Un pezzo di quattro tonnellate di un razzo SpaceX ha trascorso diciotto mesi in rotta di collisione con la Luna, a partire più o meno nel momento in cui tutti hanno smesso di pensarci. Il 5 agosto è arrivato.
La parte interessante non è la collisione. Il fatto è che la collisione era stata programmata con diciotto mesi di anticipo mediante una decisione che nessuno ricorda di aver preso.
Sì. Uno stadio superiore del Falcon 9 di SpaceX esaurito si è schiantato sulla Luna il 5 agosto 2026, intorno alle 06:34 UTC - 2:34 EDT - vicino al cratere Einstein sul bordo occidentale. L'orbiter Danuri della Corea del Sud ha confermato l'impatto lunare, immaginando il sito attraverso otto passaggi iniziati circa trenta minuti prima del contatto. Il Korea Aerospace Research Institute ha riferito che "sono stati confermati i cambiamenti nel terreno attorno al luogo dell'impatto e le tracce di diffusione dei materiali espulsi". All'Osservatorio Lowell in Arizona, il team di Carl Schmidt ha misurato un pennacchio di gas di sodio e litio largo decine di chilometri e durato dai cinque ai dieci minuti.
Quella che segue non è una storia spaziale. È ciò che il crollo dice di ogni sistema che sopravvive all’attenzione prestatagli.
L'oggetto non ha nome, solo una designazione di catalogo: 2025-010D. È stato il quarto pezzo di hardware tracciato dal decimo lancio orbitale del 2025, il 15 gennaio, che trasportava il lander Blue Ghost di Firefly Aerospace e Resilience di ispace verso la Luna. Blue Ghost atterrò con successo quel marzo. La resilienza ha perso il contatto circa novanta secondi prima dell'atterraggio e si è schiantata a giugno.
Gli stadi superiori del Falcon 9 vengono normalmente deorbitati poco dopo il lancio e bruciati nell'atmosfera. Questo non è successo qui. Spingere due lander verso il punto di schieramento ha consumato quasi tutto il propellente dello stadio, quindi il combustibile per lo smaltimento non era più disponibile. Secondo uno studio condotto da Benjamin Fernando del Los Alamos National Laboratory, il palco "è stato abbandonato in un'orbita terrestre alta che attraversava la luna".
Ha poi trascorso più di diciotto mesi in un'orbita sbilenca di 26 giorni, oscillando tra circa 220.000 e 510.000 km dalla Terra, attraversando ripetutamente il percorso della Luna, mancandola ogni volta, finché non lo fece più. L'astronomo Bill Gray del Progetto Plutone ha stimato la velocità dell'impatto a 2,43 km/s e l'energia rilasciata a circa 14,5 miliardi di joule, circa tre tonnellate di TNT.
Nessuno ha scelto di far schiantare un razzo sulla Luna. La scelta che contava era stata fatta molto prima e sembrava un budget per il carburante.
Lo smantellamento è stato l'elemento pubblicitario che è stato utilizzato per far funzionare la missione principale. Non c'è stato nessun incontro a riguardo, nessuna iscrizione nel registro dei rischi, nessun ingegnere dissenziente. La missione è stata più difficile del margine consentito, il margine è uscito dalla fine della vita e il piano di fine vita ha cessato silenziosamente di esistere.
Questo è il modo più comune in cui i sistemi software diventano permanenti. La migrazione è lunga, quindi il taglio si mangia il trimestre, quindi lo smantellamento del vecchio sistema scivola al "prossimo sprint". Il vecchio sistema continua a servire un rivolo di traffico. Due anni dopo è portante e nessuno nel team ha letto il suo codice.
La modalità di fallimento non è negligenza. Il fatto è che lo smantellamento è l’unica parte di un progetto la cui scadenza non viene rispettata.
SpaceX non se ne è semplicemente andato. Julianna Scheiman, direttrice dei programmi scientifici e Dragon della NASA, ha affermato che è stata eseguita una manovra diversa "per garantire che il secondo stadio stesso sia sicuro secondo le norme e i regolamenti appropriati".
Quella manovra soddisfaceva le regole. Non ha messo l'oggetto in un posto durevole. Come ha detto Scheiman, "una miscela di attività solare e forze di gravità lo hanno messo su un percorso verso la luna".
Un controllo che supera la revisione al go-live è una dichiarazione sul go-live. Non si tratta di una dichiarazione sullo stato del sistema diciotto mesi dopo, e trattare i due come equivalenti è il modo in cui si accumula il rischio modello. La firma è un'istantanea; i sistemi sono una traiettoria.
La forza che lo muoveva era la luce del sole. La pressione della radiazione solare - i fotoni che colpiscono la fase di rotazione - è, nella descrizione di Gray, "una forza estremamente delicata, ma nel corso dei mesi può davvero accumularsi". Inoltre, non è del tutto prevedibile, perché un oggetto che cade cattura e riflette la luce in modo diverso mentre gira.
Nessuna singola spinta contava. In diciotto mesi hanno deciso dove sarebbero finite quattro tonnellate e mezzo di metallo.
Questa è una deriva, esattamente come appare in un sistema di valutazione: nessuno spostamento di popolazione in una singola settimana merita un allarme, e lo spostamento cumulativo di diciotto mesi merita una constatazione normativa. Se la cadenza di convalida è più lenta dell'accumulo di deriva, non stai monitorando il modello. Lo visiti solo occasionalmente.
Ecco il dettaglio che ci è sembrato più scomodo. Questo oggetto è stato monitorato principalmente da rilevamenti di asteroidi e da astronomi dilettanti, perché i sistemi costruiti per i detriti spaziali non possono vedere così lontano. Il radar eccelle nell’orbita terrestre bassa – Gray nota di aver tracciato guanti e borse degli attrezzi persi dagli astronauti – ma a distanza lunare il segnale di ritorno è circa 25,6 miliardi di volte più debole. Gray calcola le orbite degli oggetti ad alta quota proprio perché sono quelli che "l'esercito non traccia".
I sondaggi che lo hanno visto non ci stavano provando. Il loro compito è la difesa planetaria e, come dice Gray, "il tempo trascorso a osservare la spazzatura è tempo non speso a cercare rocce".
Ogni organizzazione ingegneristica ha questa disposizione e la chiama in modo diverso. Il servizio deprecato non ha dashboard né rotazione di guardia e l'unico motivo per cui qualcuno sa che sta peggiorando è che un tecnico continua a notarlo in registri non correlati. Questa non è osservabilità. Quello è un volontario, e i volontari se ne vanno.
