A quote cannot be accepted after expiry.
A quote cannot be converted twice into two active orders.
An approved price override cannot be silently changed after approval.
An order item cannot complete before its required predecessor completes.
A disconnected asset cannot be modified.
A fulfillment task cannot be retried after a terminal business rejection.
A compensation cannot run without knowing what it is compensating.

quantity must be greater than zero
email must be valid format
price amount must not be null

request body must match JSON Schema
required property productOfferingId must exist
status must be one of enum values

Gold SLA is eligible only for enterprise customers
Discount above 20% requires approval
Static IP requires Internet Access product

An accepted quote must have an immutable price snapshot.
An order cannot be completed while any mandatory order item is not terminal-success.
A product instance cannot be ACTIVE without activation date.
A product instance cannot transition from DISCONNECTED back to ACTIVE.
A workflow cannot complete an order item unless the order item is still in an executable state.

if (!"COMPLETED".equals(order.getStatus())) {
    order.setStatus("CANCELLED");
}

From this state, what transitions are legal?
What command causes each transition?
What side effects are required?
What invariants must hold before and after transition?
Is transition reversible?
Is transition terminal?
Who is allowed to trigger it?

quote_id immutable
order_id immutable
product_instance_id immutable
order_item_id belongs to exactly one order
quote_item_id belongs to exactly one quote

quote.customer_id cannot change after quote creation
order.customer_id must equal source quote.customer_id when created from quote
product_instance.customer_id cannot change after activation
subscription.customer_id cannot change after activation

accepted quote must contain product/configuration/price snapshots
order created from quote must reference quote version
order must not depend on mutable live quote price
asset change must record before/after state

DRAFT quote can be submitted
ACCEPTED quote cannot be edited
COMPLETED order cannot be cancelled by normal cancellation
DISCONNECTED asset cannot be modified

money must have currency
price snapshot must preserve rounding result
manual override must preserve original price and override reason
approved price must not be changed without invalidating approval

child order item cannot complete before required parent completes
add-on product cannot exist without parent asset unless explicitly allowed
disconnect parent must evaluate child impact
fulfillment task with dependency cannot start before dependency terminal-success

same idempotency key must not create multiple quotes/orders
same quote cannot convert into multiple active orders
same external event cannot complete task twice
same workflow job retry must not duplicate external side effect

approval decision must store actor, timestamp, decision, reason
price override must store before/after value
manual repair must store operator and justification
state transition must be traceable to command/event/workflow/action

DRAFT
READY_FOR_REVIEW
PUBLISHED
RETIRED
ARCHIVED

Only PUBLISHED offering can be used for new quote.
PUBLISHED offering version must be immutable.
RETIRED offering cannot be used for new acquisition, but may be used for modify/disconnect of existing asset if policy allows.
ARCHIVED offering cannot be used by runtime CPQ except historical reconstruction.
Offering version referenced by quote snapshot must remain resolvable.

EMPTY
IN_PROGRESS
VALID
INVALID
FROZEN

FROZEN configuration cannot be mutated.
VALID configuration must include all required characteristics.
VALID configuration must not contain mutually exclusive selections.
VALID configuration must include configuration hash.
Quote cannot be submitted with INVALID configuration.
Order cannot be created from quote item with non-frozen configuration.

NOT_PRICED
PRICED
PRICE_STALE
OVERRIDE_PENDING_APPROVAL
APPROVED
REJECTED
FROZEN

Accepted quote must have FROZEN price snapshot.
Price snapshot must include currency.
Manual override must include original price, overridden price, actor, reason, and policy signal.
Approved override cannot be changed without returning to OVERRIDE_PENDING_APPROVAL.
Price hash used for approval must match price hash at acceptance.
Order cannot be created from quote with PRICE_STALE state.

