---
id: STATE-MBR-STR-006
title: Configuration record availability
object: DOM-MBR-STR-006
product_area: membership
module: structure
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
source_sha:
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
states:
  - name: active
    meaning: >-
      Availability is enabled on a program, type, reason or policy set; each consumer decides whether that
      permits new use, and policy sets have no operational consumer.
  - name: inactive
    meaning: >-
      Availability is disabled while retained references remain valid; consumer enforcement is specific to the
      record and operation.
  - name: deleted
    meaning: The current record has been removed after its protected references permit deletion.
transitions:
  - from: active
    to: inactive
    trigger: Staff save activity false.
    guard: The required record version matches.
    side_effects:
      - >-
        The version advances; content changes settle a revision at commit, while an unchanged save adds no
        content revision.
      - Existing references remain intact.
    who: Program or configuration administrator
    provenance: observed
    source: >-
      services-membership:modules/configuration/services/configuration/configuration-records.ts:updateConfiguration
  - from: inactive
    to: active
    trigger: Staff save activity true.
    guard: The required record version matches.
    side_effects:
      - The record becomes available and the version advances; history captures content changes at commit.
    who: Program or configuration administrator
    provenance: observed
    source: >-
      services-membership:modules/configuration/services/configuration/configuration-records.ts:updateConfiguration
  - from: active
    to: deleted
    trigger: Staff delete an active record.
    guard: The supplied version matches and no protected foreign key prevents removal.
    side_effects:
      - Owned child rows are removed; a dependency refusal instead directs staff to retirement.
    who: Program or configuration administrator
    provenance: observed
    source: 'services-membership:modules/configuration/services/persistence/configuration-store.ts:configurationStore'
  - from: inactive
    to: deleted
    trigger: Staff delete an inactive record.
    guard: Version and dependency checks pass.
    side_effects:
      - The current record and its owned rows are removed.
    who: Program or configuration administrator
    provenance: observed
    source: 'services-membership:modules/configuration/services/persistence/configuration-store.ts:configurationStore'
invalid:
  - from: deleted
    to: active
    why: >-
      Reusing a deleted readable identifier creates a new record, rather than restoring the removed record's
      version history.
concurrency: >-
  Conditional writes reject competing stale updates and deletions. An unchanged save still advances the
  version but adds no content revision. Packages are excluded because their activity is supplied by
  Accounting; stored policy-set activity has no processing effect yet.
invariants:
  - INV-DOM-MBR-STR-006-02
  - INV-DOM-MBR-STR-006-04
evidence:
  - >-
    services-membership at 5994c270: modules/configuration/services/persistence/configuration-store.ts;
    services/configuration/configuration-records.ts; aws/api/configuration-routes.ts.
---

# Configuration record availability

## The Lifecycle

```mermaid
stateDiagram-v2
  [*] --> active: activity defaults to true
  [*] --> inactive: explicitly created inactive
  active --> inactive: save activity false
  inactive --> active: save activity true
  active --> deleted: unreferenced at matching version
  inactive --> deleted: unreferenced at matching version
  deleted --> [*]
```

## Transitions Explained

Programs, types, reasons and policy sets default to active but can be created inactive. Saving activity changes availability without removing existing references. A used record is retained through retirement, and deletion removes only an unreferenced record.

## What Cannot Happen

Protected dependencies prevent deletion. Reusing a deleted readable identifier is a fresh creation. The stored lock flag does not block these operations, and activity does not have one uniform consumer rule.

## Concurrency and Timing

Updates and deletions check the version read. Live consumers see new settings on their next read; this does not imply every consumer checks retirement, and stored policy sets remain unused.