Declare the machine. Never lose your place.
The durable-position primitive of the estate: declare an entity's states and legal transitions once, and where it stands survives every failure — behind a front door that serves today, with every gate to the rest stated in the open.
A builder who owns a long-lived entity — an order, a claim, a deal, a session — has a problem no counter sells a primitive for: where the thing STANDS. Position gets smeared across the stack: a status column that knows the value but not the law, so every handler re-derives which moves are legal; a queue that knows what was intended but not what happened; a cron sweep that reconciles what the last bad deploy scattered. The durable-execution tier genuinely solved surviving a crash — for state that lives inside a running workflow; when the position belongs to an entity that outlives any single run, holding it is an integration project again. The actor frameworks made the entity first-class — and handed the builder a cluster to operate. The handlers took an afternoon; knowing where everything stands after a failure is apparently a job forever.
The tax lands hardest exactly where the estate's whole premise lives: on builders and businesses too small to staff a position practice. A position you must re-derive is not a position. If the machine economy runs on long-lived things — the orders agents advance, the claims workflows route, the deals businesses settle — then where they stand has to be sold as a primitive with laws, or every failure keeps its reconciliation meeting.
Three things in this estate are the substrate itself: the studio, the platform, and the runtime. This is deliberately not a fourth. state.do is a composed primitive the platform operates, wearing its own door because the builder who owns an entity's lifecycle is a different ICP from every sibling's — and a brand here is one ICP and one motion.
The runtime story the sibling decks tell is execute → orchestrate → remember: functions.do runs the stateless unit of work, workflows.do sequences units into processes, and the durable layer holds what must survive. That durable layer has two grains, and this estate gives each its own door. database.do holds the record — the facts, at rest, schema-shaped, its own deck filed as the trio's persistence leg. This door holds the position — where a long-lived entity stands right now, and which moves are legal from there. The boundary is a rule, not a vibe: if the question is what is true about this thing, that is the record door; if the question is where does this thing stand, and what may happen next, that is this door. A workflow's own checkpoints are the orchestration runtime's internal durability and stay with workflows.do; the order the workflow advances keeps its lifecycle here, because many processes touch one entity and the entity's position outlives them all.
In the estate's own registry the coordinate is exact: noun State, verb state, type primitive, subcategory data — filed at priority P1, status planned, a filing this record reports at face value on the bindings slide rather than editing the books from a deck.
// the intended contract — stated as design intent, not a live warranty
const order = await machine('order-4712', {
states: ['placed', 'charged', 'fulfilled', 'refunded'],
transitions: {
placed: ['charged'],
charged: ['fulfilled', 'refunded'],
},
})
await order.transition('charged') // legal — persisted before the ack
await order.transition('placed') // illegal — a typed refusal, not corrupted state
await order.waitFor('approval') // parked — a held position costs no compute
There is nothing else to author. The intent — stated here at its actual state: design intent behind its gate, not built architecture. The declared machine is the whole artifact — states, legal transitions, and the waits where a human approval or an outside event enters the lifecycle. Every transition persists before it is acknowledged; every illegal move is refused as a typed error rather than absorbed as corrupted state; a parked entity holds position, not compute, and resumes exactly where it stood. The live front door sells this shape in its own words — state machines that survive failures, handle human approvals, and resume where they stopped.
No engine artifact exists under this record's contract — as of 2026-07-31 the local repository named for this primitive is empty, and the one engine artifact that does exist under the door's name is the estate's own Drivly-era public repo, posted green below with a different contract. Everything above is design intent. The live apex headlines transition-latency and data-loss figures; this record adopts neither — no performance, availability, or loss figure appears here until benchmarks publish with their method and window, behind this gate.
