← The canon · AItopiaOrAImageddon?

Iron Dome — the machine that decides which rockets are not worth shooting

moment · Rafael Advanced Defense Systems, which built the Tamir interceptor and integrated the system; Elta Systems of Israel Aerospace Industries, which supplied the EL/M-2084 multi-mission radar; mPrest Systems, which wrote the battle-management and weapon-control software; Brig. Gen. Daniel Gold, who committed MAFAT to the programme in 2004–2005 before it was formally approved and was criticised by the State Comptroller for the way he did it; and Defence Minister Amir Peretz, who approved it in 2007 over his own generals' objections and demanded it in three years · 2011

Something that happened and changed what people expected next.

Descends from A Dynamical Theory of the Electromagnetic Field. Read on: Ukraine — the iteration loop that set the tempo, and the capital that set the ceiling.

Filed under idea in proposals.md; written here as moment. The id sits at line 654, inside the idea block that runs from line 195 to line 721 — which is where the whole batch appended on 2026-08-17 was written down, not what any of them turned out to be. That batch has since come out as moment (gain-of-function-2011, apt1-attribution-2013, national-content-filtering, sputnik-1957), as interpretation, and as prediction. The section records when a candidate was proposed. It does not decide the kind.

idea fails on the house test, which shannon-chess-1950 set and samuel-checkers-1959 sharpened: an idea is a construct you could implement, a loop or a formalism that later work is built out of. There is no such object here. Everything inside Iron Dome — Kalman-style track filtering, ballistic extrapolation to a predicted impact point, an assignment problem over a magazine of interceptors, proportional navigation in the terminal phase — was standard engineering before 2005 and is standard engineering now. The programme's achievement was not a new idea. It was making a known idea work, cheaply enough and fast enough, against a threat that everyone competent had said was not worth defending against.

moment is defined here as "something that happened and changed what people expected next," and the date on which that happened is legible to the minute. At about 18:20 on 7 April 2011, a battery near Ashkelon fired a Tamir at a Grad rocket launched from Gaza and destroyed it. Before that evening, a fielded system that shot down short-range artillery rockets was a thing defence establishments, including the American one, had concluded was not economically serious. After it, every country with a rocket problem wanted one, and fifteen years later the United States has named a trillion-dollar programme after it. That is the change the kind asks for.

limit is the interesting rival and I decline it, though half of this entry does the work limit entries do. The proposal asked for something corrective — the system "is routinely invoked as AI defence and it is mostly radar, trajectory computation and control theory" — and the corrective is delivered below, under Commonly misused as, which the canon requires of limit and welcomes anywhere. But limit is for results about what cannot be done, proved. Nothing here is proved. What this entry carries is an event and a fifteen-year argument about how well the event went, which is a moment with an unusually good epistemics section attached.

The descent, and the ancestors that are missing

descends_from names one id, and it is the distant one rather than the near one, because the near ones are not in the canon yet.

maxwell-1865. The whole system is downstream of the field equations in the only sense that entry permits. That file goes out of its way to correct the claim that "Maxwell predicted radio": he predicted electromagnetic waves and wrote no transmitter, no receiver and no experiment to make them, and the honest statement it settles on is that Maxwell's theory made radio possible and did not make radio. Take the same discipline here. Iron Dome's first act, on every engagement, is to bounce S-band energy off a body it has never seen and infer where it is going from the returns. That capability descends from Maxwell through Hertz through radar in the ordinary way, and the edge should be read as "made possible", not as intellectual paternity. The EL/M-2084 is not an argument about Maxwell. It is a consequence of him.

The near ancestor this entry wants and cannot draw. The direct engineering parent of Iron Dome is the anti-aircraft predictor: the Second World War problem of estimating where an aircraft will be in t seconds, from noisy observations, and putting a shell there. That work produced the M-9 director, the theory of filtering and prediction in stationary time series, and — through Norbert Wiener's frustration at how badly the pilot cooperated with his model — the whole vocabulary of feedback, control and the machine-in-the-loop that became cybernetics. There is no id for it. wiener-1960-automation exists in this canon and shares an author, and I decline to route the descent through it, because that entry is a Science paper arguing about purposes put into machines and this entry is a fire-control problem; claiming descent through the 1960 paper would be a false edge dressed up as a citation. The canon is missing an entry on prediction and filtering in fire control — Wiener's 1942 report and its 1949 publication, Kolmogorov's parallel result, and the Kalman filter of 1960 that replaced them — and until that exists, the strongest ancestor of this entry is a gap.

