Mesh-Derived Coordinates: Cooperative Localization With On-Demand Densification

1. Problem and Architectural Premise

Autonomous and unmanned systems resolve position through the same recipe almost universally: a GNSS receiver supplies absolute coordinates, an inertial measurement unit dead-reckons through brief outages, and an optional aiding sensor (lidar, visual odometry, RTK correction stream) tightens the solution where infrastructure is present. The recipe is robust in benign conditions and collapses outside them. Urban canyons produce 5-50 meter multipath errors. Forest canopy attenuates GNSS by 20-30 dB. Indoor environments lose lock entirely. Tactical jammers produce kilometer-scale denied bubbles around their emitters. Commercial spoofing has been demonstrated against ships, drones, and timing infrastructure with off-the-shelf software-defined radios.

Each existing fallback presupposes specific pre-installed and uncompromised infrastructure. Real-time-kinematic GNSS requires a surveyed base station within 10-20 km whose corrections the rover trusts implicitly. Ultra-wideband (UWB) localization requires four or more anchor beacons surveyed to centimeter accuracy and powered for the operating window. V2X cooperative perception messaging requires roadside units along the route. Bluetooth fingerprinting requires a calibrated radio map. None of these scale to expeditionary deployment, disaster response, contested logistics, indoor warehouse robotics without infrastructure investment, or operations across geographies that simply lack the prerequisite installations.

The deeper architectural gap is that no current coordinate primitive is anchorless. Every system in production assumes it can resolve to a global frame through external authoritative anchors. When the anchors are absent, jammed, spoofed, or politically unavailable, the system either degrades to dead-reckoning (which drifts unboundedly) or fails outright. There is no production primitive in which a coordinate frame can be bootstrapped from peer observations alone, populated with credentialed positions, used for navigation and actuation in that bootstrapped state, and later reconciled with an absolute frame when one becomes available. There is also no production primitive in which range observations are individually authenticated by their originator, so that a spoofed pseudorange or fake beacon is rejected at the credential layer rather than admitted to the multilateration solution.

The premise of mesh-derived coordinates is that a coordinate frame is itself a credentialed observation. The frame is constructed from credentialed range observations between credentialed peers. The frame's origin, axes, and scale are signed observations. The frame can be relative-only and remain useful, and it can promote to absolute through a credentialed alignment observation when the alignment becomes available. Authentication, anchorlessness, and densification are jointly addressed by a single primitive rather than bolted on top of an architecture designed around assumed-good GNSS.

2. Core Architectural Primitive

The primitive consists of three jointly defined elements: a credentialed range-observation type, an anchor-less coordinate-frame observation, and a multilateration observation that consumes the first two and produces a position with declared uncertainty. Each is signed under credentials issued by one or more authorities and recorded with full lineage.

A range observation is a credentialed measurement between two units across one of fifteen-plus supported modalities. Supported modalities include UWB time-of-flight, lidar point-pair correspondence, millimeter-wave and centimeter-wave radar, optical fiducial range (camera plus known-size target or coded marker), RFID and NFC proximity, acoustic time-of-flight (in air and underwater), Bluetooth Low Energy received-signal-strength, magnetic dipole gradient, GNSS pseudorange when available and admitted, inertial-integration delta-position over a calibrated window, visual SLAM correspondence, LoRa time-of-flight, 802.11 fine-timing-measurement, and 5G NR positioning reference signals. Each observation declares its modality, its claimed range with one-sigma uncertainty, the originator and target identifiers, the timestamp under mesh-time, and the originator's credential signature.

A coordinate-frame observation is a credentialed declaration of an origin, axis convention, scale, and frame class (relative-only, absolute, or aligned). The first participating unit declares the origin frame; subsequent units adopt the frame by referencing the origin observation. Frame promotion from relative to absolute is itself a credentialed observation produced when an authoritative external anchor (a unit with admitted GNSS, a surveyed RTK base, a credentialed monument) joins the mesh and produces a rigid-transform observation between the relative frame and the absolute frame.

