Equipment lending

A lending desk: browse equipment, open a reservation request, have staff review it, then check the item out and return it. Two slices — asset and booking — keep the equipment catalog and the reservation calendar independent of each other.

What it demonstrates

• Policy in the service, not the URL. Staff identity is the authenticated subject matched against APP_STAFF_SUBJECTS; no form field or query parameter can claim it.
• The database as the authority. Approved and checked-out intervals cannot overlap for the same item: a btree_gist exclusion constraint enforces it even when two requests race.
• Half-open intervals. Reservation times are UTC epoch microseconds over [start, end); pending requests never block availability.

What to steal

• A domain rule that check-then-insert cannot make safe — moved into the schema itself and mapped back to a friendly error.
• Staff actions authorized from the authenticated subject, with the decision living in the service where tests can call it directly.