Spatial-Temporal Proximity Window for Pair Settlement

Mechanism

Each proposed settlement begins with a pair of observation claims, one from each party. Each claim is a structured record naming the claiming party, the wall-clock time of observation, the spatial coordinate of observation, the uncertainty bounds on each, and the cryptographic signature of the claiming party over the entire claim. The architecture treats the two claims as a joint observation: it does not evaluate the parties' positions and times independently and then combine the results, but instead constructs a single joint spacetime estimate from the two claims and the architecture's own corroborating mesh observations.

The proximity window is a declared region of the joint spacetime in which the architecture is willing to admit a pair claim. The window has three structural axes: an acceptable spatial separation between the two parties at the claimed instant, an acceptable temporal separation between the two parties' claimed observation times, and an acceptable joint spatial-temporal correlation that bounds the rate at which separation in one axis can be traded against separation in the other. The window is itself a signed object: the authority that declares the window — a tolling operator, a charging-station consortium, an adjacency-exchange supervisor — affixes its credential to the window's parameters, and that credential is admitted by each pair before the pair attempts settlement under the window.

Admissibility evaluation is a bounded computation. Given a pair of signed claims and a signed window, the architecture computes the joint spacetime estimate, projects that estimate onto the window's three axes, and admits the pair if and only if every axis is within bounds. Pairs whose joint estimate falls outside the window on any axis produce a non-admission record that names the failed axis, the magnitude of the failure, and the reason field declared by the window's authority. Both admissions and non-admissions are signed, and both enter the operational lineage as first-class records.

Operating Parameters

The principal parameters of a proximity window are the spatial-separation bound, the temporal-separation bound, the correlation bound, and the uncertainty-handling rule. The spatial-separation bound is expressed as a maximum distance between the two parties' claimed positions, with units and a coordinate frame named in the window declaration. The temporal-separation bound is expressed as a maximum interval between the two parties' claimed observation times. The correlation bound governs the joint envelope: a pair barely within the spatial bound but also barely within the temporal bound may still be rejected if the product of the two near-misses falls outside the correlation envelope.

The uncertainty-handling rule determines how the architecture treats claims whose declared uncertainty bounds overlap the window edge. Three rules are contemplated: a strict rule, under which the entire uncertainty region must lie within the window; a permissive rule, under which any overlap suffices; and a probabilistic rule, under which the admissibility decision is made against a declared probability threshold computed from the joint distribution. The choice of rule is itself a window parameter and is signed by the declaring authority.

Window parameters can evolve. The architecture supports versioned window declarations: a new declaration carries a successor relationship to the prior declaration, and pairs initiating settlement reference the version under which they intend to settle. Mid-flight settlements are evaluated under the version they referenced at initiation, even if a successor version has since been published, ensuring that the admissibility rule is fixed at the moment of pair commitment rather than at the moment of evaluation.

Alternative Embodiments

A first embodiment uses a single global window for an entire operating environment — one set of bounds applies to every pair settlement under the architecture's jurisdiction. A second embodiment supports zoned windows, where the operating environment is partitioned into spatial regions and each region carries its own signed window declaration. A third embodiment supports tiered windows, where multiple windows of differing strictness coexist and each pair settlement names the tier under which it is being attempted; high-value settlements reference the strictest tier, while low-value settlements may reference a relaxed tier.

Observation embodiments vary as well. A self-report embodiment relies entirely on the parties' own signed claims. A mesh-corroborated embodiment requires that the architecture's own mesh observations of the parties' positions and times be consistent with the parties' claims to within a declared tolerance. A third-party-attested embodiment additionally requires a signed observation from a non-party witness, such as a roadside unit or an infrastructure node, before admissibility evaluation proceeds.

Composition

Proximity windowing composes with the architecture's joint spacetime estimation primitive. The architecture maintains a continuously-updated joint estimate of mesh participants' positions and times, and the windowing computation reads that estimate rather than constructing a fresh estimate per settlement. This composition means that the windowing decision is grounded in the same observational substrate as every other architectural decision, and that improvements in the underlying estimation propagate automatically to admissibility.

Windowing also composes with the substantive settlement evaluation that follows admission. The admission record is a precondition reference for the substantive settlement; the settlement record carries the admission record as part of its lineage; downstream audit can verify both that admission was granted and that admission was granted under the correct window version. The architecture does not permit a substantive settlement to be recorded without the prior admission, and it does not permit an admission to be retroactively altered once a substantive settlement has been recorded against it.

