Signal gaps: the silence story

What this chapter covers

Trucks on the corridor go dark — GPS dead zones, cellular holes, overnight sleep, and, occasionally, a jammer or a cut power line. A signal gap is how the engine represents silence as a first-class fact instead of a frozen dot. This chapter covers when a gap opens (and the important case where it deliberately does not), what evidence the engine gathers while a truck is dark, how it decides what happened once the truck returns — including the careful handling of a truck that reappears far away — and what the operator sees at each stage.

The picture

The behavior

When a gap opens

The engine watches the online-fix clock — the last time a usable GPS fix arrived, which a heartbeat with no coordinates does not advance. When the silence on that clock passes a threshold, a gap opens. The threshold depends on what the truck was doing when it went quiet:

• Moving — 10 minutes. A driving truck should report often; a short silence is already suspicious.
• Standing or unknown — 30 minutes. A stopped truck reporting less is ordinary, so the engine waits longer before calling it a gap.

The gap is timed from the last online fix, not the fix that revealed the silence — so its start reflects when the truck actually went dark. Whatever the truck was doing at that moment (moving, standing) is frozen onto the gap, to be used later when deciding what the silence meant.

A gap can open two ways. The reactive path opens it the moment a fresh fix arrives and shows the clock has been silent too long. The proactive path — a background sweep every two minutes — opens it for a truck that has sent nothing, because no fix will ever arrive to trigger the reactive path on its own.

The parked-truck exception: no gap for a sleeping truck

A wired-ignition truck parked overnight cuts its ignition and heartbeats only once an hour to save power. Its online-fix clock goes silent for an hour at a time — and that is completely normal. Opening a gap for it every night would cry wolf.

So the engine suppresses the gap when three things hold together: the tracker is a wired-ignition model, its ignition has been debounced off (held off past the flicker window, not a single stray sample), and the silence is still within the parked-sleep ceiling of one hour. A sleeping truck is understood as sleeping. The moment any of those fails — a non-wired chatty device, or an ignition-on truck, or silence past the ceiling — the suppression lifts and a real gap opens. Deep-sleep-capable models get their ceiling stretched further, to at least twice their configured sleep-reporting interval, so a device that heartbeats every 90 minutes is judged against its own rhythm.

Two flavours of silence

Every gap opens with a reason that captures how the truck went quiet, because it changes what the silence probably means:

• GPS-denied-while-alive — the tracker is still transmitting (a heartbeat arrived within the last 10 minutes) but its location fixes have stopped. The device is alive; only its eyes are shut. This is the signature of a GPS dead zone or active jamming.
• Observability loss — the tracker has stopped transmitting entirely — the device itself has gone silent, nothing left to observe.

Evidence gathered while a truck is dark

A gap actively gathers evidence while it is open. Every frame that arrives during the silence — status frames a GPS-denied truck keeps sending — is folded into the gap's evidence: whether GNSS reported itself unavailable, whether the factory defense defense flag dropped, whether a vibration alarm fired, whether the truck switched to internal battery. The engine also captures the two boundary frames that matter most: the last frame before the truck went dark (its state as it left — power present or cut, alarms quiet or latched) and the first frame on return (a tamper or jamming flag still set on recovery corroborates a hostile blackout). It notes the fuel level before and after, so a tank that lost fuel during the dark is visible.

Every signal is kept as a strict tri-state — reported true, reported false, or never reported — so that absence never raises an alarm. A device that simply never sends a defense flag is treated as unknown — neither tamper-free nor tampered.

How a gap resolves

When a usable fix returns, the engine decides what the silence meant, in this order of trust:

1. The plausibility cap comes first. If the straight-line distance across the gap implies a speed no truck achieves — above 200 km/h — the return reads as a transport event (the truck was shipped on another truck), a device hot-swap, or a GPS spike, and the gap resolves as relocated, overriding everything else.
2. Buffered evidence then wins. If the return is physically plausible and the truck replayed stored fixes from inside the gap window, the trip and stop machines have already reconstructed what it was doing. The engine trusts that reconstruction over any guess from the return fix alone.
3. Distance and frozen activity. Otherwise the engine reasons from how far the truck moved and what it was doing when it went dark: a moving truck that reconnects nearby after a short silence drove through; a truck that barely moved, especially with GNSS reported denied or ignition off throughout, stayed parked; a large displacement points toward relocation.

The three outcomes carry different confidence: parked-during-gap is high confidence (the truck simply sat there offline), drove-through is medium (offline but moving), and relocated is low (offline and moved an implausible distance). A large jump does not resolve immediately — it drops into the deferred path below, where the engine waits for a second fix before it will believe the truck teleported.

Deferred relocation: confirm before you believe it

A truck that reappears far from where it went dark is the trickiest case. The first return fix might be a genuine relocation — or it might be a single bad fix that will vanish on the next reading. Accepting it immediately would teleport the truck on the map and close its trip on the strength of one possibly-spurious point.

So when a large jump appears, the engine defers. It marks the gap ambiguous and waits for the next usable fix to break the tie:

• If that next fix is back near the original spot, the jump was a false reading — the truck was parked all along.
• If it is away from the original spot, the relocation is confirmed.

