Before you touch anything

Confirm the gateway's own state before and after every section below.

$ ssh edge-gateway 'systemctl is-active bootstrap-agent.service gateway-agent.service; \
    curl -s --unix-socket /run/bootstrap-agent/api.sock http://localhost/v1/status'
active
active
{"interface_version":1,"agent_version":"8df05ff-20260914T115157Z","state":"ready",
 "attestation_mode":"tpm","profile_version":163971955832716,
 "last_checkin":"2026-09-15T09:43:21Z"}

state is the agent's own vocabulary (no_config / bootstrapping / ready / error — internal/localapi/state.go), not the platform's. There is no literal active value here; ready is its healthy terminal state and is what "the gateway is up and serving a profile" means.

Also confirm TPM2_PT_HR_TRANSIENT_AVAIL hasn't dropped — a leaked TPM handle outlives any one command:

$ ssh edge-gateway 'tpm2_getcap properties-variable | grep -i transient'
TPM2_PT_HR_TRANSIENT_AVAIL: 0x2

Placeholders used throughout this site

edge-gateway is an SSH config alias, not the device's real hostname — the device's own identifiers (hostname, EUI, serial, TPM fingerprint, organisation) never appear on this site. 8df05ff above is a git build SHA, not device identity, and is shown because §1 is specifically about identifying which build is running. Where a command touches device or org identity instead, the examples use placeholders ($DEVICE_ID, $TID, an all-0/x EUI).