slotlock 0.2.0 → 0.5.0

package/store.js

@@ -1,8 +1,11 @@
 // DB mechanics for the Slotlock core — explicit `postgres` client in, structured results out.
 // Domain policy (who may reserve, pricing, holds) belongs to future callers; this layer owns the
 // reliable how: idempotent schema apply, EXCLUDE-arbitrated inserts with a structured conflict.
+import { SLOTLOCK_CHANGE_RETENTION_DAYS, slotlockEventFeedMethods } from './event-feed.js';
+import { bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
 import { createHash, randomUUID } from 'node:crypto';
-import { SLOTLOCK_CORE_DDL, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_TENANT_CONTEXT_SETTING, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, } from './ddl.js';
+import ICAL from 'ical.js';
+import { SLOTLOCK_CORE_DDL, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockTenantLockKey, } from './ddl.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
 import { SLOTLOCK_CALENDAR_HORIZON_DAYS, assertBoundedSearchWindow, expandRules, invalidWindowError, } from './rules.js';
 import { CalendarContractError, CalendarExpansionLimitError, expandCalendarEventSeries, normalizeCalendarEventContent, } from './sync.js';
@@ -30,6 +33,13 @@ export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
 export const SLOTLOCK_MAX_EVENT_DURATION_DAYS = 3_660;
 const DAY_MS = 24 * 60 * 60 * 1000;
 const MAX_CALENDAR_WINDOW_MS = SLOTLOCK_CALENDAR_HORIZON_DAYS * DAY_MS;
+/**
+ * Longest window a recurring series is stored (materialized) for: the 367-day search window plus
+ * two days. The rolling horizon starts a day before the current UTC day and must reach 367 days
+ * past its end, so that a search of the full 367 days from any moment of the day is complete.
+ */
+export const SLOTLOCK_MATERIALIZATION_WINDOW_DAYS = SLOTLOCK_CALENDAR_HORIZON_DAYS + 2;
+const MAX_MATERIALIZATION_WINDOW_MS = SLOTLOCK_MATERIALIZATION_WINDOW_DAYS * DAY_MS;
 const MAX_EVENT_DURATION_MS = SLOTLOCK_MAX_EVENT_DURATION_DAYS * DAY_MS;
 const MAX_RESOURCE_LIST_LIMIT = 1_000;
 /** Highest per-tenant resource cap `createResource` accepts. */
@@ -40,6 +50,19 @@ const MAX_COVERAGE_SOURCES = 64;
 const MAX_COVERAGE_AGE_MS = 30 * 24 * 60 * 60 * 1000;
 /** Trusted provider/maintenance namespace used by backwards-compatible store callers. */
 export const SLOTLOCK_INTERNAL_EVENT_OWNER_REF = 'internal';
+/** How many live holds one holder (a keyed hold's principal) may have in a tenant at once. */
+export const SLOTLOCK_MAX_HOLDS_PER_HOLDER = 20;
+/** Windows one holder may wait for at once (joinWaitlist). */
+export const SLOTLOCK_MAX_WAITLIST_PER_HOLDER = 20;
+/** Waiting entries one tenant may have. */
+export const SLOTLOCK_MAX_WAITLIST_PER_TENANT = 10_000;
+/** The longest window one waitlist entry may wait for. */
+const MAX_WAITLIST_WINDOW_MS = 31 * 24 * 60 * 60 * 1000;
+const DEFAULT_OFFER_TTL_MS = 15 * 60 * 1000;
+/** How long before its start a booking may be checked in. */
+export const SLOTLOCK_CHECK_IN_OPENS_MINUTES = 60;
+/** Free-looking resources one entry tries before the next entry: a race can take one first. */
+const OFFER_CANDIDATES = 3;
 /** Default hard ceiling for retained active + tombstoned identities per agent principal. */
 export const SLOTLOCK_AGENT_OWNER_EVENT_QUOTA = 1_000;
 /** Hard retained command ceiling; includes reserved cancellation capacity for every identity. */
@@ -57,13 +80,16 @@ const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3
 const AGENT_EVENT_OWNER_PATTERN = /^agent:[0-9a-f]{64}$/;
 /** Store-owned coverage source for bounded, locally materialized recurring events. */
 export const SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE = 'slotlock:local-recurrence-materialization';
-/** Stable daily target shared by the event writer, maintenance worker, and readiness proof. */
+/**
+ * Stable daily target shared by the event writer, maintenance worker, and readiness proof: from a
+ * day before the current UTC day to 367 days past its end (SLOTLOCK_MATERIALIZATION_WINDOW_DAYS).
