Making a real repo agent-legible — a before/after

@@ -344,6 +344,14 @@
       if (booking.status !== 'open') {
         throw new ConflictError('This booking is no longer open', 'BOOKING_NOT_OPEN');
       }
+      // A booking can still be `open` for a few minutes past its scheduled time — the
+      // expiry floor (now + MIN_CLAIM_WINDOW) keeps near-term bookings claimable, so
+      // a booking created shortly before its scheduled time outlives that time.
+      // Once that instant has passed a new claim is useless: reject it.
+      const scheduled = localToUtc(booking.scheduledDate, booking.scheduledTime);
+      if (scheduled.getTime() < Date.now()) {
+        throw new ConflictError('This booking is past its scheduled time', 'BOOKING_WINDOW_PASSED');
+      }
       const existing = await repo.findClaimByBookingAndAssignee(bookingId, actorId);

@@ -270,6 +270,25 @@
     expect(dup.json().error.code).toBe('DUPLICATE_CLAIM');
   });
 
+  it('claim on a booking whose scheduled time has passed is 409 BOOKING_WINDOW_PASSED', async () => {
+    const { owner, assignee, team } = await setupTeamWithAssignee();
+    // Scheduled a few minutes ago: accepted at creation via the submit grace, and
+    // the expiry floor keeps it `open` — but its scheduled time is already past.
+    const create = await createBookingAs(owner.auth, team.id, localDateTime(-3));
+    expect(create.statusCode).toBe(201);
+    expect(create.json().status).toBe('open');
+    const bookingId = create.json().id;
+
+    const claim = await app.inject({
+      method: 'POST',
+      url: `/api/v1/bookings/${bookingId}/claims`,
+      headers: { authorization: assignee.auth },
+      payload: {},
+    });
+    expect(claim.statusCode).toBe(409);
+    expect(claim.json().error.code).toBe('BOOKING_WINDOW_PASSED');
+  });
+
   it('claiming is standalone — no overlap warning even with a clashing assignee schedule', async () => {

@@ -139,6 +139,21 @@
     return scheduled;
   }
 
+  /**
+   * A booking can linger `open` for a few minutes past its scheduled time before
+   * the expiry sweep flips it — don’t let someone claim a booking that has
+   * already passed.
+   */
+  function ensureWindowNotPassed(booking: Booking, now: Date): void {
+    const scheduled = localToUtc(booking.scheduledDate, booking.scheduledTime);
+    if (scheduled.getTime() < now.getTime()) {
+      throw new ConflictError(
+        'This booking’s scheduled time has already passed',
+        'BOOKING_WINDOW_PASSED',
+        { scheduledDate: booking.scheduledDate, scheduledTime: booking.scheduledTime },
+      );
+    }
+  }
+
   async function ensureNoOwnerOverlap(input: {
@@ -344,6 +359,7 @@
       if (booking.status !== 'open') {
         throw new ConflictError('This booking is no longer open', 'BOOKING_NOT_OPEN');
       }
+      ensureWindowNotPassed(booking, new Date());
       const existing = await repo.findClaimByBookingAndAssignee(bookingId, actorId);

@@ -270,6 +270,23 @@
     expect(dup.json().error.code).toBe('DUPLICATE_CLAIM');
   });
 
+  it('rejects a claim once the booking’s scheduled time has passed (409 BOOKING_WINDOW_PASSED)', async () => {
+    const { owner, assignee, team } = await setupTeamWithAssignee();
+    // Scheduled a few minutes in the past: still inside the create-side submit grace, so
+    // the booking is born `open` and lingers open until the expiry sweep — but a claim
+    // must not succeed once its scheduled time has passed.
+    const bookingId = (await createBookingAs(owner.auth, team.id, localDateTime(-3))).json().id;
+
+    const res = await app.inject({
+      method: 'POST',
+      url: `/api/v1/bookings/${bookingId}/claims`,
+      headers: { authorization: assignee.auth },
+      payload: {},
+    });
+    expect(res.statusCode).toBe(409);
+    expect(res.json().error.code).toBe('BOOKING_WINDOW_PASSED');
+  });
+
   it('claiming is standalone — no overlap warning even with a clashing assignee schedule', async () => {