Matched-Pair Settlement: Bilateral Finality From Spatial-Temporal Proximity

1. Problem and Architectural Premise

Physical interactions occur at speeds and cadences that settlement systems cannot match. A tolling gantry observes a vehicle in tens of milliseconds; the corresponding settlement closes hours or days later through a clearinghouse pipeline involving toll authority, account host, payment network, and bank. A DC fast-charging session delivers 50 to 350 kilowatts continuously; the corresponding settlement closes after the session ends, through a charge-point operator, a roaming hub, an e-mobility service provider, and a payment processor. A port custody handoff occurs in seconds at the gate; the corresponding settlement closes over multi-day reconciliation between shipper, carrier, customs broker, and port authority. The architectural cause of this latency gap is structural, not implementation: the settlement substrate lives somewhere other than the physical interaction, and every hop between interaction and substrate introduces latency, cost, and a point at which the settlement can be disputed, lost, or reversed.

Trusted-intermediary architectures address this gap by accepting it. The clearinghouse model presumes that the latency between physical interaction and settlement is acceptable because the intermediary's books are eventually consistent and economically backstopped. This presumption breaks down for new transaction classes such as bidirectional V2G energy exchange, sub-second micropayments for ride-share segments, and per-container port handoffs at autonomous terminals, where the economic actors require finality at physical-interaction speed and cannot tolerate the dispute window that intermediation introduces.

Consensus-based architectures attempt to remove the intermediary but introduce a different structural latency: agreement among validators on a canonical ordering of events. Proof-of-work confirmation depths take minutes to hours; proof-of-stake finality takes seconds in best-case configurations and longer under contention. Layer-two constructions (Lightning Network HTLCs, state channels, optimistic rollups, atomic swaps) reduce the apparent latency by deferring on-chain settlement, but they presume pre-negotiated session state, a custody layer underneath the channel, and a dispute window during which on-chain unwinding is possible. None of these mechanisms produces finality at the moment of physical interaction without an underlying custody layer.

The architectural premise of this disclosure is that finality can be derived from a structural property of the interaction itself: the co-occurrence in space and time of two governance-credentialed observations. If both parties to the transaction observe the same spatial-temporal event, each under credentials issued by an authority that admits the pairing, the matched pair of observations is itself the settlement record. There is no intermediary because each party signs its own observation under its own credential. There is no consensus because there is nothing to agree on; finality is geometric. Governance does not participate in the event; it pre-credentials the participants and post-aggregates the records on whatever cadence its accounting requires.

2. Core Architectural Primitive: The Matched Pair

The core primitive is a matched pair: a tuple of two credentialed observations, each signed by a distinct party under a credential that has been admitted by a governance authority, where the two observations satisfy a spatial-temporal proximity predicate and carry compatible transactional identifiers. The matched pair is the settlement record. It is non-repudiable because each component observation carries its own party's signature and its own party's credential lineage. It is final because the proximity predicate, once satisfied, cannot be unsatisfied by any subsequent action of either party. It is governed because the credentials and the predicate parameters are signed by the relevant authority.

A credentialed observation is a typed record containing: the observing party's identity under the relevant credential, the spatial coordinates of the observation in a credentialed spatial frame, the temporal coordinate of the observation in a credentialed time frame, the transactional identifiers (counterparty identity claim, commodity class, quantity, conditions), and the observing party's signature over the entire record. The credential lineage is carried as part of the signature: the authority that issued the party's credential, any cross-recognition chain leading to the authority that admits the predicate, and the freshness markers needed to verify that no participating credential has been revoked.

The proximity predicate evaluates whether the two observations satisfy the structural conditions for pairing. Spatial proximity is evaluated against a window signed by the relevant authority for the apparatus class involved (toll-zone geometry, charging-pad footprint, port-gate threshold, ride-share pickup envelope). Temporal proximity is evaluated against a duration signed by the same authority. Identifier compatibility is evaluated against the commodity-class taxonomy admitted by the authority. Predicate satisfaction is decidable by either party independently; both reach the same result given the same observations and the same authority signatures.

The primitive is bilateral by construction. Aggregator-mediated settlement, third-party clearing, and consensus-driven ordering are absent because they are structurally unnecessary: the two parties to the transaction are the only parties whose observations participate, and the proximity predicate is the only condition that needs to be satisfied. Authorities aggregate matched pairs after the fact for accounting, audit, and tax purposes, but the aggregation does not produce finality; finality was already established at the moment of pairing.