+ */
 export function calendarEventRollingHorizon(now = new Date()) {
     if (!Number.isFinite(now.getTime()))
         throw invalidWindowError();
     const midnight = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
     const start = new Date(midnight - DAY_MS);
-    return { start, end: new Date(start.getTime() + SLOTLOCK_CALENDAR_HORIZON_DAYS * DAY_MS) };
+    return { start, end: new Date(start.getTime() + MAX_MATERIALIZATION_WINDOW_MS) };
 }
 /**
  * A stored series expanded from the cursor its last expansion left, or `null` when there is none it
@@ -98,15 +124,118 @@ function seriesCursorJson(tx, cursor) {
 function rolledWindow(stored, horizon) {
     if (stored.start <= horizon.start && stored.end >= horizon.end)
         return null;
-    if (stored.end.getTime() - horizon.start.getTime() > MAX_CALENDAR_WINDOW_MS)
+    if (stored.end.getTime() - horizon.start.getTime() > MAX_MATERIALIZATION_WINDOW_MS)
         return null;
     return { start: horizon.start, end: stored.end > horizon.end ? stored.end : horizon.end };
 }
+/**
+ * How far past a rule's UNTIL, read as UTC, an occurrence can still end, beyond the series' own
+ * length. UNTIL bounds an occurrence's start (RFC 5545 §3.3.10), but a floating or date-only UNTIL
+ * is a wall time in a zone from UTC-12 to UTC+14, or a whole day; a start in an hour the clocks skip
+ * moves forward; and an occurrence's wall-clock end can pass its exact length by a clock change, a
+ * whole day where a zone moved across the date line. Three days covers them together.
+ */
+const SERIES_UNTIL_SLACK_MS = 3 * DAY_MS;
+/** Stored-series windows a COUNT rule is followed through, from its start, to find its end. */
+const SERIES_COUNT_SEARCH_WINDOWS = 30;
+/**
+ * A time by which every occurrence of a recurring series ends, moved ones included, or `null` when
+ * it may go on: its rule has neither UNTIL nor COUNT as ical.js reads it (as the expansion does),
+ * or its COUNT occurrences are not all found within SERIES_COUNT_SEARCH_WINDOWS windows from its
+ * start, or that search is over its budget. A COUNT series ends a day after its last occurrence as
+ * the expansion reads it today, so a later reading of its end may be longer.
+ */
+function seriesEndsBy(event) {
+    const recurrence = event.recurrence;
+    if (!recurrence)
+        return null;
+    let rule;
+    try {
+        rule = ICAL.Recur.fromString(recurrence.rrule);
+    }
+    catch {
+        return null;
+    }
+    let endsBy;
+    if (rule.until) {
+        // ical.js stops at the first occurrence past UNTIL; a floating or date UNTIL reads as UTC.
+        const untilMs = rule.until.toUnixTime() * 1000;
+        endsBy = untilMs + (event.end.getTime() - event.start.getTime()) + SERIES_UNTIL_SLACK_MS;
+    }
+    else if (rule.count) {
+        const last = lastCountedOccurrenceEnd(event, rule.count);
+        if (last === null)
+            return null;
+        endsBy = last + DAY_MS;
+    }
+    else {
+        return null;
+    }
+    for (const exception of recurrence.exceptions ?? []) {
+        if (!exception.cancelled && exception.end && exception.end.getTime() > endsBy) {
+            endsBy = exception.end.getTime();
+        }
+    }
+    const ends = new Date(endsBy);
+    return Number.isFinite(ends.getTime()) ? ends : null;
+}
+/**
+ * The latest end among a COUNT series' occurrences, expanded window by window from its start with
+ * exceptions left out (so a cancelled or moved one is still found in its own place), or `null` when
+ * fewer than `count` turn up. ical.js yields at most COUNT occurrences, so once `count` are found
+ * there are no more. An occurrence is counted in the window its start falls in.
+ */
+function lastCountedOccurrenceEnd(event, count) {
+    const rrule = event.recurrence?.rrule;
+    if (rrule === undefined)
+        return null;
+    const series = { ...event, recurrence: { rrule } };
+    let cursor = null;
+    let found = 0;
+    let lastEnd = Number.NEGATIVE_INFINITY;
+    let from = event.start.getTime();
+    try {
+        for (let window = 0; window < SERIES_COUNT_SEARCH_WINDOWS; window++) {
+            const to = from + MAX_MATERIALIZATION_WINDOW_MS;
+            const expansion = expandCalendarEventSeries(series, { start: new Date(from), end: new Date(to) }, { cursor, stored: true });
+            for (const occurrence of expansion.occurrences) {
+                if (occurrence.start.getTime() < from)
+                    continue;
+                found += 1;
+                if (occurrence.end.getTime() > lastEnd)
+                    lastEnd = occurrence.end.getTime();
+            }
+            if (found >= count)
+                return lastEnd;
+            cursor = expansion.cursor;
+            from = to;
+        }
+    }
+    catch (error) {
+        if (error instanceof CalendarExpansionLimitError || error instanceof CalendarContractError) {
+            return null;
+        }
+        throw error;
+    }
+    return null;
+}
+/**
+ * The recurrence_ends_by column for an event, as text: NULL for a one-off, 'infinity' for no known
+ * end. Bind it as text (`::text::timestamptz`): postgres.js serializes a timestamptz parameter
+ * through Date, which cannot hold 'infinity'.
