Liveness observed by the server

The requirement

• A guard who stops moving is noticed after five minutes during a patrol, fifteen on a shift with no patrol running, and fifteen more before control is told.
• A guard must not be able to bypass idle detection by keeping the app open without interaction. That sentence fixes the architecture.

Why the device cannot judge

• If the phone decides it is idle and reports it, a phone face-up on a desk with the screen awake is a guard at work.
• A phone that has died reports nothing, including that it has died.
• The device reports activity instead: a movement, an interaction or a position fix. The server concludes idleness from the gap since the last one, read from duty_sessions.last_activity_at.
• A foregrounded screen is not activity. Neither is a heartbeat.

Why location pings are not the signal

• A guard at a static post sends a fix every interval and has not moved in an hour.
• A guard walking a perimeter with location permission denied sends nothing and is fine.
• Read liveness off the ping stream and the first is healthy and the second has collapsed; a privacy choice is escalated as an emergency. A position fix counts as activity only when the position changed.

Idle and unreachable

• Idle: the application is reachable and the guard is not moving.
• Unreachable: nothing arrives at all, because the app was killed or the battery died. The more alarming of the two.
• A heartbeat separates them. It never satisfies the idle threshold, and its absence is a signal of its own: “the app has been gone for twenty minutes” is a different dispatch decision from “he has not moved for twenty minutes”.

The sweep

• Runs continuously against open duty sessions rather than against a schedule.
• Idempotent, like the missed-check-call sweep: the second run must not raise a second alarm.
• Escalation does not end the duty session. Control is told and control decides; booking a guard off because the phone went quiet erases the record of hours they were there.

Where it stops holding

Whether a fix counts as a changed position depends on a distance threshold. Below GPS drift, a phone on a desk reports movement every interval and the check is bypassed by the device's own noise; above the distance a guard covers in a slow patrol, a walking guard is idle.