The multilateration observation is the position produced by combining credentialed range observations against the current coordinate frame. The position is signed by the producing unit, references the contributing range observations by lineage, declares the multilateration algorithm class (least-squares, factor-graph, particle-filter, or extended Kalman), and reports an uncertainty bound computed from the input uncertainties and the geometric dilution of precision. Where the input set is insufficient to produce a position within a stated uncertainty bound (typically below the operating threshold of 0.1-10 meters depending on application), the unit produces an explicit no-position observation rather than a low-confidence point estimate.

The cooperative property is structural rather than optional. A unit does not position itself by passively receiving anchor broadcasts; it positions itself by exchanging credentialed range observations with whichever credentialed peers it can reach, where the peers may be other operating units, infrastructure devices, fixed monuments, deployable beacons, or vehicles of opportunity. The resulting position is grounded in the credential graph of the contributing peers rather than in the assumed authority of any single anchor.

3. Anchor-Less Bootstrap and Frame Promotion

Anchor-less operation is the operating mode that distinguishes the primitive from every prior fallback. When no authoritative absolute-frame anchor is reachable — no admitted GNSS, no surveyed RTK base, no credentialed monument, no admitted survey database — the mesh bootstraps to a relative-only frame. The first participating unit publishes a frame observation declaring itself the origin, with axes oriented per a declared convention (typically gravity-aligned z-axis from the unit's IMU and an arbitrary x-axis from the unit's heading). Subsequent units publish their own credentialed range observations to the origin unit and to each other, and each unit's multilateration produces a position in the bootstrapped frame.

The bootstrapped relative frame is a first-class coordinate space, not a degraded fallback. Operating units carry positions in the frame; navigation, formation control, collision avoidance, and actuation proceed identically to absolute-frame operation. Mission tasking, geofencing, and rendezvous coordinates can all be expressed in the relative frame and remain operationally meaningful so long as the participants share the frame observation. The frame does not need an absolute alignment to support cooperative work.

Frame promotion is the credentialed event that aligns a relative frame with an absolute frame. When an authoritative anchor later joins the mesh — a unit with admitted GNSS regains lock, a surveyed monument is brought into communication range, a credentialed survey vehicle deploys into the operating area — the joining unit produces both its absolute position and its position in the existing relative frame (computed through the same credentialed range exchange). The two positions, paired across at least three non-collinear units, determine a rigid transform between the frames. The transform is a credentialed observation that both endpoints sign, and once admitted, all positions in the relative frame can be re-expressed in the absolute frame without re-running multilateration. Ongoing operations continue without disruption; the frame promotion is a metadata event rather than a position recomputation.

Frame demotion is the symmetric event. When the absolute anchors fail (jamming onset, spoofing detection that invalidates the anchor's admissibility, monument loss), the alignment is retracted under credential and the frame reverts to relative-only operation. The unit's positions remain valid in the relative frame; the absolute expression is suspended until alignment can be re-established. The architecture treats GNSS availability as a feature of the operating environment rather than a precondition for operation.

4. Credentialed Range Observations and Spoof Rejection

Adversarial range injection — spoofed GPS pseudoranges, fake UWB beacons, manipulated RTK correction streams, replayed time-difference-of-arrival fixes — defeats current localization stacks because the receiver has no architectural way to authenticate the originator of any individual range observation. The primitive rejects these attacks structurally by treating each range observation as a credentialed message rather than as a passive radio-frequency input.

Every range observation carries the originator's credential signature over the observation's content (modality, range, uncertainty, timestamp, target identifier). Receiving units verify the signature against the credentialing authority before admitting the observation into the multilateration computation. A spoofed GPS satellite produces a pseudorange whose signing identity does not match a credentialed GNSS authority; the observation is rejected at the admissibility gate, never reaching the coordinate-solution layer. A fake UWB beacon produces a range observation whose signing identity has not been admitted into the operating mesh; the observation is rejected. A replayed observation fails the timestamp freshness check against mesh-time and is rejected. A manipulated RTK broadcast fails its credential check at the admitting endpoint.

The architectural shift is that the adversary's required capability moves from "inject a plausible RF signal" — which is cheap with software-defined radios — to "compromise a credentialed authority" — which is structurally harder, leaves audit trace, and is detectable through credential-revocation flows in governance-chain. The economics of the attack invert. A successful spoofing campaign now requires obtaining or extracting a credentialed signing key from an authority's key management infrastructure, an attack class that is expensive, monitored, and reversible.

