What was actually built

Almost everything still unbuilt in the specification was waiting on the same thing: knowing who someone is. That now exists. Passwords are hashed with scrypt, and the cost parameters live inside the hash, so raising the cost in two years quietly re-hashes each password at the next sign-in rather than locking everyone out. Two-factor is not optional for administrators — an admin password on its own opens nothing. Recovery codes exist and are spent once each, because without them a lost phone ends with somebody turning two-factor off "temporarily", which is the exact failure it was there to prevent. Sessions are revocable immediately rather than at expiry; a lost laptop cannot wait an hour. The sign-in form never reveals whether an address has an account: a wrong password and an unknown address return the same sentence, and an unknown address still pays the hashing cost so the response time does not answer the question either. The audit log has no edit and no delete anywhere in the code that touches it — the same rule the product applies to compliance records.

FleetRan is on its own domain. Behind that, the piece that mattered more: an application is no longer a row nobody can see. A fleet or an investor signs in and finds where their application actually is. The specification describes two vocabularies for this — one the applicant reads, one the team works in — and the tempting build is two fields. That build ends with a portal saying "Qualified" while the pipeline says "New", and nobody able to say which is true. There is one stage, the internal one, and what the applicant sees is derived from it. The team moves it once. The investor data room follows the same rule as the rest of the site: it does not open by default, it opens when a person approves access, and every document in it says what state it is really in. Three say "Not started", because they are. An investor should not discover during diligence that a listed document never existed.

It is useful to know whether an investor we are talking to has actually opened what we sent, so a conversation can start from where they are. It is also the point where a site quietly turns into surveillance. The line we drew: only people who created an account and signed in, only actions they took on purpose — opened the data room, started the demonstration, asked for a meeting — and nothing at all from anonymous visitors. No time on page, no cursor, no pixels. A visitor who runs the whole demonstration without an account leaves no trace, and we tested exactly that. The engagement level shown to the team is computed from those recorded actions, carries the reasons that produced it, and is never sent to the investor. A number without its reasons is not a measurement. Writing this turned up something that had to be fixed before anything else: the privacy page still said this site sets no cookies. That stopped being true the moment accounts existed. It now says there is exactly one, that it appears only after you sign in, that it holds a random value and nothing readable, and that no account means no cookie. A privacy page that is out of date is worse than none, because people believe it.

Until now the data room listed what each document was and honestly said none of it could be downloaded. It can now, and the interesting part is what happens in between. A file is never linked to directly. Every download goes through a route that checks who is asking, checks whether that person may see that particular document, fetches the file, stamps a confidential header with their name and the date, records the download, and only then sends it. A link copied out of the page and passed to someone else does not work — the next person gets their own check and fails it. If access is withdrawn tomorrow, yesterday’s link stops working too, because the check happens on every request rather than once when the link was made. What the header does not do is worth saying plainly: it does not prevent redistribution. A screenshot defeats it. What it changes is that passing a document on becomes a decision rather than an accident, and leaves a trace if someone does it anyway. Paired with a download log nobody can edit, that is the actual value — not the stamp itself.

The public demonstration runs six trucks. That is enough to show what the interface does and not enough to show why it is built the way it is. The argument for exception-first is that past a certain size you cannot look at every truck — and at six you obviously can. An approved investor now gets fifty, and the header stops reading like a claim: eight require attention, five are short on hours, and nobody is going to scan the other forty-two. The part worth insisting on is that nothing else changed. Same engine, same rules, same events, more rows — a test asserts a scenario produces identical events at six trucks and at fifty. A separate demonstration mode with its own prepared data would have demonstrated a presentation trick rather than the product. The generated fleet is deterministic too, so someone who closes the page and comes back finds the same trucks rather than a new fleet. Two things the tests caught. Trucks generated as "at risk" were not actually at risk — their remaining hours still covered the trip, so the label was decoration. The generator now derives the arrival estimate the same way the engine does and sets the hours below it. And the header said twenty-five trucks while the map drew fifty; two numbers disagreeing on one screen is the exact failure this site keeps trying to avoid.

First public surface for FleetRan: homepage, ecosystem view, hardware inventory with honest status badges, the commercial release countdown and the interactive demo shell. Every hardware component carries the status it actually has — candidate, prototype, research required — because a website that overstates the hardware is the fastest way to lose a fleet operator.

The terminal on the homepage is no longer an illustration. Eight product renders of the Driver Terminal — Home, Active Load, Navigation, HOS, Vehicle Health, Trailer, Arrival and Maintenance — are cut from the same canonical screen rectangle and mounted over one device plate, so the bezel never flickers and only the software changes. The truck is a looping video rather than a still.

The roadmap is now public with all twelve milestones, their target dates and their real status. Progress is counted from deliverables that are finished, not typed in by hand — a percentage without a definition of what 100% means is an impression presented as a measurement. The roadmap is versioned, and revisions stay on the page rather than being quietly overwritten.

Both registration paths are live, with the full field sets from the website specification. One decision is worth stating plainly: the FleetRan database is a later milestone, so until it is connected these forms do not pretend to succeed. A form that shows a green tick while saving nothing loses the lead and tells no one — so when storage is unavailable the page says so and gives an address that reaches a person.

