowers landing-failure risk, can be converted into a single falsifiable coefficient \( \beta_1 \) and tested against the documented population of Moon, Mars, and Titan landing attempts under physical and program-strength controls. That conversion is only credible if a reader can locate every source the design rests on and can reconstruct every constructed variable from documents rather than from the analyst's judgment. The reference list and the six appendices below exist to make that possible. They are not an afterthought to the analysis; they are the executable specification of it. The reference list resolves every claim in the body to a real, retrievable artifact with a clickable digital object identifier (DOI) or a resolvable NASA Technical Reports Server (NTRS) citation URL. The appendices fix, in advance of any model fit, the population frame, the heritage-index rubric, the outcome-coding rule, the program-strength index, the pre-registered estimating specification, and the triaged literature. Together they are the apparatus that lets the eventual coefficient be checked rather than merely believed.

The problem this back matter addresses is concrete. A design-stage analysis plan that names a Firth-penalized logistic estimator, a constructed heritage index, and a small population frame is worthless to a replicator if the construction rules live only in the author's head. The desired state is a frozen, document-grounded specification that a second analyst could execute without consulting the first. The gap between those states is exactly the set of artifacts collected here: a rubric, a frame, a coding rule, a control construction, a pre-registration, and a complete bibliography. The consequence of omitting them would be that the contribution, a measured and confounding-adjusted EDL portfolio parameter, would degrade into an unverifiable assertion of the same kind the dissertation set out to discipline. Reproducibility is therefore not a courtesy in this work; it is the mechanism by which the central claim earns its falsifiability.

A note on grading and provenance precedes the list. The corpus comprises 149 verified references: 92 graded A (peer-reviewed journal articles and archival conference papers) and 57 graded B (NASA technical reports, agency memoranda, and preprints). Ninety-nine entries carry a registered DOI; the remaining fifty resolve through NTRS or repository citation URLs. Every entry was checked to resolve at compilation. Items graded B are marked as report or preprint so that a reader can weight them against peer-reviewed evidence when reconstructing any claim. No MITRE-internal note, space-brain working document, or non-resolving citation appears in the corpus, and none is cited anywhere in the dissertation. Where a corpus row carries an empty author or year field, the entry is rendered with the information that exists rather than with an invented attribution; this is a deliberate fidelity choice, since fabricating an author or date to produce a tidier citation would violate the same evidentiary discipline the dissertation argues for.


## References

[1] <span id="ref-1"></span> "2007 Mars Phoenix Entry, Descent, and Landing Simulation and Modeling Analysis." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20080013471](https://ntrs.nasa.gov/citations/20080013471). [report/preprint]

[2] <span id="ref-2"></span> "2020 NASA Technology Taxonomy." Available: [https://ntrs.nasa.gov/citations/20190031953](https://ntrs.nasa.gov/citations/20190031953).

[3] <span id="ref-3"></span> M. Faghih; Z. Bagheri; D. Stevanović; S. Ayatollahi; P. Jafari. "A Comparative Study of the Bias Correction Methods for Differential Item Functioning Analysis in Logistic Regression with Rare Events Data." BioMed Research International, 2020. doi: [10.1155/2020/1632350](https://doi.org/10.1155/2020/1632350).

[4] <span id="ref-4"></span> "A concept for the entry, descent, and landing of high-mass payloads at Mars." doi: [10.1016/j.actaastro.2009.10.003](https://doi.org/10.1016/j.actaastro.2009.10.003).

[5] <span id="ref-5"></span> "A High-Heritage Blunt-Body Entry, Descent, and Landing Concept for Human Mars Exploration." NASA Technical Reports Server (NTRS), 2017. Available: [https://ntrs.nasa.gov/citations/20170008283](https://ntrs.nasa.gov/citations/20170008283). [report/preprint]

[6] <span id="ref-6"></span> Ian G. Clark; Christopher Tanner. "A historical summary of the design, development, and analysis of the disk-gap-band parachute." 2017. doi: [10.1109/aero.2017.7943854](https://doi.org/10.1109/aero.2017.7943854). [report/preprint]

[7] <span id="ref-7"></span> Angus McRonald. "A Light-Weight Inflatable Hypersonic Drag Device for Planetary Entry." NASA STI Repository (National Aeronautics and Space Administration), 1995. Available: [https://openalex.org/W1602123245](https://openalex.org/W1602123245).

[8] <span id="ref-8"></span> Jianzhao Shen; Sujuan Gao. "A Solution to Separation and Multicollinearity in Multiple Logistic Regression." Journal of Data Science, 2021. doi: [10.6339/jds.2008.06(4).395](https://doi.org/10.6339/jds.2008.06(4).395).

[9] <span id="ref-9"></span> Ashley M. Korzun; Juan R. Cruz; Robert D. Braun. "A Survey of Supersonic Retropropulsion Technology for Mars Entry, Descent, and Landing." Proceedings - IEEE Aerospace Conference, 2008. doi: [10.1109/aero.2008.4526290](https://doi.org/10.1109/aero.2008.4526290).

[10] <span id="ref-10"></span> Joseph Del Corso; F. McNeil Cheatwood; Walter E. Bruce; Stephen J. Hughes; Anthony M. Calomino. "Advanced High-Temperature Flexible TPS for Inflatable Aerodynamic Decelerators." 2011. doi: [10.2514/6.2011-2510](https://doi.org/10.2514/6.2011-2510). [report/preprint]

[11] <span id="ref-11"></span> "Aerocapture Guidance and Performance at Mars for High-Mass Systems." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20100026546](https://ntrs.nasa.gov/citations/20100026546). [report/preprint]

[12] <span id="ref-12"></span> David Kinney. "Aerodynamic and Aerothermal Environment Models for a Mars Entry, Descent, and Landing Systems Analysis Study." 49th AIAA Aerospace Sciences Meeting including the New Horizons Forum and Aerospace Exposition, 2011. doi: [10.2514/6.2011-1189](https://doi.org/10.2514/6.2011-1189).

[13] <span id="ref-13"></span> Suman Muppidi; Dinesh Prabhu; David Saunders; Ryan McDaniel; Rathakrishnan Bhaskaran; David Kinney; Kaelan Hansson; Alireza Mazaheri. "Aerothermal Analysis and Environment Predictions for the Mars Sample Retrieval Lander (SRL)." 2024. doi: [10.2514/6.2024-3562](https://doi.org/10.2514/6.2024-3562). [report/preprint]

[14] <span id="ref-14"></span> "Approach and Entry, Descent, and Landing Operations for the Mars Science Laboratory Mission." NASA Technical Reports Server (NTRS), 2015. Available: [https://ntrs.nasa.gov/citations/20150007796](https://ntrs.nasa.gov/citations/20150007796). [report/preprint]

[15] <span id="ref-15"></span> O'Farrell C. "ASPIRE2: The Mars Sample Retrieval Lander's Supersonic Parachute Test Program." IEEE Aerospace Conference Proceedings, 2023. doi: [10.1109/aero55745.2023.10115818](https://doi.org/10.1109/aero55745.2023.10115818).

[16] <span id="ref-16"></span> David W. Way; Jody L. Davis; Jeremy Shidner. "Assessment of the Mars Science Laboratory Entry, Descent, and Landing Simulation." NASA Technical Reports Server (NASA), 2013. Available: [https://openalex.org/W50236054](https://openalex.org/W50236054).

[17] <span id="ref-17"></span> Mark Schoenenberger; John Van Norman; Chris Karlgaard; Prasad Kutty; David W. Way. "Assessment of the Reconstructed Aerodynamics of the Mars Science Laboratory Entry Vehicle." Journal of Spacecraft and Rockets, 2014. doi: [10.2514/1.a32794](https://doi.org/10.2514/1.a32794).

