A Provably Stable Geometric Bayesian Self-Healing Framework for Deep-Space Cyber-Physical Systems: SO(3) Attitude Dynamics, Multi-Physics Energy–Thermal Coupling, and Lessons from the 2025 Lunar Trailblazer Failure

Background and Motivation. NASA's Lunar Trailblazer spacecraft lost power shortly after its 27 February 2025 launch, following a solar-array pointing anomaly compounded by fault-management difficulties; the mission was declared a loss on 31 July 2025. The incident illustrates a structural gap in deep-space fault tolerance: autonomous self-healing architectures that are simultaneously mathematically provable and physically faithful to real spacecraft parameters.Contributions. We present a self-healing framework with four components, each implemented as executable, tested code rather than asserted analytically: (i) a rigid-body attitude model on SO(3) with a Lyapunov proof of almost-global asymptotic stability (AGAS) and input-to-state stability (ISS) under bounded disturbances; (ii) a coupled multi-physics energy–thermal model (photovoltaic array, battery energy balance, radiative spacecraft thermal balance); (iii) a constrained, SOC-floor-enforcing recovery controller in the geometric-MPC design pattern (torque and state-of-charge constraints; a full receding-horizon SQP implementation is identified as near-term future work in Section 11); and (iv) a Bayesian self-healing recovery index built from a genuine Monte Carlo campaign, Metropolis–Hastings MCMC with Gelman–Rubin diagnostics, and Sobol global sensitivity analysis.Corrected mission parameters. We identify and correct a parameter error present in earlier drafts of this study: the spacecraft mass was previously set to 72 kg, apparently conflating the mission's publicly reported cost ($72 million) with its mass. The verified NASA/NSSDCA mass is approximately 200 kg (210 kg launch mass per some sources), with 280 W of solar power [1, 2]. All simulations in this revision use the corrected mass and power, together with an inertia tensor estimated from the spacecraft's approximate box envelope (an assumption, not an official value, since the true inertia tensor is not publicly disclosed) and a battery capacity treated as an explicitly labelled illustrative assumption for the same reason.Results. Under the corrected parameters, a Monte Carlo campaign (n = 2000 randomized fault-detection-latency, gain, and disturbance draws) for the constrained recovery controller yields an empirical recovery probability of π̂ = 0.9475 (k = 1895 successes); Metropolis–Hastings MCMC over this data gives a posterior mean of 0.9471 (95% credible interval [0.9368, 0.9564], Gelman–Rubin R̂ = 1.0000). A comparison campaign for a conventional PD recovery law (n = 800) yields π̂ = 0.9313 (posterior mean 0.9302, CI [0.9115, 0.9468]). Sobol sensitivity analysis on final state-of-charge identifies fault-detection latency as the dominant driver of outcome variance (total-effect index ST ≈ 0.999), consistent with, but numerically distinct from, the figures reported in earlier (uncorrected) drafts of this manuscript.Recommendation. We recommend that self-healing recovery probability be estimated from campaigns of full nonlinear simulation under verified or explicitly labelled spacecraft parameters, rather than asserted from illustrative numbers, before being used to support flight certification claims.Reproducibility. All code in this manuscript (Appendix B) was executed to produce every number, table, and figure reported here.