Every instance moves through a named lifecycle.
BayStore keeps desired commercial state, rendered release intent, and observed runtime state aligned. The buyer sees where the instance is and what boundary is active.
Explicit state, end to end
Nothing happens silently. Each stage is a named position on the tide.
Buy
Select a product and berth. Order intent is confirmed — instance enters pending.
Moor
The instance enters provisioning. Domain, TLS, and access metadata are tracked as launch dependencies.
Operate
Instance is active. Health checks, backup metadata, upgrade intent, and rollback paths stay visible within the bounded non-payment evidence path.
Recover
Suspend, resume, or record restore intent against backup metadata. State is preserved, not overwritten.
When the tide turns, the record holds.
The ebb of the lifecycle is as explicit as the inbound. Recovery and retirement are named operations against the instance record, never silent state loss.
failed with its evidence intact. Operators retry against the recorded cause instead of guessing from a support thread.upgrading instance can return to its prior active shape. Capacity and version intent are tracked so the rollback target is unambiguous.suspended instance keeps its commercial and support context. State is preserved, not overwritten.deleted instance remains represented by a terminal state for audit and commercial reconciliation. Retention and deletion proof follow approved policy.The lifecycle vocabulary
These tokens are the same across every BayStore surface — catalog, customer dashboard, and operator view. Nothing is translated or hidden.