[18] <span id="ref-18"></span> Jie Yu; Honghua Zhang; Ming Cheng; Jun Liang; Yu Zhao; Ji Li; PengJi WANG; Li Wang. "Autonomous hazard avoidance control for Chang'E-3 soft landing." Scientia Sinica Technologica, 2014. doi: [10.1360/092014-51](https://doi.org/10.1360/092014-51).

[19] <span id="ref-19"></span> Dr. Apaka Rangita; Ngetich Festus. "Bias, Calibration and Stability in Logistic Regression Models: A Comparative Simulation Study of MLE, Firth and Ridge Methods." International Journal of Research and Innovation in Applied Science, 2025. doi: [10.51584/ijrias.2025.100700075](https://doi.org/10.51584/ijrias.2025.100700075).

[20] <span id="ref-20"></span> Adrián Antón-Álvarez; Adrián Lozano-Durán. "Bow-shock instability in entry, descent, and landing vehicles under high-enthalpy conditions." arXiv preprint, 2026. Available: [http://arxiv.org/abs/2605.28357v1](http://arxiv.org/abs/2605.28357v1). [report/preprint]

[21] <span id="ref-21"></span> Ioannis Kosmidis; Euloge Clovis Kenne Pagui. "brglm2: Bias Reduction in Generalized Linear Models." 2017. doi: [10.32614/cran.package.brglm2](https://doi.org/10.32614/cran.package.brglm2). [report/preprint]

[22] <span id="ref-22"></span> et al. "Comparison of autorotation and propulsive landing for planetary exploration." Acta Astronautica, 2025. doi: [10.1016/j.actaastro.2025.04.008](https://doi.org/10.1016/j.actaastro.2025.04.008).

[23] <span id="ref-23"></span> "Comparison of Mars Atmospheric Density Estimates from Models to Measurements from Mars Global Surveyor (MGS) Data." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20090024469](https://ntrs.nasa.gov/citations/20090024469). [report/preprint]

[24] <span id="ref-24"></span> "Comparison of OVERFLOW Computational and Experimental Results for a Blunt Mars Entry Vehicle Concept During Supersonic Retropropulsion." NASA Technical Reports Server (NTRS), 2023. Available: [https://ntrs.nasa.gov/citations/20230016620](https://ntrs.nasa.gov/citations/20230016620). [report/preprint]

[25] <span id="ref-25"></span> Soumyo Dutta; Robert D. Braun; Ryan Russell; Ian G. Clark; Scott A. Striepe. "Comparison of Statistical Estimation Techniques for Mars Entry, Descent and Landing Reconstruction from MEDLI-like Data Sources." 50th AIAA Aerospace Sciences Meeting including the New Horizons Forum and Aerospace Exposition, 2012. doi: [10.2514/6.2012-400](https://doi.org/10.2514/6.2012-400).

[26] <span id="ref-26"></span> Michael Anthony Skeen. "Conceptual Modeling and Analysis of Drag-Augmented Supersonic Retropropulsion for Application in Mars Entry, Descent, and Landing Vehicles." CU Scholar (University of Colorado Boulder), 2013. Available: [https://openalex.org/W435452009](https://openalex.org/W435452009).

[27] <span id="ref-27"></span> Michael Anthony Skeen; Ryan Starkey. "Conceptual Modeling of Drag-Augmented Supersonic Retropropulsion for Mars Entry, Descent, and Landing." Journal of Spacecraft and Rockets, 2014. doi: [10.2514/1.a32920](https://doi.org/10.2514/1.a32920).

[28] <span id="ref-28"></span> Ashley M. Korzun; Robert D. Braun. "Conceptual Modeling of Supersonic Retropropulsion Flow Interactions and Relationships to System Performance." Journal of Spacecraft and Rockets, 2013. doi: [10.2514/1.a32464](https://doi.org/10.2514/1.a32464).

[29] <span id="ref-29"></span> Tommaso Rigon; Emanuele Aliverti. "Conjugate priors and bias reduction for logistic regression models." arXiv preprint, 2022. Available: [http://arxiv.org/abs/2202.08734v1](http://arxiv.org/abs/2202.08734v1). [report/preprint]

[30] <span id="ref-30"></span> W. J. Hurd; Polly Estabrook; C. Racho; E. Satorius. "Critical spacecraft-to-Earth communications for Mars Exploration Rover (MER) entry, descent and landing." Proceedings - IEEE Aerospace Conference, 2003. doi: [10.1109/aero.2002.1035261](https://doi.org/10.1109/aero.2002.1035261).

[31] <span id="ref-31"></span> Jianjun Liu; Xin Ren; Wei Yan; Chunlai Li; He Zhang; Yang Jia; Xingguo Zeng; Wangli Chen. "Descent trajectory reconstruction and landing site positioning of Chang'E-4 on the lunar farside." Nature Communications, 2019. doi: [10.1038/s41467-019-12278-3](https://doi.org/10.1038/s41467-019-12278-3).

[32] <span id="ref-32"></span> Nathaniel Skolnik; Hiromasa Kamezawa; Lin Li; Grant Rossman; Brandon Sforzo; Robert D. Braun. "Design of a Novel Hypersonic Inflatable Aerodynamic Decelerator for Mars Entry, Descent, and Landing." AIAA Atmospheric Flight Mechanics Conference, 2017. doi: [10.2514/6.2017-0469](https://doi.org/10.2514/6.2017-0469).

[33] <span id="ref-33"></span> Takahiro Ito; Satoshi Ueda; Kentaro Yokota; Shinichiro Sakai; Ryo Hirasawa; Junji Kikuchi; Seisuke Fukuda; Yu Miyazawa. "Development and Flight Results of Guidance, Navigation, and Control for the SLIM Pinpoint Moon Landing." AEROSPACE TECHNOLOGY JAPAN THE JAPAN SOCIETY FOR AERONAUTICAL AND SPACE SCIENCES, 2025. doi: [10.2322/astj.24.s103](https://doi.org/10.2322/astj.24.s103).

[34] <span id="ref-34"></span> "Development and Testing of a New Family of Supersonic Decelerators." NASA Technical Reports Server (NTRS), 2015. Available: [https://ntrs.nasa.gov/citations/20150008680](https://ntrs.nasa.gov/citations/20150008680). [report/preprint]

[35] <span id="ref-35"></span> Clara O'Farrell; Suman Muppidi; Joseph M. Brock; John W. Van Norman; Ian G. Clark. "Development of models for disk-gap-band parachutes deployed supersonically in the wake of a slender body." 2017. doi: [10.1109/aero.2017.7943786](https://doi.org/10.1109/aero.2017.7943786). [report/preprint]

[36] <span id="ref-36"></span> "Development of Supersonic Retropropulsion for Future Mars Entry, Descent, and Landing Systems." doi: [10.2514/1.a32715](https://doi.org/10.2514/1.a32715).

[37] <span id="ref-37"></span> E. Satorius; Polly Estabrook; J. T. Wilson; D. Fort. "Direct-to-Earth Communications and Signal Processing for Mars Exploration Rover Entry, Descent, and Landing." Interplanetary Network Progress Report, 2003. Available: [https://openalex.org/W342055011](https://openalex.org/W342055011).

[38] <span id="ref-38"></span> "Direct-to-Earth Communications with Mars Science Laboratory During Entry, Descent, and Landing." NASA Technical Reports Server (NTRS), 2015. Available: [https://ntrs.nasa.gov/citations/20150007495](https://ntrs.nasa.gov/citations/20150007495). [report/preprint]

[39] <span id="ref-39"></span> Ziwei Wang; Nabil Aouf. "Efficient adversarial attacks detection for deep reinforcement learning-based autonomous planetary landing GNC." Acta Astronautica, 2024. doi: [10.1016/j.actaastro.2024.07.052](https://doi.org/10.1016/j.actaastro.2024.07.052).

[40] <span id="ref-40"></span> et al. "Electric propulsion reliability: Statistical analysis of on-orbit anomalies and comparative analysis of electric versus chemical propulsion failure rates." Acta Astronautica, 2017. doi: [10.1016/j.actaastro.2017.06.034](https://doi.org/10.1016/j.actaastro.2017.06.034).

