Provisioning and billing without false success

A remote allocation cannot be undone by rolling back a local database transaction.

Order the operation

The orchestration enters the billing operation guard, runs billing preflight, runs provisioning preflight, verifies fresh availability, allocates and activates, checks matching confirmation, then reconciles billing. withOrderLine must also verify order eligibility, saved selection and immutable origin under authoritative assignment protection.

Require meaningful confirmation

ProvisioningAdapter returns confirmed: true only for the actual matching number and complete intended activation, not merely an HTTP success. Billing preflight checks pricing and commercial readiness without committing charges. Billing reconciliation runs only after confirmed provisioning and must throw on failure.

Retain uncertain outcomes

Durable idempotency and duplicate-allocation guards must span all relevant workers and customers. Record partial or unknown outcomes before throwing. Do not automatically retry uncertain or already-completed remote operations; use explicit audited recovery and independently verified outcomes. The public in-memory fixtures do not provide this production durability.

Public provisioning and billing interfaces

interface ProvisioningAdapter
{
    public function preflight(SelectionContext $context): void;
    public function allocateAndActivate(
        SelectionContext $context, string $canonical
    ): array;
}

interface BillingIntegration
{
    public function withOperation(
        SelectionContext $context, string $canonical, callable $operation
    ): mixed;
    public function preflight(SelectionContext $context, string $canonical): void;
    public function reconcile(
        SelectionContext $context, string $canonical, array $provisioned
    ): void;
}

Failure is an operational outcome

Failure is an operational outcome
Failure point	Required handling
Commercial or provisioning preflight	Block allocation; do not pretend the service is ready.
Availability verification	Stop before mutation; respect shared limiter and evidence rules.
Unknown allocation response	Record the uncertain remote outcome durably; do not blindly retry.
Confirmed allocation, failed billing reconciliation	Retain the partial outcome under idempotency protection and require explicit review.
Retry of a completed or uncertain order	Guard against a duplicate effect across workers and customers.