Conformance

A conformant ABP implementation must guarantee:

1. Never exceed the Bucket’s declared limits, under any concurrency — sales ≤ commercial capacity; CONCRETE ≤ physical capacity; Redeem ≤ physical. Zero accidental oversell: physical is only exceeded by the explicitly configured overbook. A QUALITATIVE Unit never double-books.
2. Atomic multi-item — a Hold of N Units is all-or-nothing when ATOMIC is requested.
3. Idempotent Fulfill — issuing the same artifact twice is a no-op (returns the first).
4. TTL honored — a hold expires and frees the Unit without intervention.
5. Validated, auditable FSM — every transition checked against the matrix and recorded in an append-only log.
6. Typed result-codes — the codes below, not opaque exceptions.
7. Every effect attributable to a Channel — commands come from an authenticated Channel.
8. Re-accommodation preserves the commercial state — shrinking inventory (block / reduction) never silently cancels a committed Booking. It forces a transition on the resolution axis (AutoAssign or standby), keeping the FSM (a PAID stays PAID). Every involuntary transition is audited (reason) in the event log.

The Eventheca Reservations product is the reference implementation: it passes a conformance suite (to be written) that exercises these 8 invariants.

Result-codes

Code	When
OK	success
UNIT_UNAVAILABLE	Unit already allocated/sold
OVERSELL_PREVENTED	an attempt that would violate the Bucket’s capacity/uniqueness
HOLD_EXPIRED	a command over an already-expired hold
POLICY_VIOLATION	a sale rule (per-CPF limit, window, conditioned sale)
IDEMPOTENT_REPLAY	replay of an idempotency-key; returns the prior result
QUOTA_EXHAUSTED	reserved for Channel-credit (future league-owned registry)
ALREADY_ASSIGNED	Assign over an already-CONCRETE allocation without overwrite
NOT_RESOLVED	Unassign / Swap over a still-ANONYMOUS allocation
BUMPED	Redeem denied: physical capacity exhausted (overbook standby)

Sale rules (per-CPF limit, conditioned sale, gallery lock) are declarative configuration per Producer/event — never hardcoded.