Both keys stay live until the last holder has switched.
The agent in your network takes a new key from the processor to the four holders, in the order the model wrote, and checks each one's next call.
Each holder proves the switch with one read-only call to the processor from inside itself. The settlement job runs at night, so its check runs on demand.
The old key goes off once the processor's key report shows no call with it for two minutes.
- No window bookedthe run starts when the approver said
- Old key offafter all four use the new one, at 11:09
- Before the first runthe processor switches on its key API or a second key slot
Card authorization goes first, because it is the one that stops payments.
The model orders holders worst first, so a fault shows while the old key is still live. The approver sees the order before signing.
- New keyfrom the processor, checked with one read-only call
- Card authorizationwritten and confirmed at 11:01
- Disputeswritten at 11:02, its first call accepted at 11:03
- Nightly settlement jobits check run on demand, accepted at 11:05
- Deploy pipelinevariable written, group read back; old key off, register updated
In the trial, one sync stopped for good at its token's max TTL, and another replaced a whole variable group.
So the plan the model writes has the agent read each destination before writing, and read it again after.
A sync that cannot sign in will not carry the new key, and a group replaced whole can lose the 13 variables nobody meant to touch.
If a check fails, the agent puts that holder's previous key back, stops, and tells the approver.
- Production cluster sync signed in recently; token outlasts the change
- Settlement job's secret only the key's entry changes
- Deploy pipeline variables 14 there, one changes, read back after
