Oh, I didn't realize you were using a 3rd-party SIM card. You will probably need a 30 second keep-alive with an actual AT&T SIM.
Most cellular devices are basically on a huge NAT port forwarding network.
Your device is not assigned a public IP, and instead one is shared when you're sending data. This includes your Particle device. When it sends data to the Particle cloud by UDP, a temporary port forwarding is set up so the response UDP packet can be forwarded to the Particle device.
With the Particle SIM, the amount of time this port forwarding is kept alive is unusually long at 23 minutes. For 3rd-party SIMs, the is anywhere from 30 seconds to a couple minutes. For Wi-Fi and Ethernet (home and business networks with NAT), we assume 30-ish seconds.
What's happening is that AT&T sees that no data is being sent or received by your device and removes the port forwarding so the port can be used by another customer. The PDP (IP data) session is still up, but that port will no longer work for sending data to the Particle device.
This means that necessarily the cloud can no longer communicate from the cloud side, so functions, variables, events subscribed to on-device, and OTA won't work from the time the port forwarding stopped.
When the device goes to send data again, on the next keep-alive or publish, it will be assigned a new port and possibly IP address by your carrier. The Particle cloud will recognize the port/IP changed, and issue an offline event (because it was offline, but we only just realized it), then an online (because you are now online). This is a lighter-weight synchronization, less than a full handshake but more than a keep-alive.
The reason the cloud doesn't know the device fell offline when the port forwarding was removed by the carrier is that there is no way to know this. Neither side is notified, so the only way we know is when we get a port/IP change, full reconnection, or we've missed two 23-minute keep-alive packets. If we get no cellular data after around 46 minutes we mark the device as offline. Offline occurs around a minute for Wi-Fi devices, which have a 25-30 second keep-alive. Setting a different keep-alive doesn't affect the offline indicator timeout.