Sentinel: the picture of what is out there, with its uncertainty kept.

Members of a net each hold every other member's latest value, a newer one replacing it and a withdrawn one gone, in memory only.

A device can sign what it records and keep a chained log of it, so a later reader can tell whether an entry was cut out, swapped or changed.

Since 5 November 2026: tracks from many sensors with their uncertainty, contradictions kept rather than resolved, contact loss reported, and four identity states; a machine may raise suspicion, and only an authorised person's signed confirmation reaches “threat”. Tested on simulated feeds: in our tests two formations of drones crossing through each other kept every track on its own drone. Its confirmed tracks can be handed to a force's existing command systems as Cursor-on-Target events.

Since 5 November 2026 each sensor is judged against the others: one whose positions are consistently off, one that reports what nobody else sees, and one that has gone quiet are each flagged for the operator. Nothing is switched off automatically.

Since 5 November 2026 the track core is measured on repeatable simulated scenarios (drones that turn, arrive and leave; sensors with noise, a steady offset, missed detections, false plots, echoes and outages) by the standard scores of the tracking literature, over many runs with their spread, so a change that makes the picture worse is caught before it ships. Simulated feeds are not real ones.

Since 5 November 2026 a track is marked corroborated only when sensors that do not share a mast or a data path, and are of different kinds, have seen it recently, so one faulty or deceived sensor cannot confirm a track alone. Corroborated means better seen, never a threat by itself.

Since 5 November 2026 each track's path is kept, compressed within a stated error, with the sensors that saw it, and can be handed over signed by the station: evidence of where an object flew that nobody can quietly change.

Since 5 November 2026 tracks that fly together, near each other and alike in speed and heading for several seconds, are shown as one group, with when it formed, where it is and where it is going. A group is never a threat for being one: only a person decides that.

Since 6 November 2026 a coast station or a ship can check the AIS reports it receives, which nobody signs, against what is physically possible, against each other and against its own sensors. It names an identity that is not a ship's, a position no ship could have sailed to, one identity in two places, a renamed vessel, a report its own sensors do not see, a contact with no AIS, and an area where several ships' positions jumped together, which is how satellite-navigation spoofing shows. A fleet's own vessels can sign their reports, so a report falsely sent under their name is named. Each finding is for a person to look at; nothing is declared hostile.

Since 5 November 2026 an authority's warning (an incoming drone, an air raid) reaches devices signed, and a device shows only a warning it could check itself: from an office allowed to warn, for its own area, still in force. An update replaces it and a cancel ends it, even a cancel that arrives first.

Since 5 November 2026 a station learns where and when aircraft normally appear in its airspace, how fast and which way they fly, and flags a new track that is unusual for its place, its hour, its speed or its direction. Rare is not hostile: only an authorised person declares a threat. Tested on simulated traffic; a real normal needs real traffic.