[41] <span id="ref-41"></span> Callum Wilson; Annalisa Riccardi. "Enabling intelligent onboard guidance, navigation, and control using reinforcement learning on near-term flight hardware." Acta Astronautica, 2022. doi: [10.1016/j.actaastro.2022.07.013](https://doi.org/10.1016/j.actaastro.2022.07.013).

[42] <span id="ref-42"></span> Chao Xu; Xiang-Yu Huang; Minwen Guo; Maodeng Li; Jinchang Hu; Xiaolei Wang. "End-to-end Mars entry, descent, and landing modeling and simulations for Tianwen-1 guidance, navigation, and control system." Astrodynamics, 2022. doi: [10.1007/s42064-021-0115-z](https://doi.org/10.1007/s42064-021-0115-z).

[43] <span id="ref-43"></span> "Entry, Descent and Landing Systems Analysis Study: Phase 1 Report." Available: [https://ntrs.nasa.gov/citations/20100026676](https://ntrs.nasa.gov/citations/20100026676).

[44] <span id="ref-44"></span> Alicia M. Dwyer Ciancolo; Jody L. Davis; Walter C. Engelund; David R. Komar; Eric M. Queen; Jamshid A. Samareh; David W. Way; Thomas A. Zang. "Entry, Descent and Landing Systems Analysis Study: Phase 2 Report on Exploration Feed-Forward Systems." 2011. Available: [https://openalex.org/W858821250](https://openalex.org/W858821250). [report/preprint]

[45] <span id="ref-45"></span> "Entry, Descent, and Landing Communications for the 2007 Phoenix Mars Lander." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20080036099](https://ntrs.nasa.gov/citations/20080036099). [report/preprint]

[46] <span id="ref-46"></span> "Entry, Descent, and Landing Communications for the Mars 2020 Lander Mission." NASA Technical Reports Server (NTRS), 2021. Available: [https://ntrs.nasa.gov/citations/20230005619](https://ntrs.nasa.gov/citations/20230005619). [report/preprint]

[47] <span id="ref-47"></span> "Entry, Descent, and Landing Operations Analysis for the Mars Phoenix Lander." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20080033690](https://ntrs.nasa.gov/citations/20080033690). [report/preprint]

[48] <span id="ref-48"></span> "Entry, Descent, and Landing Performance of the Mars Phoenix Lander." doi: [10.2514/1.48239](https://doi.org/10.2514/1.48239).

[49] <span id="ref-49"></span> Bryan Palaszewski. "Entry, Descent, and Landing with Propulsive Deceleration: Supersonic Retropropulsion Wind Tunnel Testing." 50th AIAA Aerospace Sciences Meeting including the New Horizons Forum and Aerospace Exposition, 2012. doi: [10.2514/6.2012-401](https://doi.org/10.2514/6.2012-401).

[50] <span id="ref-50"></span> "Fatal Software Failures in Spaceflight." doi: [10.3390/encyclopedia4020061](https://doi.org/10.3390/encyclopedia4020061). [report/preprint]

[51] <span id="ref-51"></span> Anita Sengupta; Adam Steltzner; Allen Witkowski; Graham V. Candler; Carlos Pantano. "Findings from the Supersonic Qualification Program of the Mars Science Laboratory Parachute System." 2009. doi: [10.2514/6.2009-2900](https://doi.org/10.2514/6.2009-2900). [report/preprint]

[52] <span id="ref-52"></span> Rainer Puhr; Georg Heinze; Mariana Nold; Lara Lusa; Angelika Geroldinger. "Firth's logistic regression with rare events: accurate effect estimates and predictions?." Statistics in Medicine, 2017. doi: [10.1002/sim.7273](https://doi.org/10.1002/sim.7273).

[53] <span id="ref-53"></span> Joseph Coveney. "FIRTHLOGIT: Stata module to calculate bias reduction in logistic regression." RePEc: Research Papers in Economics, 2008. Available: [https://openalex.org/W1599917356](https://openalex.org/W1599917356).

[54] <span id="ref-54"></span> Anita Sengupta; L. A. Hall; Mark P. Wernet. "Fluid Structure Interaction of Parachutes in Supersonic Planetary Entry." 2011. doi: [10.2514/6.2011-2541](https://doi.org/10.2514/6.2011-2541). [report/preprint]

[55] <span id="ref-55"></span> Honghua Zhang; Ji Li; Zeguo Wang; YiFeng GUAN. "Guidance Navigation and Control for Chang'E-5 Powered Descent." Space Science & Technology, 2021. doi: [10.34133/2021/9823609](https://doi.org/10.34133/2021/9823609).

[56] <span id="ref-56"></span> "Guidance, Navigation, and Control for NASA Lunar Pallet Lander." NASA Technical Reports Server (NTRS), 2019. Available: [https://ntrs.nasa.gov/citations/20190002111](https://ntrs.nasa.gov/citations/20190002111). [report/preprint]

[57] <span id="ref-57"></span> Bradley Steinfeldt; John Theisinger; Ashley M. Korzun; Ian G. Clark; Michael J. Grant; Robert D. Braun. "High Mass Mars Entry, Descent, and Landing Architecture Assessment." 2009. doi: [10.2514/6.2009-6684](https://doi.org/10.2514/6.2009-6684). [report/preprint]

[58] <span id="ref-58"></span> "Human Mars Entry, Descent and Landing Architecture Study Overview." doi: [10.2514/6.2016-5494](https://doi.org/10.2514/6.2016-5494).

[59] <span id="ref-59"></span> "Human Mars Entry, Descent and Landing Architecture Study: Deployable Decelerators." NASA Technical Reports Server (NTRS), 2019. Available: [https://ntrs.nasa.gov/citations/20190033960](https://ntrs.nasa.gov/citations/20190033960). [report/preprint]

[60] <span id="ref-60"></span> "Human Mars Entry, Descent, and Landing Architecture Study: Rigid Decelerators." doi: [10.2514/6.2018-5192](https://doi.org/10.2514/6.2018-5192).

[61] <span id="ref-61"></span> "Hypersonic Inflatable Aerodynamic Decelerator Ground Test Development." NASA Technical Reports Server (NTRS), 2016. Available: [https://ntrs.nasa.gov/citations/20160006468](https://ntrs.nasa.gov/citations/20160006468). [report/preprint]

[62] <span id="ref-62"></span> James N. Benardini; Myron T. La Duc; Robert A. Beaudet; Robert Koukol. "Implementing Planetary Protection Measures on the Mars Science Laboratory." Astrobiology, 2014. doi: [10.1089/ast.2013.0989](https://doi.org/10.1089/ast.2013.0989).

[63] <span id="ref-63"></span> Robert W. Maddock; Alicia M. Dwyer-Cianciolo; Daniel Litton; Carlie H. Zumwalt. "Insight Entry, Descent, and Landing Pre-Flight Performance Predictions." AIAA Scitech 2020 Forum, 2020. doi: [10.2514/6.2020-1269](https://doi.org/10.2514/6.2020-1269).

[64] <span id="ref-64"></span> "Interpreted Investigation Report: Loss of Vikram Lander During Lunar Landing Phase." doi: [10.61359/11.2106-2309](https://doi.org/10.61359/11.2106-2309). [report/preprint]

[65] <span id="ref-65"></span> Myron R. Grover; Eli D. Skulsky; Matt Russell. "Introduction to the Mars InSight Entry, Descent, and Landing Flight Reconstruction Virtual Collection." Journal of Spacecraft and Rockets, 2021. doi: [10.2514/1.a35297](https://doi.org/10.2514/1.a35297).

[66] <span id="ref-66"></span> Karl T. Edquist; Chau-Lyan Chang; James C. McDaniel. "Introduction: Recent Developments in Supersonic Retropropulsion for Mars Entry, Descent, and Landing." Journal of Spacecraft and Rockets, 2014. doi: [10.2514/1.a32996](https://doi.org/10.2514/1.a32996).

