slotlock 0.2.0 → 0.3.0

package/store.js

@@ -2,7 +2,8 @@
 // Domain policy (who may reserve, pricing, holds) belongs to future callers; this layer owns the
 // reliable how: idempotent schema apply, EXCLUDE-arbitrated inserts with a structured conflict.
 import { createHash, randomUUID } from 'node:crypto';
-import { SLOTLOCK_CORE_DDL, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_TENANT_CONTEXT_SETTING, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, } from './ddl.js';
+import ICAL from 'ical.js';
+import { SLOTLOCK_CORE_DDL, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockTenantLockKey, } from './ddl.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
 import { SLOTLOCK_CALENDAR_HORIZON_DAYS, assertBoundedSearchWindow, expandRules, invalidWindowError, } from './rules.js';
 import { CalendarContractError, CalendarExpansionLimitError, expandCalendarEventSeries, normalizeCalendarEventContent, } from './sync.js';
@@ -30,6 +31,13 @@ export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
 export const SLOTLOCK_MAX_EVENT_DURATION_DAYS = 3_660;
 const DAY_MS = 24 * 60 * 60 * 1000;
 const MAX_CALENDAR_WINDOW_MS = SLOTLOCK_CALENDAR_HORIZON_DAYS * DAY_MS;
+/**
+ * Longest window a recurring series is stored (materialized) for: the 367-day search window plus
+ * two days. The rolling horizon starts a day before the current UTC day and must reach 367 days
+ * past its end, so that a search of the full 367 days from any moment of the day is complete.
+ */
+export const SLOTLOCK_MATERIALIZATION_WINDOW_DAYS = SLOTLOCK_CALENDAR_HORIZON_DAYS + 2;
+const MAX_MATERIALIZATION_WINDOW_MS = SLOTLOCK_MATERIALIZATION_WINDOW_DAYS * DAY_MS;
 const MAX_EVENT_DURATION_MS = SLOTLOCK_MAX_EVENT_DURATION_DAYS * DAY_MS;
 const MAX_RESOURCE_LIST_LIMIT = 1_000;
 /** Highest per-tenant resource cap `createResource` accepts. */
@@ -57,13 +65,16 @@ const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3
 const AGENT_EVENT_OWNER_PATTERN = /^agent:[0-9a-f]{64}$/;
 /** Store-owned coverage source for bounded, locally materialized recurring events. */
 export const SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE = 'slotlock:local-recurrence-materialization';
-/** Stable daily target shared by the event writer, maintenance worker, and readiness proof. */
+/**
+ * Stable daily target shared by the event writer, maintenance worker, and readiness proof: from a
+ * day before the current UTC day to 367 days past its end (SLOTLOCK_MATERIALIZATION_WINDOW_DAYS).
+ */
 export function calendarEventRollingHorizon(now = new Date()) {
     if (!Number.isFinite(now.getTime()))
         throw invalidWindowError();
     const midnight = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
     const start = new Date(midnight - DAY_MS);
-    return { start, end: new Date(start.getTime() + SLOTLOCK_CALENDAR_HORIZON_DAYS * DAY_MS) };
+    return { start, end: new Date(start.getTime() + MAX_MATERIALIZATION_WINDOW_MS) };
 }
 /**
  * A stored series expanded from the cursor its last expansion left, or `null` when there is none it
@@ -98,15 +109,118 @@ function seriesCursorJson(tx, cursor) {
 function rolledWindow(stored, horizon) {
     if (stored.start <= horizon.start && stored.end >= horizon.end)
         return null;
-    if (stored.end.getTime() - horizon.start.getTime() > MAX_CALENDAR_WINDOW_MS)
+    if (stored.end.getTime() - horizon.start.getTime() > MAX_MATERIALIZATION_WINDOW_MS)
         return null;
     return { start: horizon.start, end: stored.end > horizon.end ? stored.end : horizon.end };
 }
+/**
+ * How far past a rule's UNTIL, read as UTC, an occurrence can still end, beyond the series' own
+ * length. UNTIL bounds an occurrence's start (RFC 5545 §3.3.10), but a floating or date-only UNTIL
+ * is a wall time in a zone from UTC-12 to UTC+14, or a whole day; a start in an hour the clocks skip
+ * moves forward; and an occurrence's wall-clock end can pass its exact length by a clock change, a
+ * whole day where a zone moved across the date line. Three days covers them together.
+ */
+const SERIES_UNTIL_SLACK_MS = 3 * DAY_MS;
+/** Stored-series windows a COUNT rule is followed through, from its start, to find its end. */
+const SERIES_COUNT_SEARCH_WINDOWS = 30;
+/**
+ * A time by which every occurrence of a recurring series ends, moved ones included, or `null` when
+ * it may go on: its rule has neither UNTIL nor COUNT as ical.js reads it (as the expansion does),
+ * or its COUNT occurrences are not all found within SERIES_COUNT_SEARCH_WINDOWS windows from its
+ * start, or that search is over its budget. A COUNT series ends a day after its last occurrence as
+ * the expansion reads it today, so a later reading of its end may be longer.
+ */
+function seriesEndsBy(event) {
+    const recurrence = event.recurrence;
+    if (!recurrence)
+        return null;
+    let rule;
+    try {
+        rule = ICAL.Recur.fromString(recurrence.rrule);
+    }
+    catch {
+        return null;
+    }
+    let endsBy;
+    if (rule.until) {
+        // ical.js stops at the first occurrence past UNTIL; a floating or date UNTIL reads as UTC.
+        const untilMs = rule.until.toUnixTime() * 1000;
+        endsBy = untilMs + (event.end.getTime() - event.start.getTime()) + SERIES_UNTIL_SLACK_MS;
+    }
+    else if (rule.count) {
+        const last = lastCountedOccurrenceEnd(event, rule.count);
+        if (last === null)
+            return null;
+        endsBy = last + DAY_MS;
+    }
+    else {
+        return null;
+    }
+    for (const exception of recurrence.exceptions ?? []) {
+        if (!exception.cancelled && exception.end && exception.end.getTime() > endsBy) {
+            endsBy = exception.end.getTime();
+        }
+    }
+    const ends = new Date(endsBy);
+    return Number.isFinite(ends.getTime()) ? ends : null;
+}
+/**
+ * The latest end among a COUNT series' occurrences, expanded window by window from its start with
+ * exceptions left out (so a cancelled or moved one is still found in its own place), or `null` when
+ * fewer than `count` turn up. ical.js yields at most COUNT occurrences, so once `count` are found
+ * there are no more. An occurrence is counted in the window its start falls in.
+ */
+function lastCountedOccurrenceEnd(event, count) {
+    const rrule = event.recurrence?.rrule;
+    if (rrule === undefined)
+        return null;
+    const series = { ...event, recurrence: { rrule } };
+    let cursor = null;
+    let found = 0;
+    let lastEnd = Number.NEGATIVE_INFINITY;
+    let from = event.start.getTime();
+    try {
+        for (let window = 0; window < SERIES_COUNT_SEARCH_WINDOWS; window++) {
+            const to = from + MAX_MATERIALIZATION_WINDOW_MS;
+            const expansion = expandCalendarEventSeries(series, { start: new Date(from), end: new Date(to) }, { cursor, stored: true });
+            for (const occurrence of expansion.occurrences) {
+                if (occurrence.start.getTime() < from)
+                    continue;
+                found += 1;
+                if (occurrence.end.getTime() > lastEnd)
+                    lastEnd = occurrence.end.getTime();
+            }
+            if (found >= count)
+                return lastEnd;
+            cursor = expansion.cursor;
+            from = to;
+        }
+    }
+    catch (error) {
+        if (error instanceof CalendarExpansionLimitError || error instanceof CalendarContractError) {
+            return null;
+        }
+        throw error;
+    }
+    return null;
+}
+/**
+ * The recurrence_ends_by column for an event, as text: NULL for a one-off, 'infinity' for no known
+ * end. Bind it as text (`::text::timestamptz`): postgres.js serializes a timestamptz parameter
+ * through Date, which cannot hold 'infinity'.
+ */
+function recurrenceEndsByColumn(event) {
+    if (!event.recurrence)
+        return null;
+    return seriesEndsBy(event)?.toISOString() ?? 'infinity';
+}
 /** The roll's `after`, checked, or `undefined` for a pass's first batch. */
 function rollCursor(after) {
     if (after === undefined)
         return undefined;
-    if (!(after.materializedEndsAt instanceof Date) ||
+    const retryAt = after.rollRetryAt ?? null;
+    if ((retryAt !== null && (!(retryAt instanceof Date) || !Number.isFinite(retryAt.getTime()))) ||
+        !(after.materializedEndsAt instanceof Date) ||
         !Number.isFinite(after.materializedEndsAt.getTime()) ||
         !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(after.eventId)) {
         throw Object.assign(new Error('Slotlock horizon cursor must be a previous batch\'s `next`'), {
@@ -156,10 +270,18 @@ async function withPinnedSearchPath(tx, operation) {
 /**
  * The deployment DDL refuses a `slotlock` schema that another role controls with SQLSTATE 42501 and
  * its findings as a JSON array in DETAIL. Surface that as `unsafe_slotlock_schema` with `reasons`,
- * keeping the database's error (and its HINT) as `cause`; any other failure passes through unchanged.
+ * keeping the database's error (and its HINT) as `cause`. It refuses a schema a newer release
+ * migrated with SQLSTATE 55000: surface that as `schema_newer`. Any other failure passes through.
  */
 function schemaControlRefusal(error) {
     const failure = error;
+    if (failure?.code === '55000' &&
+        typeof failure.message === 'string' &&
+        failure.message.startsWith(SLOTLOCK_SCHEMA_NEWER_REFUSAL)) {
+        return Object.assign(new Error(failure.message, { cause: error }), {
+            code: 'schema_newer',
+        });
+    }
     if (failure?.code !== '42501' ||
         typeof failure.message !== 'string' ||
         !failure.message.startsWith(SLOTLOCK_SCHEMA_CONTROL_REFUSAL)) {
@@ -180,6 +302,236 @@ function schemaControlRefusal(error) {
         reasons,
     });
 }
+/** PostgreSQL lock_not_available: a lock wait passed lock_timeout. */
+const LOCK_NOT_AVAILABLE = '55P03';
+const DEFAULT_MIGRATION_LOCK_TIMEOUT_MS = 1_000;
+const DEFAULT_MIGRATION_STATEMENT_TIMEOUT_MS = 15 * 60 * 1000;
+const DEFAULT_MIGRATION_ATTEMPTS = 5;
+const SLOTLOCK_CORE_DDL_SHA256 = createHash('sha256').update(SLOTLOCK_CORE_DDL).digest('hex');
+function migrationSettings(options) {
+    const lockTimeoutMs = options?.lockTimeoutMs ?? DEFAULT_MIGRATION_LOCK_TIMEOUT_MS;
+    const statementTimeoutMs = options?.statementTimeoutMs ?? DEFAULT_MIGRATION_STATEMENT_TIMEOUT_MS;
+    const attempts = options?.attempts ?? DEFAULT_MIGRATION_ATTEMPTS;
+    const whole = (value, max) => Number.isSafeInteger(value) && value >= 1 && value <= max;
+    if (!whole(lockTimeoutMs, 600_000) ||
+        !whole(statementTimeoutMs, 86_400_000) ||
+        !whole(attempts, 20)) {
+        throw Object.assign(new Error('Slotlock migration lockTimeoutMs must be 1-600000, statementTimeoutMs 1-86400000 and attempts 1-20, whole numbers'), { code: 'invalid_migration_options' });
+    }
+    return { lockTimeoutMs, statementTimeoutMs, attempts };
+}
+/**
+ * Run one migration step: in a transaction (or a savepoint of the caller's), with names resolved
+ * in pg_catalog only, serialized with every other migration of this database, and with the lock and
+ * statement timeouts set. A step that waits past its lock timeout is rolled back and tried again
+ * after a pause, up to `attempts` times. The caller's own timeouts are put back afterwards.
+ */
+async function inMigration(executor, options, step) {
+    const settings = migrationSettings(options);
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await inTransaction(executor, (tx) => withPinnedSearchPath(tx, async () => {
+                // Taken before the timeouts are set: waiting for another migration holds up no query.
+                await tx `SELECT pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended(${SCHEMA_APPLY_LOCK}, 0))`;
+                const [caller] = await tx `
+            SELECT pg_catalog.current_setting('lock_timeout') AS lock,
+                   pg_catalog.current_setting('statement_timeout') AS statement`;
+                await tx `
+            SELECT pg_catalog.set_config('lock_timeout', ${`${settings.lockTimeoutMs}ms`}, true),
+                   pg_catalog.set_config('statement_timeout', ${`${settings.statementTimeoutMs}ms`}, true)`;
+                const result = await step(tx);
+                await tx `
+            SELECT pg_catalog.set_config('lock_timeout', ${caller?.lock ?? '0'}, true),
+                   pg_catalog.set_config('statement_timeout', ${caller?.statement ?? '0'}, true)`;
+                return result;
+            }));
+        }
+        catch (error) {
+            if (pgCode(error) !== LOCK_NOT_AVAILABLE)
+                throw error;
+            if (attempt >= settings.attempts) {
+                throw Object.assign(new Error(`Slotlock migration gave up after ${attempt} attempts to take its locks within ${settings.lockTimeoutMs} ms: a long transaction holds a slotlock table. Run it again once that transaction ends`, { cause: error }), { code: 'schema_lock_timeout' });
+            }
+            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 250, 2_000) + Math.floor(Math.random() * 250)));
+        }
+    }
+}
+/**
+ * A digest of what the migration defines in the `slotlock` schema: its tables and columns,
+ * constraints (and whether each is validated), indexes, triggers and functions, and whether PUBLIC
+ * holds any right on them. Grants to other roles, ownership and row-level security are left out:
+ * applyTenantRls and grantApplicationRole change those after applySchema has recorded the digest.
+ * Objects of an extension are left out too. Deparsed definitions depend on search_path, so this runs
+ * with it pinned, as the migration does.
+ */
+async function slotlockCatalogDigest(tx) {
+    const [row] = await tx `
+    WITH schema AS (
+      SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = 'slotlock'
+    ), members AS (
+      SELECT objid FROM pg_catalog.pg_depend WHERE deptype = 'e'
+    ), items (item) AS (
+      SELECT 'relation ' || rel.relname || ' ' || rel.relkind::text || ' '
+             || EXISTS (SELECT 1 FROM pg_catalog.aclexplode(rel.relacl) acl WHERE acl.grantee = 0)::text
+        FROM pg_catalog.pg_class rel, schema
+       WHERE rel.relnamespace = schema.oid AND rel.oid NOT IN (SELECT objid FROM members)
+      UNION ALL
+      SELECT 'column ' || rel.relname || '.' || att.attname || ' '
+             || pg_catalog.format_type(att.atttypid, att.atttypmod) || ' ' || att.attnotnull::text || ' '
+             || COALESCE(pg_catalog.pg_get_expr(def.adbin, def.adrelid), '')
+        FROM pg_catalog.pg_attribute att
+        JOIN pg_catalog.pg_class rel ON rel.oid = att.attrelid
+        JOIN schema ON rel.relnamespace = schema.oid
+        LEFT JOIN pg_catalog.pg_attrdef def ON def.adrelid = att.attrelid AND def.adnum = att.attnum
+       WHERE rel.relkind IN ('r', 'p') AND att.attnum > 0 AND NOT att.attisdropped
+      UNION ALL
+      SELECT 'constraint ' || rel.relname || '.' || con.conname || ' '
+             || pg_catalog.pg_get_constraintdef(con.oid) || ' ' || con.convalidated::text
+        FROM pg_catalog.pg_constraint con
+        JOIN pg_catalog.pg_class rel ON rel.oid = con.conrelid
+        JOIN schema ON rel.relnamespace = schema.oid
+      UNION ALL
+      SELECT 'index ' || pg_catalog.pg_get_indexdef(idx.indexrelid)
+        FROM pg_catalog.pg_index idx
+        JOIN pg_catalog.pg_class rel ON rel.oid = idx.indrelid
+        JOIN schema ON rel.relnamespace = schema.oid
+      UNION ALL
+      SELECT 'trigger ' || pg_catalog.pg_get_triggerdef(trg.oid) || ' ' || trg.tgenabled::text
+        FROM pg_catalog.pg_trigger trg
+        JOIN pg_catalog.pg_class rel ON rel.oid = trg.tgrelid
+        JOIN schema ON rel.relnamespace = schema.oid
+       WHERE NOT trg.tgisinternal
+      UNION ALL
+      SELECT 'function ' || fn.oid::pg_catalog.regprocedure::text || ' ' || fn.prosecdef::text || ' '
+             || fn.provolatile::text || ' ' || COALESCE(fn.proconfig::text, '') || ' '
+             || pg_catalog.md5(fn.prosrc) || ' '
+             || EXISTS (SELECT 1 FROM pg_catalog.aclexplode(
+                          COALESCE(fn.proacl, pg_catalog.acldefault('f', fn.proowner))) acl
+                         WHERE acl.grantee = 0)::text
+        FROM pg_catalog.pg_proc fn, schema
+       WHERE fn.pronamespace = schema.oid AND fn.oid NOT IN (SELECT objid FROM members)
+      UNION ALL
+      SELECT 'extension ' || ext.extname || ' ' || ext.extnamespace::pg_catalog.regnamespace::text
+        FROM pg_catalog.pg_extension ext
+       WHERE ext.extname = 'btree_gist'
+    )
+    SELECT pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(
+             COALESCE(pg_catalog.string_agg(item, pg_catalog.chr(10) ORDER BY item), ''),
+             'UTF8')), 'hex') AS digest
+      FROM items`;
+    return row?.digest ?? '';
+}
+/**
+ * Whether the schema is exactly what this release's applySchema last left: the same version, DDL
+ * and catalog digest, and no table left without FORCE by an interrupted migration. Reading needs
+ * the right to (the deployment role owns the table); without it the full migration runs and refuses
+ * what it must.
