State first
Every instance has a known lifecycle state. Support and operators can discuss pending, provisioning, active, suspended, failed, and deleted without guessing.
Mooring path
Recoverable operations begin with explicit instance state.
BayStore makes the commercial lifecycle visible before runtime automation is fully wired, so retries, suspensions, upgrades, and restore intent are recorded instead of hidden in ticket notes.
Action record
Operator actions request runtime mutation through the API and keep queued/current/state evidence on the record.
Recovery intent
Recovery copy names retries, restore requests, and rollback intent as lifecycle operations. It does not claim automated restore execution.
Operational model
Who owns what during the current launch boundary?
| Surface | Visible today | Deferred production dependency |
|---|---|---|
| Customer dashboard | Instance, plan, status, and sandbox access metadata. | Production identity, issued customer access URLs, and account authorization policy. |
| Operator console | Runtime mutation requests, action records, and queued/current/state feedback. | Worker-backed execution completion, queue processing, secrets, and production clusters. |
| Security review | Static trust boundary, legal policies, DPA link, and no public console navigation. | Approved controls, deployment-specific evidence, and any third-party certification claim. |
Audit trail
Recovery starts before anything mutates.
failedA readiness gate failed. The instance record keeps product, plan, owner, last action, and support context.Retry intentThe operator records the retry request, reason, correlation id, and expected state transition before execution is claimed.
Restore intentBackup metadata, target restore point, requester, and approval path stay attached to the same instance.
Buyer updateThe buyer sees the boundary: recorded action, current state, sandbox/test-runtime status, and any production dependency still open.
Recorded intent gets an execution path.
Production recovery needs queue workers, secrets, provider access, tested runbooks, backup restore proof, and rollback evidence. The public static site does not claim those are live.
The state language remains exact.
Instances still move through pending, provisioning, active, upgrading, suspended, failed, and deleted. No surface invents substitute labels.
Certification boundary: BayStore does not currently claim SOC 2, ISO 27001, HIPAA, PCI DSS, or other third-party compliance certification.