The lease
Policy carries an operating lease. While the lease is valid, a verifier that cannot reach the platform keeps working — that is the whole point of offline grace.
Fleet management
Control that survives contact with a real estate.
Devices get lost, staff get replaced, locations close, and firmware drifts. Fleet management is the set of controls that makes those ordinary events boring.
01 · Lifecycle
Four states, and one of them is a one-way door.
Lifecycle policy is versioned and leased. A verifier does not simply believe the last instruction it received; it operates under a policy version with a lease, and it re-authenticates that lease to keep going.
| State | What it means operationally |
|---|---|
| Active | Normal operation. Verification and queue delivery both permitted. |
| Suspended | Temporarily stopped — a device out for repair, or a location closed for the season. Reversible. |
| Quarantined | Held pending investigation. Verification stops; whether the device may still drain its queue is an explicit, separate permission. |
| Revoked | Terminal. The credential is retired and the device cannot be talked back into service by reinstalling, downgrading, or re-running activation. |
Restore returns a suspended or quarantined device to active. There is no restore from revoked — reprovisioning is the only path, and it is deliberate.
02 · Leases and offline grace
An offline device is trusted for a while, not forever.
Expiry is fail-closed
When the lease expires without an authenticated refresh, the verifier stops starting new sessions. It does not quietly extend itself.
Reboot invalidates the clock
A detected reboot, or an unavailable boot counter, makes a cached offline lease clock-untrusted and blocks new sessions until policy refreshes. This closes a reboot/uptime ambiguity; it is not a claim of secure local time.
03 · Versions
Warn at recommended. Block at minimum.
Two version floors, with different force. The recommended version produces a warning so an operator can plan an update. The minimum version blocks verification outright, which is how a fix for a real defect actually reaches a fleet.
Downgrade is not an escape hatch: a held, revoked, lease-expired, version-blocked, or location-mismatched device cannot be walked around by installing an older signed build.
Control Effect
recommended_app_version Warns the operator; verification continues
min_app_version Blocks verification until the device updates
configuration version Convergence is visible per device
downgrade to evade policy not a supported path
04 · Credentials
Rotation without a maintenance window.
Bounded overlap
The new credential is issued while the old one is still valid, for a bounded window. A device that is briefly offline during rotation does not fall out of the fleet.
Durable acknowledgement
The device acknowledges the new credential durably before the previous one is retired, so a crash mid-rotation cannot strand it between two keys.
Retirement, not deletion
Retired credentials are kept as a hash for the audit trail. They are never reusable, and the hash is not a patron-linked record.
05 · Binding
A verifier belongs to one place.
An activated device cannot be reassigned in place. Moving a verifier to a different location requires revoke and reprovision — which sounds inconvenient until you consider what a silent reassignment would do to a location’s aggregate counts and to your audit trail.
What Fleet Health deliberately does not show
Queued event bodies, credential material, mobile-ID data, or anything patron-derived. Diagnostics expose bounded policy and configuration convergence, outbox health, synchronization category, uptime, storage, clock status, rotation status, lease status, and location binding — and stop there.
Run these controls against real devices.
A pilot exercises suspend, restore, rotation, and version enforcement on hardware you can hold.