# TD-049HighRuntimecase study

Completing a Booking Before the Night — and Without the Money

The venue could mark the show done before it happened, and before the deposit and rent were paid

Published Nov 5, 2026

Executive Summary

The completeBooking decision checked only the actor and the status. Nothing verified that the night had actually ended, and nothing verified that the deposit and rent were paid — so a venue could complete a booking hours early or with money outstanding, which unlocked ratings and counted the night toward the filmmaker's record with no record of the shortfall. The fix adds a time gate and a payment gate, with an explicit acknowledgement path for unpaid completions.

The Prompt

“Add a completeBooking callable so a venue can mark a confirmed screening as completed.”

The Flaw

The only checks were actor and status. Nothing verified that the night had actually ended, and nothing verified that the deposit and rent were paid. A venue could complete a booking the moment it was confirmed — hours before the showtime — or with money outstanding. Completion unlocked ratings and counted the night toward the filmmaker's record while the platform held no record of what was owed. The agent implemented the happy path and skipped the forbidden states.

Risk & Impact

[Correctness] A venue could close a booking with the deposit and rent unpaid; the platform recorded the night as completed and opened ratings without ever flagging the outstanding money.

Cost: Unpaid bookings close silently — the filmmaker's record and ratings update while money is owed, with no warning and no record of the shortfall.

Code Comparison

❌ Vulnerable (AI generated)

functions/src/bookings.tsts

// decideComplete — the venue marks a confirmed screening as having happened

export const decideComplete = (status: BookingStatus, actor: Actor): Decision => {

if (actor !== 'venue') return reject('forbidden', 'Only the venue can complete a booking.');

if (status !== 'confirmed') return reject('already-final', `This booking is already ${status}.`);

return { ok: true };

};

❌ Vulnerable (AI generated)

functions/src/bookings.tsts

// decideComplete — the venue marks a confirmed screening as having happened

export const decideComplete = (status: BookingStatus, actor: Actor): Decision => {

if (actor !== 'venue') return reject('forbidden', 'Only the venue can complete a booking.');

if (status !== 'confirmed') return reject('already-final', `This booking is already ${status}.`);

return { ok: true };

};

✅ Hardened (production ready)

functions/src/bookings.tsts

export type CompleteContext = {

lastSlotEndMillis: number | null; // null for a legacy booking without one

nowMillis: number;

priceCents: number;

depositPaid: boolean;

rentPaid: boolean;

acknowledgeUnpaid: boolean; // the venue has seen the warning

};

export const decideComplete = (

status: BookingStatus,

actor: Actor,

ctx: CompleteContext,

): Decision => {

if (actor !== 'venue') return reject('forbidden', 'Only the venue can complete a booking.');

if (status !== 'confirmed') return reject('already-final', `This booking is already ${status}.`);

// The night must be over before completion can be claimed.

if (ctx.lastSlotEndMillis !== null && ctx.nowMillis < ctx.lastSlotEndMillis) {

return reject('too-early', 'The night has not ended yet.');

}

// The money must be in — or the venue acknowledges that it is not.

const unpaid = unpaidKinds(ctx);

if (unpaid.length && !ctx.acknowledgeUnpaid) {

return reject('unpaid', `The ${unpaid.join(' and ')} has not been paid.`);

}

return { ok: true, unpaid };

};

The Fix

Gate completion on two conditions: the last night of the run must have ended, and the deposit + rent must be paid — or the venue explicitly acknowledges the shortfall, which is then recorded and surfaced.

Prevention

[manual] For every state-changing action, list the forbidden transitions (time, payment, authorization) alongside the happy path.
[ci] Unit tests must assert every refusal code for a business action, not just the success case.

Why This Happened

Root cause: the prompt omitted Rule 2 — the guardrails that would have caught this. See the full guide →

Sources

Marketplace-rebuild pilot-run report (anonymized), 2026-11-05

Is your codebase vulnerable to this?

Run Diagnostic on My Project →