La ripresa qui è davvero impressionante ed è stata fatta di dati. Alla fine di febbraio l’archivio conteneva 1.053 osservazioni, fornite da osservatori nel Mississippi, Utah, Pechino e Inghilterra. Il software di Gray ha segnalato l'impatto lunare nel settembre 2025, undici mesi prima.
Le previsioni si sono poi inasprite man mano che le osservazioni si accumulavano. Una revisione di giugno ha spostato l'impatto previsto nove minuti prima e 170 km a nord-ovest. Una revisione di luglio lo ha spostato di un paio di secondi e di una decina di chilometri. Un aggiornamento finale è arrivato il 1 agosto.
Quella precisione ha dato i suoi frutti: Danuri ha iniziato a fotografare circa trenta minuti prima della collisione e ha effettuato otto passaggi sul sito, catturando un'autentica copertura prima e dopo. Punti uno strumento sul punto giusto di terreno al momento giusto solo se qualcuno ti dà una previsione. E ottieni solo una previsione per un sistema che qualcuno sta ancora misurando.
Vale la pena notare, per non esagerare: al momento della stesura di questo articolo non è stata pubblicata alcuna misurazione del nuovo cratere. Gray predisse un singolo cratere di circa 17 metri di diametro. Gran parte della copertura giornalistica cita fino a 27 m. Entrambi sono calcoli pre-impatto e non concordano tra loro.
Anche se si tratti di uno o due crateri è incerto. Lo stadio superiore Chang'e 5-T1 del 2022 ha sorpreso tutti realizzando un doppio cratere. Gray se ne aspetta uno solo qui perché questo stadio non aveva una massa paragonabile nella parte superiore: un'inferenza ragionevole, non un risultato.
I numeri in circolazione non sono misurazioni. Questa distinzione è l’intero lavoro nella validazione del modello, e non smette di essere vera perché un numero viene ripetuto con sicurezza da tutti.
Traducete le modalità di fallimento e diventeranno spiacevolmente familiari.
| Cosa è successo al 2025-010D |
L'equivalente in uno stack di prestito |
| Smaltimento del carburante speso per la missione primaria |
Smantellamento previsto per proteggere una data di lancio |
| Manovra conforme, quindi nessun proprietario |
Il controllo è stato approvato al momento del go-live e non è mai stato nuovamente verificato |
| Pressione della radiazione solare su 18 mesi |
Deriva della popolazione tra i cicli di validazione |
| Invisibile ai radar a distanza lunare |
Nessuna telemetria sul servizio deprecato |
| Tracciato da volontari con altri lavori |
Un ingegnere che per caso sa che esiste |
Concretamente, gli aspetti che vale la pena verificare in questo trimestre:
- Scorecard ritirati che segnano ancora. Una versione del modello sostituito lasciata collegata a un percorso di fallback, decidendo silenziosamente una fetta di applicazioni.
- Archivi di documenti orfani. Secchi di estratti conto dei clienti provenienti da un progetto pilota terminato. Nessuno li possiede, la politica di conservazione non è mai stata applicata e sono pura responsabilità.
- Condutture di estrazione con un chiamante rimanente. Il vecchio parser è rimasto in vita per l'integrazione di un unico prestatore, non mantenuto e non monitorato.
- Credenziali che sopravvivono al loro scopo. Chiavi API per un fornitore di dati che hai smesso di pagare, ancora valide, ancora in una configurazione da qualche parte.
- Connettori per formati che sono cambiati. Una banca ha ridisegnato il layout del proprio estratto conto; il connettore ora si guasta silenziosamente in una piccola percentuale e nessuno ha impostato un allarme.
Nessuno di questi ti chiamerà. È proprio questo il problema: falliscono in modi che non producono alcun segnale finché il fallimento non è scoperto da qualcun altro.
La soluzione, nella meccanica orbitale, è economica, se si decide in anticipo. Metti lo stadio superiore su una traiettoria che lascia completamente il sistema Terra-Luna e finisce per orbitare attorno al Sole. Lo stadio Falcon 9 del lancio dell'EscaPADE nel novembre 2025 è stato smaltito in questo modo. I lanci lunari cinesi si sono mossi nella stessa direzione.
Ma funziona solo come decisione in fase di progettazione. Una volta esaurito il propellente, non esiste alcuna opzione a nessun prezzo. Gray è onesto anche riguardo al limite: il trucco “funziona solo per una piccola frazione di spazzatura”, vale a dire per le missioni già dirette oltre l’orbita terrestre. Alcune classi di sistema non possono davvero essere ritirate in modo pulito e il tempo per scoprire in quale classe ti trovi è prima di costruire.
La domanda sollevata da Scheiman è quella giusta da rubare: "Qual è il miglior percorso di smaltimento futuro per le missioni ad alta energia che si trovano nel sistema Sole-Terra-Luna?" La versione del software è più piccola, più noiosa e altrettanto senza risposta. Qual è il percorso di pensionamento per questo modello, questa pipeline, questo archivio dati? Chi lo possiede dopo la festa di lancio? Quale segnale ci dice che è ancora in funzione e chi riceve quel segnale?
I sistemi che non puoi vedere sono sistemi che non puoi ritirare. Levmetrics' Lev Document Intelligence è costruito in modo tale che ogni estrazione, punteggio e decisione lasci una traccia verificabile, comprese quelle che volevi disattivare. Provalo su app.levmetrics.com.
Uno stadio missilistico da quattro tonnellate è un utile insegnante perché è impossibile perderlo educatamente. Mantenne un'orbita, mantenne un numero di catalogo e, diciotto mesi dopo che tutti dichiararono che la missione era un successo, arrivò dove nessuno si aspettava a 2,43 chilometri al secondo. La maggior parte dei sistemi abbandonati sono meno drammatici e più costosi. La distribuzione è una pietra miliare nella vita di un sistema. Non è affatto vicino alla fine.
- Mike Wall, "A SpaceX rocket will crash into the moon this week. Why is it on a collision course?", Space.com, August 3, 2026.
- Chelsea Gohd, "A SpaceX rocket just crashed into the moon. Now, the race is on to get a look at the impact site", Space.com, August 5, 2026.
- Mike Wall, "SpaceX rocket's impact crater on the moon spied by Korean lunar orbiter (photos)", Space.com, August 6, 2026.
