Native installation licence
EPAdmin licensing requires installation:manage. GET /v1/license/status reports the native installation state. The native protocol uses Ed25519 trusted issuer roots, installation/machine binding, signed sequence/expiry and protected clock state. Creating an Admin or holding an Orbit account does not issue a native grant.
Import and online activation
The import form accepts a signed JSON envelope at /v1/license/import as {license: ...}. The online activation form sends a one-time authorized vendor credential as {token: ...} to /v1/license/activate. Online endpoints, egress and issuer trust must be genuinely enrolled; upstream source does not supply a universal public activation service or default production root. Never load a private issuer signing key on a customer server.
Clock recovery
If the native status reports clock-anomalous/restricted state, use /v1/license/recovery-request to obtain the installation-bound challenge. Send it privately through the authorized issuer process. A genuine short-lived signed recovery grant is submitted to /v1/license/recover as {recovery: ...}. Importing arbitrary JSON, changing the server clock or deleting sequence state cannot replace the issuer's authorization.
Effects of restriction
A valid cached native grant lasts only until its signed expiry. Missing, invalid, expired or clock-anomalous state restricts new licensed management actions. Existing hosted workloads and supported export/backup/security/recovery remain available by policy. A licence failure is not authority to delete an account or stop customer data access. Orbit's optional premium adapter adds separate main/addon checks; it does not replace the native licence.
Updates and repair
Signed-update verification and isolated process-update contracts exist in source. Installed production upgrades remain blocked by incomplete full-panel reconstruction proof and update-coordinator acceptance. Menu Control Panel Updates, OS Updates, Security Patches and Update Scheduler remain explicitly unavailable; an Update History destination is not an installer.
Use the exact release's protected installation journal for same-bundle repair. Preserve hostname intent, private configuration, installation keys, sequence state, journals and original failed-operation evidence. A code rollback does not restore database/host effects. Do not copy binaries over services, invent an unattended update command or reset licensing state to force a newer build. Test on an isolated VM with independent recovery before any hosting pilot.