DRAFT
CONFIGURED
PRICED
SUBMITTED
APPROVAL_PENDING
APPROVED
REJECTED
ACCEPTED
EXPIRED
CANCELLED
CONVERTED

DRAFT quote can be edited.
SUBMITTED quote cannot be edited except through revision command.
APPROVAL_PENDING quote cannot be accepted.
APPROVED quote can be accepted only before valid_until.
ACCEPTED quote cannot be edited.
CONVERTED quote cannot be converted again.
EXPIRED quote cannot be accepted.
Quote revision must create new revision number.
Quote accepted by customer must preserve acceptance evidence.
Quote-to-order conversion must verify quote status ACCEPTED and not converted.

quote_id: Q-100
revision: 1 -> rejected
revision: 2 -> approved
revision: 3 -> accepted

NOT_REQUIRED
PENDING
APPROVED
REJECTED
CANCELLED
EXPIRED
SUPERSEDED

Approval decision must reference approval_request_id.
Approval request must reference quote_id and quote_revision.
Approval request must include policy evaluation snapshot.
Approval decision must include actor, timestamp, decision, and optional reason.
Approved request becomes SUPERSEDED if quote commercial terms change.
Rejected request cannot be reused.
Expired request cannot approve quote.

DRAFT
ACKNOWLEDGED
VALIDATED
DECOMPOSED
IN_PROGRESS
HELD
PARTIALLY_COMPLETED
COMPLETED
CANCELLATION_PENDING
CANCELLED
FAILED
FALLOUT
CLOSED

Order cannot enter IN_PROGRESS before decomposition exists.
Order cannot be COMPLETED if mandatory order items are not terminal-success.
Order cannot be CANCELLED after COMPLETED through normal cancellation.
Order in CLOSED state cannot be mutated except audit annotation.
Order from quote must reference accepted quote revision.
Order customer/account must match source quote unless explicit transfer flow exists.
Order total commercial snapshot must match accepted quote snapshot unless adjustment order is created.

PENDING
VALIDATED
READY
BLOCKED
IN_PROGRESS
COMPLETED
SKIPPED
FAILED
CANCEL_PENDING
CANCELLED
COMPENSATING
COMPENSATED

Order item belongs to exactly one order.
Order item action type must be explicit.
MODIFY/DISCONNECT/MOVE action must reference target product_instance_id.
ADD action must not reference existing product_instance_id unless it is add-on to parent.
Order item cannot start before required dependencies are terminal-success.
Order item cannot complete twice.
Failed order item can retry only if failure classification is retryable.
Cancelled item must not emit activation event.

CREATED
WAITING_DEPENDENCY
READY
DISPATCHED
IN_PROGRESS
SUCCEEDED
FAILED_RETRYABLE
FAILED_NON_RETRYABLE
TIMED_OUT
CANCELLED
COMPENSATING
COMPENSATED

Task job type must map to one worker responsibility.
Task external call must be idempotent or protected by idempotency key.
Task cannot SUCCEED if parent order item is CANCELLED.
Task cannot retry non-retryable failure.
Task timeout must not imply external failure automatically.
Task compensation must know original successful side effect.

ACTIVE product instance must have activation_date.
DISCONNECTED product instance must have termination_date.
DISCONNECTED product instance cannot be modified.
PENDING_MODIFICATION product instance cannot accept another conflicting modification.
PENDING_DISCONNECT product instance cannot accept modification unless explicit reversal flow exists.
Product instance version must increase on every state-changing mutation.
Mutation must create history row.
Mutation caused by order must reference order_id and order_item_id.

ACTIVE subscription must have start_date.
TERMINATED subscription must have end_date or termination_date.
Subscription customer/account cannot change after activation.
Renewal must preserve renewal evidence.
Renewal must not duplicate product instances unless product changes require replacement.
Termination must evaluate active product instances linked to subscription.
Billing trigger must reference subscription version.

cancel order
release operation guards
mark order items cancelled
no external compensation needed

stop tasks not started
ask external systems to cancel in-progress actions if supported
compensate successful reversible tasks
mark irreversible tasks for manual handling

Completed activation order cannot be cancelled.
Create disconnect/reversal order instead.

Cancellation must know execution progress.
Cancellation must not assume external task can be undone.
Completed order cannot transition to CANCELLED directly.
Cancellation of parent item must evaluate child items.
Cancellation must release business guards only after safe state reached.

