IoT device pub-sub and commands

Design the cloud ingestion and command pub-sub layer for an IoT fleet: 20M devices on constrained networks (intermittent cellular, low bandwidth, sleepy devices) publishing telemetry and subscribing to commands. Requirements: efficient on the wire, support at-most-once/at-least-once delivery levels, deliver commands to devices that were offline when the command was issued, and authenticate per-device. Bursts when a firmware push wakes the whole fleet.