A grid of product cards read like a parts catalogue. The hardware section now leads with the truck itself, with each component anchored where it is actually installed — terminal on the dash, gateway on the vehicle bus, cameras at the windshield and mirrors, node on the trailer. Hovering a component highlights its place on the vehicle. The cards remain underneath as the technical drill-down, each one opening what is settled and what is still an open question. Statuses are now the Product Bible terms — candidate, planned, research required — shown as a small indicator rather than a coloured band.

Shipping the registration forms created an obligation the footer had already made: policies published before the site accepts anything. They are written from what this site actually does rather than copied — it sets no cookies, runs no analytics, stores nothing in your browser and serves its own typeface, so the privacy page can say so plainly. Privacy and terms are marked as drafts until counsel reviews them, because a legal document nobody has checked should not present itself as final.

Fifty-five capabilities are now listed on one page, each with the status it actually has. Thirteen can be touched in the demo today. Six are in development. Twenty-nine are planned. Seven are still open research questions with no answer. Publishing that distribution is uncomfortable and is the point — a fleet that discovers the gap at installation is a fleet you never get back. Where a status alone could mislead, the entry says why: the hours-of-service view is a demonstration and not a compliant record, failure prediction is deliberately not called predictive maintenance, and parking availability needs a data provider that is not contracted.

The simulator now has the two controls it was missing. Next event jumps forward to the moment something happens instead of asking a visitor to sit and wait, and the jump runs through the same tick as normal playback — a shortcut that skipped it would produce a state the system could never actually reach, which a test now guards against. View as switches emphasis between the fleet owner and the driver, but keeps both surfaces on screen on a wide display, because the point being demonstrated is that an action in one appears in the other.

The Command Center page had three fixed numbers making an argument about scale. It now has a control that moves a fleet from 10 trucks to 1,000 and lets a visitor watch what happens: the list of exceptions grows, the wall of trucks does not. Two decisions kept it honest. Small fleets never round down to zero, because reporting "no problems" at ten trucks would be a lie by rounding. And the closing argument changes below fifty trucks — at that size you really can look at every truck yourself, and claiming otherwise would be a sales line rather than a demonstration.

Measuring rather than assuming turned up three things. The simulator was mounting on the homepage, so every visitor downloaded it whether or not they wanted a demo — a dynamic import does not help when the component mounts immediately, so it now sits behind the same click as the demo page. All eight terminal screens were loading at once for images shown one at a time; they now arrive as the cycle reaches them. And the WebM version of the hero video turned out to be larger than the H.264 one at this resolution, while being listed first — so browsers that preferred it were served the worse file. It is gone.

Testing at 360, 414 and 768 pixels found the navigation pushing 758 pixels past the edge of the screen on every page, and the hardware scene pushing 1,184. Two causes, both instructive. The navigation had no mobile treatment at all — it now wraps onto its own row instead of running off. The hardware labels get their position from an inline style, and inline styles beat stylesheets, so switching them to static positioning was the only thing that would make the browser ignore those offsets. Touch targets were 14 to 15 pixels tall in the footer and navigation; they are now tappable on a coarse pointer, while links inside sentences stay inline where they belong.

The milestone listed thirteen deliverables while the website had far more parts than that, so the bar was measuring a summary rather than the work. It now lists all forty-five: foundation and governance, brand, every public page, the interactive demonstration, the truth and compliance content, the quality gates, and the nine things still missing before this site can be published. Thirty-six are done, which puts the real figure at eighty per cent — lower than the old list implied, and correct. The homepage shows the six outstanding items rather than the thirty-six finished ones, because the question a visitor has is what is not ready yet.

The specification is blunt about this: the demonstration must not be hardcoded into the interface. It was — a single fixed timeline sitting in the same file as the fleet, which made adding a second scenario impossible without touching components. Scenarios are now data. There are four, each answering a question a visitor actually has: what an ordinary day looks like, what happens when the hours run out, what a fault looks like before it becomes a tow, and how a missing document gets caught before invoicing. A fifth is a file edit, not a rewrite.

Until now the demonstration could show a fleet but not a job. It can now: a load moves through all fifteen states in the specification, from assigned to completed, and the terminal shows one action at a time rather than a menu of everything a driver could theoretically do. Two of those states are the point of the whole thing. After the truck is loaded, nobody presses "documents" — the terminal has already moved to "Scan BOL". After delivery, the same for the POD. If that took an extra tap we would be demonstrating a form, not a workflow. What the system reads off a captured document is shown as extracted, beside a line saying the original scan is kept unchanged and remains the record; that is not decoration, it is the rule the product is built on. Every step raises the same named event the fleet side consumes, so a driver scanning a POD appears in the Command Center feed in the same second. The paper itself is simulated. The scanner that would produce it in a real cab is a separate question and still open.

The monorepo is set up with the domain model, the design token package and a guardrail script that runs in CI. The guardrails are not style checks: they fail the build when retired palette values reappear, and they exist so that the product rules survive contributors who have not read the Product Bible.