+ */
+function recurrenceEndsByColumn(event) {
+    if (!event.recurrence)
+        return null;
+    return seriesEndsBy(event)?.toISOString() ?? 'infinity';
+}
 /** The roll's `after`, checked, or `undefined` for a pass's first batch. */
 function rollCursor(after) {
     if (after === undefined)
         return undefined;
-    if (!(after.materializedEndsAt instanceof Date) ||
+    const retryAt = after.rollRetryAt ?? null;
+    if ((retryAt !== null && (!(retryAt instanceof Date) || !Number.isFinite(retryAt.getTime()))) ||
+        !(after.materializedEndsAt instanceof Date) ||
         !Number.isFinite(after.materializedEndsAt.getTime()) ||
         !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(after.eventId)) {
         throw Object.assign(new Error('Slotlock horizon cursor must be a previous batch\'s `next`'), {
@@ -156,10 +285,18 @@ async function withPinnedSearchPath(tx, operation) {
 /**
  * The deployment DDL refuses a `slotlock` schema that another role controls with SQLSTATE 42501 and
  * its findings as a JSON array in DETAIL. Surface that as `unsafe_slotlock_schema` with `reasons`,
- * keeping the database's error (and its HINT) as `cause`; any other failure passes through unchanged.
+ * keeping the database's error (and its HINT) as `cause`. It refuses a schema a newer release
+ * migrated with SQLSTATE 55000: surface that as `schema_newer`. Any other failure passes through.
  */
 function schemaControlRefusal(error) {
     const failure = error;
+    if (failure?.code === '55000' &&
+        typeof failure.message === 'string' &&
+        failure.message.startsWith(SLOTLOCK_SCHEMA_NEWER_REFUSAL)) {
+        return Object.assign(new Error(failure.message, { cause: error }), {
+            code: 'schema_newer',
+        });
+    }
     if (failure?.code !== '42501' ||
         typeof failure.message !== 'string' ||
         !failure.message.startsWith(SLOTLOCK_SCHEMA_CONTROL_REFUSAL)) {
@@ -180,6 +317,236 @@ function schemaControlRefusal(error) {
         reasons,
     });
 }
+/** PostgreSQL lock_not_available: a lock wait passed lock_timeout. */
+const LOCK_NOT_AVAILABLE = '55P03';
+const DEFAULT_MIGRATION_LOCK_TIMEOUT_MS = 1_000;
+const DEFAULT_MIGRATION_STATEMENT_TIMEOUT_MS = 15 * 60 * 1000;
+const DEFAULT_MIGRATION_ATTEMPTS = 5;
+const SLOTLOCK_CORE_DDL_SHA256 = createHash('sha256').update(SLOTLOCK_CORE_DDL).digest('hex');
+function migrationSettings(options) {
+    const lockTimeoutMs = options?.lockTimeoutMs ?? DEFAULT_MIGRATION_LOCK_TIMEOUT_MS;
+    const statementTimeoutMs = options?.statementTimeoutMs ?? DEFAULT_MIGRATION_STATEMENT_TIMEOUT_MS;
+    const attempts = options?.attempts ?? DEFAULT_MIGRATION_ATTEMPTS;
+    const whole = (value, max) => Number.isSafeInteger(value) && value >= 1 && value <= max;
+    if (!whole(lockTimeoutMs, 600_000) ||
+        !whole(statementTimeoutMs, 86_400_000) ||
+        !whole(attempts, 20)) {
+        throw Object.assign(new Error('Slotlock migration lockTimeoutMs must be 1-600000, statementTimeoutMs 1-86400000 and attempts 1-20, whole numbers'), { code: 'invalid_migration_options' });
+    }
+    return { lockTimeoutMs, statementTimeoutMs, attempts };
+}
+/**
+ * Run one migration step: in a transaction (or a savepoint of the caller's), with names resolved
+ * in pg_catalog only, serialized with every other migration of this database, and with the lock and
+ * statement timeouts set. A step that waits past its lock timeout is rolled back and tried again
+ * after a pause, up to `attempts` times. The caller's own timeouts are put back afterwards.
