# Availability and outages

An issuer outage prevents new sign-ins and token refresh. A management or network outage can interrupt current eligibility delivery. Products may continue protected workforce access only while their last verified signed receipt remains valid, at most 60 seconds from issue.

## Product behavior

Poll the lifecycle feed every 15 seconds. Apply through the signed receipt head before accepting it. If the feed fails, a sequence gap appears, or a receipt expires, close protected workforce routes until recovery and catch-up. An application can still serve public information or unrelated anonymous flows. Local sign-out should remain possible without fresh eligibility.

## Delivery behavior

Approved governance actions are queued with durable work. `pending` means the product has not confirmed application. A product acknowledgement moves the exact projection toward effective status. Mail's `queued` or `sent` message state is not proof that a holder received it; failed or ambiguous delivery leaves an invitation or recovery incomplete.

## Recovery procedure

Restore the failed service or connectivity, validate its issuer and signing keys, request a signed snapshot if the product's cursor is invalid, apply it transactionally, resume ordered events, then acknowledge the committed sequence. Reopen protected access only after a fresh receipt and local permission check. Operators should inspect `/v1/operations/diagnostics` and project diagnostics for stuck work and acknowledgement lag.

Availability targets and recovery times require measured drills in the deployment's private runbooks. A documentation page is not evidence that a production target has been met.