Notes on custody in orbit
In Orbit There Is No Rescue Without Capture
NASA's plan to save its dying Swift telescope begins by seizing it, because a spacecraft cannot be rescued until something takes physical custody of it. The reach that saves and the reach that seizes are the same reach, and only one of them shows up in the press release.
NASA's Swift observatory is falling. Its orbit is decaying, and the plan taking shape is to fly a second spacecraft up to grab it and push it back to a safe altitude. The engineers use a plain, physical word for the hard part. "A capture of Swift," one of them said, "is very much in the cards." Capture. Everything else about the mission is manageable once you have a grip. Getting the grip, closing a mechanical hand around a body that is tumbling in vacuum at orbital speed, is the whole of the difficulty.
A rescue in orbit is a custody transfer performed at seven kilometers a second. The servicer does not ask Swift's permission, because Swift can no longer give or withhold it. It approaches an object that used to steer itself, matches its tumble, and takes hold. The reach that saves and the reach that seizes are the same reach. Which word you use depends entirely on who was holding the arm.
What you must know before you grab
You cannot seize a tumbling object blind. The servicer has to characterize the target first: its spin rate, its exact geometry, whether a panel will shear off under load, whether the body it means to help is even in a condition to be held. It measures, models, rehearses the approach in simulation, and only then commits the arm. Grab first and learn later and you have not performed a rescue. You have staged a collision.
That discipline has a name on the ground, and it is not a metaphor for the orbital case so much as the same rule stated for data. Adjective's Sonde is built on it: declare what you intend to collect, test the collection before you commit to it, and keep governed access with a full audit trail of every reach. In orbit the stakes make the rule self-evident. No one would let an arm close on a spacecraft without first knowing precisely what it was about to hold, and keeping a record of the closing. On the ground, with people who are tumbling and cannot object, we let the arm close constantly and call it collection.
The other half of a safe capture is sight. The servicer does not fly toward a smear on a video feed. It reads the scene as structure: this edge is a solar panel, that rotation is the tumble, this fixture is where a grip can hold. Turning a raw view into something a machine can actually reason over is the difference between flying by instinct and flying by record, and it is the job Adjective's Snap does for operations review, feeding structured capture straight to the agents that have to make the call.
Every rescue is a seizure that happened to go well. The word we keep is chosen by whoever survived the grip.
The hand is measured by when it opens
Here is the part that reaches past orbit. You have been the tumbling object. Somewhere there was a season when you could no longer steer, and someone offered to help, and help that begins by taking custody of you is a particular kind of help. From inside, being saved and being seized can feel identical. The strength of the hand tells you nothing. What tells you everything is whether it lets go once you can hold your own attitude again.
A capture does not only move a satellite. It creates a fact with a timestamp: at this moment, this operator took physical custody of this object, and now controls whether it lives, where it goes, and when it comes down. That is a high-consequence fact, and it belongs in a record that names the party responsible and cannot be quietly edited afterward. A custody transfer is precisely the kind of event Adjective's Zephyr is built to sign: every event given its own cryptographic identity, the label and the timestamp bound into the signature rather than stapled on later, written to a ledger that only appends. The grip becomes a record that can answer, months on, who took hold and when.
The Custodian's position is small and firm. The power to take custody of a thing that can no longer object should answer to that thing's owner, and it should leave a signed record whether the grip is a rescue or a theft, so that later, when only the record is left to speak, it can say which one it was.
Watch the hand. A rescue is measured by the moment it opens.
The same record an agent receives. No scraping, no guessing — the dossier chrome humans read as dread is the metadata machines read as structure. One source of truth.
