1. Two Logs, One Transfer, and Nothing Both Parties Signed
Take a handoff of the kind this architecture is built to close. A trailer backs into a dock door. The driver's handheld records an arrival. The yard system records its own, stamped when the crew breaks the seal instead of when the wheels stop. Pallets come off, and the two counts disagree. Both records exist. Neither is signed by the other party. Each flows into its own system.
Three features of that setting matter, and each is a condition, not a universal. Where a load is brokered or a final mile subcontracted, the handoff may be the first and only contact between the two parties. Where the transfer happens inside a steel building or in a port yard, connectivity may be absent at the moment it occurs. And the handoff is the instant liability moves, so a shared, non-repudiable artifact is worth most where it is least likely to exist. More event data does not supply one. What neither side holds is a single artifact both signed at the point of transfer.
2. Where Hub Reconciliation and Shared Ledgers Run Out
Message-based integration works between partners who have already done the work of becoming partners. Standardized transaction sets for shipment notice and status are publicly documented as presuming a configured trading-partner relationship, with identifiers agreed and envelopes mapped in advance. A spot-market load has none of that behind it, and the handoff the next morning has no channel to use.
Hub-mediated capture stalls in the yard, not in the integration plan. A system that must reach a hub to record a transfer cannot record it while the radio is dark. The usual published answer is to buffer locally and sync when connectivity returns, at which point the sync order and the hub's receipt timestamps become the operative truth.
A shared ledger governed by a consortium goes at the missing artifact directly, at a governance cost: membership, write permissions, schema, upgrades, and who pays all have to be settled first. Consensus protocols are generally described as requiring a round trip, and a round trip is the one thing a disconnected dock door cannot make. Handheld signature capture sits at the opposite extreme, producing on the usual descriptions a mark bound to no credential establishing authority for the action class, with no counterpart artifact on the other side.
3. Settlement by Matched Pair Inside a Proximity Window
The filed architecture settles a bilateral exchange through a matched pair of governed observations. A governed observation is a signed structure comprising at minimum, and in sequence, an authority credential field, a continuity hash field encoding identity continuity of the emitting party, a spatial reference field, a temporal reference field, a time-to-live field, a payload field, and an observation lineage field. Emission is complete upon emission: the emitter requires no acknowledgment, no handshake, no delivery confirmation, and no registration with a central authority. An observation lacking a verifiable authority credential is not a governed observation.
A matched pair comprises a first governed observation representing an offer, a tender, a claim, a demand, or a commitment, and a second representing an acceptance, a counter-tender, an acknowledgment, a refusal, or a fulfillment. The pair is recognized by a pairing rule within one or more of a spatial proximity window and a temporal proximity window, the rule requiring spatial coincidence, temporal coincidence, or both as the governing policy object declares, in forms including content matching, a cryptographic handshake, an authority pair, and composites. The spatial window may be a signaling-range bound, a credentialed-venue extent, or, where the parties operate without physical co-location, a scope-partition form satisfied by a non-empty intersection of the identifiers the two observations declare.
Identity for pairing rests on continuity rather than on enrollment. The continuity hash field carries a successor hash field, being the emitting party's dynamic agent hash at the emission and verified by an equality test, and a continuity vector field of normalized projections of that party's operational state. A trust-slope validator computes a trust-slope consistency measure from the continuity vector field and no other field, over a history store of fields received from that counterparty within a declared tolerance window. A received observation is accepted on continuity only where two conditions hold conjunctively: the per-step distance against its predecessor does not exceed a declared per-step ceiling, and the measure is not less than a declared acceptance threshold.
Settlement occurs upon recognition and admission of the pair, and finality attaches at that moment. It writes a settlement record comprising the two signed observations, a cryptographic binding over both, and an attestation of the window within which the pair was recognized, so the record supports non-repudiation and is verifiable by a downstream consumer from the record alone. It also writes the settlement-lineage entry into each party's append-only lineage field and the settled state into the counterparty identity record each holds of the other, releases any content held under an escrow custody record conditioned upon that pair, and effects the state transition the pair was formed to effect.
4. The Dock Door as a Settlement Point
Configure the handoff as the pair. At the door, the carrier's agent emits the first governed observation: a tender whose payload carries the shipment identifiers the deployment declares and the enumerated action class being transferred, under an authority credential bound to that device by attestation. On receipt, the facility's agent verifies the credential and the continuity hash field against records in its own memory field, records the verification and any failing element in its append-only lineage field, then emits the second observation. A composite pairing rule suits this setting: spatial coincidence, the window declared as a credentialed-venue extent covering the dock apron, with content matching on the tender's declared fields.
Where the pair is recognized and the settlement admissibility evaluator issues the admit outcome, custody has settled, not queued for reconciliation, and a billing agent or an insurer can verify the record without asking either party what happened. Each side holds a settlement-lineage entry recording both observations, the pairing determination, the binding, each escrow event, each failure and rollback, and each downstream consumption, from which it reconstructs its own transaction history without recourse to the counterparty or to any registry. A reversal or amendment is itself appended, never applied in place.
