## State Machine Violation (High)

### Trigger Signals

Start this detection when the following code characteristics appear:
- Status field direct assignment (`obj.status = ...`, `obj.state = ...`)
- Status enum definitions (`enum Status`, `const STATUS = {...}`)
- Function names containing status change semantics such as approve/reject/complete/cancel/start

### Judgment Process

1. **Build state transition graph**: `find_references` tracks all assignment locations of status fields, recording the source state and target state of each change, building the actual state transition graph
2. **Check state transition methods**: For locations with direct assignment `obj.status = X`, `Read` confirms:
   - Whether a dedicated method is used (`transition()`, `complete()`, `cancel()`) rather than direct assignment
   - Whether preconditions are missing at direct assignment points
3. **Verify preconditions**: `Read` checks whether condition validation exists within state transition methods:
   - Whether the current state is in the allowed source state list
   - Whether business preconditions are checked (e.g., sufficient balance, enough stock)
4. **Check associated actions**: `Read` confirms whether state transitions trigger necessary side effects:
   - Stock release, notification sending, audit logging, counter updates
5. **Check terminal state protection**: `Read` confirms whether terminal states (completed/cancelled/closed/archived) have write protection to prevent modification of finalized states

### Evidence Construction

After confirming a defect, the output must include:
- State transition graph (all state change paths in the actual code)
- Violation transitions (which illegal transitions lack interception, with file:line number)
- Missing associated actions (side effects not triggered after state change)
- Business impact (consequences of illegal transitions: skipping approval, duplicate shipping, stock leakage)

### Exclusions

- Initialization assignment (initial state setting in constructors)
- Enum/constant definitions (not runtime assignments)
- Direct state setting in test code
