The compiled, valid-by-construction interpreter input (docs/architecture.md:47-51, principle 4). Statifier.Compiler.compile/1 is the only producer; the interpreter is the only consumer that matters - every other layer stops at %Statifier.Document{}.

Layout (ADR-0005)

states is a tuple of Statifier.Machine.State.t() in document order, index 0 being the synthesized :scxml root - the spec treats <scxml> as a state for LCCA and transition-domain purposes, so giving it a real index removes the special case from get_transition_domain rather than adding one; its parent and id are both nil. Every compiled state carries its own index, its parent index (nil only at the root), and last - the highest index in its own subtree, making the range index..last self-inclusive and contiguous by construction. descendant?/3, ancestor?/3, lcca/2, document_order/2, and exit_order/2 below are exactly the integer/range comparisons ADR-0005 was adopted for - no precomputed cache, no ancestor-path table.

The stored range is self-inclusive, but descendant?/3 is not: it is Appendix D's isDescendant, which is a proper-descendant test, so it compares ancestor < descendant against that range. The predicates here carry Elixir's ? form rather than the spec's isFoo, per ADR-0002's 2026-08-09 amendment, and each names its Appendix D counterpart in its own @doc.

id_to_index is partial: an entry only for a state with a non-nil, non-empty id, mirroring Statifier.Validator.Checks.Ids's own uniqueness set. There is no index_to_id map - elem(states, i).id is already that function, total with nils, exposed here as id/2.

transitions, contents, and data_elements are dense tuples indexed by t_index/c_index/d_index (ADR-0012 item 3). The compiler's transition pass populates transitions (transition/2 below is its elem/2 reader, mirroring at/2); the compiler's executable-content pass populates contents (content/2 below, the same elem/2 reader shape); the compiler's <data> pass populates data_elements (data/2 below, same shape again) - see Statifier.Machine.Data's moduledoc for what a d_index names. It lives in both places because the two carry different access patterns: here in document order as a dense list for whole-document passes, and on Statifier.Machine.State.data as per-state membership for entry-time binding.

Expressions

Every cond, every <log expr=...>, every <content expr=...> or <content> text body compiles once into expr() (docs/architecture.md:76-82, ADR-0014). Nothing before the compiler's expression-compilation seam builds one; the type is declared here because it is Machine data, not because anything yet produces a {:compiled, ...} value.

No top-level initial

The root state at index 0 already carries resolved initial indexes - giving it a real index in the first place is what lets the root need no special case here - so a second, Machine-level initial field would duplicate that fact the same way storing both ends of a self-inclusive descendant range would. initial/1 reads it off index 0.

Why global_scripts is different: not derivable from contents

global_scripts (below) looks like it should be the same kind of redundancy this section just ruled out, and it is not, for a structural reason rather than a policy one. Every contents entry is addressed by a c_index that names its owning block or transition (Content.owner/0) - that address space is the block runner's, built for a node some <onentry>/<onexit>/transition/<if>-branch/<foreach>-body walks and executes. A top-level <script> (spec 5.8) is a child of <scxml> itself, run once at load time by Statifier.Interpreter.initialize/2 directly (Phase 3, ADR-0026) - no block ever runs it, so it has no c_index, no block, and no owner to be derived from. global_scripts is not a cache of a fact contents already states; it is the only place the fact is stated at all.

warnings: a document-conformance finding, not a validity finding

warnings (ADR-0033) is a list of Statifier.Validator.Warning.t() the validator produced while checking the source document, stamped onto the Machine by Statifier.compile/1. It defaults to [] and is not in @enforce_keys, the same way global_scripts is not: a Machine with no warnings is exactly as valid as one with some.

This is deliberately not a second validity axis. Design principle 4 ("make invalid states unrepresentable") is about the Document -> Machine boundary: a Machine only exists because the validator's error checks all passed, and that boundary is untouched by this field. A warning is a statement about the document's conformance to a spec MUST the engine nonetheless has defined behavior for either way (ADR-0033's own rationale for why the finding does not gate compilation) - it says nothing about whether this Machine is well-formed. A %Machine{} with a non-empty warnings list is just as valid-by-construction as one with warnings: [].

The field exists here rather than as a third element on compile/1's return because ADR-0012 item 3 already puts every other retained diagnostic

• locations on states, transitions, and executable content, span tables on compiled expressions - on the Machine, and a warning with a location is the same kind of thing. It is also, per ADR-0033, the only surfacing seam: no trace effect, no logger, no telemetry - a caller (or a debugger) that wants a warning finds it here or nowhere.

identity: the chart revision, not the document's validity

identity (see ADR-0052) is the Statifier.Machine.Identity.t() Statifier.compile/2 stamps from the source it compiled, or nil for a Machine built without going through that boundary - Statifier.Compiler.compile/1 called directly, or a Machine an embedder's :invoke_source resolver returned rather than one Statifier.compile/2 produced (Statifier.Invoke.Source.resolve/2's src clause). It defaults to nil and is not in @enforce_keys, the same reasoning as global_scripts and warnings above: a Machine with no identity is exactly as valid as one with one. identity/1 below is the reader.

source and compile_opts: what identity was computed from

source (the SCXML binary Statifier.compile/2 compiled) and compile_opts (the persisted subset of the opts it was called with) are stamped onto the Machine together with identity, by compile/2 and only by compile/2 - the same three fields, the same one producer, so source: nil and identity: nil always co-occur, and a non-nil identity always has the exact source it was hashed from sitting beside it. compile_opts is never the caller's whole keyword list: it is filtered through a closed allowlist (Statifier.compile/2's @persisted_compile_opts) before it is stored, so an option this library does not recognize is never carried onto the Machine. source/1 and compile_opts/1 below are the readers.