Domain Invariants & Business Rules (“The Law”)

The Fitness (GYM) domain enforces a strict set of business invariants. In membership-driven businesses, domain invariants protect recurring revenue, guarantee fair access to scarce class capacity, enforce contractual freeze terms, and keep the attendance ledger legally and financially trustworthy.

---

1. Summary Matrix of Fitness Invariants

#	Invariant Law	Target Aggregate	Enforcement Point	Consequence of Violation
1	The Active Membership Access Law	MembershipAgreement & MemberAccessEvent	Credential presentation at any access point	Entry denied with explicit reason; denial recorded in the attendance ledger.
2	The Class Capacity Law	ScheduledClassSession	Booking confirmation	Confirmation rejected; demand routed to the waitlist in arrival order.
3	The Waitlist Promotion Order Law	ScheduledClassSession	Seat release or cancellation	Promotion offers issued strictly in waitlist order; skipping or reordering is impossible.
4	The Freeze Suspension & Extension Law	MembershipAgreement	Freeze activation and expiry calculation	Freeze rejected when quota exhausted; access blocked for the freeze window; expiry extended day-for-day.
5	The PT Credit Consumption Law	PtCreditPackage & PtSessionAppointment	Session confirmation	Confirmation rejected when no credits remain; balance mutations only via ledger entries.
6	The Late Cancellation & No-Show Strike Law	ScheduledClassSession	Cancellation processing and session close	Strike accrual; booking privileges suspended when the rolling threshold is crossed.
7	The Single Active Membership Law	MembershipAgreement	Activation, renewal, and plan change	Rejection of any operation producing overlapping active agreements for one member.
8	The Sealed Attendance & Settlement Law	MemberAccessEvent & MembershipAgreement	Post-commit record editing	Absolute prevention of retroactive edits; corrections only via compensating entries.

---

2. In-Depth Invariant Specifications

1. The Active Membership Access Law

A credential presentation may resolve to Granted only when the presenting member holds a membership agreement in Active state, outside any freeze window, outside payment suspension, and within the agreement’s validity dates — or when the presenter holds a valid day pass or guest pass for the current date.

Rules

• The evaluation must execute against live contract state at presentation time; cached eligibility snapshots older than the configured freshness window are rejected.
• Zone entitlements are evaluated per access point: a Standard tier member presenting at the pool zone gate is denied with ZoneNotEntitled even when their membership is fully active.
• Off-peak plans presenting during published peak windows are denied with PeakHoursRestricted.
• Every decision — granted or denied — is recorded as an immutable MemberAccessEvent; silent denials are forbidden.

---

2. The Class Capacity Law

The number of confirmed bookings on a scheduled class session must never exceed its capacity ceiling:

$$\text{ConfirmedBookings}(\text{session}) \le \text{Capacity}(\text{session})$$

Rules

• Zero Overbooking: Under no circumstances — including staff override, walk-in admission, or system retry — may a session hold more confirmed bookings than its CapacityPolicy allows.
• Atomic Confirmation: Capacity evaluation and booking confirmation execute inside the same aggregate transaction; concurrent booking attempts for the last seat resolve to exactly one winner.
• Overflow Routing: Booking requests arriving at a full session are appended to the waitlist in strict arrival order; the member receives an explicit waitlisted outcome, never a silent failure.
• Capacity Changes: Reducing capacity below the current confirmed count is rejected; the club must first cancel or relocate affected bookings through the compensating flow.

---

3. The Waitlist Promotion Order Law

When a confirmed seat is released, the opportunity to claim it is offered strictly according to waitlist arrival order:

$$\text{Offer}(\text{seat}) \rightarrow \text{WaitlistEntry}_{\min(\text{ArrivalPosition})}$$

Rules

• First In, First Offered: The earliest pending waitlist entry receives the promotion offer; no member, staff role, or tier may jump the queue.
• Time-Boxed Offers: Each offer carries an expiry window (e.g., 30 minutes, shortened near session start). An unaccepted expired offer advances to the next entry; the expired entry may retain its position or be dropped according to club policy, recorded explicitly.
• Automatic Confirmation: Accepting an offer within its window transitions the entry to a confirmed booking, subject again to the Class Capacity Law.
• Late-Release Handling: Seats released after the cancellation cutoff still trigger promotion with a proportionally shortened offer window.