3. Spatial-Temporal Proximity Binding

The proximity window is the structural finality trigger and warrants careful treatment. It is not a heuristic threshold; it is a credentialed object signed by a governance authority for a specific apparatus class and operational context. A toll authority signs window definitions for its tolling gantries, specifying the spatial polygon (typically a lane-aligned region of approximately 3 by 10 meters per gantry coil) and the temporal duration (typically 50 to 500 milliseconds, depending on vehicle-speed envelope). A charging operator signs window definitions for its charging stations, specifying the cable-engagement geometry (typically the connector-mating volume of a few cubic centimeters) and the metering interval (typically 1 to 60 seconds per energy quantum). A port authority signs window definitions for its custody-transfer points, specifying the gate-threshold geometry and the dwell duration.

Window definitions are derived from the credentialed spatial frame and credentialed time frame established by the broader mesh primitives. The spatial frame supplies a coordinate system in which the window polygon is unambiguous; the time frame supplies a clock against which the window duration is enforceable. Both frames carry their own credential lineage, and a window definition signed against an unrecognized frame is itself unrecognized. This composition prevents an apparatus operator from unilaterally redefining the proximity window: the window can only widen with the consent of the authority that signed it, and the participating credentials must trace to the same frames.

The predicate is evaluated locally by each party. The vehicle's onboard observer evaluates whether the gantry's signed observation falls within the vehicle's signed observation's spatial-temporal envelope; the gantry's roadside observer evaluates the symmetric condition. Both evaluations succeed or both fail. There is no asymmetric admission. If either party's observation falls outside the signed window, no pair is formed and no settlement occurs; the would-be transaction is simply absent from the record, and either party may retry under a fresh observation if the underlying physical interaction is repeatable.

The proximity window also bounds replay. An observation cannot be replayed against a different counterparty observation because the spatial-temporal coordinates of the original would not satisfy the predicate against the new partner. This property eliminates a class of attack that conventional bilateral settlements must address through nonces, sequence numbers, or pre-negotiated session state.

4. Lineage-Bound Matched Commitments and Cross-Authority Translation

Real settlement crosses authority boundaries. A vehicle credentialed under one state's tolling authority crosses a gantry operated under another state's authority. A charging session occurs between a vehicle credentialed under an e-mobility service provider and a charger credentialed under a utility. A port handoff occurs between a ship credentialed under a flag-state and a terminal credentialed under a port authority. The matched-pair primitive accommodates these crossings through lineage-bound credentials and cross-authority translation, without requiring pre-negotiated bilateral interoperability between every authority pair.

Each credential carries a lineage chain naming the authority that issued it and any superior authorities that admit the issuer. Cross-recognition between authorities is itself a credentialed object: authority A signs a cross-recognition record naming authority B and the commodity classes for which B's credentials are admitted under A's predicates. When a participating credential's lineage traces to an authority that A has cross-recognized, A's predicate admits the credential as if it had been issued under A directly. The cross-recognition is reflexive only when both authorities have signed mutual records.

Taxonomy translation handles the case where the two authorities use different commodity-class vocabularies. A is the tolling authority and uses an axle-count taxonomy; B is the visiting vehicle's home authority and uses a weight-class taxonomy. A and B have signed a translation table that maps weight classes to admissible axle classes for tolling purposes. When B's vehicle presents at A's gantry, the matched-pair predicate consults the signed translation table and admits the pairing if the translated class is admissible. The translation is governance-credentialed; neither operator may unilaterally redefine it.

Multi-class commodity matching extends this mechanism to transactions involving more than one commodity. A V2G charging session involves an energy commodity (kilowatt-hours of electrical energy) and may involve a grid-services commodity (frequency regulation capacity, demand-response participation). Each commodity is matched under its own taxonomy, with the matched pair carrying parallel observations for each commodity class. Disputes over one commodity do not invalidate the others; each commodity's pairing is structurally independent.

5. Counter-Offer, Escrow, and Dispute Mechanisms

Not every settlement is a single instant pairing. Some transactions involve negotiation before pairing (counter-offers, conditional acceptance), conditional finality after pairing (escrow until performance), or dispute resolution following pairing. The matched-pair primitive composes with these mechanisms structurally, by treating each negotiation step as itself a credentialed observation under the same governance framework.

