Sharing is sender-authored at egress. A node decides, per peer, exactly what shape of its picture to expose. "You may see my vessels, but you may not target them" is enforced on every action, with a cross-organization audit trail.
Each edge's policy decides what crosses, fail-closed per record, with a per-edge discipline filter withholding anything the edge did not agree to carry.
A track's classification and releasability land as sent and bind onward. An operator raises a marking freely and lowers it only with authority, never below the source.
Areas, lines, danger zones, and routes cross exactly or as a mention. A received no-fire area refuses the receiver's engage act.
Shape, sign, chain, send.
Link up, it exchanges signed bundles.
Deterministic ordering under partition needs an anchored physical clock and a hybrid logical clock.
Every outbound picture is shaped per peer, signed by the node's own key, chained into a release manifest, and queued per edge.
A subordinate's acts taken while its commander's node is down are delivered with their instant on reconnect; an abort taken in the dark binds nothing.
A peer eight days dark drains its backlog and rejoins with no hand-run database work.
A verified signature proves who sent a track, not that it makes sense. Implausible data is stored, never trusted onward.
A tenant pins any federation edge to a subset of its own geography.
Two people form a federation edge in the product, with no ceremony script.
A TAK server is added from the console; included missions appear as read-only TAK missions in the edge's group.
Bring us the mission the seams keep breaking, and we'll show you where the substrate holds. Submissions are validated server-side and routed through INSTOPCO's operational channel.