+ */
+async function inMigration(executor, options, step) {
+    const settings = migrationSettings(options);
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await inTransaction(executor, (tx) => withPinnedSearchPath(tx, async () => {
+                // Taken before the timeouts are set: waiting for another migration holds up no query.
+                await tx `SELECT pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended(${SCHEMA_APPLY_LOCK}, 0))`;
+                const [caller] = await tx `
+            SELECT pg_catalog.current_setting('lock_timeout') AS lock,
+                   pg_catalog.current_setting('statement_timeout') AS statement`;
+                await tx `
+            SELECT pg_catalog.set_config('lock_timeout', ${`${settings.lockTimeoutMs}ms`}, true),
+                   pg_catalog.set_config('statement_timeout', ${`${settings.statementTimeoutMs}ms`}, true)`;
+                const result = await step(tx);
+                await tx `
+            SELECT pg_catalog.set_config('lock_timeout', ${caller?.lock ?? '0'}, true),
+                   pg_catalog.set_config('statement_timeout', ${caller?.statement ?? '0'}, true)`;
+                return result;
+            }));
+        }
+        catch (error) {
+            if (pgCode(error) !== LOCK_NOT_AVAILABLE)
+                throw error;
+            if (attempt >= settings.attempts) {
+                throw Object.assign(new Error(`Slotlock migration gave up after ${attempt} attempts to take its locks within ${settings.lockTimeoutMs} ms: a long transaction holds a slotlock table. Run it again once that transaction ends`, { cause: error }), { code: 'schema_lock_timeout' });
+            }
+            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 250, 2_000) + Math.floor(Math.random() * 250)));
+        }
+    }
+}
+/**
+ * A digest of what the migration defines in the `slotlock` schema: its tables and columns,
+ * constraints (and whether each is validated), indexes, triggers and functions, and whether PUBLIC
+ * holds any right on them. Grants to other roles, ownership and row-level security are left out:
+ * applyTenantRls and grantApplicationRole change those after applySchema has recorded the digest.
+ * Objects of an extension are left out too. Deparsed definitions depend on search_path, so this runs
+ * with it pinned, as the migration does.
+ */
+async function slotlockCatalogDigest(tx) {
+    const [row] = await tx `
+    WITH schema AS (
+      SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = 'slotlock'
+    ), members AS (
+      SELECT objid FROM pg_catalog.pg_depend WHERE deptype = 'e'
+    ), items (item) AS (
+      SELECT 'relation ' || rel.relname || ' ' || rel.relkind::text || ' '
+             || EXISTS (SELECT 1 FROM pg_catalog.aclexplode(rel.relacl) acl WHERE acl.grantee = 0)::text
+        FROM pg_catalog.pg_class rel, schema
+       WHERE rel.relnamespace = schema.oid AND rel.oid NOT IN (SELECT objid FROM members)
+      UNION ALL
+      SELECT 'column ' || rel.relname || '.' || att.attname || ' '
+             || pg_catalog.format_type(att.atttypid, att.atttypmod) || ' ' || att.attnotnull::text || ' '
+             || COALESCE(pg_catalog.pg_get_expr(def.adbin, def.adrelid), '')
+        FROM pg_catalog.pg_attribute att
+        JOIN pg_catalog.pg_class rel ON rel.oid = att.attrelid
+        JOIN schema ON rel.relnamespace = schema.oid
+        LEFT JOIN pg_catalog.pg_attrdef def ON def.adrelid = att.attrelid AND def.adnum = att.attnum
+       WHERE rel.relkind IN ('r', 'p') AND att.attnum > 0 AND NOT att.attisdropped
+      UNION ALL
+      SELECT 'constraint ' || rel.relname || '.' || con.conname || ' '
+             || pg_catalog.pg_get_constraintdef(con.oid) || ' ' || con.convalidated::text
+        FROM pg_catalog.pg_constraint con