A second gap, closer to this project's usual subject. The canon has no entry on the Phalanx close-in weapon system or the general class of human-supervised point-defence autonomy fielded from the late 1970s onward. Iron Dome is not the first machine permitted to decide, in seconds, that something incoming should be destroyed; it is the one that did it at national scale in front of cameras for fifteen years. An entry for the earlier class would make this one's claim to novelty smaller and more accurate.

What it is

The problem it was built for

In the 2006 Lebanon war, Hezbollah fired roughly 4,200 rockets into northern Israel over 34 days. They killed 53 people. That ratio — about one death per 79 rockets — is the baseline against which everything later is measured, and it is also why the professional consensus was that active defence was the wrong answer. The rockets were inaccurate, individually cheap, and individually not very lethal. Any interceptor capable of hitting one would cost orders of magnitude more than the thing it destroyed. American defence officials looking at the Israeli proposal preferred the Phalanx: cheaper rounds, better accuracy, an existing production line.

Brig. Gen. Daniel Gold, then head of MAFAT, the Israeli Defence Ministry's research and development directorate, pushed the programme anyway — from around 2004, and, according to a 2009 State Comptroller report, partly by committing work before he had the authority to commit it. Defence Minister Amir Peretz approved full development in 2007, against the advice of much of the general staff, and set a schedule of three years. Rafael was commissioned that year. Final tests ran in 2010. The system was declared operational in March 2011, with the first battery deployed near Beersheba in the last week of that month as what the Air Defence Command called an operational experiment; a second went in near Ashkelon on 4 April. Three days later it worked.

The three boxes

A battery is three things and a lot of software.

The EL/M-2084 multi-mission radar, built by Elta Systems, an IAI subsidiary: an S-band active electronically scanned array that detects the launch, forms a track, and keeps it while doing several other jobs at once. The battle management and weapon control centre, whose software was written by mPrest Systems, a small firm that had not built a weapon system before. And the firing units — typically three or four per battery, twenty Tamir interceptors each. The Tamir is about three metres long, ninety kilograms, steered by fins, guided by a datalink from the BMC in the mid-course and by its own active radar seeker at the end, and detonated by a proximity fuze designed to throw fragments through the target's warhead.

The decision that matters

The interesting part is not the missile. It is the decision the BMC makes in the first second or two of a track, which is: is this one worth a shot?

From the radar track the BMC extrapolates the rocket's ballistic path to a predicted impact point. It compares that point against the zones the battery has been told to defend — towns, an airport, a power station, a base. If the predicted impact is inside a defended zone, it computes an engagement and fires. If the predicted impact is a field, a wadi, the sea, or anywhere else nobody is standing, it does nothing and lets the rocket land.

This is the whole economic argument of the system. Gaza's rockets are inaccurate; most of what is fired at Israel is not, in the event, going to hit anything worth an interceptor. In Operation Protective Edge in 2014, something on the order of 4,500 rounds came out of Gaza, of which Uzi Rubin estimates about 1,500 were mortars outside Iron Dome's envelope; the IDF reported 815 interception attempts, 735 of them successful. So roughly a quarter of the rockets were engaged and three quarters were watched all the way to the ground on purpose. Without that triage there is no affordable system, because the exchange ratio would be catastrophic instead of merely bad.

Everything in this decision runs faster than deliberation. Public accounts differ on whether a crew member presses a confirmation for each engagement — the contemporaneous account of the first intercept says "the battery operators decided to launch," and several technical write-ups describe an operator confirming a recommendation, while a February 2024 legal analysis from the Lieber Institute at West Point states flatly that among the IDF's systems "only the Iron Dome and David's Sling can be classified as AWS," autonomous weapon systems. No authoritative public document settles it, and this entry does not pretend to. What is not in dispute is that the classification, the impact prediction, the engagement assignment and the launch timing are computed without human input, on a clock where a human could not re-derive any of them. Whatever button exists, the judgement behind it is the machine's.

That places it precisely where American policy put the category. DoD Directive 3000.09, issued 21 November 2012 and updated 25 January 2023, permits human-supervised autonomous weapon systems to select and engage targets — with the exception of selecting humans as targets — "for local defense to intercept attempted time-critical or saturation attacks," for static defence of manned installations and onboard defence of manned platforms. Iron Dome is the textbook instance of the carve-out. The one category of lethal machine autonomy that nobody seriously proposes to ban is the one this system occupies.