+ */
+async function slotlockSchemaUpToDate(tx) {
+    const [present] = await tx `
+    SELECT COALESCE(pg_catalog.has_table_privilege(
+             pg_catalog.to_regclass('slotlock.schema_version'), 'SELECT'), false) AS versioned,
+           COALESCE(pg_catalog.has_table_privilege(
+             pg_catalog.to_regclass('slotlock.deployment_lifted_row_security'), 'SELECT'), false)
+             AS lifted`;
+    if (!present?.versioned || !present.lifted)
+        return false;
+    const [recorded] = await tx `
+    SELECT version, ddl_sha256, catalog_sha256,
+           EXISTS (SELECT 1 FROM slotlock.deployment_lifted_row_security) AS lifted
+      FROM slotlock.schema_version
+     WHERE singleton`;
+    if (!recorded ||
+        recorded.lifted ||
+        recorded.version !== SLOTLOCK_SCHEMA_VERSION ||
+        recorded.ddl_sha256 !== SLOTLOCK_CORE_DDL_SHA256 ||
+        recorded.catalog_sha256 === null) {
+        return false;
+    }
+    return recorded.catalog_sha256 === (await slotlockCatalogDigest(tx));
+}
+/** Whether a constraint in the `slotlock` schema is still NOT VALID (old rows broke it). */
+async function slotlockConstraintUnvalidated(tx) {
+    const [row] = await tx `
+    SELECT EXISTS (
+      SELECT 1
+        FROM pg_catalog.pg_constraint con
+        JOIN pg_catalog.pg_class rel ON rel.oid = con.conrelid
+        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace
+       WHERE ns.nspname = 'slotlock' AND NOT con.convalidated
+    ) AS unvalidated`;
+    return row?.unvalidated === true;
+}
+/**
+ * Whether every tenant table has forced RLS and only its tenant policy, bound to `setting`, whose
+ * live fingerprint (computed as the RLS DDL computes it) matches the contract the DDL recorded.
+ */
+async function tenantRlsUpToDate(tx, setting) {
+    const [present] = await tx `
+    SELECT COALESCE(pg_catalog.has_table_privilege(
+             pg_catalog.to_regclass('slotlock.rls_policy_contracts'), 'SELECT'), false) AS readable`;
+    if (!present?.readable)
+        return false;
+    const tables = [...SLOTLOCK_TENANT_TABLES];
+    const [state] = await tx `
+    SELECT pg_catalog.bool_and(
+             rel.relrowsecurity AND rel.relforcerowsecurity
+             AND (SELECT pg_catalog.count(*) FROM pg_catalog.pg_policy every
+                   WHERE every.polrelid = rel.oid) = 1
+             AND pg_catalog.obj_description(pol.oid, 'pg_policy') = ${`slotlock:tenant-context:${setting}`}
+             AND contract.tenant_context_setting = ${setting}
+             AND contract.policy_fingerprint = pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(
+                   pg_catalog.concat_ws(
+                     pg_catalog.chr(31), live.policyname, live.permissive, live.roles::text, live.cmd,
+                     COALESCE(live.qual, ''), COALESCE(live.with_check, '')
+                   ),
+                   'UTF8')), 'hex')
+           ) AS current,
+           pg_catalog.count(*)::int AS matched
+      FROM pg_catalog.unnest(${tables}::text[]) AS wanted(name)
+      JOIN pg_catalog.pg_namespace ns ON ns.nspname = 'slotlock'
+      JOIN pg_catalog.pg_class rel ON rel.relnamespace = ns.oid AND rel.relname = wanted.name
+      JOIN pg_catalog.pg_policy pol ON pol.polrelid = rel.oid AND pol.polname = 'tenant_isolation_v1'
+      JOIN pg_catalog.pg_policies live
+        ON live.schemaname = 'slotlock' AND live.tablename = wanted.name
+       AND live.policyname = 'tenant_isolation_v1'
+      JOIN slotlock.rls_policy_contracts contract ON contract.table_name = wanted.name`;
+    return state?.current === true && state.matched === tables.length;
+}
+/**
+ * The schema version recorded by the last migration, or `null` when there is none this role can
+ * read: no schema, a schema from 0.2 or earlier, or a role not yet granted the function (run
+ * `slotlock migrate`, which grants it).
+ */
+export async function readSlotlockSchemaVersion(sql) {
+    const [readable] = await sql `
+    SELECT COALESCE(pg_catalog.has_function_privilege(
+             pg_catalog.to_regprocedure('slotlock.installed_schema_version()'), 'EXECUTE'), false)
+             AS readable`;
+    if (!readable?.readable)
+        return null;
+    const [row] = await sql `
+    SELECT slotlock.installed_schema_version() AS version`;
+    return row?.version ?? null;
+}
+/**
+ * Refuse to serve a schema another release migrated: `schema_outdated` when it is older than this
+ * release (or unversioned), so `slotlock migrate` must run first; `schema_newer` when a newer release
+ * migrated it, whose schema this release's code does not know. Both carry `installed` and `expected`.
+ */
+export async function assertSlotlockSchemaCurrent(sql) {
+    const installed = await readSlotlockSchemaVersion(sql);
+    if (installed === SLOTLOCK_SCHEMA_VERSION)
+        return;
+    const newer = installed !== null && installed > SLOTLOCK_SCHEMA_VERSION;
+    throw Object.assign(new Error(newer
+        ? `The slotlock schema is version ${installed}, migrated by a newer release; this release serves version ${SLOTLOCK_SCHEMA_VERSION}. Serve it with that release or a later one`
+        : `The slotlock schema is ${installed === null ? 'unversioned (0.2 or earlier)' : `version ${installed}`}; this release serves version ${SLOTLOCK_SCHEMA_VERSION}. Run \`slotlock migrate\` with this release first`), {
+        code: newer ? 'schema_newer' : 'schema_outdated',
+        installed,
+        expected: SLOTLOCK_SCHEMA_VERSION,
+    });
+}
 function isFiniteWindow(window) {
     return (window.start instanceof Date &&
         window.end instanceof Date &&
@@ -196,7 +548,15 @@ function isValidEventOwnerRef(value) {
 function isValidResourceId(value) {
     return UUID_PATTERN.test(value);
 }
+function assertValidVisibility(visibility) {
+    if (visibility !== undefined && visibility !== 'shared' && visibility !== 'private') {
+        throw Object.assign(new Error("Slotlock resource visibility must be 'shared' or 'private'"), {
+            code: 'invalid_visibility',
+        });
+    }
+}
 function assertValidResourceInput(params) {
+    assertValidVisibility(params.visibility);
     if (params.externalRef !== undefined &&
         (params.externalRef.trim().length === 0 || Buffer.byteLength(params.externalRef, 'utf8') > 500)) {
         throw Object.assign(new Error('Slotlock externalRef must be 1-500 UTF-8 bytes'), {
@@ -252,6 +612,41 @@ function toReservation(row) {
         source: row.source,
     };
 }
+function toHold(row) {
+    return {
+        id: row.id,
+        resourceId: row.resource_id,
+        start: row.starts_at,
+        end: row.ends_at,
+        bufferAfterMs: Number(row.buffer_after_ms),
+        expiresAt: row.expires_at,
+        source: row.source,
+    };
+}
+/** A keyset cursor `{ start, id }` from the last row of a previous page, checked. */
+function pageCursor(after) {
+    if (after !== undefined &&
+        (!(after.start instanceof Date) ||
+            !Number.isFinite(after.start.getTime()) ||
+            !UUID_PATTERN.test(after.id))) {
+        throw Object.assign(new Error('Slotlock page cursor is invalid'), {
+            code: 'invalid_cursor',
+        });
+    }
+    return { start: after?.start ?? null, id: after?.id ?? null };
+}
+function pageLimit(limit) {
+    const value = limit ?? 100;
+    if (!Number.isSafeInteger(value) || value <= 0 || value > MAX_CALENDAR_LIST_LIMIT) {
+        throw Object.assign(new Error('Slotlock list limit must be 1-1000'), {
+            code: 'invalid_limit',
+        });
+    }
+    return value;
+}
+function invalidIdentityError(message) {
+    return Object.assign(new Error(message), { code: 'invalid_identity' });
+}
 function eventExceptionsForJson(exceptions) {
     return (exceptions ?? []).map((exception) => {
         const result = {
@@ -487,6 +882,14 @@ async function replaceCalendarEventOccurrences(tx, params) {
       )`;
     }
 }
+/** A recurring series' materialization window: finite, forward, and at most 369 days. */
+function seriesWindow(window) {
+    if (!isFiniteWindow(window) ||
+        window.end.getTime() - window.start.getTime() > MAX_MATERIALIZATION_WINDOW_MS) {
+        throw new CalendarContractError('invalid_icalendar');
+    }
+    return { start: new Date(window.start), end: new Date(window.end) };
+}
 function calendarWindow(window) {
     if (!isFiniteWindow(window) ||
         window.end.getTime() - window.start.getTime() > MAX_CALENDAR_WINDOW_MS) {
@@ -507,7 +910,7 @@ function oneOffEventWindow(event, requested) {
     if (!isFiniteWindow(window) ||
         window.start > event.start ||
         window.end < event.end ||
-        window.end.getTime() - window.start.getTime() > Math.max(MAX_CALENDAR_WINDOW_MS, duration)) {
+        window.end.getTime() - window.start.getTime() > Math.max(MAX_MATERIALIZATION_WINDOW_MS, duration)) {
         throw new CalendarContractError('invalid_icalendar');
     }
     return { start: new Date(window.start), end: new Date(window.end) };
@@ -583,9 +986,55 @@ async function calendarOwnerCommandCount(tx, tenantRef, ownerRef) {
     }
     return count;
 }
-async function findCalendarOverlap(sql, resourceId, occurrences) {
+/**
+ * The end of every event cancellation, under the event's identity and row locks: remove the event
+ * (when there is one) and its occupation, leave the identity's tombstone at `revision`, and record
+ * the command in `commandOwnerRef`'s namespace for replay.
+ */
+async function finishCalendarCancel(tx, params) {
+    const eventId = params.eventId ?? randomUUID();
+    if (params.eventId !== null) {
+        await tx `
+      DELETE FROM slotlock.reservations
+       WHERE id IN (
+         SELECT reservation_id FROM slotlock.calendar_event_occurrences
+          WHERE event_id = ${eventId} AND reservation_id IS NOT NULL
+       )`;
+        await tx `
+      DELETE FROM slotlock.calendar_events
+       WHERE id = ${eventId}
+         AND tenant_ref = ${params.tenantRef}
+         AND owner_ref = ${params.ownerRef}`;
+    }
+    await tx `
+    INSERT INTO slotlock.calendar_event_tombstones (
+      tenant_ref, owner_ref, external_ref, event_id, revision
+    ) VALUES (
+      ${params.tenantRef}, ${params.ownerRef}, ${params.externalRef}, ${eventId}, ${params.revision}
+    )`;
+    await tx `
+    INSERT INTO slotlock.calendar_event_commands (
+      tenant_ref, owner_ref, idempotency_key, operation, payload_hash, event_id, external_ref,
+      result_revision, occurrence_count
+    ) VALUES (
+      ${params.tenantRef}, ${params.commandOwnerRef}, ${params.idempotencyKey}, 'cancel',
+      ${params.payloadHash}, ${eventId}, ${params.externalRef}, ${params.revision}, 0
+    )`;
+    return {
+        ok: true,
+        eventId,
+        externalRef: params.externalRef,
+        revision: params.revision,
+        idempotent: false,
+    };
+}
+/**
+ * The row an event write lost to. The write was rolled back, so the event's own rows from before
+ * it are still there and are left out: they were to be replaced, and never block the event.
+ */
+async function findCalendarOverlap(sql, resourceId, occurrences, eventId) {
     for (const occurrence of occurrences) {
-        const result = await overlapLoss(sql, resourceId, occurrence.start, occurrence.end);
+        const result = await overlapLoss(sql, resourceId, occurrence.start, occurrence.end, 0, undefined, eventId);
         if (result.conflictingReservationId !== null)
             return result;
     }
@@ -607,12 +1056,18 @@ async function lockExternalIdentity(tx, tenantRef, externalRef) {
     // U+0000). The database hashes it to one transaction-scoped lock key.
     await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([tenantRef, externalRef])}, 0))`;
 }
-async function resourceBelongsToTenant(tx, resourceId, tenantRef) {
-    const rows = await tx `
-    SELECT id FROM slotlock.resources
+/**
+ * Whether the resource is the tenant's (`missing` when not), and whether it is archived. The row is
+ * share-locked to the end of the transaction, so it is neither archived nor deleted meanwhile.
+ */
+async function tenantResourceState(tx, resourceId, tenantRef) {
+    const [row] = await tx `
+    SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
      WHERE id = ${resourceId} AND tenant_ref = ${tenantRef}
      FOR SHARE`;
-    return rows.length === 1;
+    if (!row)
+        return 'missing';
+    return row.archived ? 'archived' : 'active';
 }
 function pgCode(err) {
     let cur = err;
@@ -629,7 +1084,10 @@ function toResource(row) {
         externalRef: row.external_ref,
         tenantRef: row.tenant_ref,
         timezone: row.timezone,
+        visibility: row.visibility,
     };
+    if (row.archived_at !== null)
+        resource.archivedAt = row.archived_at;
     if (row.availability_rules !== null && row.availability_rules !== undefined) {
         // Written through setResourceAvailability, which validates; anything else reads as closed.
         try {
@@ -653,42 +1111,452 @@ function availabilityParameter(sql, rules) {
     })));
 }
 async function upsertResource(executor, params) {
+    const visibility = params.visibility ?? 'shared';
+    const asked = params.visibility ?? null;
     let rows;
+    // An existing identity keeps the visibility it has: creating it again with none named returns it
+    // as it is, and with another one is refused, so a private one is never made shared that way.
     if (params.tenantRef !== undefined && params.externalRef !== undefined) {
         rows = await executor `
-      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone)
-      VALUES (${params.externalRef}, ${params.tenantRef}, ${params.timezone ?? 'UTC'})
+      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
+      VALUES (${params.externalRef}, ${params.tenantRef}, ${params.timezone ?? 'UTC'}, ${visibility})
       ON CONFLICT (tenant_ref, external_ref)
         WHERE tenant_ref IS NOT NULL AND external_ref IS NOT NULL
       DO UPDATE SET timezone = EXCLUDED.timezone
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules`;
+      WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
     }
     else if (params.externalRef !== undefined) {
         rows = await executor `
-      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone)
-      VALUES (${params.externalRef}, NULL, ${params.timezone ?? 'UTC'})
+      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
+      VALUES (${params.externalRef}, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
       ON CONFLICT (external_ref)
         WHERE tenant_ref IS NULL AND external_ref IS NOT NULL
       DO UPDATE SET external_ref = EXCLUDED.external_ref
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules`;
+      WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
     }
     else {
         rows = await executor `
-      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone)
-      VALUES (NULL, NULL, ${params.timezone ?? 'UTC'})
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules`;
+      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
+      VALUES (NULL, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
     }
     const row = rows[0];
     if (!row) {
-        throw new Error('slotlock: resource upsert returned no row');
+        throw Object.assign(new Error('Slotlock resource visibility cannot be changed by creating it'), {
+            code: 'resource_visibility_conflict',
+        });
     }
     return toResource(row);
 }
 /**
- * Delete expired held rows overlapping the requested window, in deterministic id order under
- * FOR UPDATE — two concurrent reapers lock the same rows in the same order (no deadlock), the
- * loser simply finds them gone. Runs inside the caller's transaction, immediately before its
- * INSERT, so the EXCLUDE arbiter only ever sees LIVE occupation.
