deviceAuthenticationHealth

The state of this device's server authentication credentials (docs/device-authentication-health.md), for the application to show or act on. Read-only: never initializes, registers, rotates, recovers, resolves, cancels, creates a key, writes storage or caches anything, and is never called implicitly.

Local state decides first, without asking the server, in this order: several pending transitions → DeviceAuthenticationHealth.Inconsistent; a pending device or last-device recovery → DeviceAuthenticationHealth.RecoveryPending; a pending rotation → DeviceAuthenticationHealth.RotationPending (or Inconsistent without the active key); no active key → DeviceAuthenticationHealth.ActiveKeyMissing. Otherwise reads the registration status once with a request signed by the active key: not registered → DeviceAuthenticationHealth.Unregistered; else DeviceAuthenticationHealth.RotationDue if policy says the key's age (client clock, read once, minus the server installation time, clamped at zero) reached its maximum, and DeviceAuthenticationHealth.Healthy otherwise or without a policy. There is no default policy.

The local state is read again (no second request) after the server answered; a transition that appeared meanwhile is reported instead. Throws SecureMessageClientException.NotInitialized without a local identity or on storage that has not created its first key yet (milestone 12 upgrade), and every transport failure, including SecureMessageTransportException.AuthenticationFailed other than NOT_REGISTERED, as it is.