The record, as its owners tell it

What it costs

A battery is usually put at $50–100 million. A Tamir is usually put at $40,000 to $50,000, with reported batch prices drifting upward under wartime production — figures around $100,000–150,000 per engagement reflect ripple fire as much as unit cost. None of these numbers is authoritative; they come from trade press and think-tank estimates rather than from a published contract, and they move by batch. The only claim worth carrying is the order of magnitude, and it is not in doubt: the interceptor costs between fifty and five hundred times the rocket. A Qassam is $300 to $800.

American money has been in it since the start: $205 million in FY2011 — the House vote was 410 to 4 — and something between $1.3 billion (CSIS's tally through FY2015) and about $1.6 billion through 2021, with a further $1 billion appropriated in 2022 after the 2021 round. Co-production with Raytheon in East Camden, Arkansas followed, and the US Army bought two batteries of its own.

Why a reading would cite it

Five occasions, and the first is the one that earns the entry.

1. The system computes its own denominator

This is the cleanest case in the canon of a deployed system being scored on a test set it selected itself, and it should be reached for whenever a vendor quotes a success rate over a subset the vendor defined.

Rubin, defending the system, states the scoring convention plainly: "The measure of effectiveness of any active defense system is its score, namely the number of destroyed rockets in proportion to the number of rockets that should have been destroyed." The emphasis is the point. The denominator is not rockets fired. It is rockets the BMC judged were going to hit a defended area — a judgement made by the same software stack whose performance is being graded, in under a second, from a partial ballistic track, and never independently audited.

Every failure mode of that arrangement is familiar from model evaluation. If the impact-point predictor is optimistic about what counts as threatening, the denominator inflates and the rate holds up while more rockets land on people. If it is pessimistic, interceptors burn on rockets headed for fields. If a rocket lands in a town that the system had classified as not-a-threat, it is not a missed interception — it never entered the score at all. And Michael Armstrong's peer-reviewed modelling found exactly the signature you would expect if the denominator were drifting: his 2014 Operations Research paper concludes that "the number of rocket hits on populated areas was understated" while "the number of threatening rockets seems overstated."

The June 2025 numbers show the same shape recurring at a higher tier fourteen years on. The Defence Ministry said 86 per cent. Independent counts reported by JINSA put it at 273 interceptions out of 574 missiles launched, with 49 impacts on populated areas, bases and infrastructure. Both can be true, and the gap between 86 per cent and 48 per cent is entirely the question of which missiles belonged in the denominator. A reading that quotes an AI benchmark score without asking who chose the eval set is making the identical mistake, and this is the worked example.

2. Verifying a fielded system's effectiveness from outside is close to impossible, and the proxies that work are not technical

Fifteen years, tens of thousands of engagements, the most photographed weapon system in history — and there is still no independent measurement of the interception rate. The strongest statement of this comes not from a critic but from the system's most credentialed defender. Rubin, writing in February 2015: "Inexplicably, the IDF refrained from disclosing specific scores for each of the major defended population centers. Instead, the overall score for the entire country was 'nearly 90 percent.' There is no way to corroborate this claim from open sources."

What did produce usable evidence was not engineering data. It was the Israeli Treasury. Israel compensates citizens for property damage from hostile action, funded by a levy on property transactions, with no minimum threshold — scratched paint on a car is claimable, and the government actively encourages filing. Rubin's insight was that buildings cannot take shelter, so damage claims per rocket fired are a proxy for how many rockets actually arrived:

| Campaign | Batteries | Rockets | Damage claims | Claims per rocket | |---|---|---|---|---| | 2006 Lebanon | 0 | 4,200 | 26,653 | 6.35 | | 2012 Gaza | 5 | 1,600 | 3,921 | 2.45 | | 2014 Gaza | 9 | 4,500 | 4,525 | 1.01 |

And compensation actually paid, per rocket: about 114,000 shekels in 2006, about 36,000 in 2012, about 20,000 in 2014 — roughly a sixth of the 2006 rate. The fatality ratio moves the same way: one death per 79 rockets in 2006, per 320 in 2012, per 1,500 in 2014.