---

4. The Freeze Suspension & Extension Law

Freezing a membership is a contractual state transition with three inseparable effects: access is blocked for the freeze window, value consumption pauses, and the expiry date extends day-for-day:

$$\text{NewExpiry} = \text{OriginalExpiry} + \text{FreezeDurationDays}$$

Rules

• Quota Enforcement: The total freeze days consumed within a contract year must never exceed the plan’s freeze quota:

$$\sum \text{FreezeDays}(\text{contract year}) \le \text{Plan.FreezeQuota}$$

• Immediate Access Block: From the freeze start date, all credential presentations are denied with MembershipFrozen; class bookings overlapping the freeze window are early-cancelled automatically without strikes.
• No Retroactive Freezes: A freeze cannot start in the past. Documented exceptions (e.g., medical emergencies) are processed through the compensating retroactive correction policy, never by backdating.
• Early Resume: A member may end a freeze early; the expiry extension is recalculated from the actual freeze duration, and access restores immediately.

---

5. The PT Credit Consumption Law

A personal training session may transition to Confirmed only by consuming one available, unexpired credit from the member’s package:

$$\text{Confirm}(\text{session}) \implies \text{CreditBalance} \ge 1$$

Rules

• No Credit, No Confirmation: Scheduling intent may be recorded without credits, but confirmation — the state that reserves the trainer — is rejected when the balance is zero or all credits are expired.
• Ledger-Only Mutation: Credit balances change exclusively through append-only CreditLedgerEntry records (Purchased, Consumed, Restored, Forfeited, Expired); direct balance edits are impossible.
• Early Cancellation Restores: Cancelling a confirmed session before the cancellation cutoff restores the consumed credit.
• Late Cancellation & No-Show Forfeit: Cancelling after the cutoff, or failing to attend, forfeits the credit permanently; forfeiture is recorded as an explicit ledger entry, never a silent decrement.
• Trainer Cancellation Protects: When the club or trainer cancels, the credit is always restored regardless of timing.

---

6. The Late Cancellation & No-Show Strike Law

Scarce class seats are protected by an automated penalty policy:

$$\text{Strikes}(\text{member, rolling window}) \ge \text{Threshold} \implies \text{BookingPrivilegesSuspended}$$

Rules

• Strike Accrual: Every late cancellation and every no-show appends exactly one strike, stamped with its origin booking and session.
• Rolling Window Evaluation: Only strikes within the rolling policy window (e.g., 30 days) count toward the threshold; expired strikes are retained for history but excluded from evaluation.
• Automatic Suspension: Crossing the threshold (e.g., 3 strikes) immediately suspends class booking privileges for the policy-defined period; existing future bookings remain honored unless club policy states otherwise.
• Gym Floor Unaffected: Suspension restricts class booking only; general club access under the Active Membership Access Law is never blocked by strikes.
• Appeal Path: Strikes recorded in error are corrected exclusively through the compensating strike reversal policy with documented evidence.

---

7. The Single Active Membership Law

A member holds exactly one membership agreement in an active-family state (Active, Frozen, or PaymentSuspended) at any moment:

$$\forall \text{member}: ; \left| { a \in \text{Agreements} : a.\text{State} \in {\text{Active}, \text{Frozen}, \text{PaymentSuspended}} } \right| \le 1$$

Rules

• No Stacking: Selling a second membership to an active member is rejected; the commercial path is a plan change on the existing agreement.
• Plan Changes Transition, Never Overlap: Upgrades and downgrades are recorded as PlanChangeRecord transitions on the same agreement with a new PlanSnapshot, effective immediately or at the next billing anchor per plan terms.
• Rejoin Requires New Agreement: A cancelled or expired member rejoining the club opens a new agreement; the historical agreement remains sealed for audit.
• Renewal Extends In Place: Auto-renewal continues the same agreement into a new billing period without creating a second active contract.

---

8. The Sealed Attendance & Settlement Law

Once recorded, access events and settled billing periods are permanently sealed against modification or deletion.

Rules

• Immutable Attendance Ledger: Every MemberAccessEvent — granted or denied — is append-only. Occupancy manifests, safety evacuation lists, and billing verifications rely on this guarantee.
• Settled Period Immutability: A billing period marked settled by Accounting cannot be reopened; financial corrections execute as compensating adjustments in the current period.
• No In-Place Contract Edits: Historical freeze periods, plan snapshots, and cancellation records cannot be rewritten; corrections are appended as new dated records referencing their origin.
• Forensic Replay: The membership state as of any historical date must be reconstructible from the event trail alone, supporting dispute resolution and regulatory inquiry.