Section 5 · Section 7
The lifecycle
A ballot package has twelve possible administrative states and a small, fixed set of moves between them. Everything else fails closed and leaves a signed record of the attempt.
Try it
Walk a package through its life
This runs the real transition validator from the engine. Pick a move — the legal ones are listed, and you can force an illegal one to see what the ledger does with it.
Current state
ISSUED
Permitted from here
Not permitted — force one
What the ledger recorded
The twelve states
| State | Meaning | Terminal |
|---|
Every permitted transition
| From | May become |
|---|
Rendered from the engine's own transition table, not typed out beside it — if the code changed, this table would change with it.
The five rules that sit above the diagram
A missing or delayed postal scan cannot cause a rejection. Not by itself, not ever. Mail is late, scans are dropped, and equipment goes down; none of that is evidence about a voter.
Physical receipt establishes RECEIVED even with no postal event at all. The election office having the envelope in its hands is the fact. The barcode is a convenience.
Legal timeliness is a jurisdiction's configured decision. It is never inferred from a scan. Received-by, postmark-plus-grace, hand delivery — the rule belongs to the law, and an authorised official applies it.
SPENT requires acceptance and a dual-controlled separation event. Two authorised officers, both attesting, before a token can be consumed. The engine refuses the spend otherwise, and you can watch it refuse on the boundary page.
Using a terminal-state token produces an exception, not a state change. A photographed envelope
code presented a second time does not quietly overwrite anything. It writes
DUPLICATE_OR_REPLAY_DETECTED and leaves the token exactly where it was.