- Bill Gray, "Upper stage impacting the moon on 2026 August 5", Project Pluto.
- Adam Kovac, "A SpaceX rocket booster is on track to hit the moon at several times the speed of sound", Scientific American, May 1, 2026.
- Leonard David, "Moon Impact of Rocket Stage Observed", Inside Outer Space, August 5, 2026.
- Benjamin Fernando et al., "preprint on the predicted lunar impact of the 2025-010D upper stage", arXiv.
A four-tonne piece of a SpaceX rocket spent eighteen months on a collision course with the Moon, starting at roughly the moment everyone stopped thinking about it. On August 5 it arrived.
The interesting part is not the collision. It is that the collision was scheduled eighteen months in advance by a decision nobody remembers making.
Yes. A spent SpaceX Falcon 9 upper stage crashed into the Moon on August 5, 2026, at about 06:34 UTC — 2:34 a.m. EDT — near the crater Einstein on the western limb. South Korea's Danuri orbiter confirmed the lunar impact, imaging the site across eight passes that began roughly thirty minutes before contact. The Korea Aerospace Research Institute reported that "changes in the terrain around the impact site and traces of ejecta spread were confirmed." At Lowell Observatory in Arizona, Carl Schmidt's team measured a sodium and lithium gas plume tens of kilometres across that lasted five to ten minutes.
What follows is not a space story. It is what the crash says about every system that outlives the attention paid to it.
The object has no name, only a catalogue designation: 2025-010D. It was the fourth tracked piece of hardware from the tenth orbital launch of 2025, on January 15, which carried Firefly Aerospace's Blue Ghost lander and ispace's Resilience toward the Moon. Blue Ghost landed successfully that March. Resilience lost contact about ninety seconds before touchdown and crashed in June.
Falcon 9 upper stages are normally deorbited shortly after launch and burned up in the atmosphere. That did not happen here. Pushing two landers to their deployment point consumed nearly all of the stage's propellant, so the disposal burn was no longer available. In the words of a study led by Benjamin Fernando of Los Alamos National Laboratory, the stage "was abandoned in a moon-crossing high-Earth orbit."
It then spent more than eighteen months in a lopsided 26-day orbit, swinging between roughly 220,000 and 510,000 km from Earth — repeatedly crossing the Moon's path, missing it every time, until it didn't. Astronomer Bill Gray of Project Pluto put the impact speed at 2.43 km/s and the released energy at about 14.5 billion joules, roughly three tons of TNT.
Nobody chose to crash a rocket into the Moon. The choice that mattered was made much earlier, and it looked like a fuel budget.
Decommissioning was the line item that got consumed to make the primary mission work. There was no meeting about it, no risk register entry, no dissenting engineer. The mission was harder than the margin allowed, the margin came out of end-of-life, and the end-of-life plan quietly ceased to exist.
This is the most common way software systems become permanent. The migration runs long, so the cutover eats the quarter, so the decommissioning of the old system slips to "next sprint." The old system keeps serving a trickle of traffic. Two years later it is load-bearing and nobody on the team has read its code.
The failure mode is not negligence. It is that decommissioning is the only part of a project whose deadline nothing enforces.
SpaceX did not simply walk away. Julianna Scheiman, the company's director of NASA science and Dragon programs, said a different maneuver was performed "to ensure that the second stage itself is safe per the appropriate rules and regulations."
That maneuver satisfied the rules. It did not put the object anywhere durable. As Scheiman put it, "a mixture of solar activity and gravity forces have put it on a path towards the moon."
A control that passes review at go-live is a statement about go-live. It is not a statement about the system's state eighteen months later, and treating the two as equivalent is how model risk accumulates. Sign-off is a snapshot; systems are a trajectory.
The force that moved it was sunlight. Solar radiation pressure — photons striking the tumbling stage — is, in Gray's description, "an extremely gentle force, but over months, it can really build up." It is also not fully predictable, because a tumbling object catches and reflects light differently as it turns.
No single push mattered. Eighteen months of them decided where four-and-a-bit tonnes of metal ended up.
That is drift, exactly as it appears in a scoring pipeline: no individual week's population shift is worth an alert, and the cumulative eighteen-month displacement is worth a regulatory finding. If your validation cadence is slower than your drift accumulation, you are not monitoring the model. You are just visiting it occasionally.
Here is the detail we found most uncomfortable. This object was tracked mainly by asteroid surveys and amateur astronomers, because the systems built for space debris cannot see that far out. Radar excels in low Earth orbit — Gray notes it has tracked gloves and tool bags lost by astronauts — but at lunar distance the return signal is about 25.6 billion times fainter. Gray computes orbits for high-altitude objects specifically because they are the ones "the military doesn't track."
The surveys that did see it were not trying to. Their job is planetary defence, and as Gray puts it, "time spent observing junk is time not spent finding rocks."
Every engineering organisation has this arrangement and calls it something else. The deprecated service has no dashboard and no on-call rotation, and the only reason anyone knows it is degrading is that one engineer keeps noticing it in unrelated logs. That is not observability. That is a volunteer, and volunteers leave.
The recovery here is genuinely impressive, and it was made of data. By late February the archive held 1,053 observations, contributed by observatories in Mississippi, Utah, Beijing and England. Gray's software flagged the lunar impact in September 2025 — eleven months ahead.
The forecast then tightened as observations accumulated. A June revision moved the predicted impact nine minutes earlier and 170 km to the northwest. A July revision moved it by a couple of seconds and about ten kilometres. A final update landed on August 1.
That precision had a payoff: Danuri began imaging roughly thirty minutes before the collision and made eight passes over the site, capturing genuine before-and-after coverage. You only point an instrument at the right patch of ground at the right minute if someone gave you a forecast. And you only get a forecast for a system somebody is still measuring.
Worth noting, in the spirit of not overclaiming: as of this writing there is no published measurement of the new crater. Gray predicted a single crater around 17 m across. Much of the news coverage cites up to 27 m. Both are pre-impact calculations, and they do not agree with each other.
Whether it is one crater or two is also unsettled. The 2022 Chang'e 5-T1 upper stage surprised everyone by making a double crater. Gray expects a single one here because this stage carried no comparable mass at the top — a reasonable inference, not a result.
Numbers in circulation are not measurements. That distinction is the whole job in model validation, and it does not stop being true because a number is repeated confidently by everyone.