[67] <span id="ref-67"></span> José Maria Campos dos Santos; Tomo Oishi; Edward Martinez. "Isotherm Sensor Calibration Program for Mars Science Laboratory Heat Shield Flight Data Analysis." 42nd AIAA Thermophysics Conference, 2011. doi: [10.2514/6.2011-3955](https://doi.org/10.2514/6.2011-3955).

[68] <span id="ref-68"></span> Georg Heinze; Meinhard Ploner; Lena Jiricka; Gregor Steiner. "logistf: Firth's Bias-Reduced Logistic Regression." 2003. doi: [10.32614/cran.package.logistf](https://doi.org/10.32614/cran.package.logistf). [report/preprint]

[69] <span id="ref-69"></span> HaiYing Wang. "Logistic Regression for Massive Data with Rare Events." arXiv preprint, 2020. Available: [http://arxiv.org/abs/2006.00683v1](http://arxiv.org/abs/2006.00683v1). [report/preprint]

[70] <span id="ref-70"></span> Todd R. White; Dominic Trombetta; Helen Hwang; Deepak Bose; Tomo Oishi; José Maria Campos dos Santos. "Mars 2020 Entry, Descent and Landing Instrumentation (MEDLI2)." NASA STI Repository (National Aeronautics and Space Administration). Available: [https://openalex.org/W3176114772](https://openalex.org/W3176114772).

[71] <span id="ref-71"></span> "Mars 2020 Entry, Descent and Landing Instrumentation 2 (MEDLI2)." Available: [https://ntrs.nasa.gov/citations/20160008391](https://ntrs.nasa.gov/citations/20160008391).

[72] <span id="ref-72"></span> "Mars 2020 Entry, Descent, and Landing Instrumentation 2 (MEDLI2) Sensor Suite." NASA Technical Reports Server (NTRS), 2017. Available: [https://ntrs.nasa.gov/citations/20170009078](https://ntrs.nasa.gov/citations/20170009078). [report/preprint]

[73] <span id="ref-73"></span> "Mars 2020 Entry, Descent, and Landing Software Implementation." NASA Technical Reports Server (NTRS), 2022. Available: [https://ntrs.nasa.gov/citations/20230006983](https://ntrs.nasa.gov/citations/20230006983). [report/preprint]

[74] <span id="ref-74"></span> "Mars 2020 Entry, Descent, and Landing System Overview." doi: [10.1109/aero.2019.8742167](https://doi.org/10.1109/aero.2019.8742167).

[75] <span id="ref-75"></span> "Mars 2020 Entry, Descent, and Landing System Software Implementation." NASA Technical Reports Server (NTRS), 2022. Available: [https://ntrs.nasa.gov/citations/20230006946](https://ntrs.nasa.gov/citations/20230006946). [report/preprint]

[76] <span id="ref-76"></span> Davide Amato. "Mars Entry, Descent, and Landing guidance under dynamic uncertainty." 2021. doi: [10.52843/cassyni.r8xwrv](https://doi.org/10.52843/cassyni.r8xwrv). [report/preprint]

[77] <span id="ref-77"></span> Christopher D. Karlgaard; Mark Schoenenberger; Soumyo Dutta; David W. Way. "Mars Entry, Descent, and Landing Instrumentation 2 Trajectory, Aerodynamics, and Atmosphere Reconstruction." Journal of Spacecraft and Rockets, 2022. doi: [10.2514/1.a35440](https://doi.org/10.2514/1.a35440).

[78] <span id="ref-78"></span> Soumyo Dutta; Robert D. Braun. "Mars Entry, Descent, and Landing Trajectory and Atmosphere Reconstruction." 48th AIAA Aerospace Sciences Meeting Including the New Horizons Forum and Aerospace Exposition, 2010. doi: [10.2514/6.2010-1210](https://doi.org/10.2514/6.2010-1210).

[79] <span id="ref-79"></span> "Mars Exploration Rover Entry, Descent, and Landing: A Thermal Perspective." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20090026396](https://ntrs.nasa.gov/citations/20090026396). [report/preprint]

[80] <span id="ref-80"></span> "Mars Exploration Rover Mission: Entry, Descent, and Landing System Validation." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20090007574](https://ntrs.nasa.gov/citations/20090007574). [report/preprint]

[81] <span id="ref-81"></span> Prasun N. Desai; Philip Knocke. "Mars Exploration Rovers Entry, Descent, and Landing Trajectory Analysis." AIAA/AAS Astrodynamics Specialist Conference and Exhibit, 2004. doi: [10.2514/6.2004-5092](https://doi.org/10.2514/6.2004-5092).

[82] <span id="ref-82"></span> "Mars InSight Entry, Descent, and Landing Trajectory and Atmosphere Reconstruction." Available: [https://ntrs.nasa.gov/citations/20200002910](https://ntrs.nasa.gov/citations/20200002910).

[83] <span id="ref-83"></span> Spencer D.A. "Mars Pathfinder entry, descent, and landing reconstruction." Journal of Spacecraft and Rockets, 1999. doi: [10.2514/2.3478](https://doi.org/10.2514/2.3478).

[84] <span id="ref-84"></span> "Mars Phoenix Entry, Descent, and Landing Simulation Design and Modelling Analysis." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20080033126](https://ntrs.nasa.gov/citations/20080033126). [report/preprint]

[85] <span id="ref-85"></span> "Mars Science Laboratory (MSL) Entry, Descent, and Landing Instrumentation (MEDLI): Complete Flight Data Set." NASA Technical Reports Server (NTRS), 2014. Available: [https://ntrs.nasa.gov/citations/20140016393](https://ntrs.nasa.gov/citations/20140016393). [report/preprint]

[86] <span id="ref-86"></span> "Mars Science Laboratory Entry Descent and Landing Simulation Using DSENDS." NASA Technical Reports Server (NTRS), 2015. Available: [https://ntrs.nasa.gov/citations/20150005559](https://ntrs.nasa.gov/citations/20150005559). [report/preprint]

[87] <span id="ref-87"></span> "Mars Science Laboratory Entry, Descent, and Landing System." doi: [10.1109/aero.2006.1655796](https://doi.org/10.1109/aero.2006.1655796).

[88] <span id="ref-88"></span> "Mars Science Laboratory Entry, Descent, and Landing System Overview." doi: [10.1109/aero.2008.4526283](https://doi.org/10.1109/aero.2008.4526283).

[89] <span id="ref-89"></span> "Mars Science Laboratory Entry, Descent, and Landing Trajectory and Atmosphere Reconstruction." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20130010087](https://ntrs.nasa.gov/citations/20130010087). [report/preprint]

[90] <span id="ref-90"></span> Behçet Açıkmeşe; Steven W. Sell; A. Miguel San Martin; Jeffrey Biesiadecki. "Mars Science Laboratory Flyaway Guidance, Navigation, and Control System Design." Journal of Spacecraft and Rockets, 2014. doi: [10.2514/1.a32709](https://doi.org/10.2514/1.a32709).

[91] <span id="ref-91"></span> Deepak Bose; Jose A. Santos; Erika D. Rodriguez; Todd R. White; Milad Mahzari. "Mars Science Laboratory Heat Shield Instrumentation and Arc Jet Characterization." 2013. doi: [10.2514/6.2013-2778](https://doi.org/10.2514/6.2013-2778). [report/preprint]

[92] <span id="ref-92"></span> "Mars Science Laboratory: Entry, Descent, and Landing System Performance." doi: [10.1109/aero.2007.352821](https://doi.org/10.1109/aero.2007.352821).

