Liveness observed by the server

The requirement

• A guard who stops moving is noticed after five minutes during a patrol and fifteen on a shift with no patrol running. Control is told fifteen minutes after that.
• A guard must not be able to bypass idle detection by keeping the app open without interaction.

Why the device cannot judge

• If the phone decides it is idle and reports it, a phone face-up on a desk with the screen awake is a guard at work.
• A phone that has died reports nothing, including that it has died.
• The device reports activity: a movement, an interaction or a position fix. The server reads the time of the last one from duty_sessions.last_activity_at and concludes idleness from the gap.
• A foregrounded screen and a heartbeat do not count as activity.

Why location pings are not the signal

• A guard at a static post sends a fix every interval and has not moved in an hour.
• A guard walking a perimeter with location permission denied sends nothing and is fine.
• Liveness read off the ping stream reports the first guard as healthy and the second as collapsed, and escalates a privacy choice as an emergency. A position fix counts as activity only when the position changed.

Idle and unreachable

• Idle: the application is reachable and the guard is not moving.
• Unreachable: nothing arrives at all, because the app was killed or the battery died.
• A heartbeat separates them and never satisfies the idle threshold. Its absence is a signal of its own: “the app has been gone for twenty minutes” is a different dispatch decision from “he has not moved for twenty minutes”.

The sweep

• Runs continuously against open duty sessions.
• Idempotent, like the missed-check-call sweep: the second run must not raise a second alarm.
• Escalation does not end the duty session. The alert goes to control, which decides whether to book the guard off. Booking off because the phone went quiet would erase the record of hours they were there.

The distance threshold

Whether a fix counts as a changed position depends on a distance threshold. Below GPS drift, a phone on a desk reports movement every interval, and the device's own noise bypasses the check. Above the distance a guard covers in a slow patrol, a walking guard counts as idle.