A counter-offer is a credentialed observation by the responding party that modifies the originator's offer along one or more dimensions (price, quantity, conditions, time window). The original offer remains open until accepted, withdrawn, or expired; the counter-offer modifies the predicate parameters under which a future matched pair would form. Both observations are signed and recorded; the eventual matched pair, if formed, includes the offer-and-counter chain as part of its lineage. This makes the negotiation auditable without requiring an intermediary to record it.

Escrow is a deferred matched-pair. The initial pairing satisfies a structural predicate but does not finalize the underlying commitment; finalization requires a release condition (delivery confirmation, performance attestation, third-party reference observation) that itself is a credentialed observation. The escrow window is bounded by an authority-signed timeout; if the release condition is not observed before the timeout, an authority-signed default rule applies. The escrow does not require an escrow agent because the release predicate is decidable by both parties given the credentialed observations.

Disputes do not unwind matched pairs. A dispute is a counter-claim observation, signed by the disputing party under its credential, asserting that some aspect of the pairing was incorrect (metering inaccuracy, identity confusion, cross-authority translation error). The counter-claim is evaluated under the same governance framework that admitted the original pairing; the authority may issue a corrective record, may convene additional credentialed observations from reference meters or third parties, or may decline to act. The original matched pair remains; corrections are layered on top. This preserves the non-repudiability of the underlying record while admitting structured correction.

6. Operating Parameters and Engineering Envelope

Spatial proximity windows range from sub-millimeter (charger connector mating) through centimeter (RFID-tag-and-reader proximity for transit ticketing) and meter scale (tolling gantry coils, port-gate sensors) to tens of meters (autonomous-vehicle handshake zones, vessel berth-arrival envelopes). Temporal proximity windows range from microseconds (cryptographic challenge-response between paired apparatus) through milliseconds (gantry-vehicle pairing at highway speed) and seconds (charging metering intervals) to minutes (port-gate dwell windows).

Credential freshness requirements range from real-time revocation checks against a credentialed revocation list (typical for high-value transactions) to cached revocation snapshots refreshed at intervals of 1 to 60 minutes (typical for high-throughput, low-value transactions such as tolling). Cross-recognition records are typically refreshed at hourly to daily cadence; their freshness is itself credentialed and the predicate refuses to admit a record older than the authority-signed staleness ceiling.

Multi-class commodity matching admits parallel observations for up to a configurable maximum, typically in the range of 2 to 8 commodities per transaction. The escrow timeout admits authority-signed defaults from seconds (real-time charging release) to days (port custody handoff). Counter-offer chains admit a configurable depth before the offer is forced to terminate (accepted, withdrawn, or expired); typical depths are 2 to 8 turns.

Throughput envelopes for representative deployments include: tolling at 1,000 to 100,000 paired settlements per gantry per hour at peak, charging at 1 to 10 paired settlements per second per active session for sub-second metering granularity, and port-gate handoffs at tens to hundreds of paired settlements per gate per hour. These ranges are illustrative and are not claim limitations; the disclosure contemplates substantially higher throughput envelopes for embodiments with optimized credentialed-observation packaging.

7. Alternative Embodiments

A first alternative embodiment is the tolling apparatus: a credentialed roadside gantry observes a credentialed vehicle as it traverses the gantry's spatial window during the gantry's signed temporal window. The matched pair finalizes the toll without forwarding to a clearinghouse. Multi-jurisdictional tolling is admitted via cross-recognition records signed between the home and visiting authorities.

A second alternative embodiment is the V2G charging apparatus: a credentialed charger and a credentialed vehicle exchange paired metering observations at sub-second cadence over the duration of a bidirectional energy session. Each metering quantum produces its own matched pair, with the proximity window defined by the cable-mating geometry and the metering interval. Grid-services co-commodities are matched in parallel under their own taxonomies.

A third alternative embodiment is the port custody handoff: a credentialed terminal-gate sensor and a credentialed container-mounted observer pair at the gate threshold, finalizing custody transfer between carrier and terminal at the moment of physical crossing. Customs and security observations are layered as additional credentialed records under the same matched-pair framework.

A fourth alternative embodiment is the ride-share micropayment: a credentialed driver vehicle and a credentialed rider device pair at pickup and at drop-off, with the matched pair encoding both endpoints and the route segment. Per-segment settlement occurs at drop-off pairing without intermediate processor involvement. A fifth alternative embodiment is the EV-charging-pair ecosystem composition, in which a fleet of chargers and a fleet of vehicles share a common credentialing framework that admits any compatible pairing without bilateral pre-negotiation between charger operator and vehicle fleet.

