Oversell & re-accommodation

Deliberate oversell is supported (default off). It is a quantitative phenomenon: selling beyond physical capacity, counting on no-shows. The model is the airline’s.

Two capacities per Bucket

• physical (C) — how many actually fit / can enter.
• commercial = physical + overbook — how many you may sell. overbook defaults to 0 (sports tickets are always 0; other cases e.g. 10%). The number is product config, outside the protocol — the protocol only enforces the limits.

Three enforcement points

Point	Limit	Effect
Hold (sale)	≤ commercial	anything past commercial → OVERSELL_PREVENTED
Assign (resolution)	≤ physical	only C become CONCRETE; the excess stays ANONYMOUS = standby
Redeem (gate)	≤ physical	standby enters only if there’s room (a no-show); else → BUMPED

Fulfill issues all sold (you hold the ticket); the physical cut happens at Redeem — like airline boarding (ticketed but bumpable), not at Fulfill.

Standby = an allocation in the overbook headroom (Allocation.standby = true). In a QUALITATIVE Bucket it is the ANONYMOUS allocation that couldn’t get a Unit — the resolution axis gives standby for free. In a QUANTITATIVE Bucket it is a quota beyond physical, bumped by order/policy at the gate.

Sports = dormant

With overbook = 0, commercial = physical, there is never a standby, and Redeem never bumps — the whole machine lies dormant. Bump reconciliation (compensation, upgrade, queue) is domain/product, not protocol.

Re-accommodation / inventory-shrink

The “trial by fire”: capacity shrinks after the sale — the organization blocks an already-sold block (last-minute guests, equipment swap, an inspection report). This is a retroactive oversell: physical dropped below what was sold. It is not a new machine — it is the resolution axis running involuntarily (system-initiated, not holder-initiated):

• An affected ANONYMOUS allocation → just one slot vanishes from the pool; AutoAssign grabs another, or it becomes standby. No violation.
• A CONCRETE allocation on a pulled Unit → a forced Unassign (reason="inventory_block", CONCRETE → ANONYMOUS) → AutoAssign to another free Unit; if none → standby / BUMPED (compensation is domain).

Every involuntary op carries a reason for audit (event log) and holder notification (“your seat changed”).

Structural consumer-rights guarantee

Resolution is orthogonal to the FSM — re-accommodation touches only the resolution axis; the FSM stays intact. A PAID/FULFILLED Booking stays PAID/FULFILLED when re-accommodated. It is impossible to lose the purchase due to an inventory change. This is conformance invariant #8.