Detection-and-response semantics are also strengthened. When a credentialed range observation is later determined to be malicious (post-event analysis, key compromise disclosure), the credential is revoked and the lineage of every position that admitted observations under that credential is recomputable. Affected positions are flagged and either recomputed from the surviving credentialed observations or downgraded to no-position. The audit-grade lineage that the primitive produces by construction is what enables this retroactive reconciliation; current localization stacks have no comparable mechanism because the contributing observations are not individually identified or signed.

5. Lineage-Bound Multilateration and On-Demand Densification

The position estimate produced by the multilateration step is itself a governed observation. The producing unit signs the position, references each contributing range observation by lineage identifier, declares the algorithm class and parameters, and reports an uncertainty bound computed from the input uncertainties and the contributing geometry's dilution of precision. Position queries — current position, position at time T, position throughout interval [T0, T1] — can be answered with full lineage from the position observation back to the contributing range observations and ultimately to the credentialing authorities of every contributor.

Lineage-bound positions enable cross-jurisdictional acceptance without re-survey. A position produced under one authority's anchors is accepted by another authority through credential verification of the underlying range observations rather than through re-computation against the second authority's anchors. The two authorities need only agree on the credential set — which is a governance-chain operation, not a re-survey operation. This is the underlying mechanism by which civilian and military airspace, federal-state highway boundaries, port-customs custody zones, multi-jurisdictional inspection regimes, and similar multi-authority spaces become navigable without pre-negotiated coordinate-frame interoperability.

On-demand densification is the operating mode that supplies coverage where the existing mesh is insufficient. Where coverage falls below the geometric or statistical threshold required for the application's accuracy class — typically fewer than four contributing peers within range, or a dilution-of-precision factor above the operating threshold — additional reference nodes are deployed and self-integrate into the coordinate mesh upon activation. Deployment modes include airdrop (ruggedized beacons released from fixed-wing or rotary platforms with parachute or impact-attenuation), drone-positioning (multirotor placement at surveyed waypoints or at adaptive sites computed against the existing mesh's coverage gaps), hand-placement (operator deployment from a kit), and vehicle-mounted (beacons mounted on patrol vehicles, ships, or rail cars). Each deployable node carries a credential issued by the deploying authority, broadcasts an initial relative-frame position, and contributes credentialed range observations to its neighbors immediately upon activation.

Densification scaling is parameterized rather than fixed. Representative deployments operate at densities of 5-50 contributing peers within a unit's effective range, with sub-meter accuracy achievable at the higher end and meter-scale accuracy at the lower end. A unit's accuracy class is reported in its position observation, and downstream consumers gate operations on the declared accuracy. The primitive does not produce confidently-wrong positions in sparse regions; it produces accurate positions in dense regions, accurate-with-larger-uncertainty positions in sparse regions, and explicit no-position observations below the floor.

6. Operating Parameters and Engineering Envelope

Modality coverage spans approximately fifteen ranging technologies with characteristic ranges and accuracies: UWB (1-200 m at 0.05-0.3 m one-sigma), lidar correspondence (1-200 m at 0.02-0.1 m), millimeter-wave radar (1-300 m at 0.1-0.5 m), optical fiducial (1-50 m at 0.005-0.05 m for known-size targets), RFID/NFC (0.01-5 m at 0.05-0.5 m), acoustic in-air (0.5-30 m at 0.05-0.3 m), acoustic underwater (10-10,000 m at 0.5-50 m), BLE RSSI (1-30 m at 1-5 m), magnetic dipole (0.1-10 m at 0.01-0.5 m), GNSS pseudorange when available (worldwide at 1-10 m, sub-meter with admitted RTK), inertial integration (drift-bounded for 1-300 s typically), 802.11 FTM (1-100 m at 0.5-3 m), 5G NR positioning (1-1000 m at 0.5-3 m), LoRa time-of-flight (10-15,000 m at 5-50 m), and visual SLAM correspondence (0.5-100 m at 0.02-0.5 m).

