Why every prediction includes calibrated uncertainty

The scheduler doesn't want the future

Contact scheduling is a decision under uncertainty: which station, which pass, how much margin to hold, when to pre-empt. None of those decisions consume a point estimate. A scheduler booking a critical downlink wants to know the floor — what link quality it can count on. A scheduler packing bulk traffic wants the median. A failover policy wants the probability of dropping below an operational threshold in the next five minutes.

So every prediction the platform serves is a distribution, reported as p10 / p50 / p90 quantiles per horizon, plus explicit breach probabilities against operational thresholds:

{
  "signal": "snr",
  "link_id": "sat-14__gw-01",
  "horizon_minutes": 3,
  "value": { "snr_db_p10": 11.5, "snr_db_p50": 12.4, "snr_db_p90": 13.1 },
  "confidence": 0.87,
  "breach": false
}

The contract is the point: downstream systems schedule against the p10 for margin-critical work, against the p50 for throughput planning, and against breach probability for failover. Nothing downstream ever has to invent its own error bars.

Uncalibrated intervals are worse than none

Any model can emit a variance. The question that matters operationally is whether the interval is calibrated: does the p10–p90 band actually contain reality about 80% of the time? An overconfident band books contacts that fade out; an underconfident band wastes capacity holding margin nobody needed. Both failure modes cost real throughput.

We treat calibration as a gated, measured property rather than an assumption:

• Raw intervals — whether from a probabilistic model head or from empirical residual quantiles — are conformally adjusted against live serving-path residuals, not against a lab dataset. The adjustment is asymmetric, because fade physics is asymmetric: links fall faster than they recover.
• Empirical p10–p90 coverage is measured on held-out, time-ordered data and must land in a 70–90% acceptance band before a model can be promoted. Coverage is a release gate with the same standing as accuracy and latency.
• Breach probability is derived from the calibrated distribution — a piecewise CDF over the quantile knots — so “P(below threshold)” is consistent with the band the operator is already looking at.

Regimes, or how pooling lies to you

The subtlest failure we've measured: calibrate one global interval and it will over-cover quiet conditions and under-cover deep fades. The pooled numbers look great — coverage in the acceptance band, reviewers happy — while the interval is at its least trustworthy exactly when the link is doing something interesting. Averages hide the regime that matters.

Refusal is part of the contract

Calibration guarantees are conditional on the model seeing the data it was calibrated for. When a link's telemetry window is too thin — a cold-start link, an outage, a sensor gap — the serving path fails the coverage gate and returns a refusal rather than a guess. An honest “insufficient telemetry” preserves the meaning of every interval we do emit. Silent extrapolation would poison all of them.

What this buys operationally

Calibrated envelopes turn forecasting from advice into infrastructure. Schedulers commit capacity against the p10 with a known miss rate. Failover triggers fire on breach probability instead of on thresholds crossed after the fact. And because every response carries provenance — model release, feature source, telemetry points used — a booked decision can be audited later against exactly what the system believed at the time.

A forecast that doesn't change the schedule is just trivia. Calibration is what makes it safe to let forecasts change the schedule.