Cite this when a capability claim cannot be checked directly. The lesson is not that outside verification is hopeless; it is that the verification which worked came from the accounting system, the insurance file and the death notices — instrumentation that existed for other reasons, that the vendor did not control, and that nobody had thought of as a test harness. When a reading needs to argue that an AI capability claim is unfalsifiable as stated, this is the precedent for what to go looking for instead.

3. Autonomy and learning are separable, and this is the proof

A reading that files Iron Dome under a capability lens, or reaches for it as an example of AI in the wild, would be making a category error the entry exists to prevent — but the error is subtler than "it isn't AI."

Under the autonomy definition, Iron Dome is the real thing and among the longest-running instances of it. West Point's Lieber Institute, in February 2024, classified it as an autonomous weapon system, in explicit contrast to the IDF's target-recommendation tools, which it classified as decision support with a commander's authorisation at the end. The machine picks what to kill.

Under the learning definition — the thing anyone in 2026 means by AI — there is no public evidence of any learned component whatsoever. No technical account of the radar, the BMC or the Tamir identifies a trained model. Rafael's own fifteen-year retrospective does not use the word. The pieces that do call it AI describe, when you read them closely, evaluation of pre-programmed parameters: "Iron Dome, like any artificial intelligence system, acts within a set of pre-programmed parameters." That is AI in a sense broad enough to include a thermostat.

So the citation is this: you can have machine decision authority over lethal force with zero machine learning, and it has been fielded and shooting for fifteen years. The autonomy debate and the learning debate are about different things, the historical record on autonomy is decades longer than the record on learning, and an argument that slides between them is doing so illegitimately.

The same conflict makes the distinction unusually easy to demonstrate, because the actual machine learning was on the other side of the sky. The IDF called Operation Guardian of the Walls in May 2021 "the first AI war." What it meant was Unit 8200's Alchemist, Gospel and Depth of Wisdom — systems that generated strike recommendations against people. Those ran during the same eleven days as Iron Dome, in the same conflict, on the same military's infrastructure. The system that decided which rockets to shoot down had no learned component; the systems that decided which buildings to strike were the ones the learning was in. Two different moral objects, one week, one country. A reading conflating them loses the only distinction that matters.

4. Cost asymmetry, and the fact that the binding constraint is capacity rather than capability

Defence pays between fifty and five hundred times per exchange what offence does, and both sides know it. Iron Dome's answer — decline three-quarters of the shots — is a genuine mitigation and not a solution, because the attacker controls the tempo. The failure mode is not that the system stops working. It is that the magazine empties, or that more arrives in a minute than the batteries can schedule.

That failure arrived on a date. The Center for European Policy Analysis warned in June 2021 that Iron Dome was vulnerable to a saturation attack designed to overwhelm it with simultaneous fire from multiple directions. On 7 October 2023 it happened, at a scale nobody had modelled: two to three thousand rockets in twenty minutes against a system whose worst previous day was 470. Sullivan and Amble stated the arithmetic three days later — if ten rockets are fired and nine miss, the one that matters gets intercepted, "but extrapolate this dynamic — by firing a thousand, two thousand, or even more rockets — and, eventually, the advantage shifts in favor of the attacker." In June 2025 the same constraint reappeared as an inventory problem rather than a throughput one, with reporting on how many days of interceptors remained and an IDF denial that any shortage existed.

Cite this whenever someone argues that AI defence will outrun AI offence. The best-instrumented, best-funded, most operationally proven defensive system on earth holds a 90-per-cent claimed rate for a decade and is then defeated, not by a better rocket, but by more rockets arriving at once. Cost per unit action and sustainable throughput are separate quantities from accuracy, and the second pair is what actually decides an engagement at scale.

5. The protected population changes its behaviour, and the change is not the one you want

Rubin records, as an aside and against his own interest in tidiness, that Iron Dome's visible near-perfection produced "an adverse effect of public laxity." Instead of taking shelter, Israelis went outside to film interceptions on their phones. Of the five people killed by rockets in 2012, he judges at least three deaths preventable — one man was killed by the very rocket he was recording. Civilians were wounded by interceptor debris while videoing in 2014.

This is risk compensation in a defended population, measured, with fatalities attached. Cite it when a safety system's headline effect is being reported without the behavioural response: the deployment of a protective technology changes what the protected people do, in the direction of consuming the safety margin the technology created. It also, incidentally, strengthens Rubin's own statistical argument — the casualty drop happened despite less sheltering, not because of more — which is the sort of thing that only shows up when someone reports the inconvenient observation.