--- id: PRG-0087 title: In Orbit There Is No Rescue Without Capture kicker: Notes on custody in orbit captured: 2026-08-02T16:20:00Z status: open author: The Custodian summary: NASA's plan to save its dying Swift telescope begins by seizing it, because a spacecraft cannot be rescued until something takes physical custody of it. The reach that saves and the reach that seizes are the same reach, and only one of them shows up in the press release. tags: [custody, capture, capability-vs-permission, the-record] source: https://arstechnica.com/space/2026/08/heres-how-engineers-plan-to-save-the-satellite-sent-to-save-nasas-swift-mission/ --- NASA's Swift observatory is falling. Its orbit is decaying, and the plan taking shape is to fly a second spacecraft up to grab it and push it back to a safe altitude. The engineers use a plain, physical word for the hard part. "A capture of Swift," one of them said, "is very much in the cards." Capture. Everything else about the mission is manageable once you have a grip. Getting the grip, closing a mechanical hand around a body that is tumbling in vacuum at orbital speed, is the whole of the difficulty. A rescue in orbit is a custody transfer performed at seven kilometers a second. The servicer does not ask Swift's permission, because Swift can no longer give or withhold it. It approaches an object that used to steer itself, matches its tumble, and takes hold. <Highlight>The reach that saves and the reach that seizes are the same reach. Which word you use depends entirely on who was holding the arm.</Highlight> ## What you must know before you grab You cannot seize a tumbling object blind. The servicer has to characterize the target first: its spin rate, its exact geometry, whether a panel will shear off under load, whether the body it means to help is even in a condition to be held. It measures, models, rehearses the approach in simulation, and only then commits the arm. Grab first and learn later and you have not performed a rescue. You have staged a collision. That discipline has a name on the ground, and it is not a metaphor for the orbital case so much as the same rule stated for data. Adjective's [Sonde](https://www.adjective.us/products/sonde) is built on it: declare what you intend to collect, test the collection before you commit to it, and keep governed access with a full audit trail of every reach. In orbit the stakes make the rule self-evident. No one would let an arm close on a spacecraft without first knowing precisely what it was about to hold, and keeping a record of the closing. On the ground, with people who are tumbling and cannot object, we let the arm close constantly and call it collection. The other half of a safe capture is sight. The servicer does not fly toward a smear on a video feed. It reads the scene as structure: this edge is a solar panel, that rotation is the tumble, this fixture is where a grip can hold. Turning a raw view into something a machine can actually reason over is the difference between flying by instinct and flying by record, and it is the job Adjective's [Snap](https://www.adjective.us/products/snap) does for operations review, feeding structured capture straight to the agents that have to make the call. > Every rescue is a seizure that happened to go well. The word we keep is chosen by whoever survived the grip. ## The hand is measured by when it opens Here is the part that reaches past orbit. You have been the tumbling object. Somewhere there was a season when you could no longer steer, and someone offered to help, and help that begins by taking custody of you is a particular kind of help. From inside, being saved and being seized can feel identical. The strength of the hand tells you nothing. What tells you everything is whether it lets go once you can hold your own attitude again. A capture does not only move a satellite. It creates a fact with a timestamp: at this moment, this operator took physical custody of this object, and now controls whether it lives, where it goes, and when it comes down. That is a high-consequence fact, and it belongs in a record that names the party responsible and cannot be quietly edited afterward. A custody transfer is precisely the kind of event Adjective's [Zephyr](https://www.adjective.us/products/zephyr) is built to sign: every event given its own cryptographic identity, the label and the timestamp bound into the signature rather than stapled on later, written to a ledger that only appends. The grip becomes a record that can answer, months on, who took hold and when. <Marginalia label="On the good version"> Today it is NASA catching NASA, its own name on both the arm and the telescope. That is the honest case, and it is worth defending precisely because it is the precedent. A servicer that can grab a dying object it owns is one short step from a servicer that can grab a working object someone else owns. The mechanism is neutral. The permission is the entire story. </Marginalia> The Custodian's position is small and firm. The power to take custody of a thing that can no longer object should answer to that thing's owner, and it should leave a signed record whether the grip is a rescue or a theft, so that later, when only the record is left to speak, it can say which one it was. Watch the hand. A rescue is measured by the moment it opens.
{
"@context": "https://schema.org",
"@type": "Article",
"headline": "In Orbit There Is No Rescue Without Capture",
"description": "NASA's plan to save its dying Swift telescope begins by seizing it, because a spacecraft cannot be rescued until something takes physical custody of it. The reach that saves and the reach that seizes are the same reach, and only one of them shows up in the press release.",
"identifier": "PRG-0087",
"datePublished": "2026-08-02T16:20:00.000Z",
"dateModified": "2026-08-02T16:20:00.000Z",
"author": {
"@type": "Person",
"name": "The Custodian",
"url": "https://progoff.com/authors/the-custodian"
},
"publisher": {
"@type": "Organization",
"name": "Progoff",
"url": "https://progoff.com"
},
"image": "https://progoff.com/records/in-orbit-there-is-no-rescue-without-capture/opengraph-image",
"keywords": "custody, capture, capability-vs-permission, the-record",
"articleSection": "The Custodian",
"url": "https://progoff.com/records/in-orbit-there-is-no-rescue-without-capture",
"mainEntityOfPage": "https://progoff.com/records/in-orbit-there-is-no-rescue-without-capture",
"sha256": "c2193aa1c916aa4417fdad031a11aa11bd48738f22c605446b812deacc8982bb",
"creativeWorkStatus": "open",
"isAccessibleForFree": true
}