Resource reserved -> release resource
Service activated -> deactivate service
Billing started -> send stop/reversal trigger
Device shipped -> create return process
Appointment booked -> cancel appointment

Only successful side effects can be compensated.
Compensation command must reference original side effect.
Compensation result must be recorded separately.
Compensation failure must create fallout/manual recovery path.
Compensation must be idempotent.
Compensation must not erase original audit trail.

fallout_id
order_id
order_item_id
task_id
severity
category
status
failure_code
message
retryable
owner_team
created_at
last_attempt_at
resolved_at
resolution_type
resolution_note

OPEN
ASSIGNED
RETRY_SCHEDULED
WAITING_EXTERNAL
MANUAL_ACTION_REQUIRED
RESOLVED
CLOSED

Fallout must reference affected business object.
Fallout must have category and severity.
Resolving fallout must record resolution evidence.
Retrying fallout must be tied to a retryable failure.
Closing fallout must not silently complete order unless state transition succeeds.
Manual repair must go through command path, not direct DB update.

JAX-RS Resource
  -> Application Service
      -> Domain Aggregate / State Machine
          -> Repository
              -> MyBatis Mapper

public final class Quote {
    private final QuoteId id;
    private final QuoteStatus status;
    private final int revision;
    private final Instant validUntil;
    private final PriceSnapshot priceSnapshot;

    public Quote accept(CustomerAcceptance acceptance, Instant now) {
        if (status != QuoteStatus.APPROVED) {
            throw new IllegalStateException("Only APPROVED quote can be accepted");
        }
        if (!now.isBefore(validUntil)) {
            throw new QuoteExpiredException(id);
        }
        if (!priceSnapshot.isFrozen()) {
            throw new PriceNotFrozenException(id);
        }
        return withStatus(QuoteStatus.ACCEPTED)
            .withAcceptanceEvidence(acceptance, now);
    }
}

public final class OrderStateMachine {
    private static final Map<OrderStatus, Set<OrderStatus>> ALLOWED = Map.of(
        OrderStatus.DRAFT, Set.of(OrderStatus.ACKNOWLEDGED),
        OrderStatus.ACKNOWLEDGED, Set.of(OrderStatus.VALIDATED, OrderStatus.FAILED, OrderStatus.CANCELLATION_PENDING),
        OrderStatus.VALIDATED, Set.of(OrderStatus.DECOMPOSED, OrderStatus.FALLOUT, OrderStatus.CANCELLATION_PENDING),
        OrderStatus.DECOMPOSED, Set.of(OrderStatus.IN_PROGRESS, OrderStatus.CANCELLATION_PENDING),
        OrderStatus.IN_PROGRESS, Set.of(OrderStatus.PARTIALLY_COMPLETED, OrderStatus.COMPLETED, OrderStatus.HELD, OrderStatus.FALLOUT, OrderStatus.CANCELLATION_PENDING),
        OrderStatus.COMPLETED, Set.of(OrderStatus.CLOSED),
        OrderStatus.CANCELLED, Set.of(OrderStatus.CLOSED),
        OrderStatus.FAILED, Set.of(OrderStatus.CLOSED),
        OrderStatus.CLOSED, Set.of()
    );

    public void assertTransition(OrderStatus from, OrderStatus to) {
        if (!ALLOWED.getOrDefault(from, Set.of()).contains(to)) {
            throw new IllegalStateException("Illegal order transition: " + from + " -> " + to);
        }
    }
}

alter table quote
add constraint chk_quote_status
check (status in (
    'DRAFT', 'CONFIGURED', 'PRICED', 'SUBMITTED', 'APPROVAL_PENDING',
    'APPROVED', 'REJECTED', 'ACCEPTED', 'EXPIRED', 'CANCELLED', 'CONVERTED'
));

alter table product_instance
add constraint chk_product_instance_status
check (status in (
    'PENDING_ACTIVATION', 'ACTIVE', 'PENDING_MODIFICATION', 'SUSPENDED',
    'PENDING_DISCONNECT', 'DISCONNECTED', 'CANCELLED', 'ERROR'
));

alter table product_instance
add constraint chk_active_has_activation_date
check (
    status <> 'ACTIVE' or activation_date is not null
);

alter table product_instance
add constraint chk_disconnected_has_termination_date
check (
    status <> 'DISCONNECTED' or termination_date is not null
);

Order cannot complete unless all mandatory items completed.

