Appendix L. Institutional invariants and state-transition matrices
Normative RTracer substrate specification section.
Concept & directionLNK
#L1. Required state machines
Institutional role
DRAFT -> EVIDENCE_PENDING -> ACTIVE
ACTIVE -> RESTRICTED | SUSPENDED | DISPUTED | EXPIRED | REVOKED
SUSPENDED | DISPUTED -> ACTIVE only through a new review decision
Common case
INTAKE -> VALIDATING -> OPEN -> INVESTIGATING
INVESTIGATING <-> AWAITING_PARTY
INVESTIGATING -> DECISION_PENDING -> DECIDED
DECIDED -> NOTICE_PENDING -> NOTIFIED -> APPEAL_WINDOW -> FINAL
APPEAL_WINDOW -> APPEALED -> REVIEWING
REVIEWING -> AFFIRMED | MODIFIED | VACATED | REMANDED
Any nonterminal state -> WITHDRAWN | DISMISSED | STAYED
FINAL -> REOPENED only through a separately authorized decision
Registry clearance
UNREQUESTED -> QUERYING -> ASSERTIONS_COLLECTED
ASSERTIONS_COLLECTED -> REVIEW_READY | CONFLICTED | STALE | INCOMPLETE
REVIEW_READY -> CLEAR | CONDITIONAL | BLOCKED | INDETERMINATE
Any new relevant assertion invalidates the prior clearance projection
Insurance claim
NOTICE_DRAFT -> SUBMITTED -> ACKNOWLEDGED -> INVESTIGATING
-> COVERAGE_PENDING -> ASSESSMENT -> REPAIR_AUTH_PENDING
-> REPAIRING -> INSPECTING -> SETTLING -> CLOSED
Any reviewable state -> DISPUTED | APPEALED | WITHDRAWN
Repair
PROPOSED -> ESTIMATED -> AUTHORIZED -> IN_PROGRESS
IN_PROGRESS -> SUSPENDED | COMPLETED
COMPLETED -> INSPECTED -> RELEASED
Changed scope, amount, parts, or procedure -> AMENDMENT_REQUIRED
Moderation
RECEIVED -> TRIAGED -> PRESERVED -> REVIEWING
REVIEWING -> NO_ACTION | ACTION_PROPOSED
ACTION_PROPOSED -> DECIDED -> NOTIFIED -> APPEAL_WINDOW -> FINAL
Emergency: RECEIVED -> TEMPORARILY_RESTRICTED -> MANDATORY_REVIEW
-> REPLACED_BY_DECISION | LIFTED | EXPIRED
Guardian authority
PENDING -> ACTIVE
ACTIVE -> SUSPENDED | DISPUTED | EXPIRED | REVOKED
SUSPENDED | DISPUTED -> ACTIVE only through new verification
Tax
CONTEXT_OPEN -> INPUT_COMPLETE -> DETERMINATION_PENDING
-> QUOTED -> ACCEPTED_FOR_TRANSACTION -> DOCUMENT_PENDING
-> DOCUMENTED -> RECONCILED
Any state -> INDETERMINATE | DISPUTED
Incident
DETECTED -> TRIAGED -> DECLARED -> CONTAINING
-> CONTAINED -> RECOVERING -> MONITORING -> CLOSED
TRIAGED -> FALSE_POSITIVE | MERGED
Any post-declaration state -> EXTERNAL_COORDINATION
CLOSED -> REOPENED through a new decision
Market integrity
SIGNALLED -> TRIAGED -> MONITORING | CASE_OPENED | DISMISSED
CASE_OPENED -> INVESTIGATING -> DECISION_PENDING
-> ACTIONED | CLEARED -> APPEAL_WINDOW -> CLOSED
Auction halt: REQUESTED -> ACTIVE -> RELEASED | CANCELLED#L2. Invariants H-45 through H-80
| ID | Invariant |
|---|---|
| H-45 | Institution identity, brand, title, or declared role creates no authority. |
| H-46 | Every institutional action binds a current functional-role assignment and explicit grant. |
| H-47 | An authenticated external response proves source and bytes, not physical or legal truth. |
| H-48 | No response, unavailable response, or NO_MATCH never means no lien, restriction, or title conflict. |
| H-49 | Stale, conflicted, or indeterminate institutional inputs cannot authorize R3/R4 effects. |
| H-50 | Native issuer values remain preserved; normalized values are versioned derivations. |
| H-51 | Every high-impact case has one named accountable principal. |
| H-52 | Every decision binds policy digest, evidence checkpoint, authority, exact scope, and reason codes. |
| H-53 | Case state changes append; decisions and evidence are never edited away. |
| H-54 | Notice disclosure is minimized and does not improperly expose reporters, victims, or protected signals. |
| H-55 | Appeals create new review records and cannot mutate the challenged decision. |
| H-56 | Reviewer independence, deadlines, and remedies come from pinned policy packs. |
| H-57 | Registry identity, title interest, encumbrance, restriction, seller authority, and clearance remain distinct. |
| H-58 | Payment, custody, possession, or profile control cannot satisfy title clearance. |
| H-59 | New relevant registry evidence invalidates dependent clearance projections. |
| H-60 | Platform clearance is scoped and time-limited, never universal legal truth. |
| H-61 | Coverage is never inferred from an active-looking policy, payment, telemetry, or relationship. |
| H-62 | Loss assessment, estimate, authorization, execution, release, and reimbursement remain distinct. |
| H-63 | Work outside authorization scope or cap requires an appended amendment. |
| H-64 | Insurer, assessor, and repairer access only explicitly authorized projections. |
| H-65 | Moderation actions have exact targets, policy basis, accountable decider, and review interval. |
| H-66 | Emergency restrictions expire automatically unless replaced by a reviewed decision. |
| H-67 | Unknown or indeterminate age invokes the selected child-safe default. |
| H-68 | Guardian assertion neither authenticates the guardian nor grants an action by itself. |
| H-69 | Exact birth data is excluded from public, ad, agent-context, and training projections by default. |
| H-70 | A management team is not a principal; membership is not authority. |
| H-71 | Every responsibility assignment has exactly one accountable principal. |
| H-72 | Delegation and subdelegation can only attenuate scope. |
| H-73 | Offboarding, expiry, and missed handoff invalidate dependent dispatch decisions. |
| H-74 | Policy-separated proposer, reviewer, approver, close, and reconciliation roles cannot collapse. |
| H-75 | Tax quote, invoice, journal, withholding, remittance, and authority status are distinct. |
| H-76 | Accounts and journals never net across legal account holders or currencies. |
| H-77 | Every tax result names producer, ruleset, input digest, limitations, and effective time. |
| H-78 | Incident changes append; response access is scoped; closure needs recovery evidence and owned actions. |
| H-79 | Market-integrity signals are private evidence, never guilt, reputation, or automatic adverse action. |
| H-80 | Exclusion, restriction, and halt require attributable decisions and serialize against auction close. |