Subscription resilience and offline operation
Understand Finetic signed operating leases, offline grace, capability-based expiry, active playback continuity and the boundaries of the provisional commercial policy.
The intended subscription promise#
Finetic is being built as subscription software, but a temporary internet or Finetic entitlement-service outage should not interrupt a household that already holds a valid signed operating lease.
Your media, catalogue, accounts, history, configuration and backups remain on your server. Entitlement controls the continued use of subscription capabilities; it does not transfer ownership of your data or delete it.
Separate dates with separate meanings#
Finetic keeps commercial and operating deadlines distinct:
| Date | Meaning |
|---|---|
| Paid through | The date covered by the subscription or approved private access |
| Payment grace until | The bounded period in which a payment problem may be corrected |
| Offline lease until | The latest signed date the installation can operate without another successful entitlement contact |
| Effective valid until | The authoritative signed deadline the runtime enforces |
These periods are issued by the entitlement service. The server does not add another local grace period when the signed deadline arrives.
Normal refresh and offline operation#
A healthy installation normally attempts to renew its signed lease every 12 hours. The default private-preview offline lease is 14 days. Requests use jitter and exponential backoff so installations do not all retry together, and refreshes become more frequent during the final 72 hours.
The runtime keeps the last valid lease when it encounters:
- DNS or network failure
- An unavailable entitlement service
- An HTTP error
- A malformed response
- An invalid signature
- An older entitlement version
Only a valid, newer, installation-bound, correctly signed entitlement can replace the cached lease.
Fetch candidate entitlement
|
+-- request failed --------------------> keep current lease; retry later
|
+-- signature or identity invalid -----> keep current lease; show warning
|
+-- version or dates move backwards ---> keep current lease; show warning
|
+-- valid, newer signed entitlement ----> store atomically; update capabilities
What happens after the signed deadline#
Finetic uses capabilities rather than a single on/off switch.
| Capability | Active or grace | Expired or revoked |
|---|---|---|
| Start new playback | Available | Blocked |
| Finish existing playback | Available | Available |
| Continue an active transcode | Available | Available |
| Create a new guest share | Available | Blocked |
| Administer the server | Available | Available |
| Renew or recover entitlement | Available | Available |
| Create, verify or restore backups | Available | Available |
| Export data and view diagnostics | Available | Available |
| Download software updates | Entitlement-dependent | Blocked |
| Start ordinary background analysis | Available | Blocked |
An expired installation does not erase data, hide the administration interface or require a rescan after renewal. Once a valid entitlement is installed, affected capabilities return immediately.
Active playback is protected#
Playback that already has an authenticated server session may finish. Direct-file ranges and existing HLS assets remain readable, and an already-started transcode may continue producing segments for that session.
A request claiming to be recovery does not bypass subscription enforcement merely by including a client-generated identifier. Finetic verifies that the server already owns a live playback session for the same media item before treating a replacement source request as continuation.
Signed leases and time integrity#
Each installation creates its own Ed25519 identity and proves possession of the corresponding private key when requesting entitlement. A signed lease is bound to that installation and includes an entitlement version, signing-key identifier, release channels and installation allowance.
To reduce clock-manipulation risk, the runtime retains the latest verified server time, the monotonic elapsed time since verification, the highest accepted entitlement version and the latest accepted paid-through date. An implausible clock change produces an administrative warning and does not silently roll entitlement backwards.
Revocation is exceptional#
Normal cancellation, a failed payment, an internet outage and an unavailable licensing service are not all treated as revocation. Revocation is reserved for explicit exceptional action such as a compromised installation credential, refunded or fraudulent access, or deliberate duplication of installation identity.
Even when revoked, Finetic preserves administration, subscription recovery, backup, restore, export and diagnostics.
Continuity planning#
Finetic intends to provide a credible vendor-disappearance path using a continuity public key embedded in customer installations and separately controlled signing material with documented release conditions. That operational and legal arrangement is not yet complete and should not be treated as a currently available guarantee.
Before public subscriptions are sold, the final continuity mechanism, release conditions and verification process will be documented here. This section is deliberately explicit so an intended safeguard is not presented as an already established service.
What the entitlement service receives#
Entitlement renewal uses an opaque customer subject, installation identity, application version, platform, architecture, release channel and check result. It does not require media titles, file paths, local users, viewing history, playback events or server analytics.
See Privacy and data boundaries for the complete destination map and Private installation and updates for release delivery.