+ * Rematerialize one stored recurring master over the window a roll to `horizon` gives it
+ * (rolledWindow): from where its last expansion stopped when that can be trusted, else its start.
+ * False when there is no such master or nothing to roll. A collision throws the database's 23P01,
+ * and a rule over the expansion budget CalendarExpansionLimitError; run it in a savepoint, which
+ * either rolls back whole.
+ */
+async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
+    const [row] = await tx `
+    SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
+           summary, description, location, status, transparency, organizer, attendees,
+           reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
+           materialized_ends_at, recurrence_cursor, revision, source, created_at,
+           updated_at, recurrence_ends_by IS NULL AS ends_by_missing
+      FROM slotlock.calendar_events
+     WHERE id = ${eventId} AND tenant_ref = ${tenantRef}
+     FOR UPDATE`;
+    if (!row || row.recurrence_rule === null)
+        return false;
+    const rolled = rolledWindow({ start: row.materialized_starts_at, end: row.materialized_ends_at }, horizon);
+    if (!rolled)
+        return false;
+    const childMap = await loadCalendarEventChildren(tx, [row.id]);
+    const event = toCalendarEvent(row, childMap.get(row.id));
+    const { occurrences, cursor } = expandCalendarEventSeries(event, rolled, {
+        cursor: row.recurrence_cursor ?? null,
+        stored: true,
+    });
+    await replaceCalendarEventOccurrences(tx, {
+        tenantRef,
+        eventId: row.id,
+        resourceId: row.resource_id,
+        event,
+        occurrences,
+        revision: Number(row.revision),
+    });
+    // A series stored before 0.3 learns when it ends at its first roll.
+    const endsBy = row.ends_by_missing ? recurrenceEndsByColumn(event) : null;
+    await tx `
+    UPDATE slotlock.calendar_events
+       SET materialized_starts_at = ${rolled.start},
+           materialized_ends_at = ${rolled.end},
+           recurrence_cursor = ${seriesCursorJson(tx, cursor)},
+           recurrence_ends_by = COALESCE(recurrence_ends_by, ${endsBy}::text::timestamptz),
+           roll_retry_at = NULL
+     WHERE id = ${row.id} AND tenant_ref = ${tenantRef}`;
+    return true;
+}
+/**
+ * Work out and store when a series stored before 0.3 ends (recurrence_ends_by), as its next roll
+ * would; its stored occurrences are left as they are.
+ */
+async function learnSeriesEnd(tx, tenantRef, eventId) {
+    const [row] = await tx `
+    SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
+           summary, description, location, status, transparency, organizer, attendees,
+           reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
+           materialized_ends_at, recurrence_cursor, revision, source, created_at,
+           updated_at
+      FROM slotlock.calendar_events
+     WHERE id = ${eventId} AND tenant_ref = ${tenantRef}
+       AND recurrence_rule IS NOT NULL AND recurrence_ends_by IS NULL
+     FOR UPDATE`;
+    if (!row)
+        return;
+    const childMap = await loadCalendarEventChildren(tx, [row.id]);
+    const event = toCalendarEvent(row, childMap.get(row.id));
+    await tx `
+    UPDATE slotlock.calendar_events
+       SET recurrence_ends_by = ${recurrenceEndsByColumn(event)}::text::timestamptz
+     WHERE id = ${row.id} AND tenant_ref = ${tenantRef} AND recurrence_ends_by IS NULL`;
+}
+/** Put a master the roll could not extend behind the others for an hour. */
+async function deferRoll(executor, tenantRef, eventId) {
+    await executor `
+    UPDATE slotlock.calendar_events
+       SET roll_retry_at = now() + interval '1 hour'
+     WHERE id = ${eventId} AND tenant_ref = ${tenantRef}`;
+}
+/**
+ * Whether every opaque recurring series on the resource (but `exceptEventId`) is stored over the
+ * part of [start, end) that a roll can ever reach: from the later of `start` and the rolling
+ * horizon's start. A write there must not land where such a series is not stored, or the series'
+ * next roll would collide with it and stop. A series known to end before that part
+ * (recurrence_ends_by) cannot meet the write and is left out, as is one stored through its end. A
+ * series behind is first rolled to the horizon, in a savepoint of the write's transaction, so the
+ * write meets its occurrences under the exclusion arbiter; false when one cannot be (it goes on
+ * past the horizon and so does the write, it collides, or its rule is over the budget). Series are
+ * rolled in id order; an event's update holds its own row while it rolls the others, so it and a
+ * write rolling the same series in that order can deadlock, which the database breaks (the writer
+ * retries once, then answers an overlap).
+ */
+async function recurrenceCoversWrite(tx, params) {
+    const horizon = calendarEventRollingHorizon();
+    if (params.end <= horizon.start)
+        return true;
+    const from = params.start > horizon.start ? params.start : horizon.start;
+    // LEAST and GREATEST ignore a NULL argument (PostgreSQL 16, Conditional Expressions): a series
+    // with no known end is behind wherever it is stored short of the write's end.
+    const behind = () => tx `
+    SELECT event.id, event.recurrence_ends_by IS NULL AS ends_by_unknown,
+           COALESCE(event.recurrence_ends_by <= ${horizon.end}::timestamptz, false)
+             AS ends_in_horizon
+      FROM slotlock.calendar_events event
+     WHERE event.tenant_ref = ${params.tenantRef}
+       AND event.resource_id = ${params.resourceId}
+       AND event.recurrence_rule IS NOT NULL
+       AND event.transparency = 'opaque'
+       AND event.id IS DISTINCT FROM ${params.exceptEventId ?? null}::uuid
+       AND (event.recurrence_ends_by IS NULL OR event.recurrence_ends_by > ${from}::timestamptz)
+       AND (
+         event.materialized_ends_at < LEAST(${params.end}::timestamptz, event.recurrence_ends_by)
+         OR event.materialized_starts_at > GREATEST(
+              ${from}::timestamptz,
+              LEAST(event.starts_at, COALESCE((
+                SELECT min(exception.starts_at)
+                  FROM slotlock.calendar_event_exceptions exception
+                 WHERE exception.tenant_ref = event.tenant_ref
+                   AND exception.event_id = event.id
+                   AND exception.cancelled = false
+              ), event.starts_at))
+            )
+       )
+     ORDER BY event.id`;
+    let due = await behind();
+    if (due.length === 0)
+        return true;
+    if (params.end > horizon.end) {
+        // A series stored before 0.3 has not worked out when it ends; it does so now, and is left out
+        // if it ends before the write or is stored through its end.
+        if (due.some((row) => row.ends_by_unknown)) {
+            for (const { id, ends_by_unknown } of due) {
+                if (ends_by_unknown)
+                    await learnSeriesEnd(tx, params.tenantRef, id);
+            }
+            due = await behind();
+            if (due.length === 0)
+                return true;
+        }
+        // No roll stores a series past the horizon: one going on past it stays behind such a write.
+        if (due.some((row) => !row.ends_in_horizon))
+            return false;
+    }
+    for (const { id } of due) {
+        try {
+            await tx.savepoint((sp) => rollStoredSeries(sp, params.tenantRef, id, horizon));
+        }
+        catch (error) {
+            if (error instanceof CalendarExpansionLimitError || pgCode(error) === EXCLUSION_VIOLATION) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    return (await behind()).length === 0;
+}
+/**
+ * Whether an event already occupies, on the resource, all the time `occurrences` would: such a
+ * write (a rename, a new description) takes no time a series could later need, so it is not held
+ * to where the series on the resource are stored.
+ */
+async function holdsEveryOccurrence(tx, eventId, resourceId, occurrences) {
+    const held = await tx `
+    SELECT reservation.starts_at AS start, reservation.ends_at AS end
+      FROM slotlock.calendar_event_occurrences occurrence
+      JOIN slotlock.reservations reservation ON reservation.id = occurrence.reservation_id
+     WHERE occurrence.event_id = ${eventId}
+       AND reservation.resource_id = ${resourceId}`;
+    return occurrences.every((occurrence) => held.some(({ start, end }) => start <= occurrence.start && occurrence.end <= end));
+}
+/** From the earliest start to the latest end of an event's occurrences, or null for none. */
+function occurrenceSpan(occurrences) {
+    const [first] = occurrences;
+    if (!first)
+        return null;
+    let start = first.start;
+    let end = first.end;
+    for (const occurrence of occurrences) {
+        if (occurrence.start < start)
+            start = occurrence.start;
+        if (occurrence.end > end)
+            end = occurrence.end;
+    }
+    return { start, end };
+}
+/**
+ * After a write lost to the exclusion arbiter: roll, in a transaction of its own, the series on the
+ * resource the write's transaction rolled with it (and lost), so they stay extended and the loss
+ * can name the occurrence that blocked it. A resource with no tenant has no series. Upkeep only: if
+ * it fails, the series are left to maintenance and the write is still answered as a loss.
+ */
+async function rollSeriesBehind(executor, resourceId, start, end, exceptEventId) {
+    try {
+        await inTransaction(executor, async (tx) => {
+            const [resource] = await tx `
+        SELECT tenant_ref FROM slotlock.resources WHERE id = ${resourceId}`;
+            if (!resource?.tenant_ref)
+                return;
+            await recurrenceCoversWrite(tx, {
+                tenantRef: resource.tenant_ref,
+                resourceId,
+                start,
+                end,
+                ...(exceptEventId !== undefined ? { exceptEventId } : {}),
+            });
+        });
+    }
+    catch {
+        // Rolled back whole (its own transaction, or a savepoint of the caller's).
+    }
+}
+const MAX_TENANT_LIMIT = 10_000_000;
+function tenantLimitsOption(limits) {
+    const valid = {};
+    for (const kind of ['resources', 'holds', 'reservations', 'events', 'coverage']) {
+        const value = limits?.[kind];
+        if (value === undefined)
+            continue;
+        const max = kind === 'resources' ? MAX_TENANT_RESOURCE_LIMIT : MAX_TENANT_LIMIT;
+        if (!Number.isSafeInteger(value) || value < 1 || value > max) {
+            throw Object.assign(new Error(`Slotlock tenant limit ${kind} must be a whole number from 1 to ${max}`), { code: 'invalid_tenant_limits' });
+        }
+        valid[kind] = value;
+    }
+    return valid;
+}
+/**
+ * Serialize one tenant's writes that add rows of one limited kind, so each counts what every
+ * earlier one committed. Taken before any row lock, after the write's identity locks.
+ */
+async function lockTenantLimit(tx, tenantRef, kind) {
+    // An object, so the key never equals a [tenantRef, externalRef] identity lock's.
+    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify({ tenantLimit: kind, tenantRef })}, 0))`;
+}
+/**
+ * Rows a tenant added within this many days count against its limits whatever time they hold, so
+ * bookings and events dated in the past, and cancellations, add at most the limit in any such
+ * window. Ended history is not pruned: over a longer time it can still grow. The same window
+ * maintenance keeps event idempotency records and stray retirements for.
+ */
+const TENANT_LIMIT_RECENT_DAYS = SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS;
+/**
+ * The rows a tenant has that its limit of `kind` counts: what is still to come, and what it added
+ * in the last TENANT_LIMIT_RECENT_DAYS days; what ended before then is history and does not count.
+ * Each part stops at `limit` rows, read through an index, so a count costs no more than the limit
+ * however much history the tenant keeps; the total is at least `limit` exactly when the tenant is
+ * at it.
+ */
+async function tenantLimitCount(tx, tenantRef, kind, limit) {
+    let rows;
+    switch (kind) {
+        case 'holds':
+            // Every held row, expired or not, until it is deleted: an expired hold no rival writes over
+            // stays stored until maintenance or a hold at the limit deletes it. And the answer kept for
+            // each keyed hold no longer held (released or confirmed, or its expired row deleted) until it
+            // is forgotten. An answer whose hold is still a held row is left out: that row counts.
+            rows = await tx `
+        SELECT (
+          (SELECT count(*) FROM (
+            SELECT 1
+              FROM slotlock.reservations hold
+              JOIN slotlock.resources resource ON resource.id = hold.resource_id
+             WHERE resource.tenant_ref = ${tenantRef} AND hold.status = 'held'
+             LIMIT ${limit}) held)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.hold_commands answer
+             WHERE answer.tenant_ref = ${tenantRef}
+               AND NOT EXISTS (
+                 SELECT 1 FROM slotlock.reservations hold
+                  WHERE hold.id = answer.hold_id AND hold.status = 'held'
+               )
+             LIMIT ${limit}) kept)
+        )::int AS count`;
+            break;
+        case 'reservations':
+            // Bookings still to come; bookings that have ended and cancellations, made recently; and
+            // references retired with no booking, until maintenance prunes them. A cancelled booking's
+            // tombstone is kept for good, and stops counting once it is no longer recent.
+            rows = await tx `
+        WITH recent AS (
+          SELECT now() - ${TENANT_LIMIT_RECENT_DAYS}::int * interval '1 day' AS since
+        )
+        SELECT (
+          (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.reservations
+             WHERE tenant_ref = ${tenantRef} AND external_ref IS NOT NULL
+               AND calendar_event_id IS NULL AND occupied_ends_at > now()
+             LIMIT ${limit}) live)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.reservations, recent
+             WHERE tenant_ref = ${tenantRef} AND external_ref IS NOT NULL
+               AND calendar_event_id IS NULL AND created_at > recent.since
+               AND occupied_ends_at <= now()
+             LIMIT ${limit}) ended)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.reservation_tombstones, recent
+             WHERE tenant_ref = ${tenantRef} AND cancelled_at > recent.since
+             LIMIT ${limit}) cancelled)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.reservation_tombstones, recent
+             WHERE tenant_ref = ${tenantRef} AND stray AND cancelled_at <= recent.since
+             LIMIT ${limit}) retired)
+        )::int AS count`;
+            break;
+        case 'events':
+            // One-off events still to come and series not known to have ended; events that have ended
+            // and cancellations of any owner, made recently; and agent cancellations until maintenance
+            // prunes them. The owner identity CHECK makes every owner but 'internal' an 'agent:' one.
+            rows = await tx `
+        WITH recent AS (
+          SELECT now() - ${TENANT_LIMIT_RECENT_DAYS}::int * interval '1 day' AS since
+        )
+        SELECT (
+          (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_events
+             WHERE tenant_ref = ${tenantRef} AND recurrence_rule IS NULL AND ends_at > now()
+             LIMIT ${limit}) one_off)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_events
+             WHERE tenant_ref = ${tenantRef} AND recurrence_rule IS NOT NULL
+               AND (recurrence_ends_by IS NULL OR recurrence_ends_by > now())
+             LIMIT ${limit}) series)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_events, recent
+             WHERE tenant_ref = ${tenantRef} AND created_at > recent.since
+               AND CASE WHEN recurrence_rule IS NULL THEN ends_at <= now()
+                        ELSE recurrence_ends_by <= now() END
+             LIMIT ${limit}) ended)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_event_tombstones, recent
+             WHERE tenant_ref = ${tenantRef} AND cancelled_at > recent.since
+             LIMIT ${limit}) cancelled)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_event_tombstones, recent
+             WHERE tenant_ref = ${tenantRef} AND owner_ref LIKE 'agent:%'
+               AND cancelled_at <= recent.since
+             LIMIT ${limit}) agent_cancelled)
+        )::int AS count`;
+            break;
+        case 'coverage':
+            rows = await tx `
+        SELECT count(*)::int AS count FROM (
+          SELECT 1 FROM slotlock.calendar_coverage WHERE tenant_ref = ${tenantRef} LIMIT ${limit}
+        ) kept`;
+            break;
+    }
+    const count = Number(rows[0]?.count ?? 0);
+    if (!Number.isSafeInteger(count) || count < 0)
+        throw new Error('slotlock: invalid tenant row count');
+    return count;
+}
+/**
+ * Delete up to `limit` of a tenant's holds that have expired, oldest first; the number deleted. A
+ * writer reaping or confirming a hold locks it: such a row is skipped, and the delete repeats the
+ * predicate on the row as it now is.
