Lunar Safety Zones: An Engineering Framework for End-of-Life Disposal of Mass-Driver-Deployed Lunar Satellites

Future high-cadence lunar satellite infrastructure may require end-of-life architectures before mature lunar traffic-management systems are established. This study evaluates controlled lunar impact as one potential end-of-life option for selected small, uncrewed satellites, particularly in future architectures where electromagnetic mass-driver systems could enable frequent deployment into lunar orbit. An ideal two-body orbital model is first used to quantify the minimum velocity change required to transform circular lunar orbits at altitudes of 100, 200, and 500 km into mean-surface-intersecting trajectories. The resulting theoretical lower-bound velocity changes are approximately 23, 44, and 96 m/s, respectively. A generic robustness analysis further examines the sensitivity of surface intersection to maneuver uncertainty and initial orbital altitude. The results indicate that robustness decreases as both altitude and maneuver uncertainty increase, while also demonstrating an important distinction between reliable surface intersection and reliable impact-location containment. To address this distinction, the paper introduces the Lunar Controlled Impact Zone (LCIZ) as an engineering safety-envelope concept. Rather than treating a nominal impact point as sufficient, the framework evaluates whether the full modeled uncertainty region remains compatible with protected lunar regions. A synthetic protected-zone demonstrator is used to illustrate GO-ELIGIBLE, HOLD, and REJECT decision states without defining real lunar impact coordinates. The study also compares controlled lunar impact with heliocentric disposal, lunar graveyard strategies, and recovery or servicing through an illustrative multi-criteria screening. No single end-of-life architecture is found to be universally preferable. Controlled lunar impact is therefore treated as a conditional engineering option rather than a default disposal mechanism. The results suggest that future high-cadence lunar satellite systems may benefit from integrating end-of-life capability at the design stage, separating surface-intersection reliability from containment reliability, incorporating dynamic protected-region exclusions, and maintaining auditable fallback logic. These engineering considerations may provide a technical basis for future lunar orbital sustainability and coordination frameworks.