# V2 Offline License Cache

V2 offline license caching lets verified owners allow play without internet for
7 days after last successful platform API ownership verification. The cache is
an offline-only grace path for previously verified owners; it never creates
ownership by itself and never extends an entitlement without reconnecting to the
platform API.

## Cache Policy

`V2/ue/Build/DRM/v2-offline-license-cache.json` defines per-provider cache
policy for Steam, EGS, Microsoft Store, Mac App Store, PlayStation Store, Xbox
Store, and Nintendo eShop. Every provider uses the same maximum offline window:
7 days after last successful verification.

Each cache entry is encrypted, device-bound, platform-account-bound, and tied to
a signed receipt fingerprint. The cached record stores only the minimum release
evidence needed for the client to prove that a prior online verification
completed successfully, plus `lastVerifiedAt`, `expiresAt`, and the provider
cache namespace.

## Expiry And Tamper Handling

The offline cache requires a monotonic clock check and a server revocation floor
from the last online verification. Clock rollback, cache decryption failure,
receipt fingerprint mismatch, account mismatch, or expiry moves the client to a
repair prompt without crashing.

While the client is offline, ranked access stays disabled and progression grants
are queued until online verification succeeds again. Reconnect refresh is
required before the 7-day window can be extended.

## CI Gates

`V2/ue/Tools/plan-v2-offline-license-cache.py` emits the deterministic offline
license cache plan. `V2/ue/Tools/check-v2-offline-license-cache.py` validates
the manifest, planner output, license verification dependency, Horde wiring, CI
workflow wiring, and this runbook.

Required release gates:

- `drm-offline-license-cache-plan-generated`
- `drm-offline-license-cache-provider-coverage`
- `drm-offline-license-cache-max-window-days`
- `drm-offline-license-cache-encrypted-device-bound`
- `drm-offline-license-cache-expiry-guardrails`

The max-window gate enforces the configured 7-day offline cap, and the expiry
guardrail gate requires non-crashing expiry, monotonic clock, and revocation
floor handling for every provider.