Full spoilers follow. The film's first major revelation is Colter's actual condition. The 'capsule' he returns to between runs does not exist as he perceives it; Colter Stevens was killed in action in Afghanistan, and what remains of him — a partial body kept alive on life support — is wired into the Source Code apparatus. His mental image of the pod is a coping construct his mind generates to make sense of an unimaginable situation. Everything he has been told about going home is, in effect, a lie of omission designed to keep an asset functional.
The second revelation is the bomber: Derek Frost, a fellow passenger hiding in plain sight, whose van outside the station carries a far larger device intended for downtown Chicago. Colter identifies him, and the information passes into the real world, allowing the second attack to be prevented. That is the mission accomplished — and the film's most important move is that it does not stop there.
Colter's final request is twofold: send him in one last time, and afterward, disconnect him. Goodwin, who has spent the film as the voice of protocol, agrees, defying Rutledge's intention to wipe Colter's memory and redeploy him indefinitely. Inside the last run Colter does everything at once — he stops Frost, alerts the authorities, calls his father under Sean's name to say what he never said in life, and then simply stands with Christina, kissing her as the timer expires.
Then the eight minutes end and nothing ends. The train does not explode; the frozen tableau resumes. Rutledge's doctrine that 'Source Code is not time travel' but 'time reassignment' — a closed, unalterable recording — is refuted by the film itself. Colter continues to exist in a branching reality as Sean Fentress, alive, with Christina, walking through Millennium Park toward Cloud Gate. In the original timeline, Goodwin pulls the plug and Colter dies; in the new one he sends her a message telling her that if she is reading it, the Source Code works better than she knows, and that everything is going to be okay.
Retrospectively, the film's structure reveals itself as a redemption arc disguised as a procedural. The details that felt like local color — the spilled coffee, the comedian, the conductor, the father's unanswered phone — turn out to be the actual material of the story, because they are what Colter chooses to spend his last eight minutes on once he understands they are all he gets. Worth noting: earlier drafts ended with Colter's death as final, and the branching-timeline ending was adopted after test audiences responded powerfully to the idea of a continuing reality, which is why the more melancholy version is still legible underneath the hopeful one.