Prior Art

Geofencing and time-windowed authorization are well-established primitives in mobile commerce and in vehicular ad-hoc network literature. Those primitives typically evaluate a single party's position against a fixed region and a fixed time interval. The disclosed primitive differs in evaluating a joint pair claim — two parties simultaneously — against a declared envelope with explicit correlation bounds, in producing a signed admission or non-admission record as a first-class lineage artifact, and in versioning the envelope itself as a credentialed object.

Prior pair-settlement protocols, including those used in tolling and electric-vehicle charging interoperability, typically rely on heuristic proximity checks performed by one party and trusted by the other. The disclosed primitive replaces that asymmetric heuristic with a symmetric, signed, joint-estimate evaluation against a publicly declared envelope, producing an audit trail that does not depend on either party's good faith.

Operational Scenarios

Three operational scenarios illustrate the primitive's application. In a tolling scenario, a vehicle and a roadside collection unit constitute the bilateral pair; the window declares that the vehicle and the unit must have observed one another within a few meters and within a few seconds, with a tight correlation bound that prevents a vehicle from claiming proximity to a unit it merely passed near at a different time. In an electric-vehicle charging-handshake scenario, the vehicle and the station constitute the pair; the window's spatial bound is correspondingly tight (the vehicle must be at the connector) but its temporal bound may be loose (the handshake may proceed over an extended pre-charge interval). In an adjacency-bound exchange scenario — for instance, a peer-to-peer payment confirmed by physical co-presence — the pair is two consumer devices, and the window may include a third-party-attested embodiment requiring a corroborating observation from infrastructure.

Across these scenarios the common pattern is that the value being exchanged is in part the proximity itself: the toll is owed because the vehicle traversed a specific gantry, the charging session is authorized because the vehicle is physically at the station, the payment is gated because the parties are physically co-present. A settlement protocol that accepts unsigned proximity claims invites fraudulent settlements in which the proximity never occurred. The disclosed primitive forces every settlement to carry a credentialed proximity admission, and forces every non-admission to be recorded as such, so that the operational lineage cannot be silently cleansed of failed attempts.

Implementation Notes

The joint-spacetime computation that underlies admissibility is the primitive's principal engineering concern. A correct implementation cannot simply average the two parties' claims; it must combine the claims with their declared uncertainty bounds and with any mesh-corroborated observations to produce a posterior estimate over the joint position-time. The choice of estimator — least-squares, maximum-likelihood, full Bayesian — is an implementation decision that affects both the per-settlement computational cost and the architecture's robustness to misreported uncertainty. The architecture exposes the estimator as a window parameter, so that high-value settlements may declare a more conservative estimator while low-value settlements use a cheaper one.

Window publication and discovery require their own discipline. The window declarations to which pairs may settle must be discoverable in advance — a pair cannot adapt its claim to a window it has not seen. The architecture publishes window declarations through a credentialed registry whose entries are signed by the declaring authorities and whose updates are themselves logged as a versioned sequence. Pairs reference the registry entry by its content-addressed identifier, ensuring that the window under which a pair attempts settlement is exactly the window the registry served at the moment of pair commitment.

The non-admission record warrants particular attention. A naive implementation that simply discards failed pair claims produces a lineage in which only successful settlements appear, which both biases downstream analytics and creates an opening for selective non-recording. The disclosed primitive requires that every evaluated pair claim produce either a signed admission or a signed non-admission, and that both record types be retained with the same retention discipline. Audit completeness depends on the non-admission stream being as durable and as inspectable as the admission stream.

Adversarial Considerations

The signed-claim discipline addresses several adversarial scenarios. A relay attack, in which an adversary forwards a legitimate party's observation to a remote location to fabricate proximity, is bounded by the temporal and correlation axes of the window: the relayed observation arrives outside the window's temporal envelope or fails the correlation bound against mesh-corroborated position estimates. A claim-replay attack, in which an adversary resubmits a prior legitimate claim to fabricate a fresh settlement, is bounded by the per-claim signature's freshness binding and by the lineage's prohibition on duplicate admissions. A collusive misclaim, in which both parties knowingly submit false-but-consistent claims, is bounded by the mesh-corroborated and third-party-attested embodiments, in which the architecture's own observations or a non-party witness's signed observation must be consistent with the parties' claims.

Disclosure Scope

The disclosure covers the representation of pair settlement as a two-stage process gated by signed proximity admission, the structure of the proximity window itself, the credentialing and versioning of window parameters, the admissibility evaluation against joint spacetime estimates, and the lineage representation that preserves both admissions and non-admissions. The disclosure further covers composition with joint spacetime estimation and with substantive settlement evaluation, and the application of the primitive to tolling, charging, and adjacency-bound exchange scenarios. Specific coordinate frames, distance metrics, uncertainty-handling rules, and tier definitions are implementation choices within the disclosed framework.