AdminConsole
Stateful journeys/Offline & Automotive
statefuldevice release aggregate
Embedded navigation · fleet control plane

Offline automotive release

Manufacture, activate, install, operate, update, recover, and retire a navigation runtime and map-data release as one compatible system.

Open implementation workshop Run verified appExplore lifecycle
Lifecycle state machine

Every state means something operational

A state is not a UI label. It determines which actor may act, what evidence exists, what may be retried, and how recovery proceeds.

01
manufactured

Manufactured

Hardware identity, target architecture, software edition, and vehicle configuration are recorded.

02
activated

Activated

The device has a scoped entitlement and trusted activation identity.

03
installed

Installed

A verified compatible runtime, configuration, voice set, and base map package are staged.

04
operational

Operational

The active slot passed startup, route, search, positioning, audio, storage, and health checks.

05
updating

Updating

A cohort release is downloading, verifying, staging, switching, and qualifying under a durable plan.

06
recovering

Recovering

Watchdog or health policy selected rollback, repair, or safe degraded operation.

07
retiredterminal

Retired

Activation is revoked and the device no longer receives protected packages or service.

Command → decision → event

Transitions are attributable and retry-safe

Commands express intent. The aggregate validates current state and invariants, commits one new version, and emits a fact in the same transaction.

Command & actorAllowed fromResultIdempotency strategy
register_deviceManufacturing system
new aggregate
manufactureddevice.registered

Hardware identity and manufacturing batch form the stable key.

activateFleet release manager
manufactured
activatedlicense.activated

Activation request and entitlement version must be replay-safe.

stage_base_releaseVehicle runtime
activated
installedrelease.installed

Manifest digest identifies the exact runtime-data-config unit.

qualifyVehicle runtime
installedrecovering
operationalrelease.qualified

Qualification result is bound to manifest and test-suite version.

start_updateFleet release manager
operational
updatingrelease.update_started

Device, target manifest, and rollout campaign identify one plan.

rollbackVehicle runtime
updatingoperational
recoveringrelease.rollback_started

Watchdog incident ID prevents repeated rollback side effects.

retireFleet release manager
manufacturedactivatedinstalledoperationalrecovering
retireddevice.retired

Revoke activation and package access under one retirement identity.

Durable records

Persist enough to recover and explain

Keep provider responses, business identity, state, events, and side-effect delivery distinct so each can be reconciled safely.

Device identity

Manufacturing, vehicle, activation, and hardware trust mapping.

deviceIdhardwareIdvehicleIdeditionactivationState

Release manifest

Signed compatibility unit for runtime, data, configuration, and assets.

manifestIddigesttargetcomponentssignaturecompatibility

Update plan

Durable per-device progress through download, verify, stage, switch, and qualify.

planIdcampaignIddeviceIdtargetManifestphasecheckpoint

Health incident

Watchdog evidence, recovery action, and support context.

incidentIdactiveManifestsignalactionoutcomeoccurredAt
Non-negotiable rules

Protect truth at the aggregate boundary

  1. 1

    Runtime, map data, configuration, and voice assets are qualified as one compatible manifest.

  2. 2

    Only a verified inactive slot may replace the active slot.

  3. 3

    Power loss at any update point leaves one bootable known-good slot.

  4. 4

    Activation identity and secrets are distinct from vehicle business identity.

  5. 5

    Retirement revokes protected access without erasing support and release history.

Failure and recovery

Know what to do before it breaks

Recovery changes durable truth only through the same rules as normal operation. A timeout is an unknown outcome, not evidence that nothing happened.

Power loss during update

Detect

Boot control sees an incomplete plan and unchanged or unqualified target slot.

Recover

Boot the known-good slot and resume or discard staging from the durable checkpoint.

Runtime and map package are incompatible

Detect

Manifest compatibility or startup qualification fails.

Recover

Reject before activation and report exact component constraints.

Activation cannot refresh while offline

Detect

Entitlement is near expiry and network is unavailable.

Recover

Apply the licensed offline grace policy visibly; never extend entitlement by changing device time.

New release causes route or crash regression

Detect

Cohort health breaches automated rollout thresholds.

Recover

Halt the campaign, roll affected devices back, and retain incident-linked diagnostic bundles.

Operational telemetry

Observe the journey, not merely HTTP status

Measure state age, event health, retries, reconciliation, and sensitive-data access alongside latency and error rate.

  • Fleet distribution by active and target manifest
  • Download, verification, switch, and qualification duration
  • Interrupted and resumed update phase
  • Activation refresh health and offline grace usage
  • Crash, watchdog, routing, positioning, and storage health by cohort
  • Rollback cause, success, and last-known-good age
Grounded implementation

Contracts, repositories, workshops, tutorials, and runnable evidence

Only explicitly indexed evidence is linked. Empty sections are not backfilled with invented endpoints or package names.