Do not process event twice.
Do not apply stale event over newer state.
Do not infer command success purely from event arrival unless event is authoritative.
Do not emit downstream event unless local state transition succeeded.

create table inbox_message (
    message_id uuid primary key,
    topic varchar(200) not null,
    partition_no int not null,
    offset_no bigint not null,
    event_type varchar(120) not null,
    received_at timestamptz not null default now(),
    processed_at timestamptz null,
    status varchar(40) not null,
    failure_reason text null
);

begin transaction
  insert inbox_message if absent
  load aggregate
  check expected version / state
  apply state transition if valid
  write outbox if needed
  mark inbox processed
commit

Worker must be idempotent.
Worker must not create duplicate external side effects on retry.
Worker must distinguish business error from technical retryable error.
Worker must not complete job if domain command failed.
Worker must map external result to explicit domain command.

externalProvisioning.activateService(request);
jobClient.newCompleteCommand(job).send();

ActivationResult result = provisioningAdapter.activateServiceWithIdempotency(request);
assetApplicationService.completeActivation(commandFrom(result));
jobClient.newCompleteCommand(job).send();

MarkExternalTaskAsSucceededAfterVerification
ReleaseStuckAssetOperationGuard
CorrectProductInstanceStatus
AttachMissingExternalServiceReference
RetryFailedBillingTrigger
CloseFalloutWithManualResolution

Repair must require actor and reason.
Repair must reference evidence.
Repair must create audit event.
Repair must not skip state machine unless command is explicitly privileged.
Privileged bypass must be extremely narrow and logged.

Quote submit: configuration valid and price not stale.
Quote accept: approved and not expired.
Quote convert: accepted and not already converted.
Order create: quote snapshot preserved.
Workflow start: order decomposed.
Asset activation: product instance not already active.
Order completion: mandatory items completed.
Event emission: outbox only after DB transition committed.

from_state | command | expected_to_state | allowed?

APPROVED + accept -> ACCEPTED allowed
EXPIRED + accept -> rejected
ACCEPTED + edit -> rejected
CONVERTED + convert -> rejected

No quote reaches ACCEPTED without frozen price.
No order reaches COMPLETED with incomplete mandatory item.
No product instance reaches ACTIVE without activation date.
No approval decision exists without actor and timestamp.

two quote conversions with same accepted quote
two modify orders targeting same asset
duplicate Kafka event completing same task
duplicate Zeebe job retry after external success

only one state transition succeeds
other operation becomes idempotent success or business rejection
no duplicate order/asset/event side effect

cannot insert ACTIVE product_instance without activation_date
cannot insert duplicate active asset operation guard
cannot insert unsupported status
cannot insert order_item referencing wrong order aggregate if FK exists

quote approval superseded after price change
quote expires before acceptance
quote accepted then converted once
order fails decomposition and enters fallout
fulfillment task timeout then external reconciliation succeeds
asset disconnect requires child add-on handling
subscription renewal does not duplicate product instance

is_approved
is_cancelled
is_completed
is_failed
is_active
is_pending

Command:
Aggregate:
Allowed source states:
Required input:
Required current-state checks:
Required related-object checks:
State transition:
Data mutation:
History/audit record:
Outbox event:
Idempotency behavior:
Failure behavior:

Command: ConvertQuoteToOrder
Aggregate: Quote + Order creation boundary
Allowed source states: Quote ACCEPTED
Required input: quote_id, quote_revision, idempotency_key, actor
Required current-state checks: quote not expired, not converted, price frozen
Required related-object checks: installed base versions still match quote snapshot
State transition: Quote ACCEPTED -> CONVERTED
Data mutation: insert order, order_items, update quote converted marker
History/audit record: quote conversion audit
Outbox event: OrderCreated
Idempotency behavior: same key returns existing order
Failure behavior: stale asset causes conversion rejection requiring requote