[93] <span id="ref-93"></span> "Mars2020 Entry, Descent, and Landing Instrumentation (MEDLI2): Science Objectives and Instrument Requirements." NASA Technical Reports Server (NTRS), 2015. Available: [https://ntrs.nasa.gov/citations/20150023564](https://ntrs.nasa.gov/citations/20150023564). [report/preprint]

[94] <span id="ref-94"></span> "Master Catalogue of Lunar and Mars Exploration Missions." doi: [10.31219/osf.io/9s6jn](https://doi.org/10.31219/osf.io/9s6jn). [report/preprint]

[95] <span id="ref-95"></span> Chun Yin Tang; Milad Mahzari; Dinesh Prabhu; Hannah S. Alpert; Brett A. Cruden. "MEDLI2: MISP Inferred Aerothermal Environment and Flow Transition Assessment." AIAA SCITECH 2022 Forum, 2022. doi: [10.2514/6.2022-0552](https://doi.org/10.2514/6.2022-0552).

[96] <span id="ref-96"></span> "Mid Lift-to-Drag Ratio Rigid Vehicle 6-DoF Performance for Human Mars Entry, Descent, and Landing: A Fractional Polynomial Powered Descent Guidance Approach." NASA Technical Reports Server (NTRS), 2020. Available: [https://ntrs.nasa.gov/citations/20200000240](https://ntrs.nasa.gov/citations/20200000240). [report/preprint]

[97] <span id="ref-97"></span> Daniel Z. Huang; Philip Avery; Charbel Farhat; Jason Rabinovitch; Armen Derkevorkian; Lee D Peterson. "Modeling, simulation and validation of supersonic parachute inflation dynamics during Mars landing." arXiv preprint, 2019. Available: [http://arxiv.org/abs/1912.01658v1](http://arxiv.org/abs/1912.01658v1). [report/preprint]

[98] <span id="ref-98"></span> "MSL Entry, Descent, and Landing Instrumentation: Return on Investment." NASA Technical Reports Server (NTRS), 2019. Available: [https://ntrs.nasa.gov/citations/20190029056](https://ntrs.nasa.gov/citations/20190029056). [report/preprint]

[99] <span id="ref-99"></span> "Multibody Modeling and Simulation for the Mars Phoenix Lander Entry, Descent and Landing." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20080034477](https://ntrs.nasa.gov/citations/20080034477). [report/preprint]

[100] <span id="ref-100"></span> "New Developments in Retropropulsion Testing for Mars Entry, Descent and Landing." NASA Technical Reports Server (NTRS), 2020. Available: [https://ntrs.nasa.gov/citations/20205002222](https://ntrs.nasa.gov/citations/20205002222). [report/preprint]

[101] <span id="ref-101"></span> J. I. Lunine. "Ocean worlds exploration." Acta Astronautica, 2016. doi: [10.1016/j.actaastro.2016.11.017](https://doi.org/10.1016/j.actaastro.2016.11.017).

[102] <span id="ref-102"></span> Pingyuan Cui; Dantong Ge; Ai Gao. "Optimal landing site selection based on safety index during planetary descent." Acta Astronautica, 2016. doi: [10.1016/j.actaastro.2016.10.040](https://doi.org/10.1016/j.actaastro.2016.10.040).

[103] <span id="ref-103"></span> Yoshihide Sugimoto; Hiroshi Takeuchi; Tsutomu Ichikawa; Masaya Nakano; Chiaki Aoshima. "Orbit Determination and Analysis for SLIM Lander." AEROSPACE TECHNOLOGY JAPAN THE JAPAN SOCIETY FOR AERONAUTICAL AND SPACE SCIENCES, 2025. doi: [10.2322/astj.24.s30](https://doi.org/10.2322/astj.24.s30).

[104] <span id="ref-104"></span> "Overview of the Mars Science Laboratory Parachute Decelerator Subsystem." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20110013162](https://ntrs.nasa.gov/citations/20110013162). [report/preprint]

[105] <span id="ref-105"></span> Michael J. Gazarik; Michael Wright; Alan Little; F. McNeil Cheatwood; Jeff A. Herath; Michelle Munk; Frank J. Novak; Edward Martinez. "Overview of the MEDLI Project." Proceedings - IEEE Aerospace Conference, 2008. doi: [10.1109/aero.2008.4526285](https://doi.org/10.1109/aero.2008.4526285).

[106] <span id="ref-106"></span> "Overview of the NASA Entry, Descent and Landing Systems Analysis Exploration Feed-Forward Study." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20110012453](https://ntrs.nasa.gov/citations/20110012453). [report/preprint]

[107] <span id="ref-107"></span> "Overview of the NASA Entry, Descent and Landing Systems Analysis Study." doi: [10.2514/6.2010-8649](https://doi.org/10.2514/6.2010-8649).

[108] <span id="ref-108"></span> "Overview of the Phoenix Entry, Descent and Landing System Architecture." NASA Technical Reports Server (NTRS), 2013. Available: [https://ntrs.nasa.gov/citations/20080034655](https://ntrs.nasa.gov/citations/20080034655). [report/preprint]

[109] <span id="ref-109"></span> "Overview of the Small Lunar Lander SLIM and Its Lunar Landing Results." doi: [10.1541/ieejjia.20250916](https://doi.org/10.1541/ieejjia.20250916).

[110] <span id="ref-110"></span> Juan R. Cruz; David W. Way; Jeremy Shidner; Jody L. Davis; Richard W. Powell; D. Kipp; Douglas Adams; Anita Sengupta. "Parachute Models Used in the Mars Science Laboratory Entry, Descent, and Landing Simulation." 2013. doi: [10.2514/6.2013-1276](https://doi.org/10.2514/6.2013-1276). [report/preprint]

[111] <span id="ref-111"></span> Ashley M. Korzun; Robert D. Braun. "Performance Characterization of Supersonic Retropropulsion for Application to High Mass Mars Entry, Descent, and Landing." AIAA Atmospheric Flight Mechanics Conference, 2009. doi: [10.2514/6.2009-5613](https://doi.org/10.2514/6.2009-5613).

[112] <span id="ref-112"></span> Mohammad Shafiqur Rahman; Mahbuba Sultana. "Performance of Firth-and logF-type penalized methods in risk prediction for small or sparse binary data." BMC Medical Research Methodology, 2017. doi: [10.1186/s12874-017-0313-9](https://doi.org/10.1186/s12874-017-0313-9).

[113] <span id="ref-113"></span> Korzun A.M. "Powered descent aerodynamics for low and mid lift-to-drag human mars entry, descent, and landing vehicles." AIAA Scitech 2020 Forum, 2020. doi: [10.2514/6.2020-1510](https://doi.org/10.2514/6.2020-1510).

[114] <span id="ref-114"></span> Joel Benito; Erich Brandeau; Evgeniy Sklyanskiy; Steve Sell. "Powered descent guidance strategy and algorithms for mars landing using supersonic retropropulsion." 2017 IEEE Aerospace Conference, 2017. doi: [10.1109/aero.2017.7943973](https://doi.org/10.1109/aero.2017.7943973).

[115] <span id="ref-115"></span> Xiangyu Huang; Chao Xu; Jinchang Hu; Maodeng Li; Minwen Guo; Xiaolei Wang; Yu Zhao; Baocheng Hua. "Powered-descent landing GNC system design and flight results for Tianwen-1 mission." Astrodynamics, 2022. doi: [10.1007/s42064-021-0118-9](https://doi.org/10.1007/s42064-021-0118-9).

[116] <span id="ref-116"></span> M. A. Mischna; Gregory Villar; D. M. Kass; Soumyo Dutta; Scot Rafkin; D. Tyler; J. R. Barnes; B. A. Cantor. "Pre- and Post-entry, Descent and Landing Assessment of the Martian Atmosphere for the Mars 2020 Rover." The Planetary Science Journal, 2022. doi: [10.3847/psj/ac7148](https://doi.org/10.3847/psj/ac7148).