Translate the failure modes and they get uncomfortably familiar.
| What happened to 2025-010D |
The equivalent in a lending stack |
| Disposal fuel spent on the primary mission |
Decommissioning descoped to protect a launch date |
| Compliant maneuver, then no owner |
Control signed off at go-live, never re-verified |
| Solar radiation pressure over 18 months |
Population drift between validation cycles |
| Invisible to radar at lunar distance |
No telemetry on the deprecated service |
| Tracked by volunteers with other jobs |
One engineer who happens to know it exists |
Concretely, the things worth auditing this quarter:
- Retired scorecards that still score. A superseded model version left wired into a fallback path, quietly deciding a slice of applications.
- Orphaned document stores. Buckets of customer bank statements from a pilot that ended. Nobody owns them, retention policy never applied, and they are pure liability.
- Extraction pipelines with one remaining caller. The old parser kept alive for a single lender integration, unmaintained and unmonitored.
- Credentials outliving their purpose. API keys for a data provider you stopped paying, still valid, still in a config somewhere.
- Connectors for formats that changed. A bank redesigned its statement layout; the connector now fails silently on a small percentage and nobody set an alarm.
None of these will page you. That is precisely the problem: they fail in ways that produce no signal until the failure is someone else's finding.
The fix, in orbital mechanics, is cheap — if you decide early. Put the upper stage on a trajectory that leaves the Earth-Moon system entirely and ends up orbiting the Sun. The Falcon 9 stage from the EscaPADE launch in November 2025 was disposed of this way. Chinese lunar launches have moved in the same direction.
But it only works as a design-time decision. Once the propellant is gone, no option exists at any price. Gray is also honest about the limit: the trick "only works for a small fraction of junk," namely missions already headed beyond Earth orbit. Some classes of system genuinely cannot be cleanly retired, and the time to find out which class you are in is before you build.
The question Scheiman raised is the right one to steal: "What is the best future disposal path for high-energy missions that are in the sun-Earth-moon system?" The software version is smaller and duller and just as unanswered. What is the retirement path for this model, this pipeline, this data store? Who owns it after the launch party? What signal tells us it is still running, and who receives that signal?
Systems you cannot see are systems you cannot retire. Levmetrics' Lev Document Intelligence is built so that every extraction, score and decision leaves an auditable trace — including the ones you meant to turn off. Try it at app.levmetrics.com.
A four-tonne rocket stage is a useful teacher because it is impossible to lose track of politely. It kept an orbit, it kept a catalogue number, and eighteen months after everyone declared the mission a success it arrived somewhere nobody intended at 2.43 kilometres per second. Most abandoned systems are less dramatic and more expensive. Deployment is a milestone in a system's life. It is nowhere near the end of it.
- Mike Wall, "A SpaceX rocket will crash into the moon this week. Why is it on a collision course?", Space.com, August 3, 2026.
- Chelsea Gohd, "A SpaceX rocket just crashed into the moon. Now, the race is on to get a look at the impact site", Space.com, August 5, 2026.
- Mike Wall, "SpaceX rocket's impact crater on the moon spied by Korean lunar orbiter (photos)", Space.com, August 6, 2026.
- Bill Gray, "Upper stage impacting the moon on 2026 August 5", Project Pluto.
- Adam Kovac, "A SpaceX rocket booster is on track to hit the moon at several times the speed of sound", Scientific American, May 1, 2026.
- Leonard David, "Moon Impact of Rocket Stage Observed", Inside Outer Space, August 5, 2026.
- Benjamin Fernando et al., "preprint on the predicted lunar impact of the 2025-010D upper stage", arXiv.
A four-tonne piece of a SpaceX rocket spent eighteen months on a collision course with the Moon, starting at roughly the moment everyone stopped thinking about it. On August 5 it arrived.
The interesting part is not the collision. It is that the collision was scheduled eighteen months in advance by a decision nobody remembers making.
Yes. A spent SpaceX Falcon 9 upper stage crashed into the Moon on August 5, 2026, at about 06:34 UTC — 2:34 a.m. EDT — near the crater Einstein on the western limb. South Korea's Danuri orbiter confirmed the lunar impact, imaging the site across eight passes that began roughly thirty minutes before contact. The Korea Aerospace Research Institute reported that "changes in the terrain around the impact site and traces of ejecta spread were confirmed." At Lowell Observatory in Arizona, Carl Schmidt's team measured a sodium and lithium gas plume tens of kilometres across that lasted five to ten minutes.
What follows is not a space story. It is what the crash says about every system that outlives the attention paid to it.
The object has no name, only a catalogue designation: 2025-010D. It was the fourth tracked piece of hardware from the tenth orbital launch of 2025, on January 15, which carried Firefly Aerospace's Blue Ghost lander and ispace's Resilience toward the Moon. Blue Ghost landed successfully that March. Resilience lost contact about ninety seconds before touchdown and crashed in June.
Falcon 9 upper stages are normally deorbited shortly after launch and burned up in the atmosphere. That did not happen here. Pushing two landers to their deployment point consumed nearly all of the stage's propellant, so the disposal burn was no longer available. In the words of a study led by Benjamin Fernando of Los Alamos National Laboratory, the stage "was abandoned in a moon-crossing high-Earth orbit."
It then spent more than eighteen months in a lopsided 26-day orbit, swinging between roughly 220,000 and 510,000 km from Earth — repeatedly crossing the Moon's path, missing it every time, until it didn't. Astronomer Bill Gray of Project Pluto put the impact speed at 2.43 km/s and the released energy at about 14.5 billion joules, roughly three tons of TNT.
Nobody chose to crash a rocket into the Moon. The choice that mattered was made much earlier, and it looked like a fuel budget.
Decommissioning was the line item that got consumed to make the primary mission work. There was no meeting about it, no risk register entry, no dissenting engineer. The mission was harder than the margin allowed, the margin came out of end-of-life, and the end-of-life plan quietly ceased to exist.
This is the most common way software systems become permanent. The migration runs long, so the cutover eats the quarter, so the decommissioning of the old system slips to "next sprint." The old system keeps serving a trickle of traffic. Two years later it is load-bearing and nobody on the team has read its code.
The failure mode is not negligence. It is that decommissioning is the only part of a project whose deadline nothing enforces.
SpaceX did not simply walk away. Julianna Scheiman, the company's director of NASA science and Dragon programs, said a different maneuver was performed "to ensure that the second stage itself is safe per the appropriate rules and regulations."
