informed-decision/history/20260909-initial-exploration/state-transitions.md

# Decision Memo state transitions v0.2

Actors: `requester`, `assignee` (current ready step), `party` (any listed party), `subject` (session principal after bind), `system`, `agent`.

Guards:

| Id | Meaning |
|---|---|
| G_STEP | Verb is in `route.steps[current].required_verbs` **or** is a always-on overlay verb for that step kind (table B) |
| G_PRES | `presentation_id` exists, `memo_version` matches, `phase` is `pre_bind` or `bind` |
| G_ACK | All `highlights[required_ack=true]` are in `presentation.acked_highlight_ids` |
| G_MAND | Actor mandate covers `requested_act` + legal/value constraints |
| G_LEVEL | Actor signature meets `step.min_binding_level` and memo `binding_level` |
| G_REASONS | `return.reasons` has ≥1 coded reason |
| G_TARGET | `transfer.to` is a resolvable party with compatible mandate |
| G_ESC | Target mandate is *strictly higher* than current assignee for this act |
| G_NOAGENT | `actor.kind ≠ agent` |
| G_SESSION | `session.status = active` and actor is `session` subject |
| G_HAT | `configure.hat.id` ∈ `awareness.available_hats` and `hat.elevates = false` |
| G_PROMOTE | Field moved from awareness → binding; new memo version; presentations invalidated |

Overlay verbs (always available when status allows, even if not in `required_verbs`): `comment`, `discuss`.  
Requester-only overlay: `withdraw` while not terminal.  
System-only: `stamp`, expiry.

## A. Memo-level status machine

```
                 submit
     draft ──────────────► submitted
       ▲                      │
       │                      │ route.started
       │ edit (ver++)         ▼
       │                 circulating
       │                      │
       │                      ├── first ready step → awaiting_actor
       │                      ├── discuss           → in_discussion
       │                      │                         │
       │                      │                         └── assignee resumes → awaiting_actor
       │                      │
       │                      ├── return            → returned ──requester revises (ver++)──► submitted
       │                      ├── last binding verb → completed (+ outcome)
       │                      ├── withdraw          → withdrawn
       │                      └── due passed        → expired (outcome timed_out)
       │
       └── completed ── new memo relation.supersedes ──► superseded

L0/L1 extra:
  completed + requested_act ∈ {login, elevate}
      → session.status = active   (bound_configuring window)
      → configure / session.ended
      → session.status = ended
```

`in_discussion` is a substate of circulation. It does not reset the step.

## B. Verb × status × step kind

Legend: `✓` allowed · `—` forbidden · `C` allowed and may complete the step · `M` allowed and may complete the *memo* · `S` session-only after bind.

Step kinds are grouped:

- **Weak:** `inform`, `comment`, `review`, `acknowledge`
- **Co-sign:** `mitzeichnung`, `approve`
- **Bind:** `schlusszeichnung`, `sign`, `seal`, `deposit`

### B1. Status `draft`

| Verb | requester | assignee | agent | Effect |
|---|---|---|---|---|
| comment | ✓ | — | ✓ | thread only |
| discuss | ✓ | — | — | stays draft |
| withdraw | ✓ | — | — | → withdrawn |
| accept / decline / acknowledge / return / forward / escalate / configure | — | — | — | not circulating |
| submit (system/requester) | ✓ | — | — | → submitted |

### B2. Status `submitted` / `circulating` / `awaiting_actor` / `in_discussion`

| Verb | Weak step | Co-sign | Bind step | Guards | Status after |
|---|---|---|---|---|---|
| comment | ✓ any party | ✓ | ✓ | — | unchanged (`in_discussion` if was circulating) |
| discuss | ✓ any party | ✓ | ✓ | — | `in_discussion` |
| return | ✓ assignee | ✓ | ✓ | G_NOAGENT G_REASONS | `returned` |
| forward | ✓ assignee | ✓ | ✓ | G_NOAGENT G_TARGET | stays circulating; step assignee replaced |
| escalate | ✓ assignee | ✓ | ✓ | G_NOAGENT G_TARGET G_ESC | circulating; higher step inserted/activated |
| acknowledge | C assignee | C | ✓ overlay | G_NOAGENT G_PRES G_ACK | step complete; memo completes only if this was the last step *and* `requested_act=acknowledge` |
| accept | — | C assignee | **M** assignee | G_NOAGENT G_PRES G_ACK G_MAND G_LEVEL G_STEP | last bind/co-sign step → `completed` outcome=`accepted` |
| decline | — | C assignee | **M** assignee | G_NOAGENT G_PRES G_STEP | → `completed` outcome=`declined` (memo ends; later steps skipped) |
| abstain | — | C assignee | C assignee | G_NOAGENT G_PRES | step complete for this actor; parallel group may continue; if actor was sole bind step → `completed` outcome=`abstained` |
| recuse | ✓ | C | C | G_NOAGENT G_PRES | step unassigned; must forward/escalate or return |
| withdraw | requester only | same | same | not terminal | → `withdrawn` |
| stamp | system | system | system | after a bind disposition or on completion | unchanged |
| configure | — | — | — | not yet bound | — |
| promote | requester | requester | requester | G_PROMOTE | version++; back toward submitted |

