Entry 100 sized the keeper tug at 40 kW class. Entry 105 found that number on ARM’s paper. What none of the ledger had checked until now: what has actually flown, and for how long, and what killed it. The sweep answers with a record book, a failure list with a surprising shape, a power ceiling the doctrine sits above, and a fleet-scale inversion hiding in low Earth orbit.

The record book

The champions, and what ended them. Dawn: three ion engines, 51,385 accumulated engine-hours, 11.5 km/s delivered under own power — the standing record — across eleven years of thrust arcs and month-long duty cycles between Vesta and Ceres. What killed the mission: hydrazine exhaustion for attitude control, 2018. The ion engines were healthy. GOCE: one T5 ion assembly ran 1,478 of 1,700 mission days, including a ten-month continuous burn, in the most abusive thermal-drag environment flown; it ended on propellant exhaustion, backup engine never needed. NEXT on the ground: 51,184 hours and 918 kg of xenon through a single thruster before they stopped the test voluntarily — the test ended, not the engine. The deep pattern of the record book: electric engines are retired by everything around them — propellant, hydrazine, budgets, programs — essentially never by the thruster core. For a doctrine whose whole premise is patient thrust, this is the most load-bearing finding of the sweep.

The failure list has a shape, and the shape is plumbing

Every consequential SEP anomaly in flight, and what actually failed:

  • Hayabusa (the great one): three of four engines effectively lost — but not the thruster physics. Neutralizers wore out at 10,000–15,000 hours; microwave sources degraded. The save belongs in every engineering curriculum: JAXA cross-strapped the surviving neutralizer of one dead engine to the surviving ion source of another — two corpses, one living hybrid — and flew the return home on it. 2.2 km/s delivered anyway.
  • BepiColombo 2024: thrusters fine; the power system developed unexpected currents, capping thrust at ~90% permanently. The response was trajectory redesign — an 11-month slip bought back with flyby geometry. Notably: the mission bent around the engine’s reduced output; nobody pretended the hardware would heal.
  • DS1’s early arcs and SMART-1’s belt-pass flameouts: transient, recovered, forgotten.
  • And the closed parenthesis: no thruster-core failure has ever ended an SEP mission. The components that die are cathodes, neutralizers, grids, and power conditioning — the peripherals, the plumbing, the parts you can carry spares of and cross-strap between.

Doctrine note: redundancy for a keeper tug should be dissimilar and cross-connectable — the PPE’s unflown design (AEPS + BHT-6000, two different thruster families) had it right, and Hayabusa proved why in the hardest way.

The power ceiling, and the orphaned class

The flown envelope, stated plainly: nothing has ever operated more than 4.5 kW into a single thruster (Psyche’s SPT-140, first Hall thrusters in deep space, cruising now) or more than ~10 kW of total EP discharge power. The 12.5 kW AEPS thrusters exist — qualified, delivered, beautiful — and have never flown, because in March 2026 NASA paused the Lunar Gateway, taking the PPE and the entire 50–60 kW flight program with it. The ledger keeps the score: ARM cancelled 2017, Gateway paused 2026. The 40–60 kW SEP class has now been orphaned twice in a decade — each time at the moment it was about to fly. Entry 100’s tug sizing sits exactly in that band: not exotic, just chronically unflown. X3 holds the ground record at 102 kW; VASIMR logged 88 continuous hours at 80 kW. The physics is ready. The manifest never is.

The doctrine’s read: a keeper tug at 40 kW is an extrapolation of one power generation (4.5→12.5 kW delivered hardware × 3–4 units), not a leap. But the ledger now marks it as extrapolation, with the corollary that the first keeper tug to actually fly would become the flight program the class has been waiting for — the same way the keeper demo doubles as the missing materials-science mission (Entry 110). Being the orphan class’s orphan adoption is a marketing asset, not just a risk.

The quiet inversion in low Earth orbit

And then the number that reframes everything: more than ten thousand Hall thrusters are operating in LEO right now on Starlink alone — krypton first, then argon, the first argon Hall thrusters ever flown, with 2.4× the thrust of the generation before. Fewer than fifty SEP thrusters have ever flown beyond Earth orbit. The dominant electric-propulsion experience of humanity is constellation station-keeping, executed by engines built in-house, priced in dollars per kilogram of argon, and — the catch — flying with failure data nobody publishes. The propellant economics explain the shift and close the tug’s own math: xenon runs $5,000–12,000/kg with projected constellation demand rivaling global production; argon runs $7–15/kg. Three orders of magnitude. A keeper tug that can burn argon at a modest Isp penalty has an operating-cost profile written in a different currency than every deep-space SEP mission to date. The fleet inverted the economics while the flagship programs were being cancelled.

Recalled

  • The Martian (Andy Weir, 2011). Watney’s whole survival is Hayabusa’s cross-strap scaled to a book: nothing on Mars works as designed, everything works as reassembled — the MAV landing straps, the Pathfinder resurrection, the rover trailer hacked into a lifeboat. Weir’s real subject is not Mars but the discipline of working with what the failures leave you: inventory the dead, salvage the living parts, never wait for the hardware to heal. JAXA’s engineers did exactly this with two dead ion engines in 2009 and flew home on the corpse-graft, eight years before the movie made the genre famous. The ledger notes the asymmetry the sweep exposed: the glamorous component (the thruster) is the reliable one; the story is always in the plumbing. Watney would have found the BepiColombo power fault entirely familiar.

What this changes

  • The tug’s duty-cycle risk is retired: years of patient thrust is the most-proven regime in all of propulsion (Dawn 51,385 hr; GOCE 1,478/1,700 days; NEXT 918 kg through one throat). The engine outlives the ship.
  • The tug’s power-class risk is marked honestly: 40 kW is one generation beyond delivered-but-unflown hardware (AEPS 12.5 kW), and the class is now twice-orphaned (ARM 2017, Gateway 2026). The keeper flight would be the adoption event.
  • Redundancy doctrine updated: dissimilar, cross-connectable thruster families with spare peripherals (cathodes, neutralizers, PPUs) — the failure list says plumbing, so spares should say plumbing too.
  • Propellant economics added to tug sizing: argon at $7–15/kg vs xenon at $5,000–12,000/kg reframes operating cost; an argon-capable tug aligns with the ten-thousand-engine fleet’s supply chain rather than the fifty-engine flagship lineage.
  • One standing note for the doctrine’s public posture: the most consequential recent SEP anomalies were survived by redesign (BepiColombo’s trajectory, Hayabusa’s cross-strap) — the keeper’s assurance story should lead with demonstrated bend-don’t-break operations, not with reliability claims nobody can publish.