+ */
+async function deleteExpiredHolds(tx, tenantRef, limit) {
+    const [row] = await tx `
+    WITH candidates AS MATERIALIZED (
+      SELECT hold.id
+        FROM slotlock.reservations hold
+        JOIN slotlock.resources resource ON resource.id = hold.resource_id
+       WHERE resource.tenant_ref = ${tenantRef}
+         AND hold.status = 'held' AND hold.expires_at <= now()
+       ORDER BY hold.expires_at, hold.id
+       LIMIT ${limit}
+       FOR UPDATE OF hold SKIP LOCKED
+    ), deleted AS (
+      DELETE FROM slotlock.reservations hold
+       USING candidates candidate
+       WHERE hold.id = candidate.id
+         AND hold.status = 'held' AND hold.expires_at <= now()
+      RETURNING 1
+    )
+    SELECT count(*)::int AS deleted FROM deleted`;
+    return Number(row?.deleted ?? 0);
+}
+/**
+ * Delete up to `limit` of a tenant's keyed hold answers whose hold has expired, so a retry with one
+ * of their keys makes a new hold; answers another transaction holds are skipped. The number deleted.
+ */
+async function forgetExpiredHoldAnswers(tx, tenantRef, limit) {
+    const [row] = await tx `
+    WITH candidates AS MATERIALIZED (
+      SELECT answer.principal_ref, answer.idempotency_key
+        FROM slotlock.hold_commands answer
+       WHERE answer.tenant_ref = ${tenantRef} AND answer.expires_at <= now()
+       ORDER BY answer.expires_at, answer.principal_ref, answer.idempotency_key
+       LIMIT ${limit}
+       FOR UPDATE OF answer SKIP LOCKED
+    ), deleted AS (
+      DELETE FROM slotlock.hold_commands answer
+       USING candidates candidate
+       WHERE answer.tenant_ref = ${tenantRef}
+         AND answer.principal_ref = candidate.principal_ref
+         AND answer.idempotency_key = candidate.idempotency_key
+      RETURNING 1
+    )
+    SELECT count(*)::int AS deleted FROM deleted`;
+    return Number(row?.deleted ?? 0);
+}
+/**
+ * Delete expired held rows whose occupied time (buffer included, as the EXCLUDE constraint reads
+ * it) overlaps the requested window, whose `end` is its own occupied end, in deterministic id
+ * order under FOR UPDATE — two concurrent reapers lock the same rows in the same order (no
+ * deadlock), the loser simply finds them gone. Runs inside the caller's transaction, immediately
+ * before its INSERT, so the EXCLUDE arbiter only ever sees LIVE occupation.
  */
 async function reapExpiredHolds(tx, resourceId, start, end) {
     await tx `
@@ -699,7 +1567,7 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
           AND status = 'held'
           AND expires_at <= now()
           AND starts_at < ${end}
-          AND ends_at > ${start}
+          AND COALESCE(occupied_ends_at, ends_at) > ${start}
         ORDER BY id
         FOR UPDATE
      )`;
@@ -710,11 +1578,13 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
  * loser's transaction start (constraint saw it) and this lookup (live filter hides it) — an
  * immediate retry reaps it and wins.
  */
-async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, excludeReservationId) {
+async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, excludeReservationId, excludeCalendarEventId) {
     const winners = await sql `
     SELECT id FROM slotlock.reservations
      WHERE resource_id = ${resourceId}
        AND (${excludeReservationId ?? null}::uuid IS NULL OR id <> ${excludeReservationId ?? null}::uuid)
+       AND (${excludeCalendarEventId ?? null}::uuid IS NULL
+            OR calendar_event_id IS DISTINCT FROM ${excludeCalendarEventId ?? null}::uuid)
        AND tstzrange(
              starts_at,
              COALESCE(occupied_ends_at, ends_at),
@@ -741,7 +1611,111 @@ function holdTenantRef(options) {
     }
     return tenantRef;
 }
+/**
+ * At most `max` holders per tenant at once; the rest wait in order. An aborted signal takes a
+ * waiter out of the line, rejecting with its reason. Each holder calls the release it gets once.
+ */
+export function createTenantSlots(max) {
+    const tenants = new Map();
+    return async (tenantRef, signal) => {
+        signal?.throwIfAborted();
+        let tenant = tenants.get(tenantRef);
+        if (!tenant) {
+            tenant = { running: 0, waiting: [] };
+            tenants.set(tenantRef, tenant);
+        }
+        const slots = tenant;
+        if (slots.running < max) {
+            slots.running += 1;
+        }
+        else {
+            await new Promise((resolve, reject) => {
+                const start = () => {
+                    signal?.removeEventListener('abort', abort);
+                    resolve();
+                };
+                const abort = () => {
+                    slots.waiting.splice(slots.waiting.indexOf(start), 1);
+                    reject(signal?.reason);
+                };
+                slots.waiting.push(start);
+                signal?.addEventListener('abort', abort, { once: true });
+            });
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            // Handed straight to the next in line, so the count stays as it is.
+            const next = slots.waiting.shift();
+            if (next) {
+                next();
+                return;
+            }
+            slots.running -= 1;
+            if (slots.running === 0)
+                tenants.delete(tenantRef);
+        };
+    };
+}
+function lockTimeoutError(cause) {
+    return Object.assign(new Error('Slotlock tenant transaction waited too long for a lock: retry later', { cause }), { code: 'lock_timeout' });
+}
 export function createSlotlockStore(sql, options = {}) {
+    return buildSlotlockStore(sql, options, null);
+}
+/**
+ * Every store method that writes for a tenant: what a suspended tenant's withTenant store refuses.
+ * Maintenance (rolling series, pruning, purging) and erasure are not among them.
+ */
+export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
+    'createResource',
+    'archiveResource',
+    'restoreResource',
+    'deleteResource',
+    'setResourceAvailability',
+    'setTenantAvailability',
+    'createReservation',
+    'createExternalReservation',
+    'rescheduleExternalReservation',
+    'cancelExternalReservation',
+    'acquireHold',
+    'confirmHold',
+    'releaseHold',
+    'putCalendarEvent',
+    'cancelCalendarEvent',
+    'cancelCalendarEventById',
+    'recordCalendarCoverage',
+]);
+function tenantSuspendedError() {
+    return Object.assign(new Error('Slotlock tenant is suspended: it may read, and write nothing'), {
+        code: 'tenant_suspended',
+    });
+}
+function staleSuspensionCheckError() {
+    return Object.assign(new Error('Slotlock writes for a tenant only in a READ COMMITTED transaction, whose suspension check sees every suspension committed before the tenant lock'), { code: 'invalid_transaction_isolation' });
+}
+/**
+ * Reading a tenant's suspension needs EXECUTE on slotlock.tenant_suspended(text), which PUBLIC does
+ * not hold (SQLSTATE 42501 without it), and a schema this release migrated (42883 before then).
+ * Name the remedy for each; any other failure passes through.
+ */
+function suspensionCheckRefusal(error) {
+    const code = pgCode(error);
+    if (code === '42501') {
+        return Object.assign(new Error('Slotlock serving role may not run slotlock.tenant_suspended(text): grant it what this release needs with grantApplicationRole (`slotlock migrate` does), once per release', { cause: error }), { code: 'application_role_not_granted' });
+    }
+    if (code === '42883') {
+        return Object.assign(new Error('The slotlock schema predates this release (it has no slotlock.tenant_suspended(text)): run applySchema (`slotlock migrate`) with this release first', { cause: error }), { code: 'schema_outdated' });
+    }
+    return error;
+}
+/**
+ * A store on `sql`. With `refusal`, every method in SLOTLOCK_TENANT_WRITE_METHODS throws what it
+ * returns before any query (a suspended tenant, or a suspension check that could be stale).
+ */
+function buildSlotlockStore(sql, options, refusal) {
     const configuredTenantSetting = options.tenantContextSetting ?? SLOTLOCK_TENANT_CONTEXT_SETTING;
     const configuredAgentOwnerEventQuota = options.agentOwnerEventQuota ?? SLOTLOCK_AGENT_OWNER_EVENT_QUOTA;
     const configuredAgentOwnerCommandQuota = options.agentOwnerCommandQuota ?? SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA;
@@ -757,56 +1731,125 @@ export function createSlotlockStore(sql, options = {}) {
         configuredAgentOwnerCommandQuota > MAX_CONFIGURED_AGENT_OWNER_COMMAND_QUOTA) {
         throw Object.assign(new Error('Slotlock agent owner command quota must exceed its event quota and be at most 1000000'), { code: 'invalid_agent_owner_command_quota' });
     }
+    const configuredTenantLimits = tenantLimitsOption(options.tenantLimits);
+    const { maxTenantTransactions, tenantLockTimeoutMs } = options;
+    const whole = (value, max) => value === undefined || (Number.isSafeInteger(value) && value >= 1 && value <= max);
+    if (!whole(maxTenantTransactions, 1_000) || !whole(tenantLockTimeoutMs, 600_000)) {
+        throw Object.assign(new Error('Slotlock maxTenantTransactions must be 1-1000 and tenantLockTimeoutMs 1-600000, whole numbers'), { code: 'invalid_tenant_transaction_options' });
+    }
+    // Only a client opens transactions of its own; inside a caller's, neither applies.
+    const ownTransactions = 'begin' in sql;
+    const tenantSlots = ownTransactions && maxTenantTransactions !== undefined
+        ? createTenantSlots(maxTenantTransactions)
+        : undefined;
+    const lockTimeout = ownTransactions && tenantLockTimeoutMs !== undefined ? `${tenantLockTimeoutMs}ms` : undefined;
     createSlotlockTenantRlsDdl(configuredTenantSetting); // Validate once before any scoped query.
-    return {
-        async applySchema() {
+    const storeOptions = {
+        tenantContextSetting: configuredTenantSetting,
+        agentOwnerEventQuota: configuredAgentOwnerEventQuota,
+        agentOwnerCommandQuota: configuredAgentOwnerCommandQuota,
+        tenantLimits: configuredTenantLimits,
+    };
+    /**
+     * Under the tenant's lock for `kind`: the limit when the tenant is at it, else null. No limit for
+     * `kind`, or no tenant, takes no lock. Writes that only lower the count take no lock, so a count
+     * read early stays an upper bound for the rest of the transaction.
+     */
+    async function tenantLimitReached(tx, tenantRef, kind) {
+        const limit = configuredTenantLimits[kind];
+        if (limit === undefined || tenantRef === null)
+            return null;
+        await assertReadCommitted(tx);
+        await lockTenantLimit(tx, tenantRef, kind);
+        if ((await tenantLimitCount(tx, tenantRef, kind, limit)) < limit)
+            return null;
+        // A hold, and a keyed hold's answer, keep their place only until the hold expires; at the
+        // limit, the expired holds and their answers are deleted, as maintenance would, and the count
+        // is read again. Counting expired rows until then keeps what a tenant stores within the limit
+        // between maintenance passes, however short its holds.
+        if (kind !== 'holds' ||
+            (await deleteExpiredHolds(tx, tenantRef, limit)) +
+                (await forgetExpiredHoldAnswers(tx, tenantRef, limit)) ===
+                0) {
+            return limit;
+        }
+        return (await tenantLimitCount(tx, tenantRef, kind, limit)) >= limit ? limit : null;
+    }
+    /**
+     * The tenant whose limit a write on the resource counts against: the caller's, else the
+     * resource's (a resource never changes tenant, so it is read before any lock). Null with no limit.
+     */
+    async function limitTenant(tx, kind, resourceId, tenantRef) {
+        if (configuredTenantLimits[kind] === undefined)
+            return null;
+        if (tenantRef !== undefined)
+            return tenantRef;
+        const [resource] = await tx `
+      SELECT tenant_ref FROM slotlock.resources WHERE id = ${resourceId}`;
+        return resource?.tenant_ref ?? null;
+    }
+    const store = {
+        async applySchema(migrationOptions) {
             // PostgreSQL's IF NOT EXISTS DDL is idempotent after commit but not race-free: two fresh
             // application instances can still collide on pg_namespace/pg_extension unique indexes.
-            // Serialize bootstrap per database and let the transaction release the lock on crashes.
-            await inTransaction(sql, (tx) => withPinnedSearchPath(tx, async () => {
-                await tx `SELECT pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended(${SCHEMA_APPLY_LOCK}, 0))`;
-                await tx.unsafe(SLOTLOCK_CORE_DDL).catch((error) => {
+            // inMigration serializes bootstrap per database and the transaction releases the lock on
+            // crashes. A schema this release already left as it is changes nothing and locks no table,
+            // unless old rows kept one of its constraints NOT VALID: then only the validation runs again.
+            const validate = await inMigration(sql, migrationOptions, async (tx) => {
+                await tx.unsafe(SLOTLOCK_DEPLOYMENT_CHECKS).catch((error) => {
                     throw schemaControlRefusal(error);
                 });
-            }));
+                if (await slotlockSchemaUpToDate(tx))
+                    return slotlockConstraintUnvalidated(tx);
+                await tx.unsafe(SLOTLOCK_STRUCTURE_DDL).catch((error) => {
+                    throw schemaControlRefusal(error);
+                });
+                return true;
+            });
+            if (!validate)
+                return;
+            // Once the DDL has committed, its ACCESS EXCLUSIVE locks are gone: validating holds none that
+            // a serving query waits for (ddl.ts, DEPLOYMENT_VALIDATE_CONSTRAINTS). Inside a caller's
+            // transaction both steps share it, and its locks, until it ends. The digests go last, so a
+            // migration stopped before them runs whole again.
+            await inMigration(sql, migrationOptions, async (tx) => {
+                await tx.unsafe(SLOTLOCK_VALIDATION_DDL);
+                await tx `
+          UPDATE slotlock.schema_version
+             SET ddl_sha256 = ${SLOTLOCK_CORE_DDL_SHA256},
+                 catalog_sha256 = ${await slotlockCatalogDigest(tx)}
+           WHERE singleton`;
+            });
         },
         async applyTenantRls(applyOptions) {
             const ddl = createSlotlockTenantRlsDdl(configuredTenantSetting);
-            await inTransaction(sql, (tx) => withPinnedSearchPath(tx, async () => {
-                await tx `SELECT pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended(${SCHEMA_APPLY_LOCK}, 0))`;
+            const { allowRebind, ...migrationOptions } = applyOptions ?? {};
+            await inMigration(sql, migrationOptions, async (tx) => {
+                await tx.unsafe(SLOTLOCK_DEPLOYMENT_CHECKS).catch((error) => {
+                    throw schemaControlRefusal(error);
+                });
+                if (await tenantRlsUpToDate(tx, configuredTenantSetting))
+                    return;
                 const bindings = await tx `
-            SELECT DISTINCT obj_description(policy.oid, 'pg_policy') AS binding
-              FROM pg_policy policy
-              JOIN pg_class table_class ON table_class.oid = policy.polrelid
-              JOIN pg_namespace namespace ON namespace.oid = table_class.relnamespace
-             WHERE namespace.nspname = 'slotlock'
-               AND table_class.relname IN (
-                 'resources',
-                 'reservations',
-                 'reservation_tombstones',
-                 'reservation_conflict_archive',
-                 'calendar_events',
-                 'calendar_event_attendees',
-                 'calendar_event_reminders',
-                 'calendar_event_exceptions',
-                 'calendar_event_occurrences',
-                 'calendar_event_tombstones',
-                 'calendar_event_commands',
-                 'calendar_coverage'
-               )
-               AND obj_description(policy.oid, 'pg_policy') LIKE 'slotlock:tenant-context:%'`;
+          SELECT DISTINCT obj_description(policy.oid, 'pg_policy') AS binding
+            FROM pg_policy policy
+            JOIN pg_class table_class ON table_class.oid = policy.polrelid
+            JOIN pg_namespace namespace ON namespace.oid = table_class.relnamespace
+           WHERE namespace.nspname = 'slotlock'
+             AND table_class.relname IN ${tx([...SLOTLOCK_TENANT_TABLES])}
+             AND obj_description(policy.oid, 'pg_policy') LIKE 'slotlock:tenant-context:%'`;
                 const conflictingBinding = bindings.find(({ binding }) => binding !== `slotlock:tenant-context:${configuredTenantSetting}`);
-                if (conflictingBinding && applyOptions?.allowRebind !== true) {
+                if (conflictingBinding && allowRebind !== true) {
                     throw Object.assign(new Error(`Slotlock tenant RLS is already bound to ${conflictingBinding.binding.slice('slotlock:tenant-context:'.length)}`), { code: 'tenant_context_conflict' });
                 }
                 await tx.unsafe(ddl).catch((error) => {
                     throw schemaControlRefusal(error);
                 });
-            }));
+            });
         },
-        async grantApplicationRole(role) {
+        async grantApplicationRole(role, migrationOptions) {
             const ddl = createSlotlockApplicationRoleGrantsDdl(role);
-            await inTransaction(sql, (tx) => withPinnedSearchPath(tx, async () => {
+            await inMigration(sql, migrationOptions, (tx) => (async () => {
                 // Every role the target belongs to counts, not only the target: a member can SET ROLE to
                 // it or use its privileges, and one holding only ADMIN OPTION can grant itself either.