The door's name has an engine history, and this record posts it rather
than denying it: the estate's own Drivly-era public repo
drivly/state.do — an xstate finite-state-machine implementation on
Durable Objects, package name state.do 1.0.0, README documenting an
HTTP API at state.do/:key — last pushed 2024-09, predating this
record with a different contract. That legacy API no longer serves:
state.do/:key answers 404 today (checked cold 2026-07-31; the live
apex is the marketing page). Whether the door adopts or deprecates the
legacy repo is queued in the program doc; nothing on this slide is
built from it.
Concreteness over adjectives: each door below was checked cold on 2026-07-30 and re-checked cold on 2026-07-31, and carries its own state and its own evidence URL — never one URL evidencing several domains. Serving is a liveness fact, not a tenancy claim: nothing here asserts external tenancy, metered billing in production, or a usage roll. Those publish behind their own gates.
state.do serves. The front door a builder would resolve is live, and
its hero sells the core of this record's offer in its own words —
durable state machines with automatic persistence that survive failures,
handle human approvals, and resume exactly where they stopped. The
page's own framing goes further than this record does: AI optimization,
agents modifying workflows dynamically, and headline performance figures
— stories this record deliberately does not claim. The page predates the
record; what this claim posts is the liveness fact.
The gateway routes this primitive as a named service today: GET https://apis.do/state returns a machine-readable JSON record — no
login, no signup — naming the service, its domain state.do, its
description "State Service", its category infrastructure, and its
status available.
platform.do serves — the operator's front door, whose own record files
the composed primitives under the same claim discipline.
functions.do serves — the execution sibling: the stateless unit of
work whose effects move the positions held here.
workflows.do serves — the orchestration sibling: the sequences that
advance an entity through the lifecycle this door holds.
database.do serves — the record grain of the same durable layer: the
facts at rest, boundary stated on the grain slide.
agents.do serves — the sibling runtime whose agents are the machine
callers that read a position before they act.
Ambers worn in the open — each the exact distance between what serves and what this door intends to be. Two run the unusual direction: the estate's own books lag its live door. One runs a direction no sibling record has had to state: the books do not name this door at all.
The domain's own machine door answers with a human page today — and not
even this brand's: state.do/api returns the gateway's own apis.do page,
while the gateway's service record lists that very address under also
as this service's own door — and the machine index at state.do/llms.txt
answers with a server error. A machine that resolves this primitive
finds a door opening onto another brand's page written for humans. The
claim flips when the catalog serves at that address in the machine's own
language.
The estate's role table carries no binding for this primitive at all — neither active nor pending. The siblings are each filed (runtime.functions and runtime.workflows pending, runtime.database pending, runtime.workers active); this door is absent from the table. The estate does not round up its own registry — and it does not invent rows either: the absence is declared here at face value, and this claim flips when a binding is filed.
The domain registry still files state.do at status planned, priority P1 — filed before the door lit, and not yet updated to match the live surface. The record reports the books at face value in both directions: the door is posted above with its evidence, and the filing is reported here as it stands until the registry flips.
The live apex titles itself with the orchestration sibling's coordinate — "Declarative Workflow Orchestration", "build complex workflows" — while the estate's registry files state.do (state management) and workflows.do (workflow orchestration) as separate coordinates, and the sibling's own live door already sells orchestration. One page, two coordinates' language: re-scope the apex to the position grain, or ratify the overlap until the surfaces are re-cut. Queued in the program doc's decision queue; non-blocking, because the green claim above asserts only that the door serves, which stays curl-true either way.
Metered on positions held and transitions served is the intended model, and the rate card IS the pricing surface: it binds when it posts at the contract surface — verbs, protocol, rate card, guarantees — not before, and never as prose in a deck. No figure is published or implied until then.
Primary motion is B2D: the buyer is a developer who evaluates in the
docs and converts at the first transition that survives a crash — the
first time a process dies mid-move and the entity comes back knowing
exactly where it stood. No sales motion, no demo call, no procurement;
the evaluation surface is the product surface, which is why the
SDK-and-docs gate on the contract slide is the deck's most important
amber. Secondary is B2A: a position is precisely what an agent must
read before it acts and write after — and the first step of that motion
already serves, because the gateway returns this service's
machine-readable record, status available, to a caller with no login.