+        JOIN pg_catalog.pg_class rel ON rel.oid = con.conrelid
+        JOIN schema ON rel.relnamespace = schema.oid
+      UNION ALL
+      SELECT 'index ' || pg_catalog.pg_get_indexdef(idx.indexrelid)
+        FROM pg_catalog.pg_index idx
+        JOIN pg_catalog.pg_class rel ON rel.oid = idx.indrelid
+        JOIN schema ON rel.relnamespace = schema.oid
+      UNION ALL
+      SELECT 'trigger ' || pg_catalog.pg_get_triggerdef(trg.oid) || ' ' || trg.tgenabled::text
+        FROM pg_catalog.pg_trigger trg
+        JOIN pg_catalog.pg_class rel ON rel.oid = trg.tgrelid
+        JOIN schema ON rel.relnamespace = schema.oid
+       WHERE NOT trg.tgisinternal
+      UNION ALL
+      SELECT 'function ' || fn.oid::pg_catalog.regprocedure::text || ' ' || fn.prosecdef::text || ' '
+             || fn.provolatile::text || ' ' || COALESCE(fn.proconfig::text, '') || ' '
+             || pg_catalog.md5(fn.prosrc) || ' '
+             || EXISTS (SELECT 1 FROM pg_catalog.aclexplode(
+                          COALESCE(fn.proacl, pg_catalog.acldefault('f', fn.proowner))) acl
+                         WHERE acl.grantee = 0)::text
+        FROM pg_catalog.pg_proc fn, schema
+       WHERE fn.pronamespace = schema.oid AND fn.oid NOT IN (SELECT objid FROM members)
+      UNION ALL
+      SELECT 'extension ' || ext.extname || ' ' || ext.extnamespace::pg_catalog.regnamespace::text
+        FROM pg_catalog.pg_extension ext
+       WHERE ext.extname = 'btree_gist'
+    )
+    SELECT pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(
+             COALESCE(pg_catalog.string_agg(item, pg_catalog.chr(10) ORDER BY item), ''),
+             'UTF8')), 'hex') AS digest
+      FROM items`;
+    return row?.digest ?? '';
+}
+/**
+ * Whether the schema is exactly what this release's applySchema last left: the same version, DDL
+ * and catalog digest, and no table left without FORCE by an interrupted migration. Reading needs
+ * the right to (the deployment role owns the table); without it the full migration runs and refuses
+ * what it must.
+ */
+async function slotlockSchemaUpToDate(tx) {
+    const [present] = await tx `
+    SELECT COALESCE(pg_catalog.has_table_privilege(
+             pg_catalog.to_regclass('slotlock.schema_version'), 'SELECT'), false) AS versioned,
+           COALESCE(pg_catalog.has_table_privilege(
+             pg_catalog.to_regclass('slotlock.deployment_lifted_row_security'), 'SELECT'), false)
+             AS lifted`;
+    if (!present?.versioned || !present.lifted)
+        return false;
+    const [recorded] = await tx `
+    SELECT version, ddl_sha256, catalog_sha256,
+           EXISTS (SELECT 1 FROM slotlock.deployment_lifted_row_security) AS lifted
+      FROM slotlock.schema_version
+     WHERE singleton`;
+    if (!recorded ||
+        recorded.lifted ||
+        recorded.version !== SLOTLOCK_SCHEMA_VERSION ||
+        recorded.ddl_sha256 !== SLOTLOCK_CORE_DDL_SHA256 ||
+        recorded.catalog_sha256 === null) {
+        return false;
+    }
+    return recorded.catalog_sha256 === (await slotlockCatalogDigest(tx));
+}
+/** Whether a constraint in the `slotlock` schema is still NOT VALID (old rows broke it). */
+async function slotlockConstraintUnvalidated(tx) {
+    const [row] = await tx `
+    SELECT EXISTS (
+      SELECT 1
+        FROM pg_catalog.pg_constraint con
+        JOIN pg_catalog.pg_class rel ON rel.oid = con.conrelid
+        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace
+       WHERE ns.nspname = 'slotlock' AND NOT con.convalidated
+    ) AS unvalidated`;
+    return row?.unvalidated === true;
+}
+/**
+ * Whether every tenant table has forced RLS and only its tenant policy, bound to `setting`, whose
+ * live fingerprint (computed as the RLS DDL computes it) matches the contract the DDL recorded.
