Module transitions 

Transition dispatcher. Routes (state, event) to the per-source-state handler in a sibling module, after performing the universal pre-checks (seq monotonicity, basic structural validity).

Each per-state module pattern-matches the events legal from that source state and returns either the new state + effects, or IllegalForState for events the §3 graph doesn’t permit from that source. The runtime layer is expected to log + drop illegal events (out-of-order retransmits) and rely on Replay-From heartbeat drift-detection (RFC-0005 §4.3) for gap recovery.

Modules

activating 🔒

Transitions from Activating.

converged 🔒

Transitions from Converged. Terminal for this rollout — the runtime creates a NEW HostRolloutState (a fresh record with a new rollout_id) when the channel opens its next rollout. The existing Converged record is read-only history from this point.

deferred 🔒

Transitions from Deferred.

failed 🔒

Transitions from Failed. Legal events:

pending 🔒

Transitions from Pending. Only legal events: LocalActivate (agent side, after long-poll receives Dispatch + cross-check vs manifest) and RemoteDispatchAck (CP mirror, after agent posts to /v1/agent/events). Both drive Pending → Activating.

reverted 🔒

Transitions from Reverted. Terminal until the channel halt is lifted by a new declared SHA (RFC-0005 §3). The runtime creates a fresh HostRolloutState when the next rollout opens for this channel; this record stays Reverted as history.

soaking 🔒

Transitions from Soaking.

Functions

dispatch 🔒

event_name 🔒

Shared utility — variant name for diagnostic strings.

illegal 🔒