Share lifecycle

States

                 ┌───────────┐
   grant         │  active   │
  ───────────────►           │
                 └─────┬─────┘
        ┌──────────────┼──────────────┐
        ▼              ▼              ▼
   ┌─────────┐    ┌─────────┐    ┌─────────┐
   │ expired │    │ revoked │    │ ceased  │
   └─────────┘    └─────────┘    └─────────┘
   (clock ran     (subject       (recipient
    out)           acted)         acknowledged
                      │           the revoke)
                      └──────────────►

A share is created active with a mandatory expires_at. Terminal states are expired, revoked, and ceased. There are no other states and no resurrection: continuing a relationship requires a renewal — a new share that references its predecessor (renewed_from_share_id), with fresh consent and a fresh fingerprint.

Transitions

Transition	Actor	Requirements
grant → active	subject	Full authorization flow; fingerprint computed; audit row + share.created event
active → expired	hub (clock)	MUST occur once expires_at passes; access to values MUST stop; share.expired event
active → revoked	subject	Immediate; access to values MUST stop; cease-contact notice issued; obligation clock starts; share.revoked event
revoked → ceased	recipient	Acknowledgement within the obligation window; business.ceased event

The cease obligation

On revocation the recipient enters a 10-business-day obligation window:

• The hub MUST record the notice, the deadline, and (if it arrives) the acknowledgement as audit rows.
• If the deadline passes unacknowledged, the hub MUST record the escalation. Non-response is evidence: the timestamped notice, deadline, and silence form a complete record for regulator complaints (e.g. TCPA/FTC filings).
• Acknowledgement after the deadline is still recorded, with the lateness preserved.

Expiry warnings

Hubs SHOULD notify both parties before expiry (SP/1 reference: 7 days and 1 day). Notification markers MUST make re-runs idempotent — a subject never receives duplicate warnings for the same share/window.

Data-access invariants

• Field values are only ever released for active shares. expired, revoked, and ceased shares return metadata and evidence — never values.
• Every value release SHOULD itself be audit-logged (share.values_viewed in the reference implementation).