Densification operates across a range of approximately 5 to 50 contributing peers within a unit's effective ranging volume. Below 5 peers the unit may report a position with elevated uncertainty (typically 1-10 m) or a no-position observation depending on geometry and modality mix. Between 5 and 15 peers the typical accuracy is 0.3-2 m with mixed-modality contributions. Above 15 peers and especially with UWB, lidar, or fiducial contributions the accuracy reaches 0.05-0.3 m. Above 50 peers the marginal benefit per additional peer is small and the densification protocol throttles further deployment.

Frame-bootstrap and frame-promotion latencies are sub-second to seconds. Bootstrap requires only the first frame observation and the first credentialed range observation between the origin unit and any peer. Promotion requires at least three non-collinear paired absolute/relative positions, achievable within seconds of an authoritative anchor joining a populated mesh. Demotion under anchor loss is immediate upon the credential revocation event.

Cryptographic overhead per range observation is below 1 ms at typical hardware profiles for signature generation and verification, with batching reducing per-observation cost further. Storage cost for lineage-bound positions is on the order of 1-5 KB per position observation including credential and reference fingerprints, manageable for fleets of tens of thousands of units operating at 1-10 Hz position rates over multi-day missions.

7. Alternative Embodiments

Expeditionary defense embodiment. A dismounted unit operates in a jammed theater with no admitted GNSS. The unit's mesh bootstraps a relative frame from credentialed inter-unit ranging across UWB and acoustic modalities; airdropped beacons densify coverage across the operating area; a forward survey team's credentialed position observation, when admitted, promotes the relative frame to absolute. Throughout, every range observation is credential-verified, and any spoofed RF emission fails admission at the credential layer.

Disaster-response embodiment. First responders enter a collapsed structure with no GPS lock and no pre-installed UWB infrastructure. Hand-placed densification beacons establish a relative coordinate frame across the rubble field; responders' positions, equipment positions, and victim-locator-beacon positions are all expressed in the bootstrapped frame; when a credentialed survey vehicle deploys to the perimeter, the frame promotes to absolute and operations integrate with municipal mapping without disruption.

Indoor warehouse robotics embodiment. Autonomous mobile robots and forklifts operate in a warehouse with no GNSS coverage. Fixed UWB and BLE beacons, vehicle-mounted lidar, and overhead optical fiducials all contribute credentialed range observations. A relative frame anchored to the warehouse's surveyed monuments operates as the working frame; the frame is promoted to absolute under municipal survey when integration with outdoor pickup-and-delivery requires it.

Maritime and underwater embodiment. Surface vessels and underwater autonomous vehicles cooperate via acoustic time-of-flight ranging supplemented by surface-vessel GNSS. The acoustic mesh's relative frame is anchored to the surface vessels' admitted GNSS positions, promoted to absolute, and propagated to underwater units operating well below GNSS reach. Spoofed acoustic signals fail credential verification.

Critical-infrastructure timing-and-positioning embodiment. Substations, telecom point-of-presence sites, and data-center campuses use the mesh-coordinate primitive to provide assured position references resistant to GPS spoofing attacks documented against utility timing infrastructure. Surveyed monuments, fixed UWB anchors, and credentialed atomic timing sources cross-validate, and frame demotion under spoofing detection is automatic.

Civil-aviation, port-custody, agricultural-fleet, and mining-equipment embodiments follow analogous patterns with domain-specific modality mixes and authority structures.

8. Composition with Broader Architecture

Mesh-derived coordinates compose with several adjacent primitives disclosed under the same provisional. The composition is what produces an end-to-end assured-PNT architecture rather than a point solution.

Composition with mesh-time. Range observations require time alignment between originator and target. Mesh-time supplies credentialed time without exclusive reliance on GNSS, bootstrapping a relative time frame analogous to the relative coordinate frame and promoting to absolute when an authoritative time source is admitted. The two primitives are jointly necessary: anchorless time supports anchorless space. The joint relative frame (time and position) is internally consistent and supports cooperative work indefinitely.

Composition with governance-chain. Every credential used to sign range observations, frame observations, multilateration observations, and densification deployments is issued, delegated, and revoked under governance-chain. Revocation propagates through the lineage of contributed positions, enabling retroactive recomputation of affected positions and audit-grade investigation of compromise events.