That maneuver satisfied the rules. It did not put the object anywhere durable. As Scheiman put it, "a mixture of solar activity and gravity forces have put it on a path towards the moon."
A control that passes review at go-live is a statement about go-live. It is not a statement about the system's state eighteen months later, and treating the two as equivalent is how model risk accumulates. Sign-off is a snapshot; systems are a trajectory.
The force that moved it was sunlight. Solar radiation pressure — photons striking the tumbling stage — is, in Gray's description, "an extremely gentle force, but over months, it can really build up." It is also not fully predictable, because a tumbling object catches and reflects light differently as it turns.
No single push mattered. Eighteen months of them decided where four-and-a-bit tonnes of metal ended up.
That is drift, exactly as it appears in a scoring pipeline: no individual week's population shift is worth an alert, and the cumulative eighteen-month displacement is worth a regulatory finding. If your validation cadence is slower than your drift accumulation, you are not monitoring the model. You are just visiting it occasionally.
Here is the detail we found most uncomfortable. This object was tracked mainly by asteroid surveys and amateur astronomers, because the systems built for space debris cannot see that far out. Radar excels in low Earth orbit — Gray notes it has tracked gloves and tool bags lost by astronauts — but at lunar distance the return signal is about 25.6 billion times fainter. Gray computes orbits for high-altitude objects specifically because they are the ones "the military doesn't track."
The surveys that did see it were not trying to. Their job is planetary defence, and as Gray puts it, "time spent observing junk is time not spent finding rocks."
Every engineering organisation has this arrangement and calls it something else. The deprecated service has no dashboard and no on-call rotation, and the only reason anyone knows it is degrading is that one engineer keeps noticing it in unrelated logs. That is not observability. That is a volunteer, and volunteers leave.
The recovery here is genuinely impressive, and it was made of data. By late February the archive held 1,053 observations, contributed by observatories in Mississippi, Utah, Beijing and England. Gray's software flagged the lunar impact in September 2025 — eleven months ahead.
The forecast then tightened as observations accumulated. A June revision moved the predicted impact nine minutes earlier and 170 km to the northwest. A July revision moved it by a couple of seconds and about ten kilometres. A final update landed on August 1.
That precision had a payoff: Danuri began imaging roughly thirty minutes before the collision and made eight passes over the site, capturing genuine before-and-after coverage. You only point an instrument at the right patch of ground at the right minute if someone gave you a forecast. And you only get a forecast for a system somebody is still measuring.
Worth noting, in the spirit of not overclaiming: as of this writing there is no published measurement of the new crater. Gray predicted a single crater around 17 m across. Much of the news coverage cites up to 27 m. Both are pre-impact calculations, and they do not agree with each other.
Whether it is one crater or two is also unsettled. The 2022 Chang'e 5-T1 upper stage surprised everyone by making a double crater. Gray expects a single one here because this stage carried no comparable mass at the top — a reasonable inference, not a result.
Numbers in circulation are not measurements. That distinction is the whole job in model validation, and it does not stop being true because a number is repeated confidently by everyone.
Translate the failure modes and they get uncomfortably familiar.
| What happened to 2025-010D |
The equivalent in a lending stack |
| Disposal fuel spent on the primary mission |
Decommissioning descoped to protect a launch date |
| Compliant maneuver, then no owner |
Control signed off at go-live, never re-verified |
| Solar radiation pressure over 18 months |
Population drift between validation cycles |
| Invisible to radar at lunar distance |
No telemetry on the deprecated service |
| Tracked by volunteers with other jobs |
One engineer who happens to know it exists |
Concretely, the things worth auditing this quarter:
- Retired scorecards that still score. A superseded model version left wired into a fallback path, quietly deciding a slice of applications.
- Orphaned document stores. Buckets of customer bank statements from a pilot that ended. Nobody owns them, retention policy never applied, and they are pure liability.
- Extraction pipelines with one remaining caller. The old parser kept alive for a single lender integration, unmaintained and unmonitored.
- Credentials outliving their purpose. API keys for a data provider you stopped paying, still valid, still in a config somewhere.
- Connectors for formats that changed. A bank redesigned its statement layout; the connector now fails silently on a small percentage and nobody set an alarm.
None of these will page you. That is precisely the problem: they fail in ways that produce no signal until the failure is someone else's finding.
The fix, in orbital mechanics, is cheap — if you decide early. Put the upper stage on a trajectory that leaves the Earth-Moon system entirely and ends up orbiting the Sun. The Falcon 9 stage from the EscaPADE launch in November 2025 was disposed of this way. Chinese lunar launches have moved in the same direction.
But it only works as a design-time decision. Once the propellant is gone, no option exists at any price. Gray is also honest about the limit: the trick "only works for a small fraction of junk," namely missions already headed beyond Earth orbit. Some classes of system genuinely cannot be cleanly retired, and the time to find out which class you are in is before you build.
The question Scheiman raised is the right one to steal: "What is the best future disposal path for high-energy missions that are in the sun-Earth-moon system?" The software version is smaller and duller and just as unanswered. What is the retirement path for this model, this pipeline, this data store? Who owns it after the launch party? What signal tells us it is still running, and who receives that signal?
Systems you cannot see are systems you cannot retire. Levmetrics' Lev Document Intelligence is built so that every extraction, score and decision leaves an auditable trace — including the ones you meant to turn off. Try it at app.levmetrics.com.
A four-tonne rocket stage is a useful teacher because it is impossible to lose track of politely. It kept an orbit, it kept a catalogue number, and eighteen months after everyone declared the mission a success it arrived somewhere nobody intended at 2.43 kilometres per second. Most abandoned systems are less dramatic and more expensive. Deployment is a milestone in a system's life. It is nowhere near the end of it.
- Mike Wall, "A SpaceX rocket will crash into the moon this week. Why is it on a collision course?", Space.com, August 3, 2026.
- Chelsea Gohd, "A SpaceX rocket just crashed into the moon. Now, the race is on to get a look at the impact site", Space.com, August 5, 2026.
- Mike Wall, "SpaceX rocket's impact crater on the moon spied by Korean lunar orbiter (photos)", Space.com, August 6, 2026.
- Bill Gray, "Upper stage impacting the moon on 2026 August 5", Project Pluto.
- Adam Kovac, "A SpaceX rocket booster is on track to hit the moon at several times the speed of sound", Scientific American, May 1, 2026.
