Mobile Store-and-Forward

Mechanism

The store-and-forward primitive operates in three credentialed phases — admit, carry, and emit — and each phase produces a signed record that becomes part of the message's hop history. In the admit phase, a mobile node within radio range of an originator (or of an upstream carrier) evaluates an incoming credentialed message under the local admissibility evaluator. The admissibility check is the same check the platform applies to any credentialed message: the originating authority's signature is verified, the temporal scope is checked, the originator's authorization for the message class is confirmed against the platform's policy, and the message's forward-error-correction structure is verified intact. If the message is admissible, the node signs an admit record and commits the message and the record to the outgoing buffer.

In the carry phase, the message persists in the outgoing buffer while the node moves through the disconnected region. Carriage is itself a credentialed action: the node's signing key is the credential that authorizes carriage, and the duration and trajectory of carriage are recorded as a continuation of the hop history when the message is eventually emitted. The buffer is durable across power cycles and is sealed against modification — a node that attempts to alter a carried message invalidates the originator's signature and the message becomes inadmissible at any downstream receiver.

In the emit phase, the node enters radio range of a receiver (or of a downstream carrier) and re-broadcasts the message. The emitted frame contains the original message, the original credential, the original FEC, and the appended hop history including the admit and carry records signed by the node. The receiver evaluates the entire artifact under its admissibility policy. The receiver is not required to trust the carrier; the carrier's signature attests only to the carriage event itself, while the originator's signature attests to the payload. The receiver's policy decides whether to admit a message that has traversed a particular carrier identity, a particular hop count, or a particular carriage duration, and whether to require corroboration from independent carriers before downstream consumption.

Operating Parameters

Buffer capacity is a bounded resource governed by the platform's policy. A carrying node specifies a maximum buffer size in bytes, a maximum carriage age per message, and an admission priority ordering across message classes that determines which messages are evicted when capacity is exhausted. The eviction policy is itself credentialed; a node that evicts a message that policy required it to retain produces a signed eviction record that downstream observers can audit.

Carriage age is bounded by the temporal scope of the originating credential and by the platform's local policy. A message whose temporal scope expires while in the buffer is dropped and an expiration record is committed to local lineage. A platform-local maximum carriage age may be shorter than the credential's temporal scope to bound the staleness of forwarded observations under operational policies that depend on freshness rather than authority.

FEC framing is mandatory across the disconnected interval. Messages are framed under a credentialed forward-error-correction code chosen by the originator and verified by the carrier on admit, on durable-store, and on emit. Bit-flip damage during prolonged carriage is detected at emit-time and the message is dropped with a signed corruption record rather than forwarded with a corrupted payload that the receiver would reject after the fact.

Hop history is a chain of signed records. Each carrier appends a record containing its identity, its admit timestamp, its emit timestamp, the credential under which it carried, and the carrier-local admit decision. The hop chain is verified end-to-end at the receiver. Receivers can require minimum hop counts, maximum hop counts, or specific intermediate-carrier requirements as part of their admissibility policy without modifying the primitive itself.

Contact discovery is opportunistic. Nodes broadcast presence beacons on a credentialed channel, and admit and emit phases are triggered by beacon receipt rather than by scheduled connectivity. The primitive does not assume a connectivity schedule and is not invalidated by an unplanned long disconnection.

Alternative Embodiments

The primitive admits several embodiments distinguished by carrier class, segment composition, and emission policy. The carrier class can be a vehicle in a road-traffic mesh, a drone in an aerial-corridor mesh, a robot in an industrial-floor mesh, a pedestrian-carried device in a personal-area mesh, or a maritime vessel in a long-haul oceanic mesh. The primitive does not depend on the carrier's mobility model; the same admit-carry-emit chain operates across timescales from minutes (a delivery drone) to weeks (a transoceanic vessel).

Segment composition can be multi-hop. A message can traverse a chain of carriers, each carrier admitting from the previous and emitting to the next, with the hop history accumulating signed records across the chain. Each segment is independently credentialed; the receiver evaluates the chain as a whole rather than as a sum of independent forwards. Embodiments that mix mobile and fixed segments — a vehicle carrying a message into range of a fixed mesh that then propagates it through wired infrastructure — operate under the same primitive with the fixed nodes contributing their own signed admit and emit records.

Emission policy can be selective. A carrier may emit only to receivers whose credentials match the originator's intended scope, only when a quorum of corroborating carriers is co-present, or only when the receiver explicitly requests messages of the carried class. Selective emission is a policy layered on top of the primitive; the primitive itself supports any of these policies through credentialed parameters rather than through structural change.

Cross-credential carriage is supported. A carrier signed under one credential can carry messages originated under a different credential, provided the carrier's policy authorizes carriage of that message class. The hop history makes the cross-credential traversal explicit and the receiver decides whether to admit under its own cross-recognition policy.