Composition with governed-actuation and cascade propagation. Position observations gate actuation policies — a unit cannot enter a restricted zone unless its position observation admits the geofence policy under composite admissibility. Position-driven refusals propagate upstream as cascade observations. Position uncertainty becomes a first-class admissibility input rather than a hidden assumption.

Composition with marker-track transport. Physical markers (surveyed monuments, deployed beacons, fiducial targets) are themselves credentialed reference nodes whose presence and integrity are tracked over time. Marker-track transport supplies the chain-of-custody for markers across deployments, retrievals, recalibrations, and retirements; mesh-coordinates consumes the credentialed marker observations as anchors when admitted. The two primitives jointly underwrite the matched-pair settlement and n-party coordination primitives that depend on physical proximity verification.

9. Prior-Art Distinctions

The primitive is distinct from GNSS, RTK GNSS, and NTRIP correction networks. Those are absolute-frame, anchor-bound systems with un-credentialed broadcast streams and no architectural defense against spoofing at the receiver. The mesh-coordinate primitive can consume GNSS and RTK as one of many credentialed range modalities, with admissibility gating on credential verification rather than on signal authenticity heuristics.

The primitive is distinct from centralized UWB and ultra-wideband fingerprinting systems. Those require pre-surveyed anchor grids and a central server that fuses observations on behalf of clients. The mesh-coordinate primitive is peer-to-peer, anchor-optional, and does not require a central fusion server; multilateration occurs at the producing unit against the credentialed mesh.

The primitive is distinct from single-agent SLAM. SLAM is a single-vehicle map-and-locate computation that does not represent multi-agent credential structure, does not propagate refusals, and does not support cross-jurisdictional position acceptance. Visual or lidar SLAM correspondence can be one of the contributing range modalities, but the architectural unit of analysis is the cooperative mesh, not the single agent.

The primitive is distinct from collaborative SLAM research. Collaborative SLAM aggregates observations across robots through shared map structures with implicit trust between participants. The mesh-coordinate primitive is medium-agnostic, credential-bound, and operates without implicit trust; participants are admitted under credential, observations are individually signed, and the architecture defends against a compromised participant by credential revocation.

The primitive is distinct from trilateration with central reference, beacon-based indoor positioning systems, and passive RF fingerprinting. Each of those presupposes a specific infrastructure that the mesh-coordinate primitive treats as one of many contributors without privileged status.

The primitive is distinct from assured-PNT programs (DARPA STOIC, Air Force NavWar, Army APNT). Those programs harden against jamming and spoofing within the GNSS-dependent architecture, adding alternative sensors and anti-spoof receivers. The primitive changes the architecture: ranges are individually authenticated, operation is anchorless when needed, frame promotion and demotion are first-class events, and densification is a deployable operating mode.

10. Disclosure Scope

This article describes architectural primitives and embodiments disclosed under USPTO provisional patent application 64/049,409. The disclosure includes credentialed range observations across fifteen-plus ranging modalities, anchor-less coordinate-frame bootstrap with a relative-only first-class frame, credentialed frame-promotion and frame-demotion events, lineage-bound multilateration with declared uncertainty and explicit no-position semantics, on-demand reference-node densification across airdrop, drone-positioning, hand-placement, and vehicle-mounted deployment modes, and cross-jurisdictional position acceptance through credential cross-recognition rather than re-survey.

The disclosure spans expeditionary defense, disaster-response, indoor warehouse robotics, maritime and underwater, critical-infrastructure timing-and-positioning, civil aviation, port-custody, agricultural-fleet, and mining-equipment embodiments without limitation to those domains. Composition with mesh-time, governance-chain, governed-actuation, cascade propagation, and marker-track transport primitives is disclosed as part of the broader architecture, with the joint mesh-time and mesh-coordinate frame providing an end-to-end assured-PNT capability that does not depend on uncompromised GNSS or pre-installed external infrastructure.

The primitive is distinguished from GNSS, RTK GNSS, NTRIP, centralized UWB, ultra-wideband fingerprinting, single-agent SLAM, collaborative SLAM, trilateration with central reference, beacon-based indoor positioning, passive RF fingerprinting, and assured-PNT programs operating within GNSS-dependent architectures. Claim scope is reserved for the corresponding non-provisional and continuation filings.