Shipping the Means of Refutation: Executable Verification and Field Validation of a Lane-Resolved Mesoscopic LWR Model

Traffic simulation verifies models almost exclusively at the output boundary: parameters are calibrated until outputs match data, and the solver in between is trusted. We treat verification as part of the model instead. An executable apparatus ships with the engine, runs on demand against any scenario, and reports through one status vocabulary — pass, warn, fail and not-exercised, the status that refuses to convert absence of evidence into evidence. Mechanismchecks are computed from output trajectories alone, against each element’s own declared parameters, so they survive any refactoring of the solver. A four-step screening protocol extends the discipline to the data, which must close conservation, localise unmeasured flows and survive physical-impossibility and endogeneity tests before they may judge the model. The evidence offered is not that the apparatus passed but that it failed productively: it caught a dimensional error in inherited reference physics, two load-bearing implementation subtleties, an unmeasured origin carrying 20 000 vehicles/day and a dead sensor in official archives, a vehicle-identity trap in a public trajectory set, and an unbounded-event defect in the engine’s lane coupling. Three instrumented corridors in two countries, rebuilt end-to-end from open detector data, then score 1 280 of 1 312 flow windows below GEH < 5; on identical data a per-lane ablation improves the fit of its own single-stream ancestor and places thecoupling coefficient on a flat optimum, φ ∈ [0.85, 0.95]. NGSIM trajectories then measure what detectors cannot see, and return the lane-commitment distance not-exercised: 94% of exit-bound vehicles enter the section already committed, which bounds the distance below at 378 m instead of estimating it. Replaying the observed vehicles reproduces measured throughput with no calibrated parameter.