[117] <span id="ref-117"></span> "Predicting Failures and Estimating Duration of Service Life from Satellite Telemetry." doi: [10.26077/md4y-zx37](https://doi.org/10.26077/md4y-zx37). [report/preprint]

[118] <span id="ref-118"></span> David W. Way. "Preliminary assessment of the Mars Science Laboratory entry, descent, and landing simulation." 2013. doi: [10.1109/aero.2013.6497404](https://doi.org/10.1109/aero.2013.6497404). [report/preprint]

[119] <span id="ref-119"></span> Katie J. Siegel; Clara O'Farrell; Jeremiah Rowan; Kirin Peterson; Charles Lowry. "Preliminary Design of the Supersonic Disk-Gap-Band Parachute for Sample Retrieval Lander." AIAA AVIATION FORUM AND ASCEND 2024, 2024. doi: [10.2514/6.2024-4222](https://doi.org/10.2514/6.2024-4222).

[120] <span id="ref-120"></span> Ioana Cozmuta; Todd R. White; José Santos; Bernard Laub; Milad Mahzari. "Proposed Analysis Process for Mars Science Laboratory Heat Shield Sensor Plug Flight Data." 42nd AIAA Thermophysics Conference, 2011. doi: [10.2514/6.2011-3957](https://doi.org/10.2514/6.2011-3957).

[121] <span id="ref-121"></span> "Railroads and American Economic Growth: Essays in Econometric History (Fogel 1964)." doi: [10.2307/2552284](https://doi.org/10.2307/2552284).

[122] <span id="ref-122"></span> "Real-time Terrain Relative Navigation Test Results from a Relevant Environment for Mars Landing." NASA Technical Reports Server (NTRS), 2016. Available: [https://ntrs.nasa.gov/citations/20160009627](https://ntrs.nasa.gov/citations/20160009627). [report/preprint]

[123] <span id="ref-123"></span> O'Farrell C. "Reconstructed Performance of the Mars InSight Lander's Supersonic Parachute & Comparison with the Phoenix Lander." IEEE Aerospace Conference Proceedings, 2022. doi: [10.1109/aero53065.2022.9843430](https://doi.org/10.1109/aero53065.2022.9843430).

[124] <span id="ref-124"></span> Clark I.G. "Reconstructed performance of the supersonic parachute of the mars insight lander." Journal of Spacecraft and Rockets, 2021. doi: [10.2514/1.a35180](https://doi.org/10.2514/1.a35180).

[125] <span id="ref-125"></span> Deepak Bose; Todd R. White; Milad Mahzari; Karl T. Edquist. "Reconstruction of Aerothermal Environment and Heat Shield Response of Mars Science Laboratory." Journal of Spacecraft and Rockets, 2014. doi: [10.2514/1.a32783](https://doi.org/10.2514/1.a32783).

[126] <span id="ref-126"></span> Sanford Krasner; K. Bruvold; Jared A. Call; Paul Fieseler; Andrew Klesh; M. Michael Kobayashi; Norman Lay; Ryan S. Lim. "Reconstruction of Entry, Descent, and Landing Communications for the InSight Mars Lander." Journal of Spacecraft and Rockets, 2021. doi: [10.2514/1.a34892](https://doi.org/10.2514/1.a34892).

[127] <span id="ref-127"></span> "Reliability analysis of deep space satellites launched 1991-2020: Bulk population and deployable satellite performance analysis." doi: [10.1002/qre.3600](https://doi.org/10.1002/qre.3600).

[128] <span id="ref-128"></span> Anita Sengupta; Adam Steltzner; Keith Comeaux; Graham V. Candler; Michael Barnhardt; Carlos Pantano; James Bell; JT Heineck. "Results from the Mars Science Laboratory Parachute Decelerator System Supersonic Qualification Program." Proceedings - IEEE Aerospace Conference, 2008. doi: [10.1109/aero.2008.4526284](https://doi.org/10.1109/aero.2008.4526284).

[129] <span id="ref-129"></span> J. A. Magalhães; J. T. Schofield; A. Seiff. "Results of the Mars Pathfinder atmospheric structure investigation." Journal of Geophysical Research Atmospheres, 1999. doi: [10.1029/1998je900041](https://doi.org/10.1029/1998je900041).

[130] <span id="ref-130"></span> et al. "Safety analysis for shallow controlled re-entries through reduced order modeling and inputs' statistics method." Acta Astronautica, 2018. doi: [10.1016/j.actaastro.2018.10.015](https://doi.org/10.1016/j.actaastro.2018.10.015).

[131] <span id="ref-131"></span> "Scientific rationale for Saturn's in situ exploration." doi: [10.1016/j.pss.2014.09.014](https://doi.org/10.1016/j.pss.2014.09.014).

[132] <span id="ref-132"></span> Shuya Kashioka; et al. "Self-position estimation using terrain shadows for precise planetary landing." Acta Astronautica, 2018. doi: [10.1016/j.actaastro.2018.05.002](https://doi.org/10.1016/j.actaastro.2018.05.002).

[133] <span id="ref-133"></span> Tim Leunig. "Social Savings." Journal of Economic Surveys, 2010. doi: [10.1111/j.1467-6419.2010.00636.x](https://doi.org/10.1111/j.1467-6419.2010.00636.x).

[134] <span id="ref-134"></span> Soumyo Dutta; Robert D. Braun. "Statistical Entry, Descent, and Landing Performance Reconstruction of the Mars Science Laboratory." Journal of Spacecraft and Rockets, 2014. doi: [10.2514/1.a32937](https://doi.org/10.2514/1.a32937).

[135] <span id="ref-135"></span> "Supersonic Retropropulsion Experimental Results from NASA Ames 9x7 Foot Supersonic Wind Tunnel." doi: [10.2514/1.a32650](https://doi.org/10.2514/1.a32650).

[136] <span id="ref-136"></span> Anita Sengupta; Mark P. Wernet; James W. Roeder; Richard Kelsch; Allen Witkowski; T. W. Jones. "Supersonic Testing of 0.8 m Disk Gap Band Parachutes in the Wake of a 70 deg Sphere Cone Entry Vehicle." 2009. doi: [10.2514/6.2009-2974](https://doi.org/10.2514/6.2009-2974). [report/preprint]

[137] <span id="ref-137"></span> J Stephen Lingard; John C. Underwood; Matthew G. Darley; Lionel Marraffa; Luca Ferracina. "Supersonic Tests of the Double Gap Disk-Gap Band Parachute and Fluid Structure Interaction Simulation." 23rd AIAA Aerodynamic Decelerator Systems Technology Conference, 2015. doi: [10.2514/6.2015-2109](https://doi.org/10.2514/6.2015-2109).

[138] <span id="ref-138"></span> David Blette; Robert Braun. "Supersonic vehicle configuration transitions to enable supersonic retropropulsion during mars entry, descent, and landing." 2016 IEEE Aerospace Conference, 2016. doi: [10.1109/aero.2016.7500640](https://doi.org/10.1109/aero.2016.7500640).

[139] <span id="ref-139"></span> "Technological revolutions and techno-economic paradigms." doi: [10.1093/cje/bep051](https://doi.org/10.1093/cje/bep051).

[140] <span id="ref-140"></span> "Terrain Relative Navigation for Guided Descent on Titan." NASA Technical Reports Server (NTRS), 2020. Available: [https://ntrs.nasa.gov/citations/20220000773](https://ntrs.nasa.gov/citations/20220000773). [report/preprint]

[141] <span id="ref-141"></span> "The Adaptable, Deployable, Entry and Placement Technology (ADEPT) Enabling Advanced Entry, Descent, and Landing Capabilities for SmallSat Missions." NASA Technical Reports Server (NTRS), 2020. Available: [https://ntrs.nasa.gov/citations/20205010432](https://ntrs.nasa.gov/citations/20205010432). [report/preprint]

[142] <span id="ref-142"></span> J. N. Maki; David Gruel; Colin McKinney; M. A. Ravine; M. Morales; D. Lee; Reg G. Willson; Djuna Copley-Woods. "The Mars 2020 Engineering Cameras and Microphone on the Perseverance Rover: A Next-Generation Imaging System for Mars Exploration." Space Science Reviews, 2020. doi: [10.1007/s11214-020-00765-9](https://doi.org/10.1007/s11214-020-00765-9).

