MARK V — STATION SYNCHRONIZATION LIFECYCLE (normative 0.2.1)
================================================================================
Cross-check: openapi TipSyncState · shall-v0.2 · CURRENT.txt
Features never redefine CORE. Create No Victims.

================================================================================
CANONICAL OPERATIONAL VOCABULARY (wire / OpenAPI TipSyncState)
================================================================================
  UNSYNCED         No confirmed tip/rev for this act (or missing sync identity)
  DEGRADED         Operating without full tip/mesh — mule/local only; limited claims
  SYNC_CONFIRMED   Tip loaded + SYNC_CONFIRM done for this epoch (sync_code/rev known)

These three are the ONLY values for TipSyncState on the wire.
Absence of sync_code on MessageSend:
  - if station TipSyncState == SYNC_CONFIRMED: MAY inherit station tip
  - if UNSYNCED: reject OR mark DEGRADED (implementation MUST document which)
  - NEVER silent "don't care" without a written default

================================================================================
INTERNAL BOOT PHASES (map to TipSyncState — not separate wire enums)
================================================================================
  Phase (station-local)     Maps to TipSyncState
  -----------------------   ----------------------
  COLD                      UNSYNCED
  TIP_FETCH in progress     UNSYNCED (or DEGRADED if using cache)
  CORE_BOUND                still UNSYNCED until SYNC_CONFIRM
  STATION_LOCAL             still UNSYNCED until SYNC_CONFIRM
  SYNC_CONFIRM done         SYNC_CONFIRMED
  READY (ops label)         SYNC_CONFIRMED  *** see READY != AUTHORIZED ***
  tip/mesh failure          DEGRADED
  MAJOR rev mismatch        DEGRADED (reason: COMPATIBILITY) — MUST NOT claim full interop
  SEMANTIC_DRIFT (decoder)  DEGRADED (reason: SEMANTIC) or stay SYNC_CONFIRMED
                            with SEMANTIC_DRIFT caution flag — MUST NOT assume mind meld

DEGRADED reason codes (recommended telemetry, not separate TipSyncState values):
  AVAILABILITY   tip fetch fail, mesh down, local mule only
  COMPATIBILITY  MAJOR sync_code / SPEC_VERSION mismatch
  SEMANTIC       decoder ring MELD_FAIL/PARTIAL

================================================================================
HAPPY PATH (internal)
================================================================================
  COLD -> TIP_FETCH -> CORE_BOUND -> STATION_LOCAL -> SYNC_CONFIRM
       -> TipSyncState = SYNC_CONFIRMED
       -> ops label READY (sync plane only)

================================================================================
READY != AUTHORIZED
================================================================================
  TipSyncState SYNC_CONFIRMED (or ops "READY") means:
    station may act within grant/allowlist **on the sync plane**.
  It does NOT mean high-blast EXEC is authorized.

  High-blast EXEC requires ALL of:
    1) TipSyncState SYNC_CONFIRMED (or explicit DEGRADED policy for that op)
    2) Ball grant_provenance appropriate to blast (CATCHER for HIGH)
    3) Operation scope / blast policy (LOW|HIGH|UNKNOWN) per AUTH_BOUNDARY

================================================================================
FAILURE / RECOVERY
================================================================================
  TIP_FETCH fail        -> DEGRADED (AVAILABILITY); optional last-known cache
  CORE_BOUND MAJOR miss -> DEGRADED (COMPATIBILITY); alert carbon; no full interop claim
  Mesh down             -> DEGRADED (AVAILABILITY) + carbon mule
  SEMANTIC_DRIFT        -> run decoder probes; do not assume peer mind meld
  Hard stop             -> recover via local BIOS/heartbeat; recovery IS a feature

INVARIANTS:
  Features never redefine CORE
  SYNC_CONFIRM before high-blast or assuming remote peer state
  Advertise sync_code + silicon_rev on mesh participation when known
================================================================================