Interface ExecutionFenceTransition

The state the caller believes the fence is in.

The state to move to.

Required when next is 'proof-only'; rejected otherwise.

unknown rather than string because every caller is a control-plane route holding a parsed JSON body, and #proofKeyFor already validates it against PATH_SAFE_ID_PATTERN and throws InvalidExecutionFenceRequestError on anything else. Typing it string bought nothing and cost something: it made every route write body.proofKey as string, an assertion that is false exactly when the caller sent the wrong thing, so the one input this field exists to police arrived pre-blessed at the type level.