Hub Lockdowns

A lockdown is a state in which a Hub refuses to reach its sites because of its license. It is the Hub's counterpart of an engine stopping its channels: a Hub runs no channels, so it stops connecting to sites and acting at them instead. A lockdown is read from the Hub's license and check-in records each time it matters, so it ends the moment its cause clears. Nothing has to be restarted or re-enabled afterward.

What Starts a Lockdown

There are two causes, and either one is enough:

Over the licensed site count: more sites are registered than the Hub's licenses allow, for example after a check-in returns a smaller license. See Licensed Site Count.

Failed check-ins: the Hub has gone 22 consecutive days without a successful check-in to https://www.qvera.com. The Hub warns administrators from the 2nd consecutive day, and warns harder from the 8th, before the lockdown starts.

What a Lockdown Blocks

Connecting to a site: Connect on the Sites Dashboard is refused with a message giving the reason, and the proxy answers every request for a site with HTTP 403, a bookmarked site address included. Console sign-in through the Hub goes through the proxy, so it is refused too.

Registering a new site: Add New Client, generating its bundle, and a new site's registration with a bundle it already holds are all refused. Re-enrolling an existing site with a recovery bundle is not refused, because it adds no site.

Re-enabling a disabled site: refused while the Hub is over its licensed site count.

Starting a job: a ready job cannot be started, with the message New jobs cannot start during a Hub lockdown.

Running jobs: paused by the Hub until the lockdown clears.

• No new step starts at any site, and no new site starts. A step already sent to a site finishes, and the Hub keeps asking the site how it went.
• A wait for a length of time keeps counting. A wait until a clock time that comes due during the pause carries on once the pause ends.
• Continue past a checkpoint is not available while the job is paused.
• The Hub writes a JOB_PAUSED audit event with the reason a Hub lockdown. When the lockdown clears, it resumes the job and writes JOB_RESUMED.
• A job that an operator also paused stays paused after the lockdown clears, until someone clicks Resume. Clicking Resume during the lockdown leaves the job paused until the lockdown clears.

Rolling back a site: a rollback someone asks for during the lockdown, or that was not yet sent when it began, waits until the lockdown clears. A rollback already sent carries on. See Rolling Back a Job Site.

AI calls through the Hub: every call an AI assistant makes to a site through the Hub is refused, with a message that the Hub is in a lockdown and sends no calls to sites until it clears. Tools the Hub answers from its own records, such as listing sites and jobs, still work. Starting a job through an AI tool is refused as it is in the console.

See Jobs and MCP Calls Through the Hub for these features.

What a Lockdown Does Not Block

• Disabling a site is always allowed, and so is deleting a disabled site. Deleting sites is the way out of a lockdown over the licensed site count. A site in a submitted job that has not ended cannot be deleted, so stop that job or let it end first.
• Ending a person's Hub console sessions at sites. When someone loses access at the Hub, the Hub still sends the sites the request to end their sessions.
• Preparing, submitting and approving jobs. Only starting one waits for the lockdown to clear.
• Site tunnels. No site is disabled, and sites stay connected to the Hub.

Ending a Lockdown

• Over the licensed site count: disable and delete sites until the registered count is at or below the licensed count, or contact Qvera to raise the count. See Over the limit.
• Failed check-ins: restore the Hub's access to https://www.qvera.com. The lockdown ends the moment a check-in succeeds.

When both causes apply, Connect and registration refusals name the failed check-ins, because deleting sites restores nothing until a check-in succeeds.