ADR-004 Release via evidence state machine
| Status | Accepted |
| Date | 2026-09-20 |
Context
A cron that checks last_seen > 90 days and sends everything is simple and wrong. Silence has many causes: travel, a dead phone, a missed email, a provider outage, an abusive person hoping for a trigger. Titip’s differentiator is a presence process that collects evidence and can always return to active when the owner confirms.
Decision
Life check and escalation are one state machine, specified in TITIP-006 and TITIP-007.
- Transitions emit domain events. Workers do not hide transitions in timers without a persisted state.
- Eligibility requires
life_check_unconfirmed,grace_period_elapsed, andtrusted_contact_confirmedfor the frozen policy version. - Owner confirmation from any non-terminal state returns the cycle to
ACTIVEand cancels eligibility for that cycle. - Policy documents are immutable versions. The open cycle does not change version mid-flight.
release.automaticis false. Eligibility creates a candidate. It does not deliver. Delivery approval is ADR-005.
“Inactive” is the name of an operational condition inside this machine. It is not a legal or medical finding.
Consequences
- Schedulers are more work than a single query. That work is the product.
- Demos must use the same states as production, in simulation mode, or they will not be evidence of the design.
- Later automation may reduce manual review only by a new ADR that states the residual risk. It may not delete the evidence requirements.