A promise to wipe later is only honest if the product says when later has happened.
Lost is a state, not a support ticket
Reporting the object lost now moves it into a distinct lifecycle state. Ordinary use is revoked, while one narrow route remains open so the device can return for its lost instruction.
That ordering is deliberate. Refusing every connection would sound safer, but it would also prevent an offline device from ever receiving the wipe waiting for it.
Wipe on contact
The device receives a versioned lost-mode instruction the next time it checks in. The instruction can wipe local material and make the object identify itself with a chirp. The fleet record keeps requested and reported versions separately.
Until the acknowledgement arrives, the truthful status is wipe pending—not wiped.
What this does not do
SA‑NT does not turn the object into a location beacon. Lost mode is about protecting the person and making recovery explicit, not creating a permanent map of where they have been.
The device work described here is part of the active system programme. It is not a claim that production hardware has shipped.