+ */
+async function tenantRlsUpToDate(tx, setting) {
+    const [present] = await tx `
+    SELECT COALESCE(pg_catalog.has_table_privilege(
+             pg_catalog.to_regclass('slotlock.rls_policy_contracts'), 'SELECT'), false) AS readable`;
+    if (!present?.readable)
+        return false;
+    const tables = [...SLOTLOCK_TENANT_TABLES];
+    const [state] = await tx `
+    SELECT pg_catalog.bool_and(
+             rel.relrowsecurity AND rel.relforcerowsecurity
+             AND (SELECT pg_catalog.count(*) FROM pg_catalog.pg_policy every
+                   WHERE every.polrelid = rel.oid) = 1
+             AND pg_catalog.obj_description(pol.oid, 'pg_policy') = ${`slotlock:tenant-context:${setting}`}
+             AND contract.tenant_context_setting = ${setting}
+             AND contract.policy_fingerprint = pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(
+                   pg_catalog.concat_ws(
+                     pg_catalog.chr(31), live.policyname, live.permissive, live.roles::text, live.cmd,
+                     COALESCE(live.qual, ''), COALESCE(live.with_check, '')
+                   ),
+                   'UTF8')), 'hex')
+           ) AS current,
+           pg_catalog.count(*)::int AS matched
+      FROM pg_catalog.unnest(${tables}::text[]) AS wanted(name)
+      JOIN pg_catalog.pg_namespace ns ON ns.nspname = 'slotlock'
+      JOIN pg_catalog.pg_class rel ON rel.relnamespace = ns.oid AND rel.relname = wanted.name
+      JOIN pg_catalog.pg_policy pol ON pol.polrelid = rel.oid AND pol.polname = 'tenant_isolation_v1'
+      JOIN pg_catalog.pg_policies live
+        ON live.schemaname = 'slotlock' AND live.tablename = wanted.name
+       AND live.policyname = 'tenant_isolation_v1'
+      JOIN slotlock.rls_policy_contracts contract ON contract.table_name = wanted.name`;
+    return state?.current === true && state.matched === tables.length;
+}
+/**
+ * The schema version recorded by the last migration, or `null` when there is none this role can
+ * read: no schema, a schema from 0.2 or earlier, or a role not yet granted the function (run
+ * `slotlock migrate`, which grants it).
+ */
+export async function readSlotlockSchemaVersion(sql) {
+    const [readable] = await sql `
+    SELECT COALESCE(pg_catalog.has_function_privilege(
+             pg_catalog.to_regprocedure('slotlock.installed_schema_version()'), 'EXECUTE'), false)
+             AS readable`;
+    if (!readable?.readable)
+        return null;
+    const [row] = await sql `
+    SELECT slotlock.installed_schema_version() AS version`;
+    return row?.version ?? null;
+}
+/**
+ * Refuse to serve a schema another release migrated: `schema_outdated` when it is older than this
+ * release (or unversioned), so `slotlock migrate` must run first; `schema_newer` when a newer release
+ * migrated it, whose schema this release's code does not know. Both carry `installed` and `expected`.
+ */
+export async function assertSlotlockSchemaCurrent(sql) {
+    const installed = await readSlotlockSchemaVersion(sql);
+    if (installed === SLOTLOCK_SCHEMA_VERSION)
+        return;
+    const newer = installed !== null && installed > SLOTLOCK_SCHEMA_VERSION;
+    throw Object.assign(new Error(newer
+        ? `The slotlock schema is version ${installed}, migrated by a newer release; this release serves version ${SLOTLOCK_SCHEMA_VERSION}. Serve it with that release or a later one`
+        : `The slotlock schema is ${installed === null ? 'unversioned (0.2 or earlier)' : `version ${installed}`}; this release serves version ${SLOTLOCK_SCHEMA_VERSION}. Run \`slotlock migrate\` with this release first`), {
+        code: newer ? 'schema_newer' : 'schema_outdated',
+        installed,
+        expected: SLOTLOCK_SCHEMA_VERSION,
+    });
+}
 function isFiniteWindow(window) {
     return (window.start instanceof Date &&
         window.end instanceof Date &&
@@ -196,7 +563,15 @@ function isValidEventOwnerRef(value) {
 function isValidResourceId(value) {
     return UUID_PATTERN.test(value);
 }
+function assertValidVisibility(visibility) {
+    if (visibility !== undefined && visibility !== 'shared' && visibility !== 'private') {
+        throw Object.assign(new Error("Slotlock resource visibility must be 'shared' or 'private'"), {
+            code: 'invalid_visibility',
+        });
+    }
+}
 function assertValidResourceInput(params) {
+    assertValidVisibility(params.visibility);
     if (params.externalRef !== undefined &&
         (params.externalRef.trim().length === 0 || Buffer.byteLength(params.externalRef, 'utf8') > 500)) {
         throw Object.assign(new Error('Slotlock externalRef must be 1-500 UTF-8 bytes'), {
@@ -252,6 +627,42 @@ function toReservation(row) {
         source: row.source,
     };
 }
+function toHold(row) {
+    return {
+        id: row.id,
+        resourceId: row.resource_id,
+        start: row.starts_at,
+        end: row.ends_at,
+        bufferAfterMs: Number(row.buffer_after_ms),
+        expiresAt: row.expires_at,
+        source: row.source,
+        ...(row.hold_group_id ? { groupId: row.hold_group_id } : {}),
