Operations

Channel Depletion¶

Each device holds N cell secrets (v1: N = 10). They wear down over time — individually, randomly, and sometimes deliberately — and are refreshed in person. This slow depletion is what turns a once-a-term registration stampede into a steady trickle, and what makes deprovisioning automatic.

Why 10, and not 2 or 3¶

The redundancy math is the reason: a device is stranded only if all N cells die inside its response window (pᴺ). N = 10 buys ~eight orders of magnitude of safety margin over N = 3, essentially for free. The "lose all 10 at once" case is real but vanishingly rare — and N is a manifest tunable, so we can push it to 40 and experiment.

Rotation is random and independent¶

Cells rotate on their own schedules, not on a synchronised calendar. The spread over weeks is a statistical property, not an engineered stagger:

With a ~90-day mean lifetime, a device loses roughly one cell every ~9 days.
It reaches a low-water mark (~3 remaining) around day ~63.
At that point the user visits any checkpoint and tops back up to N.

Because each device's clock started at its own enrollment, arrivals self-distribute — no scheduling, no announcement, no calendar dependency.

The checkpoint load this produces¶

10,000 devices ÷ ~63-day cycle  ≈  160 devices/day  ≈  5 desk-hours/day

One continuously staffed checkpoint — versus nine desks during a synchronised registration week. A twelve-fold peak flattened into a trickle.

Devices degrade; they do not fail¶

A device never hits zero by surprise. The client surfaces a fuel gauge — 3 of 10 cells remaining — giving weeks of warning. That is a better failure mode than almost any credential system in production.

graph LR
    A["10 / 10<br/>healthy"] -->|~9 days each| B["...gradual..."]
    B --> C["3 / 10<br/>low-water → refresh"]
    C -->|checkpoint visit| A
    C -.->|suspected key theft| D["fast teardown<br/>3 → 2 → ... in minutes"]

    style C fill:#c1121f,color:#fff,stroke:#8c0c16
    style D fill:#c1121f,color:#fff,stroke:#8c0c16

Deliberate teardown is instant¶

The slow drip is the healthy path. When a key is suspected stolen, the operator does not wait — rotating a cell secret invalidates that cell immediately, taking a device 4 → 3 → 2 in one minute, or to 0 outright if physical compromise is suspected. Slow depletion and instant teardown are two speeds of the same mechanism.

Deprovisioning is passive¶

Leaving the network requires no offboarding

Credentials must be renewed in person. Someone who stops showing up falls off within ~60 days automatically. Graduation and departure need no process. Urgent removal still uses a manifest bump.

Everything here is tunable¶

N, rotation rate, mean lifetime, and the low-water threshold all live in the root-signed manifest. They are expected to change during development — the protocol assumes none of them. Retuning is a signature, not a redeploy.