                 // MEMBER also counts a PostgreSQL 16 grant made with none of ADMIN, INHERIT or SET, which
@@ -910,7 +1953,7 @@ export function createSlotlockStore(sql, options = {}) {
                     throw Object.assign(new Error(`Slotlock application role ${role} could get around forced RLS or the exclusion arbiter, itself, through a role it belongs to or through PUBLIC (${check.reasons.join('; ')}); use a plain NOBYPASSRLS login role that owns nothing and can create nothing`), { code: 'unsafe_application_role', reasons: check.reasons });
                 }
                 await tx.unsafe(ddl);
-            }));
+            })());
         },
         async withTenant(tenantRef, callback, options) {
             if (!isValidIdentity(tenantRef)) {
@@ -921,45 +1964,90 @@ export function createSlotlockStore(sql, options = {}) {
             const isolation = options?.isolation;
             if (isolation !== undefined && isolation !== 'read committed')
                 throw invalidIsolationError();
+            const release = await tenantSlots?.(tenantRef, options?.signal);
+            // A lock wait that timed out leaves the transaction unusable, so the reset below fails with
+            // another error in its place: noted here as it happens.
+            let timedOut = false;
             return inTransaction(sql, async (tx) => {
+                if (lockTimeout !== undefined) {
+                    await tx `SELECT set_config('lock_timeout', ${lockTimeout}, true)`;
+                }
                 if (isolation !== undefined)
                     await assertReadCommitted(tx);
+                // Held shared until the transaction ends: suspension and erasure, which take it
+                // exclusively, wait for this transaction, and one that starts after them reads them below
+                // (READ COMMITTED: a statement after the lock sees what committed before it was granted).
                 const previous = await tx `
-          SELECT current_setting(${configuredTenantSetting}, true) AS value`;
-                await tx `SELECT set_config(${configuredTenantSetting}, ${tenantRef}, true)`;
+            SELECT current_setting(${configuredTenantSetting}, true) AS value,
+                   current_setting('transaction_isolation') AS isolation,
+                   pg_advisory_xact_lock_shared(
+                     hashtextextended(${slotlockTenantLockKey(tenantRef)}, 0)
+                   ) AS locked`;
+                const [context] = await tx `
+            SELECT set_config(${configuredTenantSetting}, ${tenantRef}, true) AS tenant,
+                   slotlock.tenant_suspended(${tenantRef}) AS suspended`.catch((error) => {
+                    throw suspensionCheckRefusal(error);
+                });
+                // A caller's REPEATABLE READ or SERIALIZABLE snapshot was taken before the lock was
+                // granted, so it may not show a suspension that committed while this transaction waited:
+                // its writes are refused, and it may read.
+                const refusal = context?.suspended === true
+                    ? tenantSuspendedError
+                    : previous[0]?.isolation !== 'read committed'
+                        ? staleSuspensionCheckError
+                        : null;
                 try {
-                    return await callback(createSlotlockStore(tx, {
-                        tenantContextSetting: configuredTenantSetting,
-                        agentOwnerEventQuota: configuredAgentOwnerEventQuota,
-                        agentOwnerCommandQuota: configuredAgentOwnerCommandQuota,
-                    }));
+                    return await callback(buildSlotlockStore(tx, storeOptions, refusal));
+                }
+                catch (error) {
+                    if (pgCode(error) === LOCK_NOT_AVAILABLE)
+                        timedOut = true;
+                    throw error;
                 }
                 finally {
                     await tx `SELECT set_config(${configuredTenantSetting}, ${previous[0]?.value ?? ''}, true)`;
                 }
-            }, isolation);
+            }, 'read committed')
+                .catch((error) => {
+                if (lockTimeout !== undefined && (timedOut || pgCode(error) === LOCK_NOT_AVAILABLE)) {
+                    throw lockTimeoutError(error);
+                }
+                throw error;
+            })
+                .finally(() => release?.());
         },
         async createResource(params) {
             assertValidResourceInput(params);
-            const max = params.maxTenantResources;
-            if (max === undefined)
+            const requested = params.maxTenantResources;
+            const configured = params.tenantRef === undefined ? undefined : configuredTenantLimits.resources;
+            if (requested === undefined && configured === undefined)
                 return upsertResource(sql, params);
-            if (!Number.isSafeInteger(max) ||
-                max < 1 ||
-                max > MAX_TENANT_RESOURCE_LIMIT ||
-                params.tenantRef === undefined ||
-                params.externalRef === undefined) {
+            if (requested !== undefined &&
+                (!Number.isSafeInteger(requested) ||
+                    requested < 1 ||
+                    requested > MAX_TENANT_RESOURCE_LIMIT ||
+                    params.tenantRef === undefined ||
+                    params.externalRef === undefined)) {
                 throw Object.assign(new Error(`Slotlock maxTenantResources must be a whole number from 1 to ${MAX_TENANT_RESOURCE_LIMIT}, for a tenant-owned resource`), { code: 'invalid_resource_limit' });
             }
-            const { tenantRef, externalRef } = params;
+            const max = requested === undefined
+                ? configured
+                : configured === undefined
+                    ? requested
+                    : Math.min(requested, configured);
+            const tenantRef = params.tenantRef;
+            const externalRef = params.externalRef ?? null;
             return inTransaction(sql, async (tx) => {
                 await assertReadCommitted(tx);
                 // An object, so the key never equals a [tenantRef, externalRef] identity lock's.
                 await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify({ resourceCount: tenantRef })}, 0))`;
                 // READ COMMITTED: each statement below sees every create committed before the lock.
-                const known = await tx `
-            SELECT id FROM slotlock.resources
-             WHERE tenant_ref = ${tenantRef} AND external_ref = ${externalRef}`;
+                // Re-creating a resource the tenant has (by its reference) adds none.
+                const known = externalRef === null
+                    ? []
+                    : await tx `
+                  SELECT id FROM slotlock.resources
+                   WHERE tenant_ref = ${tenantRef} AND external_ref = ${externalRef}`;
                 if (known.length === 0) {
                     const [counted] = await tx `
               SELECT count(*) AS count FROM slotlock.resources WHERE tenant_ref = ${tenantRef}`;
@@ -971,15 +2059,17 @@ export function createSlotlockStore(sql, options = {}) {
             }, 'read committed');
         },
         async getResource(params) {
+            assertValidVisibility(params.visibility);
             if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
                 throw Object.assign(new Error('Slotlock resource identity is invalid'), {
                     code: 'invalid_identity',
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at
           FROM slotlock.resources
-         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}`;
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+           AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -994,7 +2084,7 @@ export function createSlotlockStore(sql, options = {}) {
         UPDATE slotlock.resources
            SET availability_rules = ${rules}::jsonb
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -1029,42 +2119,126 @@ export function createSlotlockStore(sql, options = {}) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef}
+           AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
+           AND (${params.includeArchived === true} OR archived_at IS NULL)
            AND (${params.after ?? null}::uuid IS NULL OR id > ${params.after ?? null}::uuid)
          ORDER BY id
          LIMIT ${limit}`;
             return rows.map(toResource);
         },
+        async archiveResource(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw invalidIdentityError('Slotlock resource identity is invalid');
+            }
+            // Its clock time, not the transaction's start: a booking that committed holding the row's
+            // share lock went in before this.
+            const [row] = await sql `
+        UPDATE slotlock.resources
+           SET archived_at = COALESCE(archived_at, clock_timestamp())
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
+            return row ? toResource(row) : null;
+        },
+        async restoreResource(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw invalidIdentityError('Slotlock resource identity is invalid');
+            }
+            const [row] = await sql `
+        UPDATE slotlock.resources
+           SET archived_at = NULL
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
+            return row ? toResource(row) : null;
+        },
+        async deleteResource(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw invalidIdentityError('Slotlock resource identity is invalid');
+            }
+            return inTransaction(sql, async (tx) => {
+                // The row lock waits for writers holding its share lock and keeps new ones out until done.
+                const [resource] = await tx `
+          SELECT id FROM slotlock.resources
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+           FOR UPDATE`;
+                if (!resource)
+                    return { ok: true, deleted: false };
+                const [live] = await tx `
+          SELECT EXISTS (
+                   SELECT 1 FROM slotlock.reservations
+                    WHERE resource_id = ${params.id}
+                      AND calendar_event_id IS NULL
+                      AND (CASE WHEN status = 'held' THEN expires_at > now()
+                                ELSE COALESCE(occupied_ends_at, ends_at) > now() END)
+                 )
+                 OR EXISTS (
+                   SELECT 1 FROM slotlock.calendar_events
+                    WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.id}
+                      AND (recurrence_rule IS NOT NULL OR ends_at > now())
+                 ) AS live`;
+                if (live?.live)
+                    return { ok: false, code: 'resource_in_use' };
+                // Its rows go with it: reservations, events and their children, coverage and hold answers
+                // all cascade from the resource.
+                await tx `DELETE FROM slotlock.resources WHERE id = ${params.id}`;
+                return { ok: true, deleted: true };
+            });
+        },
         async createReservation(params) {
             if (!isFiniteWindow({ start: params.start, end: params.end })) {
                 return { ok: false, code: 'invalid_window' };
             }
+            if (!isValidResourceId(params.resourceId))
+                return { ok: false, code: 'resource_not_found' };
+            if (params.tenantRef !== undefined && !isValidIdentity(params.tenantRef)) {
+                return { ok: false, code: 'resource_not_found' };
+            }
+            // A booking on a tenant's resource takes the tenant and its own id as reference, so it can be
+            // cancelled and moved like any other; one on a resource with no tenant stays tenantless.
+            const id = randomUUID();
             for (let attempt = 1;; attempt++) {
                 try {
-                    const rows = await inTransaction(sql, async (tx) => {
+                    return await inTransaction(sql, async (tx) => {
+                        const bookingLimit = await tenantLimitReached(tx, await limitTenant(tx, 'reservations', params.resourceId, params.tenantRef), 'reservations');
+                        const [resource] = await tx `
+              SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
+               WHERE id = ${params.resourceId}
+                 AND (${params.tenantRef ?? null}::text IS NULL
+                      OR tenant_ref = ${params.tenantRef ?? null})
+               FOR SHARE`;
+                        if (!resource)
+                            return { ok: false, code: 'resource_not_found' };
+                        if (resource.archived)
+                            return { ok: false, code: 'resource_archived' };
+                        if (bookingLimit !== null && resource.tenant_ref !== null) {
+                            return { ok: false, code: 'reservation_limit_reached', limit: bookingLimit };
+                        }
+                        if (resource.tenant_ref !== null &&
+                            !(await recurrenceCoversWrite(tx, {
+                                tenantRef: resource.tenant_ref,
+                                resourceId: params.resourceId,
+                                start: params.start,
+                                end: params.end,
+                            }))) {
+                            return { ok: false, code: 'recurrence_not_materialized' };
+                        }
                         await reapExpiredHolds(tx, params.resourceId, params.start, params.end);
-                        return tx `
-              INSERT INTO slotlock.reservations (resource_id, starts_at, ends_at, source)
-              VALUES (${params.resourceId}, ${params.start}, ${params.end}, ${params.source ?? null})
-              RETURNING id, resource_id, starts_at, ends_at, source`;
+                        const [row] = await tx `
+              INSERT INTO slotlock.reservations (
+                id, resource_id, tenant_ref, external_ref, starts_at, ends_at, source
+              ) VALUES (
+                ${id}, ${params.resourceId}, ${resource.tenant_ref},
+                ${resource.tenant_ref === null ? null : id},
+                ${params.start}, ${params.end}, ${params.source ?? null}
+              )
+              RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
+                        buffer_after_ms, revision, source`;
+                        if (!row)
+                            throw new Error('slotlock: reservation insert returned no row');
+                        return { ok: true, reservation: toReservation(row) };
                     });
-                    const row = rows[0];
-                    if (!row)
-                        throw new Error('slotlock: reservation insert returned no row');
-                    const reservation = {
-                        id: row.id,
-                        resourceId: row.resource_id,
-                        tenantRef: null,
-                        externalRef: null,
-                        start: row.starts_at,
-                        end: row.ends_at,
-                        bufferAfterMs: 0,
-                        revision: 1,
-                        source: row.source,
-                    };
-                    return { ok: true, reservation };
                 }
                 catch (err) {
                     const code = pgCode(err);
@@ -1078,6 +2252,7 @@ export function createSlotlockStore(sql, options = {}) {
                     }
                     // A SECOND contention abort is treated as a loss too (structured, possibly with a null
                     // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
+                    await rollSeriesBehind(sql, params.resourceId, params.start, params.end);
                     return overlapLoss(sql, params.resourceId, params.start, params.end);
                 }
             }
@@ -1118,8 +2293,22 @@ export function createSlotlockStore(sql, options = {}) {
                             }
                             return { ok: true, reservation: toReservation(found), idempotent: true };
                         }
-                        if (!(await resourceBelongsToTenant(tx, params.resourceId, params.tenantRef))) {
+                        const bookingLimit = await tenantLimitReached(tx, params.tenantRef, 'reservations');
+                        const resourceState = await tenantResourceState(tx, params.resourceId, params.tenantRef);
+                        if (resourceState === 'missing')
                             return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (resourceState === 'archived')
+                            return { ok: false, code: 'resource_archived' };
+                        if (bookingLimit !== null) {
+                            return { ok: false, code: 'reservation_limit_reached', limit: bookingLimit };
+                        }
+                        if (!(await recurrenceCoversWrite(tx, {
+                            tenantRef: params.tenantRef,
+                            resourceId: params.resourceId,
+                            start: params.start,
+                            end: occupiedEnd(params),
+                        }))) {
+                            return { ok: false, code: 'recurrence_not_materialized' };
                         }
                         await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd(params));
                         const rows = await tx `
@@ -1148,6 +2337,7 @@ export function createSlotlockStore(sql, options = {}) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
+                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd(params));
                     return overlapLoss(sql, params.resourceId, params.start, params.end, params.bufferAfterMs);
                 }
             }
@@ -1190,8 +2380,18 @@ export function createSlotlockStore(sql, options = {}) {
                         if (params.revision !== currentRevision + 1) {
                             return { ok: false, code: 'revision_conflict' };
                         }
-                        if (!(await resourceBelongsToTenant(tx, params.resourceId, params.tenantRef))) {
+                        const resourceState = await tenantResourceState(tx, params.resourceId, params.tenantRef);
+                        if (resourceState === 'missing')
                             return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (resourceState === 'archived')
+                            return { ok: false, code: 'resource_archived' };
+                        if (!(await recurrenceCoversWrite(tx, {
+                            tenantRef: params.tenantRef,
+                            resourceId: params.resourceId,
+                            start: params.start,
+                            end: occupiedEnd(params),
+                        }))) {
+                            return { ok: false, code: 'recurrence_not_materialized' };
                         }
                         await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd(params));
                         const rows = await tx `
@@ -1221,6 +2421,7 @@ export function createSlotlockStore(sql, options = {}) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
+                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd(params));
                     return overlapLoss(sql, params.resourceId, params.start, params.end, params.bufferAfterMs, currentReservationId);
                 }
             }
@@ -1262,9 +2463,26 @@ export function createSlotlockStore(sql, options = {}) {
                         return { ok: false, code: 'revision_conflict' };
                     }
                 }
+                if (!found) {
+                    // A calendar event's occupation row carries this reference: it is the event's, not a
+                    // booking's. Nothing is cancelled, and nothing retired: a tombstone would only grow.
+                    const [occupation] = await tx `
+            SELECT id FROM slotlock.reservations
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
+               AND calendar_event_id IS NOT NULL
+             LIMIT 1`;
+                    if (occupation)
+                        return { ok: true, cancelled: false, revision: params.revision };
+                    // Retiring a reference no booking holds adds a row; cancelling a booking replaces one.
