ADR-009: BookingConfirmed Trigger Condition — DEPOSIT_PAID

Status: ✅ Approved — 2026-04-10 Impacts: schema-commerce.md (Hasura Event Trigger definition), level-3-domain-1-cross-context-event-contracts.md (§4 delivery contracts)

---

Context

The Booking lifecycle includes two payment confirmation states: DEPOSIT_PAID (deposit received) and FULLY_PAID (final payment complete). The domain model says the CostingSheet locks "when the operator confirms the first booking" — but "confirmed" remained ambiguous and could mean either state.

The costing-pricing-separation ADR establishes that CostingSheet locking freezes costs (not prices). PriceMatrix versioning manages prices independently. However, locking costs early ensures the Soll baseline (cost forecast) stays stable for financial reconciliation.

Decision

DEPOSIT_PAID triggers the BookingConfirmed domain event for CostingSheet cost-locking purposes.

A deposit is a legal commitment to the published price in DACH contract law (§ 651a BGB for package travel). Locking costs at deposit time ensures:

1. The first commercial commitment establishes the Soll baseline
2. The system freezes the cost forecast used for Soll/Ist reconciliation to the state at first commercial obligation
3. No ambiguity in the event trigger — DEPOSIT_PAID is a single, unambiguous state transition

Consequences

Positive:

• BookingConfirmed fires on commerce.bookings.status → DEPOSIT_PAID as a Hasura Event Trigger
• The system disables cost editing on the CostingSheet after lock — this is the Soll baseline
• Clear legal alignment with § 651a BGB contract law

Neutral:

• PriceMatrix versioning remains unaffected — the operator can still publish new price versions after cost lock. They derive from the locked cost base, which is now stable.
• Existing bookings bind to their price_matrix_id at checkout (costing-pricing-separation ADR §3) — PriceMatrix versioning handles price guarantees, not CostingSheet locking.

Rejected alternative:

• FULLY_PAID as trigger: would allow cost edits during the deposit-to-full-payment window, but creates Soll instability and is legally questionable (deposit = contractual commitment under German package travel law).