Mega-constellations run thousands of satellites off one shared control plane. One bad configuration push can — and did — take an entire fleet dark. StarLoom partitions the constellation into isolated failure domains and stages every change, so a bad update stops at the domain boundary instead of cascading fleet-wide.
One shared brain, no firebreaks.
In July 2025, a single configuration push took 8,000 satellites dark for two and a half hours. No rocket failed and no debris struck — one shared control plane pushed one bad change to every node at once. No canary, no staged rollback, nothing to stop a bad node from taking its neighbors with it. As fleets grow toward 10,000+ satellites, that architecture is a standing invitation for the next outage.
Isolation as the shape of the control plane.
StarLoom divides a constellation into independent failure domains. Every change rolls out domain by domain — canaried, monitored, reversible. A regression is contained at the boundary: the rest of the constellation keeps flying while one domain rolls back. Isolation isn't a feature bolted on after the outage; it's the structure of the system.
Measured on real orbits.
Every figure is measured, not modeled for convenience: real orbital mechanics of Starlink, Kuiper and Telesat, roughly 600,000 simulated routes, and failure injection across the control and data planes. A bad update under StarLoom reaches 3% of the fleet instead of all of it — 33× fewer satellites affected — and control-plane failures recover 265× faster.
Resilience is the product.
An open constellation only works if no tenant can inherit another's failure. StarLoom is the isolation layer under the ToDare cloud — the reason any operator can plug in, sell compute, and trust that someone else's bad day stays theirs.
@unpublished{starloom2026,
title = {StarLoom: Resilient Control Plane for LEO Satellite Constellations},
year = {2026},
note = {Under submission, ACM EuroSys 2026}
}