What it got right, and what it got wrong

The kind does not require this section. It is here because the entry's whole value is dated claims graded against outcomes, and because a canon that carries prediction discipline only where a file is filed under prediction is cheating.

Peretz's schedule. Claim: three years, made 2007. Due: 2010. Verdict: met, or close enough that the miss is not interesting. Final tests ran in 2010, operational declaration March 2011. Against the base rate for defence procurement this is close to anomalous, and it is the strongest thing anyone can say for Gold's method of starting before he was allowed to.

The professional consensus that it was not worth building. Claim: made 2005–2007 by much of the Israeli general staff and by American defence officials who preferred Phalanx. Due: continuously since 2011. Verdict: wrong, and wrong in a specific way worth naming. The consensus reasoned from the cost-exchange ratio and was correct about the ratio — it is still 50:1 or worse. What it missed was that the value of an interception is not the value of the rocket destroyed; it is the option value of not having to invade. That is the argument RAND made from the other direction in 2017, in a piece asking whether Iron Dome was a "poisoned chalice": the tactical success bought decision-makers freedom of action and simultaneously removed the political pressure that might have forced a settlement, so Israel got to absorb the threat indefinitely instead of resolving it. Both halves of that are still live in 2026 and this entry does not adjudicate them. What the record does establish is that the sceptics' cost model was measuring the wrong quantity.

The IDF's claimed rates. Claim: 84–85 per cent (2012), "nearly 90 per cent" (2014), ~90 per cent (2021), "exceeding 90%" sustained (Rafael, 2026). Due: continuously. Verdict: uncorroborated in the strict sense, probably too high, probably not wildly too high. The only peer-reviewed independent estimate this entry could find is Armstrong's: under 32 per cent in 2012, 59–75 per cent in 2014, against IDF figures of 85 and 92. He also puts a number on the benefit that is far smaller than the rhetoric — 3 to 6 deaths and 120 to 250 injuries prevented in 2014, $42–86 million of property damage — while Rubin's treasury arithmetic gets to roughly 50 lives saved across 2012 and 2014 and $109 million of damage averted. Those two are not reconcilable and both are on the record. Where the vendor grades itself and outsiders grade it lower, the canon carries both numbers and says they differ, and here they differ by a factor of ten on lives and by 25 to 55 points on the rate.

Postol and Lloyd's counter-claim. Claim: the intercept rate is "probably 5 percent or less," made in a series of publications in 2013 and July 2014, on the basis of contrail geometry in television and YouTube footage. Due: immediately. Verdict: almost certainly too low, and the reasons are instructive. Theodore Postol's arithmetic was explicit — roughly 0.2 × (0.3 or 0.6), giving 6 to 12 per cent, which he rounded down — and rested on the claim that most engagements were side-on or tail-chase, where the fuze cannot locate the warhead along the body and the fragments strike at angles that deflect. He attributed the low Israeli casualty count to small warheads and good civil defence rather than to interception, and said so with the declared aim of dissuading the US Congress from further funding.

Three things count against him. Bellingcat's 2016 open-source review pointed out that only the interceptor's contrail is visible in the footage — the incoming rocket is too small to see — so the geometry is being inferred from one of the two bodies, in a two-dimensional projection of three-dimensional motion with no depth. Rubin's damage-claim series shows material damage per rocket falling six-fold between 2006 and 2014, which Postol's account has no mechanism to explain, since civil defence does not protect buildings. And Postol's own observation about civil defence runs backwards: sheltering discipline got worse after 2011, not better.

But the same man, using the same method, was substantially right the last time, and that is the part a reading must carry. After the 1991 Gulf War the US Army claimed Patriot had intercepted 45 of 47 Scuds — about 96 per cent. Postol, working with George Lewis from television footage, testified in 1992 that the rate might be under 10 per cent and possibly zero. The Army's number came down to 79 per cent over Saudi Arabia and 40 per cent over Israel, then to high confidence in about 25 per cent. The GAO's report NSIAD-92-340, issued 22 September 1992, found that only 9 per cent of engagements were supported by the strongest evidence of a warhead kill, and that for the rest the Army could show the Patriots came close to the Scuds, not that they destroyed them.