- Leonard David, "Moon Impact of Rocket Stage Observed", Inside Outer Space, August 5, 2026.
- Benjamin Fernando et al., "preprint on the predicted lunar impact of the 2025-010D upper stage", arXiv.
A four-tonne piece of a SpaceX rocket spent eighteen months on a collision course with the Moon, starting at roughly the moment everyone stopped thinking about it. On August 5 it arrived.
The interesting part is not the collision. It is that the collision was scheduled eighteen months in advance by a decision nobody remembers making.
Yes. A spent SpaceX Falcon 9 upper stage crashed into the Moon on August 5, 2026, at about 06:34 UTC — 2:34 a.m. EDT — near the crater Einstein on the western limb. South Korea's Danuri orbiter confirmed the lunar impact, imaging the site across eight passes that began roughly thirty minutes before contact. The Korea Aerospace Research Institute reported that "changes in the terrain around the impact site and traces of ejecta spread were confirmed." At Lowell Observatory in Arizona, Carl Schmidt's team measured a sodium and lithium gas plume tens of kilometres across that lasted five to ten minutes.
What follows is not a space story. It is what the crash says about every system that outlives the attention paid to it.
The object has no name, only a catalogue designation: 2025-010D. It was the fourth tracked piece of hardware from the tenth orbital launch of 2025, on January 15, which carried Firefly Aerospace's Blue Ghost lander and ispace's Resilience toward the Moon. Blue Ghost landed successfully that March. Resilience lost contact about ninety seconds before touchdown and crashed in June.
Falcon 9 upper stages are normally deorbited shortly after launch and burned up in the atmosphere. That did not happen here. Pushing two landers to their deployment point consumed nearly all of the stage's propellant, so the disposal burn was no longer available. In the words of a study led by Benjamin Fernando of Los Alamos National Laboratory, the stage "was abandoned in a moon-crossing high-Earth orbit."
It then spent more than eighteen months in a lopsided 26-day orbit, swinging between roughly 220,000 and 510,000 km from Earth — repeatedly crossing the Moon's path, missing it every time, until it didn't. Astronomer Bill Gray of Project Pluto put the impact speed at 2.43 km/s and the released energy at about 14.5 billion joules, roughly three tons of TNT.
Nobody chose to crash a rocket into the Moon. The choice that mattered was made much earlier, and it looked like a fuel budget.
Decommissioning was the line item that got consumed to make the primary mission work. There was no meeting about it, no risk register entry, no dissenting engineer. The mission was harder than the margin allowed, the margin came out of end-of-life, and the end-of-life plan quietly ceased to exist.
This is the most common way software systems become permanent. The migration runs long, so the cutover eats the quarter, so the decommissioning of the old system slips to "next sprint." The old system keeps serving a trickle of traffic. Two years later it is load-bearing and nobody on the team has read its code.
The failure mode is not negligence. It is that decommissioning is the only part of a project whose deadline nothing enforces.
SpaceX did not simply walk away. Julianna Scheiman, the company's director of NASA science and Dragon programs, said a different maneuver was performed "to ensure that the second stage itself is safe per the appropriate rules and regulations."
That maneuver satisfied the rules. It did not put the object anywhere durable. As Scheiman put it, "a mixture of solar activity and gravity forces have put it on a path towards the moon."
A control that passes review at go-live is a statement about go-live. It is not a statement about the system's state eighteen months later, and treating the two as equivalent is how model risk accumulates. Sign-off is a snapshot; systems are a trajectory.
The force that moved it was sunlight. Solar radiation pressure — photons striking the tumbling stage — is, in Gray's description, "an extremely gentle force, but over months, it can really build up." It is also not fully predictable, because a tumbling object catches and reflects light differently as it turns.
No single push mattered. Eighteen months of them decided where four-and-a-bit tonnes of metal ended up.
That is drift, exactly as it appears in a scoring pipeline: no individual week's population shift is worth an alert, and the cumulative eighteen-month displacement is worth a regulatory finding. If your validation cadence is slower than your drift accumulation, you are not monitoring the model. You are just visiting it occasionally.
Here is the detail we found most uncomfortable. This object was tracked mainly by asteroid surveys and amateur astronomers, because the systems built for space debris cannot see that far out. Radar excels in low Earth orbit — Gray notes it has tracked gloves and tool bags lost by astronauts — but at lunar distance the return signal is about 25.6 billion times fainter. Gray computes orbits for high-altitude objects specifically because they are the ones "the military doesn't track."
The surveys that did see it were not trying to. Their job is planetary defence, and as Gray puts it, "time spent observing junk is time not spent finding rocks."
Every engineering organisation has this arrangement and calls it something else. The deprecated service has no dashboard and no on-call rotation, and the only reason anyone knows it is degrading is that one engineer keeps noticing it in unrelated logs. That is not observability. That is a volunteer, and volunteers leave.
The recovery here is genuinely impressive, and it was made of data. By late February the archive held 1,053 observations, contributed by observatories in Mississippi, Utah, Beijing and England. Gray's software flagged the lunar impact in September 2025 — eleven months ahead.
The forecast then tightened as observations accumulated. A June revision moved the predicted impact nine minutes earlier and 170 km to the northwest. A July revision moved it by a couple of seconds and about ten kilometres. A final update landed on August 1.
That precision had a payoff: Danuri began imaging roughly thirty minutes before the collision and made eight passes over the site, capturing genuine before-and-after coverage. You only point an instrument at the right patch of ground at the right minute if someone gave you a forecast. And you only get a forecast for a system somebody is still measuring.
Worth noting, in the spirit of not overclaiming: as of this writing there is no published measurement of the new crater. Gray predicted a single crater around 17 m across. Much of the news coverage cites up to 27 m. Both are pre-impact calculations, and they do not agree with each other.
Whether it is one crater or two is also unsettled. The 2022 Chang'e 5-T1 upper stage surprised everyone by making a double crater. Gray expects a single one here because this stage carried no comparable mass at the top — a reasonable inference, not a result.
Numbers in circulation are not measurements. That distinction is the whole job in model validation, and it does not stop being true because a number is repeated confidently by everyone.
