Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.

Versions, approvals and state transitions

Source: architecture rev 3 p. 6; TDD workshop (rev 1.1).

Two independent things are shown separately: the candidate revision’s review states, and the live-version pointer. Editing never takes the live opportunity out of service.

flowchart LR
  subgraph REV[Candidate revision - review states]
    D[Draft candidate] --> S[Submitted exact version]
    S --> AP[Approved candidate]
    S --> RT[Returned for correction]
    RT --> D
  end
  subgraph LIVE[Live-version pointer]
    V1[V1 live]
    V2[V2 live]
  end
  V1 -. stays live while a candidate is reviewed .- S
  AP -->|publish of the approved candidate only| V2

flowchart LR
  NP[Not published] -->|approved version published| LV[Live]
  LV -->|pause| PA[Paused]
  LV -->|close| CL[Closed]

Pause and close are a separate lifecycle, independent of revision review. Reopen and resubmit transitions are not drawn because they are undecided (Q04, Q05); the diagram implements no undefined transition.

• Every sensitive update carries the expected record version; stale writes get a safe conflict and the last approved content stays (T14, T15).
• Editing after approval invalidates that approval; a formal submission binds the approved version and actor authority (T13).
• Material revision (offers, needs, geography, terms, disclosure): V1 stays live while V2 is reviewed, and the live-version pointer moves only when the approved V2 is published; after approval new viewers see V2; each existing EOI keeps V1 and gets its own safe change notice. A meaning-neutral typo needs no material-change alert but still creates a version and needs approval (T21, T22, Q06).
• Self-approval: an entitled owner/admin may approve their own exact version with audit. Contributors cannot. Four-eyes configuration is outside Balanced (T13, Q02).

Lifecycle matrix (proposed, Q04):

Operation	Live	Paused	Closed
Start new question thread	Allowed if entitled	Blocked	Blocked
Reply to existing question thread	Allowed if entitled	Allowed both parties	Allowed both parties (read-only only by explicit DG change to A07)
Submit new interest	Allowed if entitled	Blocked	Blocked
Accept pending interest	Allowed if entitled	Allowed if entitled	Blocked
Use existing accepted discussion	Allowed	Allowed	Allowed
Pending interest display	Current state	Current state	”Closed” in-app, no new email event
Reopen / resubmit terminal attempt	DG transition needed	DG transition needed	DG transition needed

Races (T18, T19, T23): accept versus withdraw is one serialised transition; the loser gets a safe “state changed” conflict. Idempotency binds actor, command, attempt, key and payload; authorise before replaying any stored result. Decline is terminal for that attempt; resubmission needs an explicit Q05 transition.