Multi-tenant event reservations with a Rails 8 JSON API and Angular SPA. Visitors claim seats; org managers publish events. Built around concurrency-safe seat locks, JWT auth, Pundit authorisation, natural-language search, and an MCP door so browsers and agents hit the same lock.
What a signed-in visitor browses. Anything down to its last seat says so in the list, before you commit to it.
An account is only for booking. The catalogue stays open without one.
Where a claim lands: confirmed seats, an .ics file, and a cancel that puts the seat back in the pool.
Five browsers and five agents reach for the last seat at once. Nine get sold_out, one gets the seat, and here the winner came in over MCP — the lock lives in the database, not in HTTP.