Translate the failure modes and they get uncomfortably familiar.
| What happened to 2025-010D |
The equivalent in a lending stack |
| Disposal fuel spent on the primary mission |
Decommissioning descoped to protect a launch date |
| Compliant maneuver, then no owner |
Control signed off at go-live, never re-verified |
| Solar radiation pressure over 18 months |
Population drift between validation cycles |
| Invisible to radar at lunar distance |
No telemetry on the deprecated service |
| Tracked by volunteers with other jobs |
One engineer who happens to know it exists |
Concretely, the things worth auditing this quarter:
- Retired scorecards that still score. A superseded model version left wired into a fallback path, quietly deciding a slice of applications.
- Orphaned document stores. Buckets of customer bank statements from a pilot that ended. Nobody owns them, retention policy never applied, and they are pure liability.
- Extraction pipelines with one remaining caller. The old parser kept alive for a single lender integration, unmaintained and unmonitored.
- Credentials outliving their purpose. API keys for a data provider you stopped paying, still valid, still in a config somewhere.
- Connectors for formats that changed. A bank redesigned its statement layout; the connector now fails silently on a small percentage and nobody set an alarm.
None of these will page you. That is precisely the problem: they fail in ways that produce no signal until the failure is someone else's finding.
The fix, in orbital mechanics, is cheap — if you decide early. Put the upper stage on a trajectory that leaves the Earth-Moon system entirely and ends up orbiting the Sun. The Falcon 9 stage from the EscaPADE launch in November 2025 was disposed of this way. Chinese lunar launches have moved in the same direction.
But it only works as a design-time decision. Once the propellant is gone, no option exists at any price. Gray is also honest about the limit: the trick "only works for a small fraction of junk," namely missions already headed beyond Earth orbit. Some classes of system genuinely cannot be cleanly retired, and the time to find out which class you are in is before you build.
The question Scheiman raised is the right one to steal: "What is the best future disposal path for high-energy missions that are in the sun-Earth-moon system?" The software version is smaller and duller and just as unanswered. What is the retirement path for this model, this pipeline, this data store? Who owns it after the launch party? What signal tells us it is still running, and who receives that signal?
Systems you cannot see are systems you cannot retire. Levmetrics' Lev Document Intelligence is built so that every extraction, score and decision leaves an auditable trace — including the ones you meant to turn off. Try it at app.levmetrics.com.
A four-tonne rocket stage is a useful teacher because it is impossible to lose track of politely. It kept an orbit, it kept a catalogue number, and eighteen months after everyone declared the mission a success it arrived somewhere nobody intended at 2.43 kilometres per second. Most abandoned systems are less dramatic and more expensive. Deployment is a milestone in a system's life. It is nowhere near the end of it.
- Mike Wall, "A SpaceX rocket will crash into the moon this week. Why is it on a collision course?", Space.com, August 3, 2026.
- Chelsea Gohd, "A SpaceX rocket just crashed into the moon. Now, the race is on to get a look at the impact site", Space.com, August 5, 2026.
- Mike Wall, "SpaceX rocket's impact crater on the moon spied by Korean lunar orbiter (photos)", Space.com, August 6, 2026.
- Bill Gray, "Upper stage impacting the moon on 2026 August 5", Project Pluto.
- Adam Kovac, "A SpaceX rocket booster is on track to hit the moon at several times the speed of sound", Scientific American, May 1, 2026.
- Leonard David, "Moon Impact of Rocket Stage Observed", Inside Outer Space, August 5, 2026.
- Benjamin Fernando et al., "preprint on the predicted lunar impact of the 2025-010D upper stage", arXiv.
A four-tonne piece of a SpaceX rocket spent eighteen months on a collision course with the Moon, starting at roughly the moment everyone stopped thinking about it. On August 5 it arrived.
The interesting part is not the collision. It is that the collision was scheduled eighteen months in advance by a decision nobody remembers making.
Yes. A spent SpaceX Falcon 9 upper stage crashed into the Moon on August 5, 2026, at about 06:34 UTC — 2:34 a.m. EDT — near the crater Einstein on the western limb. South Korea's Danuri orbiter confirmed the lunar impact, imaging the site across eight passes that began roughly thirty minutes before contact. The Korea Aerospace Research Institute reported that "changes in the terrain around the impact site and traces of ejecta spread were confirmed." At Lowell Observatory in Arizona, Carl Schmidt's team measured a sodium and lithium gas plume tens of kilometres across that lasted five to ten minutes.
What follows is not a space story. It is what the crash says about every system that outlives the attention paid to it.
The object has no name, only a catalogue designation: 2025-010D. It was the fourth tracked piece of hardware from the tenth orbital launch of 2025, on January 15, which carried Firefly Aerospace's Blue Ghost lander and ispace's Resilience toward the Moon. Blue Ghost landed successfully that March. Resilience lost contact about ninety seconds before touchdown and crashed in June.
Falcon 9 upper stages are normally deorbited shortly after launch and burned up in the atmosphere. That did not happen here. Pushing two landers to their deployment point consumed nearly all of the stage's propellant, so the disposal burn was no longer available. In the words of a study led by Benjamin Fernando of Los Alamos National Laboratory, the stage "was abandoned in a moon-crossing high-Earth orbit."
It then spent more than eighteen months in a lopsided 26-day orbit, swinging between roughly 220,000 and 510,000 km from Earth — repeatedly crossing the Moon's path, missing it every time, until it didn't. Astronomer Bill Gray of Project Pluto put the impact speed at 2.43 km/s and the released energy at about 14.5 billion joules, roughly three tons of TNT.
Nobody chose to crash a rocket into the Moon. The choice that mattered was made much earlier, and it looked like a fuel budget.
Decommissioning was the line item that got consumed to make the primary mission work. There was no meeting about it, no risk register entry, no dissenting engineer. The mission was harder than the margin allowed, the margin came out of end-of-life, and the end-of-life plan quietly ceased to exist.
This is the most common way software systems become permanent. The migration runs long, so the cutover eats the quarter, so the decommissioning of the old system slips to "next sprint." The old system keeps serving a trickle of traffic. Two years later it is load-bearing and nobody on the team has read its code.
The failure mode is not negligence. It is that decommissioning is the only part of a project whose deadline nothing enforces.
SpaceX did not simply walk away. Julianna Scheiman, the company's director of NASA science and Dragon programs, said a different maneuver was performed "to ensure that the second stage itself is safe per the appropriate rules and regulations."
That maneuver satisfied the rules. It did not put the object anywhere durable. As Scheiman put it, "a mixture of solar activity and gravity forces have put it on a path towards the moon."
