---
id: STATE-PFM-ELG-006
title: Cover arrangement lifecycle
object: DOM-PFM-ELG-004
product_area: platform
module: eligibility
revision: 1
status: draft
design_intent: confirmed
origin: >-
  Responsibilities and attention architecture D-07 (delegation in phase 1),
  approved by Andrew 2026-10-18 (PLAT-M15 "Decisions"); PLAT-M23 D3 for the
  handover notices
implementation_evidence: observed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
states:
  - name: active
    meaning: >-
      A stored-active arrangement covering a personal holding; it is effective
      only within both applicable windows.
  - name: expired
    meaning: 'Its window has ended, although the row can still be stored active.'
  - name: ended
    meaning: The arrangement was explicitly ended and retained.
transitions:
  - from: active
    to: ended
    trigger: endResponsibilityDelegation
    guard: >-
      The caller is original holder, covering colleague or manager and stored
      status is active.
    side_effects:
      - Audit the ending
      - Remove effective cover on the next read
    who: 'Holder, covering colleague or responsibility administrator'
    provenance: observed
    source: >-
      services-platform:modules/responsibilities/services/persistence/delegations.ts:endDelegation
  - from: active
    to: ended
    trigger: Manual ending of its underlying direct or template holding
    guard: A direct or template holding’s manual ending commits.
    side_effects:
      - End its active cover in the holding transaction
    who: Responsibility administrator
    provenance: observed
    source: >-
      services-platform:modules/responsibilities/services/persistence/delegations.ts:endOpenDelegationsOf
  - from: active
    to: expired
    trigger: Current instant reaches cover end
    guard: Current time reaches the arrangement end.
    side_effects:
      - Stop effective coverage
      - >-
        Inactive colleagues are separately logged by reconcile without automatic
        ending
    who: Time
    provenance: observed
    source: 'services-platform:modules/responsibilities/rules.ts:windowIncludes'
invalid:
  - from: ended
    to: active
    why: Ended cover cannot be reactivated in place.
  - from: expired
    to: active
    why: >-
      A passed cover window requires a new arrangement to provide new effective
      cover.
concurrency: >-
  Single cover creation locks the holding; bulk creation inserts its selected
  holdings atomically without an asserted per-holding lock. Ending checks stored
  active status, so a temporally expired arrangement can still be explicitly
  ended.
invariants:
  - INV-DOM-PFM-ELG-004-06
  - INV-DOM-PFM-ELG-004-07
evidence:
  - >-
    services-platform at ad3f6a6:
    modules/responsibilities/services/persistence/delegations.ts; rules.ts;
    db/responsibility-delegations.table.ts;
    services/notices/responsibility-notices.ts; docs/responsibilities.md §5, §6,
    §8.
---
# Cover arrangement lifecycle

## The Lifecycle

```mermaid
stateDiagram-v2
  active --> ended
  active --> expired
```

## Transitions Explained

Cover is temporary accountability and supplies no extra permission. Effective expiry changes reads without updating the stored status. Derived synchronization can leave an active cover row attached to an ended holding, which effective reads exclude.

## What Cannot Happen

Ended cover cannot be reactivated in place. A passed cover window requires a new arrangement to provide new effective cover.

## Concurrency and Timing

Single cover creation locks the holding; bulk creation inserts its selected holdings atomically without an asserted per-holding lock. Ending checks stored active status, so a temporally expired arrangement can still be explicitly ended.