The warrant lifecycle

A warrant is only ever in one of nine states, and every move between them is a named transition that either succeeds or leaves the warrant exactly where it was.

draft ──open──▶ held ──verify──▶ verifying ──┬── pass ────────▶ released
                                             ├── partial ─────▶ partially_released
                                             └── fail / grey ─▶ escalated
                                                                  │
held / escalated ──deadline──▶ expired            escalated ──────┴──▶ released
held ──cancel──▶ cancelled                                             refunded
any settled state is terminal

The nine

Transitions are the only way in

Every state change runs through one transition() with an optimistic lock on the warrant's version. Two consequences worth designing around:

The first is that an illegal move fails loudly rather than corrupting anything. Releasing an already-refunded warrant returns invalid_state, not a second payment.

The second is that concurrency is safe by construction. Two verifiers finishing at the same moment cannot both settle: the second sees a stale version and loses. version is on every warrant response for exactly this reason — it is how you tell whether the thing you are looking at is still current.

No path leaves funds held forever

Every warrant carries a deadline, and expiry is a real transition rather than a cleanup job that might not run. If nobody verifies and nobody decides, the deadline fires and the money goes back to the payer. That property is what makes holding funds acceptable at all: the worst case is a delay, never a disappearance.