`accept` on a **weak** step is illegal. Weak steps take `acknowledge`. That is how Kenntnisnahme stays distinct from Schlusszeichnung.

### B3. Status `returned`

| Verb | Who | Effect |
|---|---|---|
| comment / discuss | any party | thread |
| revise + submit | requester | version++; → submitted; new route from policy |
| withdraw | requester | → withdrawn |
| binding verbs | — | illegal on a returned version |

### B4. Status `completed`

| Verb | Who | Effect |
|---|---|---|
| comment | parties | thread; does not unseal |
| stamp | system | file.stamped / bundle.sealed |
| configure | subject | **S** session hat; see §C |
| promote | requester | not on this version; open child memo |
| accept / return / … | — | sealed |

If `requested_act ∈ {login, elevate}` then `session.status` becomes `active` at the completing accept/acknowledge.

### B5. Terminal `withdrawn` | `expired` | `superseded`

No actor verbs except system `stamp` of the evidence bundle already accumulated.

## C. Post-bind session transitions

Applies when `session.status = active`.

```
pre_bind presentation
    │  actor chooses identity + bind-scope
    │  sees proposed hat / other tenants as AWARENESS only
    ▼
bind disposition (accept | acknowledge)
    │  view_hash covers binding_slice only
    │  awareness_hash recorded alongside, not signed
    ▼
session.active
    ├── configure(hat)           if hat.elevates=false ∧ hat in available_hats
    ├── attempt other scope
    │     requires_new_bind=false → still configure (same bind)
    │     requires_new_bind=true  → emit scope.rebind_required, open child memo
    └── session.ended            logout / expiry / revoke
```

| Event | In `view_hash`? | In `awareness_hash`? | Evidence event |
|---|---|---|---|
| Chosen identity | yes | copy ok | identity.authenticated |
| Chosen bind-scope / tenant of *this* login | yes | copy ok | disposition.recorded |
| Privileges granted *at the gate* | yes | preview ok | disposition.recorded |
| Proposed / last-used hat shown | no | yes | awareness.shown |
| Hat selected after login | no | yes | session.hat_selected |
| Hat with `elevates=true` | must promote | — | promote + new bind |
| Other tenant with `requires_new_bind` | no | listed | scope.rebind_required |

Defaulting the hat to `last_used` or `system_default` is an awareness act. Showing it on the login banner is required for situational awareness and forbidden from silently entering `view_hash`.

## D. Completing a step vs completing the memo

A step completes when the assignee records a verb in that step’s completion set:

| Step kind | Completion set |
|---|---|
| inform, review, acknowledge | acknowledge, return, recuse |
| comment | comment (if so configured) or acknowledge |
| mitzeichnung, approve | accept, decline, abstain, recuse, return |
| schlusszeichnung, sign, seal, deposit | accept, decline, abstain, recuse, return |

The memo completes when:

1. A bind-step `decline` is recorded, or
2. Every required step is `completed` or `skipped`, and at least one completing verb in the memo’s `requested_act` family was recorded, or
3. Requester `withdraw`, or system expiry.

Parallel groups: all members must reach a terminal step status before the next ordinal becomes `ready`.

## E. Illegal combinations (explicit)

- Agent + any binding verb
- `accept` on `inform`/`review`
- `configure` before `session.active`
- `configure` of a hat with `elevates=true`
- `configure` of a scope with `requires_new_bind=true`
- Binding verb whose presentation `phase=post_bind`
- Binding verb whose presentation `awareness_hash` was substituted for `view_hash`
- Mutating `identity_context.binding` after the first bind disposition of that version