- Spool before acknowledge
- The device is acknowledged only after the batch is fsynced to disk. A crash between the two loses the acknowledgement, not the data: the device retransmits and ingest deduplicates. This ordering is protected by a regression test that fails if it is ever reversed.
- Idempotent ingest
- Deduplication on (device, recorded timestamp). At-least-once delivery is the transport contract; exactly-once accounting is the observable behaviour.
- Per-vehicle-day regeneration
- The engine recomputes an entire day rather than appending to it, so late data and reruns refine a single row. Running it twice produces an identical report.
- Bounded, crash-safe spool
- Segments roll at a size limit and are deleted only once every byte in them has been forwarded. Rotation only ever creates or deletes whole files, so a crash mid-rotation is recoverable from a directory listing — no manifest to corrupt.
- Poison isolation
- A batch that can never parse is quarantined with its original bytes, the reason and a timestamp, and the queue behind it keeps flowing. Nothing vanishes silently; a human inspects and resubmits.
- Listener hardening
- TLS and per-source admission control, fail-closed on partial configuration — configure half of it and the listener refuses to start rather than quietly serving plaintext. Device provisioning is an IMEI allowlist, because the protocol authenticates by IMEI alone.