Fleet tracking - 21,600 writes per vehicle per day

Half a million vehicles reporting continuously, and a handful of dispatchers looking at a map. The load and the product are on completely different scales, and the design is mostly about keeping them apart.

Ask these before designing

• How often does a vehicle report, and who decides? 4 s, 10 s and 60 s are the same product and a 15x difference in every number on the capacity page. This is the first question and it is usually answered by a firmware default nobody revisits.
• What is the history FOR? A map replay needs 30 s. A harsh-braking score needs 1 s. A collision reconstruction needs 10 Hz accelerometer data this board does not even carry. Downsampling is irreversible, so this question must be answered before ingest, not after.
• Does the customer see live, or recent? "Live" means a push channel and a write path that cannot lag. "Within a minute" means a poll and a much cheaper system.
• How long must data be kept, and by whom is that mandated? Tachograph and hours-of-service rules put a legal floor under retention that no amount of cost engineering may go below.
• Is the vehicle ever offline? Long-haul trucks lose signal for hours. Either the device buffers and back-fills - which means out-of-order arrivals of thousands of points - or the history has holes. Both are real designs; only one of them is usually considered.
• Per-customer retention, or one global policy? Per-customer is the right answer commercially and the expensive one architecturally, because it makes every partition boundary a per-tenant decision.

Functional

• Ingest positions from 500,000 devices, tolerate duplicates and out-of-order back-fill.
• Answer "where is every vehicle in this map viewport" in under 200 ms.
• Push live position updates to open consoles.
• Replay any vehicle’s track for any day within retention.
• Segment the raw stream into trips (ignition on to ignition off) and daily rollups.
• Raise alerts - speeding, geofence-adjacent, idling, harsh braking - from the stream rather than from the history.

Non-functional

• Ingest must never reject. A device that cannot deliver retries, and 500,000 devices retrying together is the only real way to take this system down. Accept, acknowledge, and sort it out downstream.
• Last-known position fresh within one report interval (4 s).
• Viewport query p99 under 200 ms with up to 20,000 vehicles in frame.
• Ingest availability 99.99%; console availability 99.9%. They are different numbers because dropping the map is an inconvenience and dropping the stream is a hole in a legal record.
• Writes are idempotent on (vehicle_id, reported_at) - the only defence against back-fill that works.

Explicitly out of scope

Geofence evaluation and enter/exit events (that is the geofencing board), route planning and navigation, driver identity and payroll, video telematics, maintenance scheduling.