Purchase and settlement for the machine motion gate on the contract
surface, exactly as the sibling records state for theirs.
Layer-1 economics at the position grain: fixed cost is the durable substrate; a position is bytes plus a law, so a tenant's million parked entities hold state, not compute — cost tracks transitions served, and blended margin improves with density.
A position is the smallest state there is — a value and its legal next moves — which makes it the honest end of metered pricing: parked entities hold bytes, not machinery, and cost tracks the transitions that actually advance them. The substrate's durability practice is a fixed cost amortized across every tenant; what the builder stops paying for is the reconciliation labor that never belonged to their entity in the first place. And there is no regulatory floor anywhere in this function: nothing in persisting a transition reserves a step for a statutory person, so the implementation mix migrates all the way to Code.
Entity counts, transition volumes, and the internal-versus-external split are gated. Each figure publishes with its window and base or it does not publish.
every brand the estate launches keeps its entities’ lifecycles on the estate stack this primitive holds — demand generated by the portfolio’s own search process, structural before commercial; the usage roll publishes behind its stack#1 §A5 gate or not at all
the estate’s gateway already routes /state as a named service, status available, to a machine with no login — when the reader is an agent, being discoverable and callable IS the distribution channel
a status column can be copied anywhere; a lifecycle — position plus enforced legality plus history — is worth exactly the substrate that guarantees it, a pull this record declines to dress up as lock-in: the tenancy holds only as long as the contract stays worth staying for
functions, workflows, records, and positions are composed primitives under one operator and, when it posts, one contract — unbundling the position grain re-creates the reconciliation burden the builder came here to delete
Serving is a liveness fact, not a tenancy claim: each posted URL below evidences that one door resolves — not that anyone occupies it.
state.do serves — the primitive's front door is live.
apis.do/state serves machine-readable JSON — the gateway's service
record for this primitive resolves for a machine with no login, status
available.
github.com/drivly/state.do is public — the estate's own Drivly-era
engine artifact under the door's name (xstate FSM on Durable Objects,
package state.do 1.0.0, pushed 2024-09), predating this record with a
different contract; its legacy state.do/:key API no longer serves
(404, checked cold 2026-07-31).
The engine under this record's contract is design intent — no artifact exists under it, and this record says so on the contract slide rather than borrowing a built-architecture posture it cannot evidence; the Drivly-era repo posted above is the door's history, not this contract. The most important amber for the B2D motion, because for this ICP the docs are the brand.
The domain's own machine door — today answering with the gateway's own
human page, listed under also in the gateway's record — is the next
gate for the B2A leg: a position an agent cannot read is a promise, and
this deck declines to make it in present tense.
The estate's role table does not yet name this door at all; the record reports the absence at face value until a binding is filed.
The domain registry's own filing — planned, P1 — lags the live door; the record wears the lag rather than editing the books from a deck.
The apex speaks the orchestration sibling's coordinate; the registry files two. Queued for reconciliation, stated here in the open.
No figure is published or implied until the card posts where it binds.
The front door is state.do — it serves today.
If this was forwarded to you: state.do is the durable-position primitive of the startups.studio estate's infrastructure layer — the grain of the durable layer that remembers where every long-lived thing stands, while the sibling data door holds the record of what is true. It is deliberately not one of the estate's three substrate properties, and its deck says so; it is a primitive under them, sold to the builder who owns an entity's lifecycle and refuses to build a position practice around it. What is live is posted with a URL checked cold; what is not is pending with the gate that flips it — including the ambers it wears openly: an engine contract that is still design intent (the door's one existing engine artifact, the estate's own Drivly-era public repo, is posted with its URL and carries a different contract), the machine door serving another brand's human page, the estate's own books that lag or omit this door, the apex speaking a sibling's coordinate, and the unposted rate card. Judge it by what is posted, and by how plainly it labels what is not.