Timed Auction Service

Give each auction one serialized write authority. Check its deadline and increment policy under the same lock as bid insertion, then finalize exactly one outcome with an outbox event independently of projection or notification delays.

1. Define fixed end time, exact unit bounds, increment, bidder eligibility and the admission-time ordering contract. Route writes to one fenced authority per auction.
2. Scope idempotency by bidder and auction and compare immutable payloads. Check an existing result first; then lock the auction, read authority time and reject after the deadline or when the required increment is not met.
3. Append the accepted bid and update the highest bid atomically. Return the committed sequence so the caller can distinguish acceptance from a delayed read projection.
4. The close worker locks the auction after the deadline, snapshots the committed highest eligible bid and stores CLOSED plus a winner/no-bids event in one transaction. Retries return the same outcome; payment execution is a separate workflow.

• Two concurrent bids see one serialized increment policy.
• A delayed close worker does not permit post-deadline bids.
• Retrying an accepted bid after closing returns its original outcome.
• Conflicting reuse of an idempotency key fails and closing emits one stable result.

Trade-offs to explain

• Per-auction serialization bounds throughput for a single hot auction.
• Admission-time ordering is implementable but differs from fairness by client send time.
• Asynchronous projections scale reads but must show their revision and cannot approve bids.