+                    const limit = await tenantLimitReached(tx, params.tenantRef, 'reservations');
+                    if (limit !== null)
+                        return { ok: false, code: 'reservation_limit_reached', limit };
+                }
+                // A reference no booking holds yet is retired too, so a create delivered after its cancel
+                // cannot bring the booking back. Only such a stray retirement is pruned past retention.
                 await tx `
-          INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision)
-          VALUES (${params.tenantRef}, ${params.externalRef}, ${params.revision})`;
+          INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray)
+          VALUES (${params.tenantRef}, ${params.externalRef}, ${params.revision}, ${!found})`;
                 if (!found)
                     return { ok: true, cancelled: false, revision: params.revision };
                 const deleted = await tx `
@@ -1282,31 +2500,101 @@ export function createSlotlockStore(sql, options = {}) {
             if (!Number.isFinite(params.ttlMs) || params.ttlMs <= 0 || params.ttlMs > MAX_HOLD_TTL_MS) {
                 return { ok: false, code: 'invalid_ttl' };
             }
+            const bufferAfterMs = params.bufferAfterMs ?? 0;
+            if (!Number.isSafeInteger(bufferAfterMs) ||
+                bufferAfterMs < 0 ||
+                bufferAfterMs > MAX_BUFFER_AFTER_MS) {
+                return { ok: false, code: 'invalid_buffer' };
+            }
+            const { tenantRef, principalRef, idempotencyKey } = params;
+            if (tenantRef !== undefined && !isValidIdentity(tenantRef)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            const keyed = idempotencyKey !== undefined || principalRef !== undefined;
+            if (keyed &&
+                (tenantRef === undefined || !isValidIdentity(principalRef) || !isValidIdentity(idempotencyKey))) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            if (!isValidResourceId(params.resourceId))
+                return { ok: false, code: 'resource_not_found' };
+            const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
+            const payloadHash = calendarCommandHash({
+                operation: 'hold',
+                resourceId: params.resourceId,
+                start: params.start.toISOString(),
+                end: params.end.toISOString(),
+                ttlMs: params.ttlMs,
+                bufferAfterMs,
+                source: params.source ?? null,
+            });
             const ttlSeconds = params.ttlMs / 1000;
             for (let attempt = 1;; attempt++) {
                 try {
-                    const rows = await inTransaction(sql, async (tx) => {
-                        await reapExpiredHolds(tx, params.resourceId, params.start, params.end);
-                        return tx `
-              INSERT INTO slotlock.reservations (resource_id, starts_at, ends_at, status, expires_at, source)
-              VALUES (${params.resourceId}, ${params.start}, ${params.end}, 'held',
-                      now() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null})
-              RETURNING id, resource_id, starts_at, ends_at, expires_at, source`;
+                    return await inTransaction(sql, async (tx) => {
+                        if (keyed) {
+                            await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([
+                                'slotlock-hold-command',
+                                tenantRef,
+                                principalRef,
+                                idempotencyKey,
+                            ])}, 0))`;
+                            const [prior] = await tx `
+                SELECT hold_id AS id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at,
+                       source, payload_hash
+                  FROM slotlock.hold_commands
+                 WHERE tenant_ref = ${tenantRef ?? null} AND principal_ref = ${principalRef ?? null}
+                   AND idempotency_key = ${idempotencyKey ?? null}`;
+                            if (prior) {
+                                return prior.payload_hash === payloadHash
+                                    ? { ok: true, hold: toHold(prior), idempotent: true }
+                                    : { ok: false, code: 'idempotency_conflict' };
+                            }
+                        }
+                        const holdLimit = await tenantLimitReached(tx, await limitTenant(tx, 'holds', params.resourceId, tenantRef), 'holds');
+                        const [resource] = await tx `
+              SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
+               WHERE id = ${params.resourceId}
+                 AND (${tenantRef ?? null}::text IS NULL OR tenant_ref = ${tenantRef ?? null})
+               FOR SHARE`;
+                        if (!resource)
+                            return { ok: false, code: 'resource_not_found' };
+                        if (resource.archived)
+                            return { ok: false, code: 'resource_archived' };
+                        if (holdLimit !== null)
+                            return { ok: false, code: 'hold_limit_reached', limit: holdLimit };
+                        if (resource.tenant_ref !== null &&
+                            !(await recurrenceCoversWrite(tx, {
+                                tenantRef: resource.tenant_ref,
+                                resourceId: params.resourceId,
+                                start: params.start,
+                                end: occupied,
+                            }))) {
+                            return { ok: false, code: 'recurrence_not_materialized' };
+                        }
+                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
+                        const [row] = await tx `
+              INSERT INTO slotlock.reservations (
+                resource_id, starts_at, ends_at, buffer_after_ms, status, expires_at, source
+              ) VALUES (
+                ${params.resourceId}, ${params.start}, ${params.end}, ${bufferAfterMs}, 'held',
+                now() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null}
+              )
+              RETURNING id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at, source`;
+                        if (!row)
+                            throw new Error('slotlock: hold insert returned no row');
+                        if (keyed) {
+                            await tx `
+                INSERT INTO slotlock.hold_commands (
+                  tenant_ref, principal_ref, idempotency_key, payload_hash, hold_id, resource_id,
+                  starts_at, ends_at, buffer_after_ms, expires_at, source
+                ) VALUES (
+                  ${tenantRef ?? null}, ${principalRef ?? null}, ${idempotencyKey ?? null},
+                  ${payloadHash}, ${row.id}, ${row.resource_id}, ${row.starts_at}, ${row.ends_at},
+                  ${row.buffer_after_ms}, ${row.expires_at}, ${row.source}
+                )`;
+                        }
+                        return { ok: true, hold: toHold(row), idempotent: false };
                     });
-                    const row = rows[0];
-                    if (!row)
-                        throw new Error('slotlock: hold insert returned no row');
-                    return {
-                        ok: true,
-                        hold: {
-                            id: row.id,
-                            resourceId: row.resource_id,
-                            start: row.starts_at,
-                            end: row.ends_at,
-                            expiresAt: row.expires_at,
-                            source: row.source,
-                        },
-                    };
                 }
                 catch (err) {
                     const code = pgCode(err);
@@ -1320,74 +2608,172 @@ export function createSlotlockStore(sql, options = {}) {
                     }
                     // A SECOND contention abort is treated as a loss too (structured, possibly with a null
                     // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
-                    return overlapLoss(sql, params.resourceId, params.start, params.end);
+                    await rollSeriesBehind(sql, params.resourceId, params.start, occupied);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs);
                 }
             }
         },
-        async confirmHold(holdId, options = {}) {
-            const tenantRef = holdTenantRef(options);
+        async getHold(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.holdId))
+                return null;
+            const [row] = await sql `
+        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+               hold.expires_at, hold.source
+          FROM slotlock.reservations hold
+          JOIN slotlock.resources resource ON resource.id = hold.resource_id
+         WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
+           AND hold.status = 'held' AND hold.expires_at > now()`;
+            return row ? toHold(row) : null;
+        },
+        async listHolds(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.resourceId)) {
+                throw invalidIdentityError('Slotlock resource id must be a UUID');
+            }
+            const limit = pageLimit(params.limit);
+            const after = pageCursor(params.after);
             const rows = await sql `
-        UPDATE slotlock.reservations
-           SET status = 'confirmed', expires_at = NULL
-         WHERE id = ${holdId} AND status = 'held' AND expires_at > now()
-           AND (${tenantRef}::text IS NULL
-                OR resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef}))
-         RETURNING id, resource_id, starts_at, ends_at, source`;
-            const row = rows[0];
-            if (row) {
-                return {
-                    ok: true,
-                    reservation: {
-                        id: row.id,
-                        resourceId: row.resource_id,
-                        tenantRef: null,
-                        externalRef: null,
-                        start: row.starts_at,
-                        end: row.ends_at,
-                        bufferAfterMs: 0,
-                        revision: 1,
-                        source: row.source,
-                    },
-                };
+        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+               hold.expires_at, hold.source
+          FROM slotlock.reservations hold
+          JOIN slotlock.resources resource ON resource.id = hold.resource_id
+         WHERE hold.resource_id = ${params.resourceId} AND resource.tenant_ref = ${params.tenantRef}
+           AND hold.status = 'held' AND hold.expires_at > now()
+           AND (${after.start}::timestamptz IS NULL
+                OR (hold.starts_at, hold.id) > (${after.start}::timestamptz, ${after.id}::uuid))
+         ORDER BY hold.starts_at, hold.id
+         LIMIT ${limit}`;
+            return rows.map(toHold);
+        },
+        async getReservation(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.externalRef)) {
+                throw invalidIdentityError('Slotlock booking identity must be 1-500 UTF-8 bytes');
             }
-            const present = await sql `
-        SELECT status, (status = 'held' AND expires_at <= now()) AS expired,
-               resource_id, starts_at, ends_at, source
+            const [row] = await sql `
+        SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
+               revision, source
           FROM slotlock.reservations
-         WHERE id = ${holdId}
-           -- A hold has no external identity, before or after it is confirmed; a booking that has
-           -- one is not a hold, and confirming it again would describe it wrongly.
-           AND tenant_ref IS NULL
-           AND (${tenantRef}::text IS NULL
-                OR resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef}))`;
-            const found = present[0];
-            // Idempotent confirm: a retried confirm (network replay) of an already-confirmed hold is
-            // SUCCESS — the booking exists; reporting failure would make callers double-book elsewhere.
-            if (found && found.status === 'confirmed') {
-                return {
-                    ok: true,
-                    reservation: {
-                        id: holdId,
-                        resourceId: found.resource_id,
-                        tenantRef: null,
-                        externalRef: null,
-                        start: found.starts_at,
-                        end: found.ends_at,
-                        bufferAfterMs: 0,
-                        revision: 1,
-                        source: found.source,
-                    },
-                };
+         WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
+           AND calendar_event_id IS NULL`;
+            return row ? toReservation(row) : null;
+        },
+        async listReservations(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             }
-            if (found?.expired)
-                return { ok: false, code: 'hold_expired' };
-            // NOTE: a hold reaped mid-flight by a rival (expired while this confirm waited on the
-            // reaper's lock) reads as hold_not_found — the row is gone and the space was legitimately
-            // taken; both refusal codes are terminal for the caller.
-            return { ok: false, code: 'hold_not_found' };
+            if (!isValidResourceId(params.resourceId)) {
+                throw invalidIdentityError('Slotlock resource id must be a UUID');
+            }
+            const window = calendarWindow(params.window);
+            const limit = pageLimit(params.limit);
+            const after = pageCursor(params.after);
+            const rows = await sql `
+        SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
+               revision, source
+          FROM slotlock.reservations
+         WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+           AND calendar_event_id IS NULL
+           AND starts_at < ${window.end}
+           AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
+           AND (${after.start}::timestamptz IS NULL
+                OR (starts_at, id) > (${after.start}::timestamptz, ${after.id}::uuid))
+         ORDER BY starts_at, id
+         LIMIT ${limit}`;
+            return rows.map(toReservation);
+        },
+        async confirmHold(holdId, options = {}) {
+            const tenantRef = holdTenantRef(options);
+            // Not an id the store issues: it names no hold (and would be a raw 22P02 in the query).
+            if (!isValidResourceId(holdId))
+                return { ok: false, code: 'hold_not_found' };
+            return inTransaction(sql, async (tx) => {
+                // The tenant whose booking the hold becomes is its resource's; a hold never changes
+                // resource, so it is read before the identity lock, which is taken before the row lock as
+                // every booking write takes them.
+                const [owner] = await tx `
+          SELECT hold.resource_id, resource.tenant_ref AS resource_tenant
+            FROM slotlock.reservations hold
+            JOIN slotlock.resources resource ON resource.id = hold.resource_id
+           WHERE hold.id = ${holdId} AND hold.calendar_event_id IS NULL
+             AND (${tenantRef}::text IS NULL OR resource.tenant_ref = ${tenantRef})`;
+                if (!owner)
+                    return { ok: false, code: 'hold_not_found' };
+                const bookingTenant = owner.resource_tenant;
+                if (bookingTenant !== null)
+                    await lockExternalIdentity(tx, bookingTenant, holdId);
+                const bookingLimit = await tenantLimitReached(tx, bookingTenant, 'reservations');
+                // The resource's share lock, as every booking write takes it: an archive waits for this
+                // confirmation, and one that committed first is read here.
+                const [resource] = await tx `
+          SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
+           WHERE id = ${owner.resource_id}
+           FOR SHARE`;
+                const [row] = await tx `
+          SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
+                 revision, source, status, (status = 'held' AND expires_at > now()) AS live
+            FROM slotlock.reservations
+           WHERE id = ${holdId}
+           FOR UPDATE`;
+                if (!row) {
+                    // NOTE: a hold reaped mid-flight by a rival (expired while this confirm waited on the
+                    // reaper's lock) reads as hold_not_found: the row is gone and the space was legitimately
+                    // taken; both refusal codes are terminal for the caller.
+                    return { ok: false, code: 'hold_not_found' };
+                }
+                if (row.status === 'confirmed') {
+                    // Idempotent confirm: a retried confirm (network replay) of an already-confirmed hold is
+                    // SUCCESS, the booking as it now is; reporting failure would make callers double-book
+                    // elsewhere. A confirmed hold's reference is its own id (none without a tenant); a
+                    // booking with another reference was never this hold.
+                    if (row.external_ref !== null && row.external_ref !== row.id) {
+                        return { ok: false, code: 'hold_not_found' };
+                    }
+                    return { ok: true, reservation: toReservation(row) };
+                }
+                if (!row.live)
+                    return { ok: false, code: 'hold_expired' };
+                // Archived since the hold was taken: a confirmation would be a new booking on it.
+                if (resource?.archived !== false)
+                    return { ok: false, code: 'resource_archived' };
+                if (bookingTenant !== null) {
+                    const [retired] = await tx `
+            SELECT revision FROM slotlock.reservation_tombstones
+             WHERE tenant_ref = ${bookingTenant} AND external_ref = ${holdId}`;
+                    if (retired)
+                        return { ok: false, code: 'reservation_cancelled' };
+                    const [taken] = await tx `
+            SELECT id FROM slotlock.reservations
+             WHERE tenant_ref = ${bookingTenant} AND external_ref = ${holdId}
+               AND calendar_event_id IS NULL`;
+                    if (taken)
+                        return { ok: false, code: 'idempotency_conflict' };
+                }
+                if (bookingLimit !== null) {
+                    return { ok: false, code: 'reservation_limit_reached', limit: bookingLimit };
+                }
+                // The occupied end is already the end plus the hold's buffer (the trigger set it); the
+                // tenant and reference make the hold a booking that cancel and reschedule reach.
