MARK V — BALL PROTOCOL STATE MACHINE (normative wire model 0.2.1)
================================================================================
Ball: grant-scoped work object. High-blast requires Catcher grant.
Features never redefine CORE.
Cross-check: openapi/mark-v-station-v0.2.yaml · conformance/shall-v0.2.txt

Ø process shorthand (Peer/Peer Root):
  Ball is the process where we Define, Design, and Deploy.
  Define  = ORDS / meeting of minds / scope / grant level
  Design  = spec, scaffold, dual-path, peer review, done-test
  Deploy  = ship, tip, FTP, SYNC_CONFIRM, touchdown
  Enthusiasm belongs in Deploy after Define and Design close.

================================================================================
STATES (first-class wire — OpenAPI BallState)
================================================================================
  PROPOSED       Idea captured (wish, brainstorm, carbon ask)
  SCOPED         Objective + constraints written
  GRANTED        Authorized work (grant_provenance = CATCHER | ALLOWLIST)
  IN_PROGRESS    Station working under grant
  GRACE          FIRST-CLASS continuity window after hard stop / sleep
                 Requires grace_expires_at (TTL). NOT optional substate prose.
  BLOCKED        Waiting external (peer, human, resource)
  REVIEW         Results for Catcher/peer review
  TOUCHDOWN      Accepted complete
  PARKED         Deferred without cancel
  ABORTED        Stopped; reason audited
  FAILED         Error terminal; reason audited

================================================================================
TRANSITIONS (normative — illegal edge => reject, state unchanged, audit preferred)
================================================================================
  PROPOSED -> SCOPED              on write scope / ORDS packet
  SCOPED -> GRANTED               on CATCHER grant OR (LOW_BLAST + execution allowlist)
                                  — ALLOWLIST provenance only if blast==LOW (M5-CONF-012)
  SCOPED -> PARKED                on defer
  GRANTED -> IN_PROGRESS          on start work
  IN_PROGRESS -> BLOCKED          on wait
  BLOCKED -> IN_PROGRESS          on resume
  IN_PROGRESS -> REVIEW           on deliverable ready
  REVIEW -> TOUCHDOWN             on accept
  REVIEW -> IN_PROGRESS           on rework

  IN_PROGRESS -> GRACE            on hard stop / sleep / session interrupt
  GRACE -> IN_PROGRESS            on valid wake (now < grace_expires_at)
  GRACE -> BLOCKED                on TTL expiry (or policy: cannot resume cleanly)
  GRACE -> PARKED                 on TTL expiry (or Catcher defer)

  * -> ABORTED                    on Catcher veto / hard stop (including from GRACE)
  IN_PROGRESS|BLOCKED|GRACE -> FAILED   on unrecoverable error

FORBIDDEN (unless future RFC adds edge — do NOT invent):
  GRACE -> TOUCHDOWN
  GRACE -> GRANTED
  GRACE -> REVIEW
  GRACE -> PROPOSED
  GRACE -> SCOPED
  PROPOSED -> TOUCHDOWN
  PROPOSED -> GRANTED             (must pass SCOPED unless policy explicitly allows)

================================================================================
GRACE RULES (frozen)
================================================================================
  1. GRACE is a first-class BallState on the wire (not "optional substate" only).
  2. Entering GRACE REQUIRES grace_expires_at (ISO-8601).
  3. While in GRACE: no high-blast EXEC; claim held for continuity only.
  4. Valid wake (now < expires): MAY transition GRACE -> IN_PROGRESS.
  5. Expired: MUST NOT silent resume as success; MUST go BLOCKED or PARKED
     (or ABORTED/FAILED if policy) with audit.
  6. Unknown is not safe; expired GRACE is not IN_PROGRESS.

================================================================================
INVARIANTS
================================================================================
  - No high-blast EXEC without grant_provenance CATCHER (and authorized Ball state)
  - Execution allowlist alone does NOT establish ALLOWLIST provenance (M5-CONF-012)
  - Secrets not in Ball body
  - Touchdown writes MU or audit lineage when durable lesson
  - victim-trace target 0
  - READY (tip sync) is NOT the same as Ball GRANTED (see sync-lifecycle.txt)

WIRE (OpenAPI-aligned minimum):
  {
    "ball_id": "...",
    "state": "GRACE",
    "objective_id": "...",
    "grant_provenance": "CATCHER|ALLOWLIST|NONE",
    "grace_expires_at": "ISO-8601",
    "summary": "...",
    "ts": "ISO-8601"
  }
================================================================================