{"lexicon":1,"id":"money.atmosphere.payment.lifecycle","defs":{"main":{"type":"record","key":"tid","description":"EXPERIMENTAL DRAFT — not published. A MUTABLE CURRENT-STATE sidecar authored by a lifecycle authority for one payment, stored at the SAME record key as the corresponding proof in that authority’s repository (the style-guide sidecar pattern). GENESIS: the record is created AT SETTLEMENT — revision 1, status `settled` — written atomically with the proof (one applyWrites commit), so every proof produced under the lifecycle-authority role has a lifecycle record from birth and ABSENCE at that path is ALWAYS ANOMALOUS: verifiers treat it as a fail-closed alarm (possible deletion or rollback), never as good standing. Deletion is never a valid transition. Discovery is by deterministic path — this record MUST NOT be referenced by persisted strongRef, because updates change its CID by design. It never negates the historical settlement fact: the receipt and proof stand; this record carries present status only. Writes MUST follow the normative lifecycle write algorithm in COMMITMENT_PROFILE.md (genesis via one com.atproto.repo.applyWrites batch of two #create actions — proof + genesis — with frozen precomputed bodies and both-records recovery; every update via compare-and-swap on the exact current record CID; staleness, idempotency, and split-brain rules as specified). `revision` is a DEDICATED per-payment lifecycle counter allocated atomically when the canonical state transition is accepted and frozen into the projection job (never a shared wire-ordering counter). Restoration (e.g. a dispute resolved in the recipient’s favor) is expressed by writing status `settled` at a higher revision. Stateful consumers that have observed revision N MUST treat later observations of a lower revision, an equal revision with a different body, or absence as fail-closed integrity alarms, never as restorations. The lifecycle authority’s canonical authoritative state source remains the operational source of truth; this is a verifiable projection. Each lifecycle-authority producer manages exactly ONE locally authored proof/sidecar path per receipt generation; another authority’s path is a verification-side concept, and multi-managed-path admission by one producer is out of v1 scope (normative in COMMITMENT_PROFILE.md).","record":{"type":"object","required":["proof","status","revision","asOf"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"Exact reference to the immutable money.atmosphere.payment.proof record whose payment this state describes. Its cid is the proof's canonical AT repository-record CID string (lowercase unpadded base32 CIDv1, DAG-CBOR, SHA-256/32)."},"status":{"type":"string","maxLength":64,"knownValues":["settled","refunded","partially-refunded","disputed","reversed"],"description":"Present post-settlement state asserted by the lifecycle authority (kebab-case fixed values). `settled` is the GENESIS state (revision 1, written at settlement) and the restoration state (a higher revision after an earlier non-settled state). State meanings and the ledger-transition mapping (dispute outcomes, refund reversal) are normatively defined in COMMITMENT_PROFILE.md. `transferred` is RESERVED for the future entitlement-transfer flow and is not a v1 value (no writer exists). Open set (knownValues); consumers treat unknown values as an unrecognized-but-present lifecycle event and fail closed for authorization purposes."},"revision":{"type":"integer","minimum":1,"maximum":9007199254740991,"description":"Dedicated, ledger-generated, per-payment lifecycle revision. Strictly increases with every accepted lifecycle transition; frozen into the projection job and reused verbatim on retries. `revision` orders THIS record's writer transition sequence only: stateless verifiers select by category-then-path (COMMITMENT_PROFILE.md) and never compare revisions across paths; regression REJECTION is a stateful-consumer obligation, not a verifier behavior. Named `revision` (not `rev`) to avoid confusion with AT Protocol repository rev strings."},"reason":{"type":"string","maxLength":64,"description":"Optional short machine-readable reason code (kebab-case). Never free text, PII, or processor detail."},"asOf":{"type":"string","format":"datetime","description":"When the lifecycle authority last asserted this state (UTC). Evidence, not the sole ordering authority — the authority's canonical state source orders transitions."}}}}}}