+    };
+}
+/** A keyset cursor `{ start, id }` from the last row of a previous page, checked. */
+function pageCursor(after) {
+    if (after !== undefined &&
+        (!(after.start instanceof Date) ||
+            !Number.isFinite(after.start.getTime()) ||
+            !UUID_PATTERN.test(after.id))) {
+        throw Object.assign(new Error('Slotlock page cursor is invalid'), {
+            code: 'invalid_cursor',
+        });
+    }
+    return { start: after?.start ?? null, id: after?.id ?? null };
+}
+function pageLimit(limit) {
+    const value = limit ?? 100;
+    if (!Number.isSafeInteger(value) || value <= 0 || value > MAX_CALENDAR_LIST_LIMIT) {
+        throw Object.assign(new Error('Slotlock list limit must be 1-1000'), {
+            code: 'invalid_limit',
+        });
+    }
+    return value;
+}
+function invalidIdentityError(message) {
+    return Object.assign(new Error(message), { code: 'invalid_identity' });
+}
 function eventExceptionsForJson(exceptions) {
     return (exceptions ?? []).map((exception) => {
         const result = {
@@ -459,7 +870,8 @@ async function replaceCalendarEventOccurrences(tx, params) {
     for (const occurrence of params.occurrences) {
         let reservationId = null;
         if ((params.event.transparency ?? 'opaque') === 'opaque') {
-            await reapExpiredHolds(tx, params.resourceId, occurrence.start, occurrence.end);
+            const occupied = new Date(occurrence.end.getTime() + (params.bufferAfterMs ?? 0));
+            await reapExpiredHolds(tx, params.resourceId, occurrence.start, occupied);
             const derivedExternalRef = `calendar:${params.eventId}:${createHash('sha256')
                 .update(occurrence.recurrenceId)
                 .digest('hex')}`;
@@ -469,7 +881,7 @@ async function replaceCalendarEventOccurrences(tx, params) {
           buffer_after_ms, revision, source, calendar_event_id
         ) VALUES (
           ${params.resourceId}, ${params.tenantRef}, ${derivedExternalRef},
-          ${occurrence.start}, ${occurrence.end}, 0, ${params.revision},
+          ${occurrence.start}, ${occurrence.end}, ${params.bufferAfterMs ?? 0}, ${params.revision},
           ${`calendar-event:${params.eventId}`}, ${params.eventId}
         )
         RETURNING id`;
@@ -487,6 +899,14 @@ async function replaceCalendarEventOccurrences(tx, params) {
       )`;
     }
 }
+/** A recurring series' materialization window: finite, forward, and at most 369 days. */
+function seriesWindow(window) {
+    if (!isFiniteWindow(window) ||
+        window.end.getTime() - window.start.getTime() > MAX_MATERIALIZATION_WINDOW_MS) {
+        throw new CalendarContractError('invalid_icalendar');
+    }
+    return { start: new Date(window.start), end: new Date(window.end) };
+}
 function calendarWindow(window) {
     if (!isFiniteWindow(window) ||
         window.end.getTime() - window.start.getTime() > MAX_CALENDAR_WINDOW_MS) {
@@ -507,7 +927,7 @@ function oneOffEventWindow(event, requested) {
     if (!isFiniteWindow(window) ||
         window.start > event.start ||
         window.end < event.end ||
-        window.end.getTime() - window.start.getTime() > Math.max(MAX_CALENDAR_WINDOW_MS, duration)) {
+        window.end.getTime() - window.start.getTime() > Math.max(MAX_MATERIALIZATION_WINDOW_MS, duration)) {
         throw new CalendarContractError('invalid_icalendar');
     }
     return { start: new Date(window.start), end: new Date(window.end) };
@@ -515,8 +935,30 @@ function oneOffEventWindow(event, requested) {
 function calendarCommandHash(value) {
     return createHash('sha256').update(JSON.stringify(value)).digest('hex');
 }
+/**
+ * What makes a put the same request: its identity and the event it asks for. Not the window its
+ * occurrences are stored over, which for a series is the rolling horizon from the current UTC
+ * midnight: with it in the hash, a retry after midnight was refused as a different request.
+ */
 function putCommandHash(params) {
+    return calendarCommandHash(putCommandValue(params));
+}
+/**
+ * The hash 0.3.0 and earlier stored, with the window in it, so a command stored before the upgrade
+ * still replays: always for a one-off event, whose window is its own span, and on the same UTC day
+ * for a series. Remove once no stored command can be that old (commands are pruned after 30 days).
+ */
+export function legacyPutCommandHash(params) {
     return calendarCommandHash({
+        ...putCommandValue(params),
+        materializationWindow: {
+            start: params.window.start.toISOString(),
+            end: params.window.end.toISOString(),
+        },
+    });
+}
+function putCommandValue(params) {
+    return {
         operation: 'put',
         ownerRef: params.ownerRef,
         externalRef: params.command.externalRef,
@@ -524,6 +966,8 @@ function putCommandHash(params) {
         expectedRevision: params.command.expectedRevision,
         resourceId: params.command.resourceId,
         source: params.command.source ?? null,
+        // Only when present, so a create without a hold keeps the hash it always had.