A control that passes review at go-live is a statement about go-live. It is not a statement about the system's state eighteen months later, and treating the two as equivalent is how model risk accumulates. Sign-off is a snapshot; systems are a trajectory.
The force that moved it was sunlight. Solar radiation pressure — photons striking the tumbling stage — is, in Gray's description, "an extremely gentle force, but over months, it can really build up." It is also not fully predictable, because a tumbling object catches and reflects light differently as it turns.
No single push mattered. Eighteen months of them decided where four-and-a-bit tonnes of metal ended up.
That is drift, exactly as it appears in a scoring pipeline: no individual week's population shift is worth an alert, and the cumulative eighteen-month displacement is worth a regulatory finding. If your validation cadence is slower than your drift accumulation, you are not monitoring the model. You are just visiting it occasionally.
Here is the detail we found most uncomfortable. This object was tracked mainly by asteroid surveys and amateur astronomers, because the systems built for space debris cannot see that far out. Radar excels in low Earth orbit — Gray notes it has tracked gloves and tool bags lost by astronauts — but at lunar distance the return signal is about 25.6 billion times fainter. Gray computes orbits for high-altitude objects specifically because they are the ones "the military doesn't track."
The surveys that did see it were not trying to. Their job is planetary defence, and as Gray puts it, "time spent observing junk is time not spent finding rocks."
Every engineering organisation has this arrangement and calls it something else. The deprecated service has no dashboard and no on-call rotation, and the only reason anyone knows it is degrading is that one engineer keeps noticing it in unrelated logs. That is not observability. That is a volunteer, and volunteers leave.
The recovery here is genuinely impressive, and it was made of data. By late February the archive held 1,053 observations, contributed by observatories in Mississippi, Utah, Beijing and England. Gray's software flagged the lunar impact in September 2025 — eleven months ahead.
The forecast then tightened as observations accumulated. A June revision moved the predicted impact nine minutes earlier and 170 km to the northwest. A July revision moved it by a couple of seconds and about ten kilometres. A final update landed on August 1.
That precision had a payoff: Danuri began imaging roughly thirty minutes before the collision and made eight passes over the site, capturing genuine before-and-after coverage. You only point an instrument at the right patch of ground at the right minute if someone gave you a forecast. And you only get a forecast for a system somebody is still measuring.
Worth noting, in the spirit of not overclaiming: as of this writing there is no published measurement of the new crater. Gray predicted a single crater around 17 m across. Much of the news coverage cites up to 27 m. Both are pre-impact calculations, and they do not agree with each other.
Whether it is one crater or two is also unsettled. The 2022 Chang'e 5-T1 upper stage surprised everyone by making a double crater. Gray expects a single one here because this stage carried no comparable mass at the top — a reasonable inference, not a result.
Numbers in circulation are not measurements. That distinction is the whole job in model validation, and it does not stop being true because a number is repeated confidently by everyone.
Translate the failure modes and they get uncomfortably familiar.
| What happened to 2025-010D |
The equivalent in a lending stack |
| Disposal fuel spent on the primary mission |
Decommissioning descoped to protect a launch date |
| Compliant maneuver, then no owner |
Control signed off at go-live, never re-verified |
| Solar radiation pressure over 18 months |
Population drift between validation cycles |
| Invisible to radar at lunar distance |
No telemetry on the deprecated service |
| Tracked by volunteers with other jobs |
One engineer who happens to know it exists |
Concretely, the things worth auditing this quarter:
- Retired scorecards that still score. A superseded model version left wired into a fallback path, quietly deciding a slice of applications.
- Orphaned document stores. Buckets of customer bank statements from a pilot that ended. Nobody owns them, retention policy never applied, and they are pure liability.
- Extraction pipelines with one remaining caller. The old parser kept alive for a single lender integration, unmaintained and unmonitored.
- Credentials outliving their purpose. API keys for a data provider you stopped paying, still valid, still in a config somewhere.
- Connectors for formats that changed. A bank redesigned its statement layout; the connector now fails silently on a small percentage and nobody set an alarm.
None of these will page you. That is precisely the problem: they fail in ways that produce no signal until the failure is someone else's finding.
The fix, in orbital mechanics, is cheap — if you decide early. Put the upper stage on a trajectory that leaves the Earth-Moon system entirely and ends up orbiting the Sun. The Falcon 9 stage from the EscaPADE launch in November 2025 was disposed of this way. Chinese lunar launches have moved in the same direction.
But it only works as a design-time decision. Once the propellant is gone, no option exists at any price. Gray is also honest about the limit: the trick "only works for a small fraction of junk," namely missions already headed beyond Earth orbit. Some classes of system genuinely cannot be cleanly retired, and the time to find out which class you are in is before you build.
The question Scheiman raised is the right one to steal: "What is the best future disposal path for high-energy missions that are in the sun-Earth-moon system?" The software version is smaller and duller and just as unanswered. What is the retirement path for this model, this pipeline, this data store? Who owns it after the launch party? What signal tells us it is still running, and who receives that signal?
Systems you cannot see are systems you cannot retire. Levmetrics' Lev Document Intelligence is built so that every extraction, score and decision leaves an auditable trace — including the ones you meant to turn off. Try it at app.levmetrics.com.
A four-tonne rocket stage is a useful teacher because it is impossible to lose track of politely. It kept an orbit, it kept a catalogue number, and eighteen months after everyone declared the mission a success it arrived somewhere nobody intended at 2.43 kilometres per second. Most abandoned systems are less dramatic and more expensive. Deployment is a milestone in a system's life. It is nowhere near the end of it.
- Mike Wall, "A SpaceX rocket will crash into the moon this week. Why is it on a collision course?", Space.com, August 3, 2026.
- Chelsea Gohd, "A SpaceX rocket just crashed into the moon. Now, the race is on to get a look at the impact site", Space.com, August 5, 2026.
- Mike Wall, "SpaceX rocket's impact crater on the moon spied by Korean lunar orbiter (photos)", Space.com, August 6, 2026.
- Bill Gray, "Upper stage impacting the moon on 2026 August 5", Project Pluto.
- Adam Kovac, "A SpaceX rocket booster is on track to hit the moon at several times the speed of sound", Scientific American, May 1, 2026.
- Leonard David, "Moon Impact of Rocket Stage Observed", Inside Outer Space, August 5, 2026.
- Benjamin Fernando et al., "preprint on the predicted lunar impact of the 2025-010D upper stage", arXiv.
Ciclo di vita
Punteggio del credito
Frode