[143] <span id="ref-143"></span> Adam Steltzner; Prasun N. Desai; Wayne Lee; Robin Bruno. "The Mars Exploration Rovers Entry Descent and Landing and the Use of Aerodynamic Decelerators." NASA Technical Reports Server (NASA), 2003. Available: [https://openalex.org/W2083617493](https://openalex.org/W2083617493).

[144] <span id="ref-144"></span> "The Tianwen-1 Guidance, Navigation, and Control for Mars Entry, Descent, and Landing." doi: [10.34133/2021/9846185](https://doi.org/10.34133/2021/9846185).

[145] <span id="ref-145"></span> Seisuke Fukuda; Takayuki Ishida; Tetsuhito Arakawa; Tsuyoshi Nakagawa; Hajime Murao. "Thermal Cycle Tests of CLCC Solder Joints: Influence of Substrate, Solder, and Pad Patterns." TRANSACTIONS OF THE JAPAN SOCIETY FOR AERONAUTICAL AND SPACE SCIENCES AEROSPACE TECHNOLOGY JAPAN, 2020. doi: [10.2322/tastj.18.51](https://doi.org/10.2322/tastj.18.51).

[146] <span id="ref-146"></span> Yue Xu; Corinne Huggins-Manley; Eric Wright; M. D. Miller. "Using Firth's Penalized Maximum Likelihood Estimation for Logistic Regression to Detect Polytomous Differential Item Functioning." Proceedings of the 2025 AERA Annual Meeting, 2025. doi: [10.1080/08957347.2026.2613854](https://doi.org/10.1080/08957347.2026.2613854).

[147] <span id="ref-147"></span> T. Ishida; Seisuke Fukuda; Kazuki Kariya; Hiroyuki Kamata; Keiki Takadama; Hirohisa Kojima; Shujiro Sawai; Shin-ichiro Sakai. "Vision-based navigation and obstacle detection flight results in SLIM lunar landing." Acta Astronautica, 2024. doi: [10.1016/j.actaastro.2024.11.002](https://doi.org/10.1016/j.actaastro.2024.11.002).

[148] <span id="ref-148"></span> et al. "Visual navigation based on curve matching for planetary landing in unknown environments." Acta Astronautica, 2020. doi: [10.1016/j.actaastro.2020.01.023](https://doi.org/10.1016/j.actaastro.2020.01.023).

[149] <span id="ref-149"></span> Carlie H. Zumwalt; Juan R. Cruz; Clara O'Farrell; Donald F. Keller. "Wind Tunnel Test of Subscale Ringsail and Disk-Gap-Band Parachutes." 34th AIAA Applied Aerodynamics Conference, 2016. doi: [10.2514/6.2016-3882](https://doi.org/10.2514/6.2016-3882).

*Reference note.* Entries are ordered alphabetically by title and numbered for in-text citation. Items marked [report/preprint] are graded B (NASA technical reports, agency memoranda, or preprints) and should be weighted accordingly relative to the peer-reviewed (grade-A) entries. The Fogel and Mokyr methodological anchors are represented in the corpus by resolvable surrogates: the Fogel railroads study via its archival review record [121], the social-savings tradition via Leunig's survey [133], and the propositional-versus-prescriptive useful-knowledge frame via Perez's techno-economic-paradigms article [139], applied in the body alongside Mokyr's monographs *The Gifts of Athena* (Princeton, 2002) and *A Culture of Growth* (Princeton, 2017), which are cited as books rather than as DOI-bearing corpus rows. Where a corpus row lacked author or year metadata, the entry is rendered with the fields that were present rather than with reconstructed attribution.



# Appendices

## Appendix A: Landing-Attempt Population Frame and Inclusion/Exclusion Template

Appendix A specifies the population frame, the unit on which every coefficient is estimated, and freezes its boundary before any model is fitted. The unit of analysis is the individual landing attempt at the Moon, Mars, or Titan, defined as a vehicle committing to an entry-descent-landing or powered-descent sequence intended to place a payload on the surface. The frame is assembled from the Master Catalogue of Lunar and Mars Exploration Missions [94] cross-checked against the mission-overview and reconstruction literature in the reference list, including the Mars Pathfinder reconstruction [83], the Mars Exploration Rovers trajectory analysis [81], the Phoenix performance report [48], the Mars Science Laboratory system and reconstruction reports [87][88][89], the Mars 2020 overview [74], the Tianwen-1 control reports [42][115][144], the Chang'E descent reconstructions [18][31][55], the SLIM results [33][103][109][147], and the Saturn and ocean-worlds in-situ rationale that frames the Titan external-validity row [101][131].

The inclusion rule is positive and narrow: a row is included if, and only if, the vehicle initiated a descent sequence intended to terminate in surface placement at one of the three named bodies, and the attempt and its outcome are documented in at least one resolvable source. Orbital insertions, flybys, impactors not intended to survive, and sample-return Earth-entry vehicles are excluded, because Earth entry is a different target body and a different physical regime; the Mars Sample Retrieval Lander work [13][15] is retained only as architecture-coding context for Mars rows, not as a separate attempt. Each row carries a fixed template of fields: a mission identifier, target body, launch and attempt epochs, entry mass, landed mass, a one-line architecture descriptor, the binary outcome, a documentation-quality flag, and the source citations used to populate every field. The documentation-quality flag is the hinge that links Appendix A to the robustness battery in Appendix E: rows flagged low-documentation are the ones dropped in the pre-registered sensitivity analysis, so the flag must be set at frame-assembly time, blind to the eventual heritage and outcome coding. The frame is intrinsically small, on the order of several dozen attempts, with Mars and the Moon contributing most rows and Titan contributing a single row through the Huygens-class descent; this is stated here so that the power analysis in Appendix E inherits a fixed, auditable denominator rather than a moving target.


## Appendix B: The EDL-Heritage-Reuse Index Rubric

Appendix B is the most consequential appendix, because the heritage index is the treatment variable and the entire contribution lives in its coefficient. The rubric decomposes each attempt's architecture into a fixed set of six EDL functional elements: aeroshell and thermal protection system, entry guidance, supersonic deceleration (parachute or retropropulsion), terminal descent and propulsion, terminal guidance and hazard avoidance, and touchdown mechanism. This decomposition is not arbitrary; it follows the element structure that the reconstruction and architecture literature itself uses to describe these systems, from the sky-crane lineage documented for MSL and Mars 2020 [74][87][88] to the parachute-qualification and disk-gap-band literature [6][104][110][119][149], the supersonic-retropropulsion maturation record [9][28][36][66][111][135], the inflatable-decelerator work [10][32][61], and the terminal-guidance and hazard-avoidance reports for lunar and Mars landers [18][55][56][122].

Each element receives a heritage score on a fixed ordinal scale. An element scores high if it had been flown successfully in a comparable physical regime on a prior mission, and low if it is introduced for the first time or, critically, if it is flown well outside its proven envelope. This regime-aware coding is the operational embodiment of a Mokyr-derived caution carried verbatim from the prospectus: an institution that over-weights heritage can fly a proven element outside its qualified regime, converting an apparent strength into a hidden hazard, so the index is coded against the regime in which an element was proven, not merely against whether it flew before. The element scores are combined into the attempt-level index, a continuous quantity on the closed interval from zero to one, as a fixed-weight, mass-or-criticality-weighted mean. The weights are fixed in advance and recorded in the coding log so that the index is reproducible from the named documents rather than re-derivable from the analyst's discretion.

