The worker lifecycle

Requested, approved, active, suspended, retired: what each state means and who moves it.

A worker moves through a small number of states. Every transition is recorded, and none of them deletes anything: measurements a worker contributed remain part of the record after the worker itself is gone.

Requested

Somebody has asked to run a worker. Nothing has been issued yet. The request carries who is asking, where the machine is, and what network it is on, because that is what the decision is made on.

Approved

Staff have accepted the request and an enrollment token has been issued. The token is shown once, to the person who requested it, and is not recoverable afterwards. An approved worker that has never enrolled is a token nobody used.

Approval is a real decision rather than a formality: an approved worker's observations move the public health verdict on provider listings, so admitting one to the fleet is admitting a machine whose measurements will be believed.

Active

Enrolled, heartbeating, and contributing measurements. This is the state a healthy worker sits in indefinitely.

Active does not immediately mean influential. A new worker has to establish a record before its measurements carry full weight; see How workers contribute to monitoring.

Silent

Not a state anybody sets: it is what the platform concludes when heartbeats stop. A silent worker is excluded from consensus, because a measurement nobody can date is not evidence about now. It returns to active by itself the moment heartbeats resume.

Silence is common and usually boring: a reboot, a network blip, a host being moved. It is only worth investigating when it lasts.

Suspended

Staff have stopped a worker contributing, without removing it. Its measurements stop counting immediately, its history is kept, and the operator is told. Suspension is reversible and is the right response to a worker producing results that look wrong: it stops the harm without discarding the evidence of what happened.

Retired

The worker is out of the fleet for good, either because the operator uninstalled it or because staff removed it. Its rows stay: the measurements it contributed are provenance for verdicts that were published at the time, and deleting them would make the historical record unexplainable.

What never happens

A worker is never deleted, and no state transition removes a measurement. This is not caution for its own sake. A provider's uptime figure for last March was computed from specific measurements by specific workers, and a record you can no longer explain is not a record.