Three nodes in a line
Put three EdgeLance nodes in a line. Alpha can reach Bravo. Bravo can reach Charlie. Alpha and Charlie cannot reach each other at all. Post a message on Charlie, and it appears on Alpha in about 200 milliseconds, marked as relayed through Bravo. Tasks, map markers, and notes travel the same way.
Now cut the link between Bravo and Charlie. Both sides keep working. Operators on each side post, edit tasks, and drop markers, and neither side sees the other's changes. Restore the link and both sides converge in under a second, with a count of what was caught up. Nobody reconciles anything by hand.
No server, so nothing to lose
That behavior falls out of one design decision. There is no authoritative server. Each node holds its own copy of the mission in its own store, with a durable outbox for everything it has written. When a peer is reachable, nodes exchange what the other is missing. When no peer is reachable, the node keeps working and the outbox keeps growing.
The node that loses every peer is the case that matters most, and the one most software handles worst. In EdgeLance an isolated node runs the full workspace: map, chat, tasks, files, and AI. It does not show a spinner or a disconnected banner that blocks work. When any path returns, through any peer, it syncs the backlog and the team's picture closes back up.
This is the design we described when we wrote that the mission ledger has no cloud to cut. The ledger was the idea. A node that survives total isolation and catches up on its own is what the idea looks like in the field.
Trust at every layer
A mesh that relays for its neighbors has to be careful about who its neighbors are. Nodes join a mission only when an operator approves them, and membership is pinned. Links between nodes use mutual TLS 1.3 over QUIC, so each side proves its identity before anything moves. Every event is signed and chained to the ones before it, so a relayed message can be checked against its original author and a gap in the chain is visible.
Revocation is immediate. Revoke a node and its links go dark. Anything it writes after that stays on the node. If the revocation was a mistake, restore the node and its backlog arrives like any other catch-up.
Membership and revocation land in the same signed record as everything else, so a review can show which node joined, when, and who approved it. The full set of controls is on the Mesh capability page and the security page.
Why we built our own
EdgeLance started on a third-party mesh layer, and it served us well for proving the concept. Last week we replaced it with our own. Relay behavior, membership, revocation, and signing are where mission trust lives, and we wanted that code to be ours, written to our threat model, and carried in our own package.
The data plane underneath is transport-agnostic. IP networks, satellite links, Bluetooth, LoRa radios, serial links, and a USB drive carried by hand all feed the same sync. The team uses whatever is available, and the mission does not care which one it was.
The transport list matters more than it looks. Both sides in Ukraine learned that drone and radio mesh is an electronic warfare problem, and the team that can fall back from one link type to the next keeps its picture.
Design for the cut
Every program says it supports disconnected operations. The useful test is simple. Pull the plug on one node in the middle of a mission and watch what the operator on that node can still do. If the answer is "wait," that tells you what the software was really designed around.