Durable planning pipeline and trusted commands

The system of record is Postgres 17 on Supabase, with more than 100 migrations and row-level security on all 70 public tables (119 policies); every row is keyed by company. Commands take one of two paths. Four Deno edge functions (truck commands, the worker, truck projection and load economics) handle transport and authentication only; services hold the business meaning, and repositories run SQL in one transaction.

Newer features call about 46 Postgres functions from the Next.js server, with their rules in SQL. One idempotency implementation serves the core command families (truck, driver, dispatch, booking and assignment): it serialises on the command id, checks digest, type and actor, and fails closed when evidence is missing, so a retry never applies twice and a rejected command leaves nothing behind.

Route planning is a durable asynchronous operation: a pg_cron job claims work every 15 seconds into an outbox, and a worker hands it to a Node planning host, which calls the Python engine of Route Optimizer, a separate system, through the versioned ro-planning-intent-v2 contract. Results become route plans, with explicit attention and quarantine paths.

The planning host runs a pinned, archived Route Optimizer build with a recorded rollback; cross-system tests run against fixed Route Optimizer checkouts. Multi-company isolation is in place and a demo is hosted.