Computed: a circular sun-synchronous orbit (period from Kepler's third law, inclination from the sun-synchronous condition, Earth rotation and Sun position from standard formulas). From it the orbits, the eclipses, the imaging opportunities (a target within half a swath of the sub-satellite point with the Sun high enough) and the ground contacts (a station sees the satellite above its minimum elevation) of every mission day.

Executed: every day the Landsat-9 physics model (sunlight/eclipse from the orbit, battery, solar wings, star trackers) is stepped in 10-minute steps and, at the start of every planned task, both controllers decide from the same state. The physics status (NOMINAL = battery above 20 % and attitude integrity above 90 %) judges each decision.

Inputs, not measurements: the target list (named places, approximate coordinates), the three example ground stations, the swath width, the two elevation masks, and the choice of what hardware each task needs:

Limits: this is a model orbit in a Landsat-9-like plane, not the real Landsat-9 ephemeris (the orbit phase is arbitrary). Only the EPS (battery and solar wings) and star trackers A/B are physically modelled; the payload and communication nodes stay at 100 %. GPS and IMU faults are modelled as a star tracker A failure. The Kalman-filter baseline is deliberately simple (a linear filter without residual check). No hardware is involved; the maturity of the whole work is TRL 3-4.