+                const [confirmed] = await tx `
+          UPDATE slotlock.reservations
+             SET status = 'confirmed', expires_at = NULL,
+                 tenant_ref = ${bookingTenant}, external_ref = ${bookingTenant === null ? null : holdId}
+           WHERE id = ${holdId}
+          RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
+                    buffer_after_ms, revision, source`;
+                if (!confirmed)
+                    throw new Error('slotlock: hold confirmation returned no row');
+                return { ok: true, reservation: toReservation(confirmed) };
+            });
         },
         async releaseHold(holdId, options = {}) {
             const tenantRef = holdTenantRef(options);
+            if (!isValidResourceId(holdId))
+                return { ok: true, released: false };
             const rows = await sql `
         DELETE FROM slotlock.reservations
          WHERE id = ${holdId} AND status = 'held'
@@ -1396,9 +2782,30 @@ export function createSlotlockStore(sql, options = {}) {
          RETURNING id`;
             return { ok: true, released: rows.length > 0 };
         },
-        async listBusy(resourceId, window) {
+        async listBusy(resourceId, window, options = {}) {
             if (!isFiniteWindow(window))
                 throw invalidWindowError();
+            if (!isValidResourceId(resourceId)) {
+                throw invalidIdentityError('Slotlock resource id must be a UUID');
+            }
+            if (options.limit !== undefined && !(Number.isSafeInteger(options.limit) && options.limit > 0)) {
+                throw Object.assign(new Error('Slotlock busy read limit must be a positive whole number'), {
+                    code: 'invalid_limit',
+                });
+            }
+            if (options.tenantRef !== undefined) {
+                if (!isValidIdentity(options.tenantRef)) {
+                    throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+                }
+                const [owned] = await sql `
+          SELECT id FROM slotlock.resources
+           WHERE id = ${resourceId} AND tenant_ref = ${options.tenantRef}`;
+                if (!owned) {
+                    throw Object.assign(new Error('Slotlock resource not found in this tenant'), {
+                        code: 'resource_not_found',
+                    });
+                }
+            }
             // Expired holds are dead occupation: excluded here so findNextAvailable can offer their
             // space (the acquiring transaction reaps the row itself when it takes the window).
             const rows = await sql `
@@ -1408,11 +2815,15 @@ export function createSlotlockStore(sql, options = {}) {
            AND starts_at < ${window.end}
            AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
            AND (status <> 'held' OR expires_at > now())
-         ORDER BY starts_at`;
+         ORDER BY starts_at
+         LIMIT ${options.limit ?? null}`;
             return rows.map((r) => ({ start: r.starts_at, end: r.occupied_ends_at }));
         },
         async putCalendarEvent(params) {
             const ownerRef = params.ownerRef ?? SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
+            if (params.expectedResourceId !== undefined && !isValidResourceId(params.expectedResourceId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
             if (!isValidIdentity(params.tenantRef) ||
                 !isValidEventOwnerRef(ownerRef) ||
                 !isValidIdentity(params.externalRef) ||
@@ -1432,7 +2843,7 @@ export function createSlotlockStore(sql, options = {}) {
                 if (event.recurrence) {
                     if (!params.materializationWindow)
                         return { ok: false, code: 'invalid_event' };
-                    materializationWindow = calendarWindow(params.materializationWindow);
+                    materializationWindow = seriesWindow(params.materializationWindow);
                 }
                 else {
                     materializationWindow = oneOffEventWindow(event, params.materializationWindow);
@@ -1461,7 +2872,9 @@ export function createSlotlockStore(sql, options = {}) {
                 event,
                 window: materializationWindow,
             });
+            const recurrenceEndsBy = recurrenceEndsByColumn(event);
             let attempted = expanded?.occurrences ?? [];
+            let storedEventId;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -1509,9 +2922,11 @@ export function createSlotlockStore(sql, options = {}) {
                                 currentRevision: Number(tombstones[0].revision),
                             };
                         }
-                        if (!(await resourceBelongsToTenant(tx, params.resourceId, params.tenantRef))) {
+                        const resourceState = await tenantResourceState(tx, params.resourceId, params.tenantRef);
+                        if (resourceState === 'missing')
                             return { ok: false, code: 'resource_tenant_mismatch' };
-                        }
+                        if (resourceState === 'archived')
+                            return { ok: false, code: 'resource_archived' };
                         const existing = await tx `
               SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
                      summary, description, location, status, transparency, organizer, attendees,
@@ -1523,6 +2938,11 @@ export function createSlotlockStore(sql, options = {}) {
                  AND external_ref = ${params.externalRef}
                FOR UPDATE`;
                         const found = existing[0];
+                        storedEventId = found?.id;
+                        if (params.expectedResourceId !== undefined &&
+                            found?.resource_id !== params.expectedResourceId) {
+                            return { ok: false, code: 'resource_tenant_mismatch' };
+                        }
                         const currentRevision = found ? Number(found.revision) : 0;
                         if (params.expectedRevision !== currentRevision) {
                             return { ok: false, code: 'revision_conflict', currentRevision };
@@ -1553,8 +2973,26 @@ export function createSlotlockStore(sql, options = {}) {
                                 };
                             }
                         }
+                        if (!found) {
+                            const limit = await tenantLimitReached(tx, params.tenantRef, 'events');
+                            if (limit !== null)
+                                return { ok: false, code: 'event_limit_reached', limit };
+                        }
                         const eventId = found?.id ?? randomUUID();
                         const revision = currentRevision + 1;
+                        const reach = occurrenceSpan(occurrences);
+                        if ((event.transparency ?? 'opaque') === 'opaque' &&
+                            reach &&
+                            !(found && (await holdsEveryOccurrence(tx, found.id, params.resourceId, occurrences)))) {
+                            if (!(await recurrenceCoversWrite(tx, {
+                                tenantRef: params.tenantRef,
+                                resourceId: params.resourceId,
+                                ...reach,
+                                ...(found ? { exceptEventId: found.id } : {}),
+                            }))) {
+                                return { ok: false, code: 'recurrence_not_materialized' };
+                            }
+                        }
                         if (found) {
                             await tx `
                 UPDATE slotlock.calendar_events
@@ -1575,6 +3013,8 @@ export function createSlotlockStore(sql, options = {}) {
                        materialized_starts_at = ${materializationWindow.start},
                        materialized_ends_at = ${materializationWindow.end},
                        recurrence_cursor = ${seriesCursorJson(tx, series.cursor)},
+                       recurrence_ends_by = ${recurrenceEndsBy}::text::timestamptz,
+                       roll_retry_at = NULL,
                        revision = ${revision},
                        source = ${params.source ?? null},
                        updated_at = now()
@@ -1588,7 +3028,7 @@ export function createSlotlockStore(sql, options = {}) {
                   id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
                   summary, description, location, status, transparency, organizer, attendees,
                   reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
-                  materialized_ends_at, recurrence_cursor, revision, source
+                  materialized_ends_at, recurrence_cursor, recurrence_ends_by, revision, source
                 ) VALUES (
                   ${eventId}, ${params.tenantRef}, ${ownerRef}, ${params.externalRef},
                   ${params.resourceId},
@@ -1601,8 +3041,8 @@ export function createSlotlockStore(sql, options = {}) {
                   ${event.recurrence?.rrule ?? null},
                   ${tx.json(eventExceptionsForJson(event.recurrence?.exceptions))},
                   ${materializationWindow.start}, ${materializationWindow.end},
-                  ${seriesCursorJson(tx, series.cursor)}, ${revision},
-                  ${params.source ?? null}
+                  ${seriesCursorJson(tx, series.cursor)}, ${recurrenceEndsBy}::text::timestamptz,
+                  ${revision}, ${params.source ?? null}
                 )`;
                         }
                         // The normalized children are the queryable/canonical representation. The JSON
@@ -1645,7 +3085,11 @@ export function createSlotlockStore(sql, options = {}) {
                         code !== SERIALIZATION_FAILURE) {
                         throw error;
                     }
-                    return findCalendarOverlap(sql, params.resourceId, attempted);
+                    const reach = occurrenceSpan(attempted);
+                    if (reach) {
+                        await rollSeriesBehind(sql, params.resourceId, reach.start, reach.end, storedEventId);
+                    }
+                    return findCalendarOverlap(sql, params.resourceId, attempted, storedEventId);
                 }
             }
         },
@@ -1673,7 +3117,31 @@ export function createSlotlockStore(sql, options = {}) {
             const children = await loadCalendarEventChildren(sql, [row.id]);
             return toCalendarEvent(row, children.get(row.id));
         },
+        async getCalendarEventById(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.eventId)) {
+                throw invalidIdentityError('Slotlock event id must be a UUID');
+            }
+            const rows = await sql `
+        SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
+               summary, description, location, status, transparency, organizer, attendees,
+               reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
+               materialized_ends_at, revision, source, created_at, updated_at
+          FROM slotlock.calendar_events
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}`;
+            const row = rows[0];
+            if (!row)
+                return null;
+            const children = await loadCalendarEventChildren(sql, [row.id]);
+            return toCalendarEvent(row, children.get(row.id));
+        },
         async listCalendarEvents(params) {
+            if (params.allOwners === true && params.ownerRef !== undefined) {
+                throw invalidIdentityError('Slotlock lists one owner or every owner, not both');
+            }
+            const allOwners = params.allOwners === true;
             const ownerRef = params.ownerRef ?? SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
             if (!isValidIdentity(params.tenantRef) || !isValidEventOwnerRef(ownerRef)) {
                 throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
@@ -1711,7 +3179,7 @@ export function createSlotlockStore(sql, options = {}) {
                event.source, event.created_at, event.updated_at
           FROM slotlock.calendar_events event
          WHERE event.tenant_ref = ${params.tenantRef}
-           AND event.owner_ref = ${ownerRef}
+           AND (${allOwners}::boolean OR event.owner_ref = ${ownerRef})
            AND event.resource_id = ${params.resourceId}
            AND EXISTS (
              SELECT 1 FROM slotlock.calendar_event_occurrences occurrence
@@ -1738,7 +3206,7 @@ export function createSlotlockStore(sql, options = {}) {
                     code: 'invalid_identity',
                 });
             }
-            const window = calendarWindow(params.window);
+            const window = seriesWindow(params.window);
             const limit = params.limit ?? 100;
             if (!Number.isSafeInteger(limit) || limit <= 0 || limit > MAX_CALENDAR_LIST_LIMIT) {
                 throw Object.assign(new Error('Slotlock horizon batch limit must be 1-1000'), {
@@ -1747,9 +3215,12 @@ export function createSlotlockStore(sql, options = {}) {
             }
             const after = rollCursor(params.after);
             // Due: the masters rolledWindow rolls, which do not cover the window and end within the cap
-            // of its start.
+            // of its start. Those it has never put back come first, then those it has, longest waiting
+            // first: however many it cannot extend, they never stand in front of one it has not tried,
+            // so every pass that is not capped by such new ones reaches the healthy series, and the ones
+            // put back take turns.
             const candidates = await sql `
-        SELECT id, materialized_ends_at
+        SELECT id, materialized_ends_at, roll_retry_at
           FROM slotlock.calendar_events
          WHERE tenant_ref = ${params.tenantRef}
            AND recurrence_rule IS NOT NULL
@@ -1757,71 +3228,40 @@ export function createSlotlockStore(sql, options = {}) {
              materialized_starts_at > ${window.start}
              OR materialized_ends_at < ${window.end}
            )
-           AND materialized_ends_at <= ${new Date(window.start.getTime() + MAX_CALENDAR_WINDOW_MS)}
+           AND materialized_ends_at <= ${new Date(window.start.getTime() + MAX_MATERIALIZATION_WINDOW_MS)}
+           -- One it could not extend waits its turn behind the ones it can.
+           AND (roll_retry_at IS NULL OR roll_retry_at <= now())
            AND (
              ${after?.materializedEndsAt ?? null}::timestamptz IS NULL
-             OR (materialized_ends_at, id) >
-                (${after?.materializedEndsAt ?? null}::timestamptz, ${after?.eventId ?? null}::uuid)
+             OR (COALESCE(roll_retry_at, '-infinity'), materialized_ends_at, id) >
+                (COALESCE(${after?.rollRetryAt ?? null}::timestamptz, '-infinity'),
+                 ${after?.materializedEndsAt ?? null}::timestamptz, ${after?.eventId ?? null}::uuid)
            )
-         ORDER BY materialized_ends_at, id
+         ORDER BY COALESCE(roll_retry_at, '-infinity'), materialized_ends_at, id
          LIMIT ${limit + 1}`;
             const due = candidates.slice(0, limit);
             let extended = 0;
             let conflicts = 0;
             let refused = 0;
             const refusedEventIds = [];
+            const conflictEventIds = [];
             for (const candidate of due) {
                 for (let attempt = 1; attempt <= 2; attempt++) {
                     try {
-                        const changed = await inTransaction(sql, async (tx) => {
-                            const [row] = await tx `
-                SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
-                       summary, description, location, status, transparency, organizer, attendees,
-                       reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
-                       materialized_ends_at, recurrence_cursor, revision, source, created_at,
-                       updated_at
-                  FROM slotlock.calendar_events
-                 WHERE id = ${candidate.id} AND tenant_ref = ${params.tenantRef}
-                 FOR UPDATE`;
-                            if (!row || row.recurrence_rule === null)
-                                return false;
-                            const rolled = rolledWindow({ start: row.materialized_starts_at, end: row.materialized_ends_at }, window);
-                            if (!rolled)
-                                return false;
-                            const childMap = await loadCalendarEventChildren(tx, [row.id]);
-                            const event = toCalendarEvent(row, childMap.get(row.id));
-                            // From where its last expansion stopped, when that can be trusted; else its start.
-                            const { occurrences, cursor } = expandCalendarEventSeries(event, rolled, {
-                                cursor: row.recurrence_cursor ?? null,
-                                stored: true,
-                            });
-                            await replaceCalendarEventOccurrences(tx, {
-                                tenantRef: params.tenantRef,
-                                eventId: row.id,
-                                resourceId: row.resource_id,
-                                event,
-                                occurrences,
-                                revision: Number(row.revision),
-                            });
-                            await tx `
-                UPDATE slotlock.calendar_events
-                   SET materialized_starts_at = ${rolled.start},
-                       materialized_ends_at = ${rolled.end},
-                       recurrence_cursor = ${seriesCursorJson(tx, cursor)}
-                 WHERE id = ${row.id} AND tenant_ref = ${params.tenantRef}`;
-                            return true;
-                        });
+                        const changed = await inTransaction(sql, (tx) => rollStoredSeries(tx, params.tenantRef, candidate.id, window));
                         if (changed)
                             extended += 1;
                         break;
                     }
                     catch (error) {
                         if (error instanceof CalendarExpansionLimitError) {
-                            // It takes more than Slotlock expands: a rule that never occurs again, or one with no
-                            // cursor to resume from whose search from its start has outgrown the budget. Nothing
-                            // was written; its old coverage stays, and the masters after it still roll.
+                            // It takes more than Slotlock expands: a rule that never occurs again, one with no
+                            // cursor to resume from whose search from its start has outgrown the budget, or one an
+                            // earlier Slotlock stored that this one refuses. Nothing was written; its old coverage
+                            // stays, and the masters after it still roll.
                             refused += 1;
                             refusedEventIds.push(candidate.id);
+                            await deferRoll(sql, params.tenantRef, candidate.id);
                             break;
                         }
                         const code = pgCode(error);
@@ -1834,9 +3274,17 @@ export function createSlotlockStore(sql, options = {}) {
                             // The savepoint rolled every delete/insert back, so the previous materialized
                             // coverage remains truthful and callers will fail closed beyond it.
                             conflicts += 1;
+                            conflictEventIds.push(candidate.id);
+                            await deferRoll(sql, params.tenantRef, candidate.id);
                             break;
                         }
-                        throw error;
+                        // Anything else this one series meets (a row no Slotlock would write, a constraint it
+                        // trips) was rolled back with its savepoint too: it is put back like one over the
+                        // budget, so no single row stops the tenant's roll.
+                        refused += 1;
+                        refusedEventIds.push(candidate.id);
+                        await deferRoll(sql, params.tenantRef, candidate.id);
+                        break;
                     }
                 }
             }
@@ -1846,14 +3294,24 @@ export function createSlotlockStore(sql, options = {}) {
                 examined: due.length,
                 extended,
                 conflicts,
+                conflictEventIds,
                 refused,
                 refusedEventIds,
                 hasMore,
-                next: hasMore && last ? { materializedEndsAt: last.materialized_ends_at, eventId: last.id } : null,
+                next: hasMore && last
+                    ? {
+                        rollRetryAt: last.roll_retry_at,
+                        materializedEndsAt: last.materialized_ends_at,
+                        eventId: last.id,
+                    }
+                    : null,
             };
         },
         async cancelCalendarEvent(params) {
             const ownerRef = params.ownerRef ?? SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
+            if (params.expectedResourceId !== undefined && !isValidResourceId(params.expectedResourceId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
             if (!isValidIdentity(params.tenantRef) ||
                 !isValidEventOwnerRef(ownerRef) ||
                 !isValidIdentity(params.externalRef) ||
@@ -1918,12 +3376,16 @@ export function createSlotlockStore(sql, options = {}) {
                     };
                 }
                 const events = await tx `
-          SELECT id, revision FROM slotlock.calendar_events
+          SELECT id, resource_id, revision FROM slotlock.calendar_events
            WHERE tenant_ref = ${params.tenantRef}
              AND owner_ref = ${ownerRef}
              AND external_ref = ${params.externalRef}
            FOR UPDATE`;
                 const found = events[0];
+                if (params.expectedResourceId !== undefined &&
+                    found?.resource_id !== params.expectedResourceId) {
+                    return { ok: false, code: 'event_not_found' };
+                }
                 const currentRevision = found ? Number(found.revision) : 0;
                 if (!found && ownerRef !== SLOTLOCK_INTERNAL_EVENT_OWNER_REF) {
                     return { ok: false, code: 'event_not_found' };
@@ -1931,41 +3393,183 @@ export function createSlotlockStore(sql, options = {}) {
                 if (params.expectedRevision !== currentRevision) {
                     return { ok: false, code: 'revision_conflict', currentRevision };
                 }
-                const eventId = found?.id ?? randomUUID();
-                const revision = currentRevision + 1;
-                if (found) {
+                return finishCalendarCancel(tx, {
+                    tenantRef: params.tenantRef,
+                    ownerRef,
+                    externalRef: params.externalRef,
+                    eventId: found?.id ?? null,
+                    revision: currentRevision + 1,
+                    commandOwnerRef: ownerRef,
+                    idempotencyKey: params.idempotencyKey,
+                    payloadHash,
+                });
+            });
+        },
+        async cancelCalendarEventById(params) {
+            if (!isValidIdentity(params.tenantRef) ||
+                !isValidResourceId(params.eventId) ||
+                !isValidIdentity(params.idempotencyKey) ||
+                (params.expectedResourceId !== undefined && !isValidResourceId(params.expectedResourceId))) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            if (!Number.isSafeInteger(params.expectedRevision) || params.expectedRevision < 0) {
+                return { ok: false, code: 'invalid_revision' };
+            }
+            const commandOwnerRef = SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
+            // Its own operation in the hash: an owner-scoped cancel under the same key never replays it.
