Measuring is not enforcing: a licence check that never stops your work

Software companies have a bad habit when it comes to licences: the check that proves you are entitled to something becomes the switch that takes it away. A seat count drifts over a limit at four in the afternoon and a warehouse stops scanning. Nobody planned that outage; a spreadsheet caused it.

We have just built the machinery that could do exactly that — a register of every Rutba deployment, what it runs and who uses it — and the first thing written into it is that it never refuses anything.

What we could not answer

Until now our backend could say what a customer had bought and roughly what their installation held. It could not say which installation actually serves them, what version it is running, which hostnames it answers on, or which background workers stand beside it. The service that once answered some of that had been retired, and the console screens that asked it had been dead ever since.

The obvious fix — go and look at the boxes — does not work here, and the reason is the product. Not every Rutba runs on our machines. A self-hosted installation sits behind somebody else’s firewall by design, so an inventory built by polling would be an inventory of the deployments we can reach, which is the least interesting subset.

One round trip, both halves

So it is the other direction. A deployment already talks to us to validate its licences; it now uses the same trip to say what it is: its domains, its databases and which engine they are, the apps from its own manifest, the workers beside it and what they are allocated. The answer that comes back says what it may run.

Four rules make that safe to run unattended:

• Nothing here creates a customer. An organization named in a report we have never heard of is skipped and counted. A deployment holding a valid token could otherwise invent customers, and telemetry is the estate describing itself, not a door into the customer register.
• Absence is not deletion. A domain, database or app that stops being reported is marked missing and kept. That row is exactly how an operator finds out a box stopped serving something; a sweep that deleted it would erase the evidence somebody came looking for.
• A repeated report changes nothing. Each report carries an id we remember, so sending it twice only moves the “last seen” time. At-least-once delivery is all a deployment behind a flaky link can offer, so a repeat is the normal case rather than an error.
• The wire contract is pinned. Report and answer are both fixed in the contracts pack, with a worked example of an unlicensed app being withheld — and the blocked list empty beside it.

Two questions that are not the same question

What a box may run and what a customer may run look alike and are not. “Does this machine run the video studio at all?” is an operational decision somebody made about the machine. “Did this customer buy HR?” is a commercial one, and the licence already knows the answer.

So they are two separate records. The commercial one is derived from the licence and only ever overridden by hand; the operational one is only ever set by hand. An operator’s switch survives a licence being reissued. A licence-derived row does not, because it is a copy of the licence, and a stale copy of a licence is worse than no copy at all.

What happens when it does not match

An app running that nobody bought, a seat count past what was paid for — the register sees both. What it does about them is deliberately mild: the reconciliation runs daily rather than per request, what it finds is notified, and where somebody has chosen it, metered onto the same usage machinery every other billed thing already uses. The deployment carries on serving.

There is exactly one setting that refuses service, it has to be set deliberately on one deployment or one customer, and the estate is not allowed to default to it. That is the difference between a licence that is measured and a licence that is enforced, and it is the same rule our billing already follows: one unit, one rater — count carefully, charge once, and never let the counter become a switch.

Measuring is not enforcing. A number that can turn itself into an outage is not a measurement, it is a trap with a dashboard.

Why this matters if you are the customer

• No surprise lockouts. Going over an allowance produces a conversation and, at most, a charge — never a stopped shift.
• Support knows what you are running. Which version, which hostnames, which workers — without asking you to send screenshots of a terminal.
• Self-hosting stays self-hosting. Your installation reports what it is; nothing reaches into it, and nothing about your records leaves it.