Inland waterway and river operations.

The mission

A patrol boat works a long stretch of a major river: navigation checks, water sampling, incident response, and a survey drone flying bathymetry runs and bank inspections from the aft deck. The command centre wants the boat’s position and status throughout, the drone’s feed when it flies, and the survey product in the pipeline without waiting for the boat’s return. On a border river, the job comes with a peculiarity no landlocked operation has: the left bank is one country’s network, the right bank is another’s, and the boat spends all day in between.

What breaks

Cellular coverage follows people, and on a river the people are in the towns. Between them, high banks turn the channel into a trench: the cells that nominally cover the area sit behind tens of metres of earth and rock, and the boat sails reach after reach in radio shadow. On border rivers the failure is administrative as well as geographic — no single SIM covers the passage, because each shore’s carrier serves its own side, and mid-river the strong network changes nationality with the bend. A roaming handset sorts itself out in minutes; a working data session does not survive the swap at all.

The classical answer — a dual-SIM failover box — switches after the outage has already happened and resets every session when it does. And through the genuinely empty reaches, where neither bank offers anything, a conventional link simply drops the data: the survey runs on, the product accumulates, and the pipeline ashore learns about it hours later, all at once, at the quay.

The architecture on this mission

The boat runs one node with SIMs from both shores, bonded into a single encrypted tunnel to the command centre. Every link is probed several times a second, so as the channel bends and the banks trade shadows, weight shifts to whichever shore’s network currently serves — one bank’s carrier holds while the other’s is dead, and the crossover is a rebalancing, not an event. The tunnel address never changes: the command session, the position feed and any open video ride straight across the border stretch without a reconnection, because the endpoint the shore sees is the tunnel, not the SIM of the hour.

The drone treats the boat as its floating ground station: one short hop down to the deck, and the boat’s bond carries it the rest of the way. Short hops beat long ones — the drone’s link survives bank shadow that would kill a direct path to any tower. Through the genuinely empty reaches, store-carry-forward takes over: the survey product queues aboard in priority order, position reports thin to a heartbeat on whatever sliver remains, and when the next town’s cell — or the lock’s — comes over the horizon, the backlog drains, highest priority first. Classes keep the order of sacrifice honest throughout: command and position hold their floor; bathymetry waits its turn.

How the passage unfolds

1. Cast off. The node brings both shores’ SIMs into one tunnel at the pontoon; the drone joins the mesh on the aft deck. The dashboard shows two measured links, not two signal bars.
2. The first reach. The left bank rises and its carrier fades behind the earth; weight shifts to the right bank’s network mid-stream. Nobody in the wheelhouse touches anything — the shift is visible only in the journal.
3. The border stretch. The strong network changes country with the channel. Sessions ride the stable tunnel address across the swap; the command centre sees continuous position, not a reconnection banner.
4. The empty reach. Both banks go dark for the better part of an hour. The drone’s bathymetry run continues; its product queues aboard in priority order while the position beacon rides the last thin sliver of coverage, then queues too.
5. The lock. Waiting in the chamber under a town’s full coverage, the backlog drains — the morning’s survey is in the pipeline ashore before the gates open, flagged frames first, bulk behind.
6. The debrief. The journal holds a per-carrier, per-kilometre record of the whole passage: where each bank’s network held, where both failed, what queued and when it delivered. That chart is the administration’s coverage map of its own river — measured, not assumed.

What each mechanism contributes

• Multi-carrier bonding across both banks — two countries’ networks as one measured tunnel; the stronger shore carries at every bend. Shipped.
• Endpoint roaming — a stable tunnel address, so sessions survive the carrier swaps the border stretch forces. Shipped.
• Mesh relay through the boat — the drone’s short hop to the deck survives bank shadow no direct tower path would. Shipped.
• Store-carry-forward — survey data queued through the dead reaches and delivered in priority order at the next town or lock. Shipped.
• Class floors and the journal — position and command first on thin coverage; a per-kilometre link record of the river accumulating for free. Shipped, classes opt-in.

The honest boundary: Atlas cannot put coverage on a reach neither shore serves — there the guarantee is the queue and the heartbeat, not a live feed, and if the mission needs live video through such a reach the answer is a relay node on the bank or a satellite link joining the bond. The cross-border SIM contracts, the flight approvals over the waterway and the boat itself are yours.

What a pilot should prove

• Session continuity across a full passage including the border stretch — zero re-establishments, from the built-in journal.
• A per-carrier, per-kilometre coverage chart of the river, showing where each bank’s network actually held.
• Drone feed continuity through bank shadow via the boat relay, against a direct single link on the same run.
• Queued survey data delivered complete and in priority order at the next town or lock, timestamped by the journal.

One boat, one long reach, one passage each way. The evaluation format covers the structure.