+            const payloadHash = calendarCommandHash({
+                operation: 'cancel-by-id',
+                eventId: params.eventId,
+                idempotencyKey: params.idempotencyKey,
+                expectedRevision: params.expectedRevision,
+                expectedResourceId: params.expectedResourceId ?? null,
+            });
+            return inTransaction(sql, async (tx) => {
+                await lockCalendarIdempotency(tx, params.tenantRef, commandOwnerRef, params.idempotencyKey);
+                const commands = await tx `
+          SELECT operation, payload_hash, event_id, external_ref,
+                 result_revision, occurrence_count
+            FROM slotlock.calendar_event_commands
+           WHERE tenant_ref = ${params.tenantRef}
+             AND owner_ref = ${commandOwnerRef}
+             AND idempotency_key = ${params.idempotencyKey}
+           FOR UPDATE`;
+                const priorCommand = commands[0];
+                if (priorCommand) {
+                    if (priorCommand.operation !== 'cancel' || priorCommand.payload_hash !== payloadHash) {
+                        return { ok: false, code: 'idempotency_conflict' };
+                    }
+                    return {
+                        ok: true,
+                        eventId: priorCommand.event_id,
+                        externalRef: priorCommand.external_ref,
+                        revision: Number(priorCommand.result_revision),
+                        idempotent: true,
+                    };
+                }
+                // An event's owner and reference never change, so they are read before its identity lock,
+                // which is taken before its row lock as every event write takes them.
+                const [identity] = await tx `
+          SELECT owner_ref, external_ref FROM slotlock.calendar_events
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}`;
+                if (!identity)
+                    return { ok: false, code: 'event_not_found' };
+                await lockCalendarEventIdentity(tx, params.tenantRef, identity.owner_ref, identity.external_ref);
+                const [found] = await tx `
+          SELECT id, resource_id, revision FROM slotlock.calendar_events
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}
+           FOR UPDATE`;
+                // Cancelled while this waited on its lock.
+                if (!found)
+                    return { ok: false, code: 'event_not_found' };
+                if (params.expectedResourceId !== undefined &&
+                    found.resource_id !== params.expectedResourceId) {
+                    return { ok: false, code: 'event_not_found' };
+                }
+                const currentRevision = Number(found.revision);
+                if (params.expectedRevision !== currentRevision) {
+                    return { ok: false, code: 'revision_conflict', currentRevision };
+                }
+                return finishCalendarCancel(tx, {
+                    tenantRef: params.tenantRef,
+                    ownerRef: identity.owner_ref,
+                    externalRef: identity.external_ref,
+                    eventId: found.id,
+                    revision: currentRevision + 1,
+                    commandOwnerRef,
+                    idempotencyKey: params.idempotencyKey,
+                    payloadHash,
+                });
+            });
+        },
+        async pruneBookingRetention(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 100;
+            if (!Number.isSafeInteger(limit) || limit <= 0 || limit > MAX_CALENDAR_LIST_LIMIT) {
+                throw Object.assign(new Error('Slotlock retention batch limit must be 1-1000'), {
+                    code: 'invalid_limit',
+                });
+            }
+            const retentionDays = params.retentionDays ?? SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS;
+            if (!Number.isSafeInteger(retentionDays) ||
+                retentionDays < 1 ||
+                retentionDays > MAX_EVENT_COMMAND_RETENTION_DAYS) {
+                throw Object.assign(new Error('Slotlock retention window must be 1-3650 days'), {
+                    code: 'invalid_retention_window',
+                });
+            }
+            return inTransaction(sql, async (tx) => {
+                // A 0.2 server still serving after the migration wrote its confirmed holds (and
+                // createReservation bookings) on the tenant's resources without the tenant or a reference,
+                // so no cancel or move reaches them; the migration gives those it finds the tenant and
+                // their own id, and this gives later ones the same. Each takes its reference's identity lock
+                // first, as every booking write does; a tombstone of its id retired nothing and goes.
+                const legacy = await tx `
+          SELECT booking.id
+            FROM slotlock.reservations booking
+            JOIN slotlock.resources resource ON resource.id = booking.resource_id
+           WHERE resource.tenant_ref = ${params.tenantRef}
+             AND booking.tenant_ref IS NULL AND booking.status = 'confirmed'
+             AND booking.calendar_event_id IS NULL
+             AND NOT EXISTS (
+               SELECT 1 FROM slotlock.reservations taken
+                WHERE taken.tenant_ref = ${params.tenantRef}
+                  AND taken.external_ref = booking.id::text
+                  AND taken.calendar_event_id IS NULL
+             )
+           ORDER BY booking.id
+           LIMIT ${limit}`;
+                for (const { id } of legacy) {
+                    await lockExternalIdentity(tx, params.tenantRef, id);
+                    const [taken] = await tx `
+            SELECT id FROM slotlock.reservations
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${id}
+               AND calendar_event_id IS NULL`;
+                    if (taken)
+                        continue;
                     await tx `
-            DELETE FROM slotlock.reservations
-             WHERE id IN (
-               SELECT reservation_id FROM slotlock.calendar_event_occurrences
-                WHERE event_id = ${eventId} AND reservation_id IS NOT NULL
-             )`;
+            DELETE FROM slotlock.reservation_tombstones
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${id}`;
                     await tx `
-            DELETE FROM slotlock.calendar_events
-             WHERE id = ${eventId}
-               AND tenant_ref = ${params.tenantRef}
-               AND owner_ref = ${ownerRef}`;
+            UPDATE slotlock.reservations
+               SET tenant_ref = ${params.tenantRef}, external_ref = id::text,
+                   occupied_ends_at = ends_at + buffer_after_ms * interval '1 millisecond'
+             WHERE id = ${id} AND tenant_ref IS NULL AND status = 'confirmed'`;
                 }
-                await tx `
-          INSERT INTO slotlock.calendar_event_tombstones (
-            tenant_ref, owner_ref, external_ref, event_id, revision
-          ) VALUES (
-            ${params.tenantRef}, ${ownerRef}, ${params.externalRef}, ${eventId}, ${revision}
-          )`;
-                await tx `
-          INSERT INTO slotlock.calendar_event_commands (
-            tenant_ref, owner_ref, idempotency_key, operation, payload_hash, event_id, external_ref,
-            result_revision, occurrence_count
-          ) VALUES (
-            ${params.tenantRef}, ${ownerRef}, ${params.idempotencyKey}, 'cancel', ${payloadHash},
-            ${eventId}, ${params.externalRef}, ${revision}, 0
-          )`;
+                const expiredHoldsDeleted = await deleteExpiredHolds(tx, params.tenantRef, limit);
+                const holdCommandsDeleted = await forgetExpiredHoldAnswers(tx, params.tenantRef, limit);
+                // Only references retired with no booking: a cancelled booking's tombstone is kept.
+                const [tombstones] = await tx `
+          WITH candidates AS MATERIALIZED (
+            SELECT tombstone.external_ref
+              FROM slotlock.reservation_tombstones tombstone
+             WHERE tombstone.tenant_ref = ${params.tenantRef}
+               AND tombstone.stray
+               AND tombstone.cancelled_at <
+                   clock_timestamp() - (${retentionDays}::int * interval '1 day')
+             ORDER BY tombstone.cancelled_at, tombstone.external_ref
+             LIMIT ${limit}
+             FOR UPDATE OF tombstone SKIP LOCKED
+          ), deleted AS (
+            DELETE FROM slotlock.reservation_tombstones tombstone
+             USING candidates candidate
+             WHERE tombstone.tenant_ref = ${params.tenantRef}
+               AND tombstone.external_ref = candidate.external_ref
+               AND tombstone.stray
+            RETURNING 1
+          )
+          SELECT count(*)::int AS deleted FROM deleted`;
+                const tombstonesDeleted = Number(tombstones?.deleted ?? 0);
                 return {
-                    ok: true,
-                    eventId,
-                    externalRef: params.externalRef,
-                    revision,
-                    idempotent: false,
+                    expiredHoldsDeleted,
+                    holdCommandsDeleted,
+                    tombstonesDeleted,
+                    hasMore: legacy.length === limit ||
+                        expiredHoldsDeleted === limit ||
+                        holdCommandsDeleted === limit ||
+                        tombstonesDeleted === limit,
                 };
             });
         },
@@ -2084,7 +3688,8 @@ export function createSlotlockStore(sql, options = {}) {
             }
             return inTransaction(sql, async (tx) => {
                 await lockExternalIdentity(tx, params.tenantRef, `calendar-coverage:${params.resourceId}:${params.source}`);
-                if (!(await resourceBelongsToTenant(tx, params.resourceId, params.tenantRef))) {
+                // Coverage of an archived resource may still be recorded: it books nothing.
+                if ((await tenantResourceState(tx, params.resourceId, params.tenantRef)) === 'missing') {
                     return { ok: false, code: 'resource_tenant_mismatch' };
                 }
                 const rows = await tx `
@@ -2119,6 +3724,9 @@ export function createSlotlockStore(sql, options = {}) {
                 else {
                     if (params.revision !== 1)
                         return { ok: false, code: 'revision_conflict' };
+                    const limit = await tenantLimitReached(tx, params.tenantRef, 'coverage');
+                    if (limit !== null)
+                        return { ok: false, code: 'coverage_limit_reached', limit };
                     await tx `
             INSERT INTO slotlock.calendar_coverage (
               tenant_ref, resource_id, source, starts_at, ends_at, revision
@@ -2261,17 +3869,148 @@ export function createSlotlockStore(sql, options = {}) {
             };
         },
         async findNextAvailableFor(params) {
-            if (!isFiniteWindow(params.searchWindow))
+            const window = params.searchWindow;
+            if (!isFiniteWindow(window))
                 throw invalidWindowError();
-            assertBoundedSearchWindow(params.searchWindow);
+            assertBoundedSearchWindow(window);
+            const { tenantRef } = params;
+            if (tenantRef !== null && !isValidIdentity(tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const bufferAfterMs = params.bufferAfterMs ?? 0;
+            if (!Number.isSafeInteger(bufferAfterMs) ||
+                bufferAfterMs < 0 ||
+                bufferAfterMs > MAX_BUFFER_AFTER_MS) {
+                throw Object.assign(new Error('Slotlock bufferAfterMs must be a whole 0-30 days'), {
+                    code: 'invalid_buffer',
+                });
+            }
+            const notFound = () => Object.assign(new Error('Slotlock resource not found in this tenant'), {
+                code: 'resource_not_found',
+            });
+            if (!isValidResourceId(params.resourceId))
+                throw notFound();
+            const [row] = await sql `
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at
+          FROM slotlock.resources
+         WHERE id = ${params.resourceId} AND tenant_ref IS NOT DISTINCT FROM ${tenantRef}`;
+            if (!row)
+                throw notFound();
             if (!Number.isFinite(params.durationMs) || params.durationMs <= 0)
                 return null;
-            // Rules are authored in the resource's zone — expansion must honour it (DST-correct).
-            const tzRows = await sql `
-        SELECT timezone FROM slotlock.resources WHERE id = ${params.resourceId}`;
-            const busy = await this.listBusy(params.resourceId, params.searchWindow);
-            const windows = expandRules(params.rules, params.searchWindow, tzRows[0]?.timezone ?? 'UTC');
-            return findNextAvailable({ busy, windows, durationMs: params.durationMs });
+            const resource = toResource(row);
+            const rules = params.rules ?? resource.availabilityRules ?? [];
+            // A slot's buffer may run past the window: the time it can reach must be proven free too.
+            const reach = { start: window.start, end: new Date(window.end.getTime() + bufferAfterMs) };
+            let busy;
+            if (tenantRef === null) {
+                // No event, coverage or series can belong to a resource with no tenant: only its rows.
+                busy = await this.listBusy(params.resourceId, reach);
+            }
+            else {
+                busy = [];
+                const parts = bufferAfterMs > 0 ? [window, { start: window.end, end: reach.end }] : [window];
+                for (const part of parts) {
+                    const freeBusy = await this.getFreeBusy({
+                        tenantRef,
+                        resourceId: params.resourceId,
+                        window: part,
+                        ...(params.requiredSources !== undefined
+                            ? { requiredSources: params.requiredSources }
+                            : {}),
+                        ...(params.coverageMaxAgeMs !== undefined
+                            ? { coverageMaxAgeMs: params.coverageMaxAgeMs }
+                            : {}),
+                    });
+                    // Absence is never treated as free time: what cannot be proven gives no slot.
+                    if (freeBusy.coverage.state !== 'complete')
+                        return null;
+                    busy.push(...freeBusy.busy);
+                }
+            }
+            // A slot [s, s + d) with its buffer meets busy [b, e) exactly when [s, s + d) meets [b - buffer, e).
+            return findNextAvailable({
+                busy: busy.map((interval) => ({
+                    start: new Date(interval.start.getTime() - bufferAfterMs),
+                    end: interval.end,
+                })),
+                windows: expandRules(rules, window, resource.timezone),
+                durationMs: params.durationMs,
+            });
+        },
+        async suspendTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const reason = params.reason;
+            if (reason !== undefined &&
+                (typeof reason !== 'string' ||
+                    reason.length === 0 ||
+                    Array.from(reason).length > 500 ||
+                    Array.from(reason).some((character) => {
+                        const codePoint = character.codePointAt(0) ?? 0;
+                        return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+                    }))) {
+                throw Object.assign(new Error('Slotlock suspension reason must be 1-500 characters without control characters'), { code: 'invalid_suspension_reason' });
+            }
+            try {
+                const [row] = await sql `
+          SELECT slotlock.suspend_tenant(${params.tenantRef}::text, ${reason ?? null}::text) AS suspended`;
+                return { suspended: row?.suspended === true };
+            }
+            catch (error) {
+                throw suspensionRefusal(error);
+            }
+        },
+        async unsuspendTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            try {
+                const [row] = await sql `
+          SELECT slotlock.unsuspend_tenant(${params.tenantRef}::text) AS unsuspended`;
+                return { unsuspended: row?.unsuspended === true };
+            }
+            catch (error) {
+                throw suspensionRefusal(error);
+            }
+        },
+        async isTenantSuspended(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const [row] = await sql `
+        SELECT slotlock.tenant_suspended(${params.tenantRef}::text) AS suspended`.catch((error) => {
+                throw suspensionCheckRefusal(error);
+            });
+            return row?.suspended === true;
+        },
+        async eraseTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const erased = await sql `
+        SELECT erased_table, erased_rows FROM slotlock.erase_tenant(${params.tenantRef}::text)`;
+            const rows = {};
+            let total = 0;
+            for (const row of erased) {
+                const count = Number(row.erased_rows);
+                rows[row.erased_table] = count;
+                total += count;
+            }
+            return { rows, total };
         },
     };
+    if (refusal === null)
+        return store;
+    const refuse = async () => {
+        throw refusal();
+    };
+    return Object.assign(store, Object.fromEntries(SLOTLOCK_TENANT_WRITE_METHODS.map((name) => [name, refuse])));
+}
+/** The deployment role alone may suspend: another role is refused EXECUTE on the functions. */
+function suspensionRefusal(error) {
+    if (pgCode(error) !== '42501')
+        return error;
+    return Object.assign(new Error('Slotlock suspends tenants and lifts suspensions only as the deployment role'), { code: 'tenant_suspension_not_permitted', cause: error });
 }