While the engine is deferring, it shows the map dot at the unconfirmed candidate so the operator sees the possible new location, but it keeps the frozen last known position as the anchor it will fall back to. If no confirming fix arrives — the truck stays silent — the engine waits at most one more batch or 30 minutes, then sets the unconfirmed candidate aside: the gap stays open, the display reverts to the frozen last-known spot, and the gap is flagged as an unconfirmed relocation candidate. It never silently commits to a jump it could not verify.

Backfill recovery

Sometimes the hole fills in later. A truck that was dark for two hours dumps its buffered fixes when it reconnects, and those fixes land inside the already-open gap window. If the return did not already trip the impossible-speed cap, the engine uses the reconstructed movement to resolve the gap as drove-through, and the diary gains the trip that happened during the outage. The silence is retroactively explained by the data that was merely delayed.

Security signatures at close

At resolution the engine checks the gathered evidence for a hostile signature, which overrides the ordinary classification:

• Tampering suspected — a hardware defense or vibration alarm fired, or the jamming signature (GPS denied while alive and the truck physically moved during the blackout), or fuel dropped while a tamper flag was set (a fuel-loss-in-the-dark signal). A hardware alarm is high confidence; an inferred jammed-and-moved pattern alone is medium, since it could be a transport event.
• Power off — the truck's external power was already cut when it went dark, with no tamper alarm to escalate it. The device stopped because it lost its supply, not because it slept. This requires a positive power-absent reading — a device that merely lost coverage or ran its backup battery flat while still plugged in never trips it.

What the operator sees at each stage

• A confidently-parked truck going quiet shows "Stationné — dernière position connue" — the calm parked state, no alarm — because a report-by-motion truck sending nothing while parked is expected. A GPS-denied gap on such a truck keeps it parked but tints the freshness amber.
• An alive truck with its engine on but no fix shows "Sans GPS" in amber — a real GPS failure or jamming, not a normal park.
• A truck that stopped transmitting entirely shows offline, and once its heartbeat clock passes the threshold the liveness sweep raises a device-offline alert.
• A jammed-but-alive truck raises a distinct GPS-jamming-suspected alert — the device keeps heartbeating, so the device-offline alert stays silent, and without this the operator would get nothing for an actively-jammed vehicle.
• On return, a gap that closed with a tamper signature raises a tracker-anomaly alert that auto-resolves as the gap ends — the tampering window is already over, so it delivers its warning and clears itself on the same close; a very long gap raises an extended-offline alert; and the device-offline alert auto-resolves the instant any message proves the tracker is back.

Edge cases

• A future-skewed heartbeat during a gap. The freshness test that separates GPS-denied from observability-loss is clamped against clock skew, so a tracker stamping a frame in the future cannot fake "still alive" and mask a real transmission loss.
• A historical gap processed long after the fact. When old telemetry is reprocessed, the engine looks for the pre-gap boundary frame within three days of the gap's own start, not three days before now — so a gap from last month still resolves against the frame that actually preceded it. A gap whose last prior fix is older than that gets no boundary frame rather than an arbitrarily ancient one.
• A relocation that never confirms. A truck that jumps and then goes silent has its candidate set aside after one extra batch or 30 minutes: the gap stays open, it is flagged as an unconfirmed relocation candidate, and it is shown at its frozen last-known spot — the engine records its uncertainty rather than hiding it.
• A gap that never closes cleanly. A gap left open longer than a week is closed by a background sweep as an unknown, low-confidence outcome, so no truck carries an eternally-open silence.
• Innocent silence is never an alarm. Parked sleep, a flat backup battery with main power still present, or a plain coverage hole satisfies none of the security triggers, so it falls through to the ordinary parked or signal-loss classification. Only a positively-reported anomaly escalates.

Known limitations

A gap is a story assembled from what a silent truck happened to reveal before and after the dark. That shapes what the engine can and cannot promise.

• A resolution is a confidence-ranked reading. Parked, drove-through, and relocated each close with an explicit confidence — high for a truck that plainly sat still, medium for one that moved while offline, low for an implausible jump. The engine states how sure it is; a low-confidence outcome is a best inference, and it is labelled as one.
• Absence of a signal is never treated as an alarm. Every security signal is kept as a strict tri-state — reported true, reported false, or never reported — and only a positively-reported anomaly escalates. The deliberate cost is that a tampering that produces no positive signal at all — no defense drop, no vibration, no fuel loss, no jammed-and-moved pattern — resolves as ordinary silence, not as tampering. Korido would rather stay quiet than cry wolf on a device that simply went dark.
• An unconfirmed relocation waits for a second fix before it is decided. When a truck reappears far away and then goes silent before a second fix can confirm the jump, the engine holds the gap open, reverts the display to the frozen last-known spot, and flags the candidate as unconfirmed. It records the uncertainty rather than committing to a teleport it could not verify — which means such a gap can stay open until a later fix or the weekly safety-net sweep settles it.

How it connects

• The online-fix clock, the liveness semantics, and the parked / "Sans GPS" / offline display come from Part 2 — Telemetry and the vehicle-state memory.
• A mid-trip gap that resolves as drove-through keeps a trip alive; parked or relocated closes it: Trips.
• Fuel lost during a dark window feeds the tamper signature and fuel-loss story: Fuel.
• Device-offline, jamming, tracker-anomaly, and extended-offline alerts reach people through Part 6 — Fleet intelligence.