The rubric carries one further, theory-driven refinement: a reconstruction-depth weighting that operationalizes the Mokyr propositional-knowledge argument. A prior flight that was instrumented and reconstructed in fine detail, such as those carrying the MEDLI and MEDLI2 suites [70][71][77][85][95][105], converts prescriptive recipes into codified propositional understanding more thoroughly than a flight that was poorly reconstructed, and so should confer a larger protective increment to the heritage score of any element that inherits from it. The depth of NTRS reconstruction documentation is therefore an explicit multiplier on the heritage contribution of a flown element. Finally, the rubric specifies an inter-coder reliability schema: a second coder independently scores the six elements for a random subsample of attempts, blind to the first coder's scores and to the outcome, and a pre-registered agreement statistic is reported. Disagreements are adjudicated against the document of record, not split, so that the final index remains a function of the sources rather than of a negotiated compromise.


## Appendix C: Partial-Success Outcome-Coding Rule and Boundary-Case Register

Appendix C fixes the dependent variable so that the outcome cannot be retrofitted to the hypothesis. The variable \( \text{failure} \) is binary: it equals one if the vehicle did not achieve a survivable surface placement enabling nominal post-landing operations, and zero otherwise. The pre-registered partial-success rule resolves the cases that lie between clean success and total loss: loss of the mission's primary surface function is coded as failure, while a survivable landing with degraded but operable function is coded as success. The rule is applied blind to the heritage coding, and the coder records, for every row, the single document-grounded fact that determined the classification.

The boundary-case register names the attempts that exercise the rule and commits in advance to recoding them in both directions during the sensitivity analysis. The SLIM small lunar lander is the canonical boundary case: it achieved a pinpoint landing but came to rest at an anomalous attitude, and its results are documented across several sources [33][103][109][147]. Under the primary rule it is coded by whether its primary surface function survived; under sensitivity it is recoded the opposite way to confirm that no headline conclusion turns on a single contested classification. Other anomalous-touchdown or degraded-function attempts surfaced during frame assembly are added to the register by the same standard, with the loss-of-Vikram investigation [64] as the reference example of a documented terminal-phase loss at the unambiguous failure end of the scale. The register is reported in full regardless of how many cases it contains, because its size is itself evidence about how much interpretive weight the outcome variable bears.


## Appendix D: Program-Strength Index Construction

Appendix D constructs the control that guards against the central confounder, namely that heritage reuse may proxy for unmeasured program strength, so that well-funded, experienced programs both reuse heritage and execute better. The program-strength index is built from two documented inputs. The first is program cost-and-schedule information drawn from U.S. Government Accountability Office assessments of NASA major projects and the relevant Mars and lunar programs; these are accessed as a data substrate through the GAO public report archive rather than as bibliographic citations, which is why no GAO report appears as a corpus row. The second is organizational flight experience, coded from the documented mission histories of the responsible organization at the time of each attempt, using the same mission-overview and reconstruction sources that populate the frame in Appendix A.

The index is constructed to be conceptually distinct from the heritage index, even though the two are expected to correlate. Heritage is a property of the architecture, scored element by element against flown lineage and qualification regime; program strength is a property of the organization and the project, scored from budget, schedule stability, and institutional descent experience. The design's main specification includes program strength as a control, and the robustness battery in Appendix E re-estimates the model with and without it precisely to bound the confounding. The honest failure mode is named in advance: if the heritage index and the program-strength index prove collinear to the point that the two cannot be separately identified, the claim that heritage carries independent value cannot be sustained, and that inseparability is reported as a falsification rather than worked around. The TRL-classification framework that anchors the heritage scoring, the NASA Technology Taxonomy [2], is the shared vocabulary across Appendices B and D, but it does not substitute for the GAO and flight-history inputs that give the program-strength index its content.


## Appendix E: Pre-Registration of the Primary Specification, Robustness Set, and Decision Rule

Appendix E is the pre-registration. It fixes the estimating equation, the inference procedure, the robustness battery, and the decision rule before any model is fitted, so that the headline result cannot be a product of searching over specifications until the coefficient turns significant. The canonical estimating equation, carried verbatim from the shared bible, is

\[ \operatorname{logit} \Pr(\text{failure}_i = 1) = \beta_0 + \beta_1 \, \text{heritage\_index}_i + \boldsymbol{\gamma}' \mathbf{controls}_i + \epsilon_i \qquad\qquad (1) \]

for landing attempt `i`, where \( \mathbf{controls}_i \) contains the target-body indicators, entry mass, landed mass, and the program-strength index. The contribution lives entirely in \( \beta_1 \). The primary estimator is Firth's bias-reduced penalized-likelihood logistic regression, chosen because the small frame and the real possibility of quasi-separation make ordinary maximum likelihood unreliable; the choice is grounded in the rare-events and penalized-likelihood literature [8][19][21][52][53][68][112][146] and its software implementations. Inference on the heritage coefficient is exact or permutation-based rather than asymptotic, because the asymptotic intervals cannot be trusted at this sample size. A discrete-time complementary-log-log hazard is pre-specified as the link-robustness confirmation, to verify that any conclusion is not an artifact of the logit link.

The robustness set is itself pre-registered and reported in full regardless of whether it strengthens or weakens the contribution. It comprises five fixed analyses: the complementary-log-log link as an alternative to the logit; exclusion of the low-documentation rows flagged in Appendix A; recoding of the boundary partial-successes from Appendix C in both directions; estimation with and without the program-strength control from Appendix D to bound confounding; and the Mokyr decomposition that splits the novelty captured in the index into propositionally grounded novelty, exemplified by supersonic retropropulsion matured through wind-tunnel and computational campaigns [36][49][66][111][135], and ungrounded novelty introduced with thin analytical backing. The decision rule is fixed and stated as a single sentence: reject H0 in favor of H1 if, and only if, the estimated \( \beta_1 \) is below zero and its exact or permutation ninety-five percent interval excludes zero in the primary specification, and the sign is stable across the robustness set. An interval that includes zero fails to reject H0. A \( \beta_1 \) that is negative without the program-strength control but collapses to zero with it is reported as confounded, which is itself a decision-relevant finding. Appendix E also fixes the power and minimum-detectable-effect computation: under the realized small frame the analysis reports the smallest heritage effect the design could have detected, so that a failure to reject H0 can be correctly read as either a true null or insufficient power rather than conflated. This pre-registration, together with the retained coding log, is the reproducibility commitment on which the design-stage status of the dissertation rests; every number that eventually fills these slots will be an executed estimate, and none is reported here.


## Appendix F: Extended Literature Table

Appendix F holds the corpus entries that were triaged out of the main-text literature review to keep Chapter 3 focused on the strongest forty-five to fifty keys, without discarding the supporting record. It is organized along the same mutually-exclusive branches that structure the literature review. The first branch, the EDL reconstruction-and-architecture record, retains the communications, atmosphere-reconstruction, thermal-protection, and instrumentation reports that document individual missions in fine detail but do not by themselves estimate a cross-mission effect [11][12][14][23][30][37][38][45][46][62][67][79][80][84][86][91][98][99][116][118][120][125][126][134][142]. The second branch, the forward architecture and technology-gap studies and the decelerator-maturation literature, retains the high-mass Mars, inflatable-decelerator, parachute-qualification, and retropropulsion entries that define the novelty side of the index but reason forward about a hypothetical fleet rather than backward from the record [5][7][10][13][24][26][27][32][34][35][51][54][57][59][96][100][113][128][136][137][138][141]. The third branch, the reliability-and-failure-statistics tradition and adjacent methods, retains the spacecraft-reliability, telemetry-failure, software-failure, and re-entry-safety entries that supply the discrete-outcome precedent and the small-sample-inference apparatus but omit an EDL-architectural-novelty regressor [3][20][22][29][39][40][41][50][69][102][117][127][130][132][145][148]. Each entry in this table is real and resolves through its DOI or repository URL exactly as in the main reference list; relegation to the appendix reflects citation triage for chapter focus, not any judgment about validity. The table exists so that a replicator assembling the population frame or reconstructing the heritage index can reach every documented attempt and every relevant method, not only the subset that earned a place in the main-text argument.