The machine proves itself against itself.

13 organism tests

• T1

  signal

  Normal trip

  Demand → authority → dispatch → delivery → evidence → economics → books. Freight never enters SSDF treasury.

  Demand · Authority · Dispatch · Evidence · Economics · Books

• T2

  signal

  Radio failure

  App unavailable → SMS. Same CommunicationRecord. Driver confirms. Trip updated. The hop is not the product.

  Radio · Trip

• T3

  signal

  Authority failure

  Candidate match + live hop, no appointment → SEND HALTS. A hop is not a grant. Online is not authorized.

  Reality · Authority · Radio

• T4

  signal

  Mid-trip revocation

  Grantor revokes during an active trip. Future restricted actions halt. Evidence and observation are preserved.

  Authority · Radio · Evidence

• T5

  signal

  ELD failure

  ELD live → disappears → last-known held → dispatch halt → radio may continue → reconnect reconciles.

  Reality · Authority · Radio

• T6

  signal

  Commercial discrepancy

  Accepted $3,200 vs confirmation $2,950. Detected. Dispatcher decides. No silent overwrite.

  Economics · Authority

• T7

  signal

  Real problem

  Cole: facility 45 minutes. Radio → CommunicationRecord → Trip → detention → evidence candidate → human.

  Radio · Trip · Evidence · Command

• T8

  signal

  Exit

  Carrier leaves. Exit pack includes communications. Revoke. Access changes. Records remain attributable.

  Exit · Authority · Radio · Books

• T12

  signal

  Integration drop ≠ revoke

  ELD disconnects. Last-known held. Dispatch halt. AuthorityRecord still active. Radio may continue.

  Integration · Authority · Reality

• T13

  signal

  Revoke ≠ disconnect

  Grantor revokes AUTH. Adapter stays connected. Observations still ingest. Execution halts.

  Authority · Integration

• T14

  signal

  Observation ≠ authority

  A live telematics event becomes a Canonical Observation. grantsAuthority is always false. No AuthorityRecord is created.

  Integration · Authority

• T17

  signal

  Connect ≠ authority

  Connecting an adapter produces an IntegrationRecord and an adapter credential. No AuthorityRecord. DISPATCH still halted.

  Integration · Authority

• T18

  signal

  Offboard ≠ revoke

  Adapter offboarded. Credential dropped. Last-known held. AuthorityRecord still active. Execution still governed by AUTH, not by the adapter.

  Integration · Authority

Failure proofs

• T9

  signal

  Two dispatchers

  Two operators write the same trip within 30 seconds. First write stands. Second is recorded, not applied. Spine is not corrupted.

• T10

  signal

  Webhook missing

  Processor reports paid. Webhook does not arrive. Invoice stays issued. Treasury does not invent cash.

• T11

  signal

  Offline ≠ unauthorized

  Cole offline still has software authority — send fails for no hop, not for no grant. Marcus online with no appointment — send halts for authority.

• T15

  signal

  Unverified webhook

  Bad signature is rejected. Nothing enters the spine. The machine does not ingest on trust.

• T16

  signal

  Duplicate event

  The same providerEventId is ingested once. The second write is recorded as duplicate, not a second observation.

Failure lab — live desk

These write the actual operating layer. Watch Command, Dispatch, and Radio change state. Failure has a known transition, a degraded mode, a human-visible record, and a recovery.