Booking Marketplace Calendar and Availability Logic: Prevent Conflicts and Broken Promises

Two customers can see the same slot as available and both complete payment unless the platform treats availability as a transactional promise rather than a colored calendar cell.

The difficult cases involve resources, provider schedules, time zones, lead times, buffers, temporary holds and changes arriving from several channels.

This guide models calendars from source availability through durable reservation and recovery.

Define bookable resources

Define bookable resources is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats define bookable resources as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for define bookable resources before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For define bookable resources, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For define bookable resources, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned define bookable resources decision, acceptance criteria and recovery record
• Stop condition: define bookable resources cannot be explained or restored from durable evidence

Choose the authoritative timezone

Choose the authoritative timezone is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats choose the authoritative timezone as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for choose the authoritative timezone before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For choose the authoritative timezone, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For choose the authoritative timezone, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned choose the authoritative timezone decision, acceptance criteria and recovery record
• Stop condition: choose the authoritative timezone cannot be explained or restored from durable evidence

Model weekly schedules

Model weekly schedules is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats model weekly schedules as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for model weekly schedules before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For model weekly schedules, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For model weekly schedules, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned model weekly schedules decision, acceptance criteria and recovery record
• Stop condition: model weekly schedules cannot be explained or restored from durable evidence

Add dated exceptions

Add dated exceptions is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats add dated exceptions as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for add dated exceptions before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For add dated exceptions, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For add dated exceptions, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned add dated exceptions decision, acceptance criteria and recovery record
• Stop condition: add dated exceptions cannot be explained or restored from durable evidence

Checkpoint 4: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Apply lead times and buffers

Apply lead times and buffers is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats apply lead times and buffers as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for apply lead times and buffers before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For apply lead times and buffers, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For apply lead times and buffers, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned apply lead times and buffers decision, acceptance criteria and recovery record
• Stop condition: apply lead times and buffers cannot be explained or restored from durable evidence

Calculate slot inventory

Calculate slot inventory is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats calculate slot inventory as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for calculate slot inventory before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For calculate slot inventory, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For calculate slot inventory, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned calculate slot inventory decision, acceptance criteria and recovery record
• Stop condition: calculate slot inventory cannot be explained or restored from durable evidence

Create temporary holds

Create temporary holds is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats create temporary holds as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for create temporary holds before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For create temporary holds, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For create temporary holds, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned create temporary holds decision, acceptance criteria and recovery record
• Stop condition: create temporary holds cannot be explained or restored from durable evidence

Confirm reservations atomically

Confirm reservations atomically is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats confirm reservations atomically as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for confirm reservations atomically before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For confirm reservations atomically, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For confirm reservations atomically, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned confirm reservations atomically decision, acceptance criteria and recovery record
• Stop condition: confirm reservations atomically cannot be explained or restored from durable evidence

Checkpoint 8: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Expire abandoned holds

Expire abandoned holds is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats expire abandoned holds as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for expire abandoned holds before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For expire abandoned holds, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For expire abandoned holds, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned expire abandoned holds decision, acceptance criteria and recovery record
• Stop condition: expire abandoned holds cannot be explained or restored from durable evidence

Prevent double booking

Prevent double booking is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats prevent double booking as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for prevent double booking before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For prevent double booking, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For prevent double booking, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned prevent double booking decision, acceptance criteria and recovery record
• Stop condition: prevent double booking cannot be explained or restored from durable evidence

Support recurring availability

Support recurring availability is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats support recurring availability as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for support recurring availability before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For support recurring availability, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For support recurring availability, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned support recurring availability decision, acceptance criteria and recovery record
• Stop condition: support recurring availability cannot be explained or restored from durable evidence

Synchronize external calendars

Synchronize external calendars is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats synchronize external calendars as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for synchronize external calendars before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For synchronize external calendars, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For synchronize external calendars, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned synchronize external calendars decision, acceptance criteria and recovery record
• Stop condition: synchronize external calendars cannot be explained or restored from durable evidence

Checkpoint 12: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Handle rescheduling

Handle rescheduling is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats handle rescheduling as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for handle rescheduling before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For handle rescheduling, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For handle rescheduling, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned handle rescheduling decision, acceptance criteria and recovery record
• Stop condition: handle rescheduling cannot be explained or restored from durable evidence

Apply cancellation policy

Apply cancellation policy is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats apply cancellation policy as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for apply cancellation policy before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For apply cancellation policy, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For apply cancellation policy, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned apply cancellation policy decision, acceptance criteria and recovery record
• Stop condition: apply cancellation policy cannot be explained or restored from durable evidence

Reconcile calendar state

Reconcile calendar state is a separate product and operating decision within a booking marketplace coordinating provider supply, customer reservations, time zones and cancellation obligations. It changes the promise made to users, the authority of each role, the evidence the platform retains and the recovery route when normal processing fails.

The failure mode is concrete: the team treats reconcile calendar state as a screen requirement while lifecycle, permissions, downstream consequences and exception ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable owner, allowed transitions, user-visible result and exception route for reconcile calendar state before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For reconcile calendar state, retain stable identifiers, explicit states, server-side authorization, version checks, event and processing timestamps, reason codes, correlation IDs, audit history and a bounded recovery command. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with For reconcile calendar state, test the successful journey followed by stale state, duplicate delivery, concurrent commands, revoked authority, dependency timeout, partial completion, operator correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned reconcile calendar state decision, acceptance criteria and recovery record
• Stop condition: reconcile calendar state cannot be explained or restored from durable evidence

Implementation references

Use IETF iCalendar RFC 5545 and record the version applied during release review.

Validate against OWASP API Security Top 10 and record the version applied during release review.

Review OWASP Authorization Cheat Sheet and record the version applied during release review.

Compare with W3C WCAG 2.2 and record the version applied during release review.

Continue with Marketplace Development when converting this operating model into delivery scope.

Frequently asked questions

What is the source of truth for availability?

The booking service must calculate availability from resource rules and committed reservations.

How is double booking prevented?

Use transactional holds, version checks and idempotent confirmation.

Which timezone should be stored?

Store instants consistently and retain the business timezone used to interpret local rules.

How long should a hold last?

Only long enough to complete the bounded checkout, with explicit expiry.

Can external calendars be authoritative?

Only if synchronization delay and conflict rules are accepted and visible.

How should rescheduling work?

Reserve the replacement before releasing the original when policy permits.

What should cancellation change?

Reservation, inventory, payment, notification and provider obligation state.

What must be load tested?

Popular-slot contention, hold expiry, duplicate checkout and calendar synchronization.

Turn the plan into release evidence

A credible release joins the customer promise to durable state, scoped authority and an owned recovery route. Product, engineering, operations, security and support should reach the same conclusion from the same identifiers.

Keep the first scope narrow enough to rehearse under failure. Expand only after permissions, data, financial consequences and customer remedies stay consistent through retries, dependency outages and human mistakes.