So the base rate a reading should take from this pair is not "critics are cranks" and not "vendors lie." It is: the vendor's first public number was off by a factor of ten once, and the same critic using the same method was off by a factor of ten in the other direction the next time. Video-of-the-sky is a weak instrument in both directions. The instruments that resolved it were the GAO's subpoena power in 1992 and the tax authority's claims file in 2014 — an auditor and an actuary, neither of them a missile expert.

CEPA's saturation warning. Claim: June 2021, that Iron Dome could be overwhelmed by simultaneous fire from multiple directions. Due: unspecified. Verdict: correct, 7 October 2023, twenty-eight months later. One of the few clean hits in this file.

The implicit promise of the name. Claim: never stated by its builders, always heard by everyone else — that a dome exists. Rubin was careful about this as early as 2015: "Iron Dome is not designed to provide an airtight defensive shield." The system is selective, geographically partial, and was never deployed over every population centre; Haifa may not have had a battery in 2014. What the public heard was the metaphor, and the gap between the metaphor and the specification is most of the disappointment recorded after October 2023.

Commonly misused as

As AI defence. Handled above and worth stating in its short form: it is autonomy without learning. Anyone using Iron Dome as evidence about what machine learning can do in the physical world is citing a system that, so far as any public source shows, contains none. Anyone using it as evidence that lethal autonomy is unprecedented is citing a system that has been doing exactly that since 2011, with an explicit carve-out in American policy since 2012.

As proof that a national missile shield is achievable, via its name. This is the live misuse in 2026 and the most consequential. Executive Order 14186 of 27 January 2025 launched a programme originally titled Iron Dome for America, since renamed Golden Dome, with a stated price of $175 billion in May 2025 against a Congressional Budget Office estimate of up to $1.2 trillion over twenty years for an architecture matching the order's description, and $24.4 billion appropriated in the FY2025 reconciliation. The name is doing argumentative work that the engineering will not support. Iron Dome defends an area the size of New Jersey against unguided rockets flying tens of kilometres on ballistic arcs, from launch points a few dozen kilometres away, with a radar horizon that sees the whole flight. Continental defence against ICBMs and hypersonic glide vehicles shares the phrase "intercept the incoming thing" and almost nothing else — not the physics, not the timelines, not the cost-exchange ratio, and not the adversary's ability to exhaust the magazine. Cite Iron Dome against the Golden Dome analogy, never in support of it.

As a 90-per-cent success rate against rockets fired. It is not, and its own defenders do not claim it is. It is a claimed rate against rockets the system decided were threatening — roughly a quarter of what was fired in 2014. The number is quoted without its denominator constantly, including by people arguing in the system's favour, and it is a different and much weaker claim once the denominator is restored.

As evidence that defence beats offence. The record says the opposite over a long enough window. Fifteen years of high claimed rates ended in a single morning of volume, and the response to that morning was not a better interceptor but a ground war. If there is a transferable lesson for AI security, it is that a defensive system with an excellent hit rate and a shallow magazine is a system whose defeat is a scheduling problem for the attacker.

As a system with no human in it, or as a system with a human fully in it. Both are asserted confidently in public and neither is established. What is established is that the substantive judgement — is this thing going to hurt someone — is made by software in under a second, and any human involvement is supervision at a speed where meaningful re-derivation is impossible. A reading should describe the epistemic position honestly rather than pick the version that suits it.

A note on the owner's landmark, which this entry does not touch. SCALE.md already carries a 2025 Ukraine landmark describing terminal-guidance autonomy on strike drones and AI-cued interceptor drones as the counter to mass strikes. That is the case where the interceptor side genuinely acquired learned components, and it is the right contrast to this entry — same mission, different machinery, fourteen years apart. Landmarks on the scale are the owner's to set and this file sets none, places no score, and deposits nothing in the ledger.

Sources

Provenance is marked. Where something was read directly it says so; where it comes from a search summary or from a hostile intermediary, it says that too.

A note on what could not be established. No public source located here identifies a learned or statistical-learning component anywhere in Iron Dome, and no source states that there is none. The entry's claim is therefore about the public record and not about the system's internals, and it is phrased that way throughout. If a later reading finds a technical description of a trained model in the radar's discrimination stage or in the BMC's classifier, section 3 above needs revising, not deleting — the point that autonomy and learning are separable survives, but Iron Dome would stop being the clean example of it.