Commands

Commands are RPCs in the .proto (the normative form), derived from EPP and the proven EHUB façade.

Consumption commands

Command	EPP	What it does
`Check`	check	availability of Unit(s) in a Bucket, or remaining count of a Bucket. Idempotent read.
`Hold`	create	allocates items (explicit Units or quantitative) into a Booking (the Order/cart) with a TTL. Carries a `FulfillmentMode`.
`AddItems`	—	adds items to a still-`HELD` Booking (incremental cart).
`RemoveItems`	—	removes allocations from a still-`HELD` Booking.
`Confirm`	—	hold → committed (buyer identity attached).
`Settle`	—	confirmed → paid (capture via Billing). Separate from Confirm.
`Fulfill`	—	paid → issues the artifact (the ticket). Idempotent. Issues all sold.
`Redeem`	—	`FULFILLED → USED` (check-in at the gate). Validated against physical capacity; standby may return `BUMPED`.
`Refund`	—	paid/fulfilled → real refund (returns the Unit to the Bucket). Whole Booking or a subset of allocations (partial / per-item).
`Transfer`	transfer	nominal post-sale transfer (swaps the holder of the Allocation).
`Extend`	renew	extends the hold’s TTL.
`Release`	delete	explicitly releases hold/booking (= automatic on TTL expiry).
`Get`	info	state of a Booking.

The resolution axis (ANONYMOUS ↔ CONCRETE) is orthogonal to the FSM and applies only to QUALITATIVE Buckets. See Lifecycle.

Command	What it does
`Assign`	concretizes `ANONYMOUS` allocation(s) → a Unit chosen by the Channel. `overwrite=true` = reseat (same holder, releases the old Unit atomically).
`AutoAssign`	concretizes `ANONYMOUS` → the Registry chooses (best-available / strategy).
`Unassign`	`CONCRETE → ANONYMOUS` (drops the Unit, keeps the slot/count).
`Swap`	atomic exchange of Units between two `CONCRETE` allocations (≠ Transfer, which swaps the holder).

A multi-item Hold carries N items (each explicit or quantitative). The policy is a server-default or per-request:

ATOMIC — all-or-nothing (cross-Bucket = 2-phase).
BEST_EFFORT — reserves what it can; the response carries a per-item AllocationResult.
THRESHOLD — succeeds if at least min_units make it.

A cross-domain atomic Hold is just a cross-Bucket atomic Hold — there is no cross-module dance.