The shells that stopped hitting
In May 2024 the Washington Post published a number that should have ended a decade of architecture debates. Excalibur, the GPS-guided artillery shell, had gone from hitting its target about 70 percent of the time in Ukraine to hitting it less than 10 percent of the time. Russian jammers did that without shooting anything down. They cut the signal the shell depended on.
The shell was the same shell. The factory was the same factory. What changed was the assumption underneath it, that a link would be there when the round needed one. Jamming turned that assumption into a target. So a weapon that costs six figures a round became a dumb shell the moment somebody flipped a switch in a truck forty kilometers away.
Software has the same failure mode. It just hides it better, because software degrades quietly instead of missing a grid square.
Every C2 system assumes a reachable server
The architecture diagram of any command and control system fielded in the last decade has the same box on it somewhere, labeled server. Everything else syncs to it. The clients cache a little and wait for the connection to come back. The server holds the truth. The mission lives in that box.
That worked when adversaries could not touch the link. They can now. CSIS has documented China building out electronic warfare and communications sites near the South China Sea, and Ukraine's front line is saturated with jammers on both sides. In both theaters the lesson is identical. If your mission state lives in a box someone else can make unreachable, your architecture is doing the enemy's work for them.
Degradation is the polite word for what happens next. The map freezes. Tasking issued twenty minutes ago is the newest thing anyone can see. The vendor calls this graceful degradation. But a degraded C2 system in a firefight is a failed one with better marketing.
The mission is a ledger and every node holds it
EdgeLance keeps mission state in a signed, append-only ledger. Every detection and every tasking becomes a signed entry in the log. So does every approval, every chat message, every sensor track. The node that authors an entry signs it, and the signature travels with the entry forever.
Every node in the mesh holds a full copy. Nodes replicate peer to peer over whatever link exists between them. When two nodes that have been separated reconnect, they exchange entries and merge. The merge is deterministic. Two squads that split for six hours and operated independently will reconcile to the same mission state, byte for byte, regardless of the order entries arrive in. That is the CRDT property, and it means the system needs no tiebreaker server because the math settles every conflict the same way on every device.
So there is no authoritative node. Lose the commander's tablet and the mission keeps going on eleven other devices. Lose half the mesh and the surviving half continues with everything it holds, then syncs the rest when links return. Jamming can shrink the mesh. It cannot decapitate it, because there is no head.
Burn rides the same rails
A mission burn is the hard case. When an operator burns a mission, every node that receives the order wipes that mission's data. But the mesh is partitioned by design, and some node is always out of contact when the burn goes out. That node comes back an hour later carrying payloads from a mission that no longer exists.
Burn tombstones handle this. A burn writes a signed tombstone entry into the ledger, and the tombstone replicates like everything else. When the late node reconnects, the merge runs, the tombstone wins, and the stale payload dies on arrival. No operator ever sees the resurrected data. The ledger already knows the mission is burned, so the node wipes the payload before it renders anywhere.
Deterministic merge is what makes this safe. There is no window where a delayed payload can outrank a burn, because ordering comes from the merge itself and a tombstone always sorts above the data it kills. Burn is enforced by the same mechanism that keeps the map in sync. Nothing extra to trust, nothing extra to break.
The ledger rides whatever link is up
Underneath the ledger sits a transport stack that treats every link as temporary. WiFi when the team is close. BLE between devices on a body. LoRa for kilometers of thin-pipe reach. Satellite profiles when a window opens. And a USB-C courier mode for when nothing is up at all, where an operator carries the ledger delta over a cable run between devices. Entries queue when no link exists and move the moment one does. The ledger does not care which transport carried it. Neither does the signature.
A node on a forward observation post logs a detection and signs the entry. Twenty minutes later that node takes a hit and goes dark. But the entry had already crossed to a teammate's device over BLE. That device then sits through a nine-hour jamming window with no RF path at all, so the entry waits in the queue. When the teammate rotates back, the entry moves to the operations center over a USB-C cable. The signature verifies against the dead node's key. The detection enters the common picture with its proof intact, authored by a node that no longer exists, delivered across an outage that never mattered.
Chatham House credits Ukraine's edge to iteration at the unit level, tools rebuilt in weeks to answer what the enemy did last month. The ledger is built for that fight. It assumes the link you have today is gone tomorrow and makes the mission indifferent to which links survive. When the jammers switch on, the only thing that changes on an EdgeLance mesh is which cable an operator plugs in next.