Worked Example: Cross-Pasture Agricultural Mesh

Consider an agricultural deployment in which a soil-moisture sensor at the far end of a sectioned pasture publishes a credentialed observation every fifteen minutes. The pasture has no cellular coverage and the wired backhaul terminates at the equipment yard six kilometers away across uneven terrain. A self-driving sprayer transits the pasture twice daily on a route that brings it within radio range of the sensor at one end and the yard at the other. Under the primitive, the sprayer admits the most recent observations during its sensor-side pass, signing an admit record into hop history under its operator-issued credential. It carries the sealed payload in its outgoing buffer for the duration of its pass — typically four to seven hours — and emits the payload during its yard-side pass, where the yard's fixed receiver verifies the originator's signature, the FEC framing, the carriage attestation, and the temporal scope. The yard's receiver consumes the observation under the same admissibility evaluator it applies to wired-backhauled observations. A second self-driving unit on a complementary route provides corroborating carriage on a different schedule; the receiver's policy treats two-carrier corroboration as raising the freshness confidence of the observation without altering its admissibility.

If the primary carrier's buffer fills during a pass — for example, during a sustained period in which higher-priority sensor classes are also accumulating — the carrier evicts under its credentialed eviction policy and writes a signed eviction record. The yard receiver sees the eviction record at the next emit, learns which observations were dropped, and reasons about gaps in the temporal record without inferring them from missing payload. If a damaged frame arrives at emit-time after the buffer detected bit-flip during prolonged carriage, the carrier emits a signed corruption record rather than the corrupted payload, and the yard receiver credits the carrier's diligence even though the original observation is unrecoverable. The same primitive applies, with the same admit-carry-emit chain, when the carrier is a maritime vessel carrying environmental telemetry across an ocean basin, a delivery drone carrying merchant attestations across a metro area, or a pedestrian-carried device carrying clinical observations between rural clinics that share no common backhaul.

Composition with the Spatial-Mesh Stack

Mobile store-and-forward composes with the other spatial-mesh primitives disclosed in Provisional 64/049,409. It composes with credentialed observation authorship: a sensor's observation is signed at the source and carried unmodified to the receiver regardless of how many mobile carriers participated. It composes with intentional disconnection: a region under a temporary disconnection policy continues to receive policy and observation propagation through transit by mobile units, with the disconnection itself recorded in lineage. It composes with composite admissibility: a receiver's policy can require multi-credential corroboration before consuming a forwarded payload, and the corroboration check operates on the same hop-history records the primitive produces.

The primitive composes downward into the application layer without modification. A receiver that consumes a forwarded credentialed observation does not need to know whether the observation arrived through fixed mesh, mobile carriage, or a mixture of the two; the admissibility check is uniform. Application logic depends only on the originator's credential and the temporal scope, both of which are preserved end-to-end across carriage.

Prior-Art Distinction

Existing delay-tolerant networking research and existing mobile-mesh deployments address forwarding under intermittent connectivity, but typically locate trust at the carrier or in a session-layer end-to-end check that requires the originator and the receiver to share state. The primitive disclosed here decouples trust from the carrier by sealing the originator's credential into the payload and treating each carrier as an independently credentialed contributor of admit, carry, and emit attestations. The receiver evaluates the originator's credential, not the carrier's identity, and the carrier's role is to attest to its own carriage rather than to vouch for the originator's authority.

Existing mobile-mesh systems that do credential their carriers tend to require homogeneous carrier infrastructure — all carriers signed by the same operator under the same key. The primitive here admits heterogeneous carriers under cross-recognized credentials, which is the operationally realistic case in cross-jurisdictional, cross-operator, and expeditionary deployments where no single operator controls every node along the path.

The hop-history-as-signed-chain construction distinguishes the primitive from store-and-forward designs that record forwarding events as out-of-band telemetry. Here the hop history is part of the message itself and is admissibility-relevant; a tampered or absent hop history makes the message inadmissible at the receiver under the same evaluator that checks the originator's signature.

Disclosure Scope

The disclosure covers the primitive across mobile-platform classes where continuous backhaul is unavailable or operationally undesirable. Disclosed deployment contexts include maritime mesh between vessels operating outside cellular coverage, agricultural mesh between equipment operating across fields without infrastructure, mining mesh between haul trucks operating in pit and underground environments, expeditionary defense mesh operating in deny-comms or low-comms environments, rural-utility mesh operating across distribution networks without cellular density, and disaster-response mesh operating across infrastructure that is intermittently or permanently degraded.

The disclosure includes the admit-carry-emit chain, the signed hop history, the credentialed buffer with eviction record, the FEC framing across the disconnected interval, the temporal-scope handling, the opportunistic contact discovery, the multi-hop segment composition, the cross-credential carriage with cross-recognition, and the composition with the broader spatial-mesh primitives. The disclosure does not depend on a particular radio modality, a particular framing format, a particular signing algorithm, or a particular routing policy; the primitive is specified at a level of abstraction that admits substitution along each of those axes provided the credentialed-segment integrity property is preserved end-to-end.