Count mismatches have their own path. Absent a recognized and admitted pair nothing settles, so neither party's number becomes the settled one by default. The receiver may emit a counter-tender, after which the parties exchange counter-observations bounded by a round count declared in the policy object, exhaustion of that count being non-convergence and a failure of the timeout class. Or the receiver declines, emitting a refusal observation bearing its authority credential and referencing the observation refused, which pairs with the offer it refuses and against which each party appends a settlement-lineage entry. A refused load leaves each side holding the other's signed observation.
A refusal meter carried in the refusing party's own memory field is incremented once upon each emission of a refusal observation, by an increment declared in the policy object, and without any party determining whether the refusal was well founded. Responsive to the meter satisfying its declared bound, that party's settlement-binding authorization is written from a granting state to a withheld state, whereupon it binds no further settlements, its capacity to observe, to produce determinations, and to emit further refusals being preserved. The exclusions matter as much: a timeout, a failed fulfillment, a rejection for want of a partition intersection, the holding of an orphan observation, non-convergence, and the initiation of a dispute record each increment no refusal meter of either party.
In a dark yard, deferral does the work a retry against a hub cannot. A first governed observation whose matching second has not arrived is an orphan observation, held in a deferral queue under a deferral-expiration parameter declared in the policy object. Deferred pairing completes where the second arrives while the orphan remains held, including where it was carried by store-and-forward across a disconnection, the pair then settling identically to an immediately recognized pair and the lineage entry recording the deferral interval. Upon expiry without pairing it resolves as a timeout, which resolves nothing against either party. While orphaned it settles nothing, binds no party, and increments no meter.
Multi-leg movements use a chained settlement dependency, its length bounded above by a chained-settlement length bound declared in the policy object. Upon a failure at a link, that link and the links of greater index are rolled back in ascending index order, so rollback propagates downstream only, while the links of lesser index stand settled and a chain-truncation entry is appended. A failure in the final mile therefore does not unwind a drayage leg that already closed. Content moving with custody sits under an escrow custody record, one custody form being a dual lock in which each party holds one lock, released on satisfaction of the declared escrow condition and returned unchanged on failure.
A settlement may also complete conditionally, the pair recognized only upon satisfaction of a declared completion condition whose evidence is linked in the append-only lineage field: a credentialed observation of a declared external event, a declared authority sign-off, a declared compliance demonstration, or an aggregation of a declared count of contributing governed observations. Cold-chain release against a credentialed temperature reading takes that shape; in the aggregation form the pair completes only once the count recorded against the settlement reaches the declared count. Where a settlement is admitted in the non-empty intersection of two parties' scope partitions, the escrow custody record so arising is held within those partitions and within no other, and no release is performed while that intersection is empty.
5. What a Deployment Has to Declare
Integration turns on one property: the settlement record is verifiable by a downstream consumer from the record alone. Checking what was bound requires no access to either party's internal state, which is what lets the record and the lineage entry be read by systems already running the network.
The credential program is the substantive work. An authority credential requires an issuing-authority identifier, a scope specification, a temporal-validity specification, an attestation binding it to the emitting party or device, and a cryptographic attestation over those, under an authority taxonomy declared by a deploying authority. Someone has to issue credentials to the drivers, handhelds, and dock systems that will emit observations. Because the credential bears a temporal-validity specification and the taxonomy declares a supersession specification at each level, retiring one is a declared operation.
Policy comes second. The governing policy object is a signed object bearing a policy identifier and a successor index, declaring the proximity and time windows, the pairing rule form, the continuity parameters, the admissibility coefficients and thresholds, the refusal-meter increment and bound, the escrow-depth and chained-settlement length bounds, and the deferral-expiration parameter. Where the parties resolve different policy objects, each applies its own, so two sides declaring incompatible windows will find their pairs are not recognized. Removing the intermediary does not remove the need to agree on what counts as the same place and the same moment.
What windows a deployment can declare is bounded by what it can measure. Two observations failing the pairing rule, or falling outside an applicable proximity window, produce a rejection recorded with the measured and required windows and the failing element, which at least makes a badly chosen window diagnosable. Continuity carries a comparable prerequisite, since the trust-slope consistency measure is computed over a history store of fields received from that counterparty.
State the limits plainly. The architecture does not establish physical ground truth. It records what a credentialed party asserted, when, where, and bound to which device, turning a mismatch into a jointly recorded condition instead of a private one. Nor does it adjudicate merit: a settled pair is subject to challenge only through a credentialed dispute procedure, evaluated against declared time limits, an authority scope enclosing the action class, and standing, then routed to a procedure declared in the policy object, no step of which increments any refusal meter. Metering itself runs independent of merit, so a receiver with sound reasons to decline accrues the same increment as one declining arbitrarily.
6. Disclosure Scope
The mechanisms described here are disclosed in U.S. Provisional Application No. 64/117,812, principally at Chapter 6, Matched-Pair Settlement, covering the governed observation and its authority credential, the matched pair and the pairing rule, the three negative conditions, identity by continuity, the settlement-lineage entry, metered non-acceptance, orphan observations and deferred pairing, escrow and settlement in the intersection, chained settlement and the failure procedure, composite admissibility, and credentialed dispute resolution, together with the further settlement rules of Section 10.13 on partition-scoped escrow release and conditional settlement completion. As that chapter records, the subject matter of the section originates in U.S. Provisional Application No. 64/049,409, filed April 25, 2026. This article describes a logistics application of the disclosed architecture, published as a timestamped public description of it and making no assertion about any other party's systems or practices.