8. Composition with Broader Architecture

The matched-pair primitive composes with the credentialed spatial frame and credentialed time frame supplied by the mesh coordinate and time primitives. Without those frames, proximity windows would be defined against unverifiable coordinates and durations and the predicate would not be enforceable; with them, the predicate inherits the frames' credential lineage and revocation semantics.

The primitive composes with marker-track transport primitives: a credentialed gantry, charger, or gate is a marker whose track is traversed by a credentialed vehicle, vessel, or container. The marker's signed observation and the traverser's signed observation form the matched pair, and the marker-track route composition mechanism supplies the cross-authority recognition for routes that cross authority boundaries.

The primitive composes upward with the five-property governance chain: identity (the credential bound to each party), authority (the issuer of each credential), policy (the predicate parameters signed by the authority), evidence (the matched-pair record itself), and accountability (the post-aggregation by authorities for audit and tax). Each property is supplied by an existing primitive in the umbrella, and the matched pair is the structural object across which the properties compose.

The primitive generalizes upward to n-party coordination. A two-party matched pair is the base case; an n-party matched tuple admits ceremonies in which more than two parties must co-observe a spatial-temporal event for finality to obtain. The n-party generalization preserves the bilateral-finality property at the level of each pairwise edge in the tuple while admitting joint events such as multi-party port handoffs (carrier, terminal, customs, security) and multi-party charging (vehicle, charger, grid operator, regulator).

9. Prior-Art Distinctions

The disclosure is structurally distinct from existing tolling clearinghouses (E-ZPass, FasTrak, equivalent international systems). Those systems pair vehicles with gantries at the moment of physical interaction but defer settlement to a centralized clearinghouse over hours-to-days latency. The clearinghouse is the trusted intermediary; finality is its accounting decision. The present disclosure makes finality structural at the moment of pairing and treats authority aggregation as a post-finality accounting step.

The disclosure is structurally distinct from blockchain-based pair-settlement constructions, including Lightning Network HTLCs, state channels, and atomic swaps. Those constructions presume a pre-negotiated session state and an underlying custody layer (the on-chain settlement substrate) against which channel state is eventually reconciled. The present disclosure has no underlying custody layer; the proximity-window admission is itself the custody, and the matched pair is the settlement.

The disclosure is structurally distinct from locational marginal pricing (LMP) and related electricity-market settlement constructions. LMP settles energy transactions through a market operator that aggregates bids and offers and clears them at locational prices; finality is the market operator's clearing decision. The present disclosure does not require a market operator; energy pairings finalize at the metering interval between charger and vehicle under their respective credentials.

The disclosure is structurally distinct from bilateral OTC trade clearing in financial markets. OTC clearing involves two principals who agree on terms and then submit the trade to a clearinghouse for novation, netting, and margining; the clearinghouse becomes the counterparty to each side. The present disclosure has no novation; the two principals remain the counterparties, and the matched pair is the entire settlement record.

10. Disclosure Scope

The disclosure is directed to the architectural primitive of bilateral finality through a governance-credentialed spatial-temporal proximity predicate, the matched-pair record produced by predicate satisfaction, and the composition of that primitive with credentialed coordinate frames, lineage-bound credentials, cross-authority translation, multi-class commodity matching, counter-offer chains, and escrow timeouts. The disclosure encompasses the predicate, the credentialed observation format, and the alternative embodiments enumerated in section 7 (tolling, V2G charging, port handoff, ride-share micropayment, and ecosystem charging-pair composition).

The disclosure is not directed to any specific cryptographic signature scheme, any specific spatial-sensor or time-source technology, or any specific governance authority's policy content. Those subsystems are interchangeable consumers and producers of the disclosed primitive's inputs and outputs. Disclosed under USPTO provisional 64/049,409.

Implementation details, deployment readiness, regulatory certification in any specific jurisdiction, and quantitative throughput guarantees are context-dependent and outside the scope of this architectural disclosure. The parameter ranges identified in section 6 are illustrative of a practical engineering envelope and are not claim limitations. The alternative embodiments in section 7 do not exhaust the space of admissible embodiments; the primitive applies wherever two credentialed parties co-observe a spatial-temporal event under a governance authority that admits the pairing.