+        ...(params.command.fromHold ? { fromHold: params.command.fromHold.holdId } : {}),
         event: {
             ...params.event,
             start: params.event.start.toISOString(),
@@ -535,11 +979,7 @@ function putCommandHash(params) {
                 }
                 : null,
         },
-        materializationWindow: {
-            start: params.window.start.toISOString(),
-            end: params.window.end.toISOString(),
-        },
-    });
+    };
 }
 function cancelCommandHash(params) {
     return calendarCommandHash({ operation: 'cancel', ...params });
@@ -583,19 +1023,133 @@ async function calendarOwnerCommandCount(tx, tenantRef, ownerRef) {
     }
     return count;
 }
-async function findCalendarOverlap(sql, resourceId, occurrences) {
+/**
+ * The end of every event cancellation, under the event's identity and row locks: remove the event
+ * (when there is one) and its occupation, leave the identity's tombstone at `revision`, and record
+ * the command in `commandOwnerRef`'s namespace for replay.
+ */
+async function finishCalendarCancel(tx, params) {
+    const eventId = params.eventId ?? randomUUID();
+    if (params.eventId !== null) {
+        await tx `
+      DELETE FROM slotlock.reservations
+       WHERE id IN (
+         SELECT reservation_id FROM slotlock.calendar_event_occurrences
+          WHERE event_id = ${eventId} AND reservation_id IS NOT NULL
+       )`;
+        await tx `
+      DELETE FROM slotlock.calendar_events
+       WHERE id = ${eventId}
+         AND tenant_ref = ${params.tenantRef}
+         AND owner_ref = ${params.ownerRef}`;
+    }
+    await tx `
+    INSERT INTO slotlock.calendar_event_tombstones (
+      tenant_ref, owner_ref, external_ref, event_id, revision
+    ) VALUES (
+      ${params.tenantRef}, ${params.ownerRef}, ${params.externalRef}, ${eventId}, ${params.revision}
+    )`;
+    await tx `
+    INSERT INTO slotlock.calendar_event_commands (
+      tenant_ref, owner_ref, idempotency_key, operation, payload_hash, event_id, external_ref,
+      result_revision, occurrence_count
+    ) VALUES (
+      ${params.tenantRef}, ${params.commandOwnerRef}, ${params.idempotencyKey}, 'cancel',
+      ${params.payloadHash}, ${eventId}, ${params.externalRef}, ${params.revision}, 0
+    )`;
+    return {
+        ok: true,
+        eventId,
+        externalRef: params.externalRef,
+        revision: params.revision,
+        idempotent: false,
+    };
+}
+/**
+ * The row an event write lost to. The write was rolled back, so the event's own rows from before
+ * it are still there and are left out: they were to be replaced, and never block the event.
+ */
+async function findCalendarOverlap(sql, resourceId, occurrences, eventId) {
     for (const occurrence of occurrences) {
-        const result = await overlapLoss(sql, resourceId, occurrence.start, occurrence.end);
+        const result = await overlapLoss(sql, resourceId, occurrence.start, occurrence.end, 0, undefined, eventId);
         if (result.conflictingReservationId !== null)
             return result;
     }
     return { ok: false, code: 'overlap', conflictingReservationId: null };
 }
-function sameExternalPayload(row, params) {
+/**
+ * What the resource's booking rules say about a booking of `interval` made now (by the database's
+ * clock, at this statement): the rule it breaks, if any, and the turnaround it must keep after it.
+ * A resource without its own hours is judged against `defaultHours`.
+ */
+async function bookingRuling(tx, resourceId, interval, defaultHours) {
+    const judge = await bookingJudge(tx, resourceId, defaultHours);
+    return { rule: judge.broken(interval), turnaroundMs: judge.turnaroundMs };
+}
+/** How recently a sync must have read a resource whose booking rules require certainty. */
+const CERTAIN_COVERAGE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/**
+ * The resource's booking rules, read once, as a check of any interval booked now (by the database's
+ * clock at this statement) and the turnaround a booking keeps.
+ */
+async function bookingJudge(tx, resourceId, defaultHours) {
+    const [row] = await tx `
+    SELECT booking_rules, availability_rules, timezone, statement_timestamp() AS now
+      FROM slotlock.resources WHERE id = ${resourceId}`;
+    if (!row || row.booking_rules === null || row.booking_rules === undefined) {
+        return { broken: () => null, turnaroundMs: 0 };
+    }
+    const { bookingRules: rules, availabilityRules } = toResource({
+        id: resourceId,
+        external_ref: null,
+        tenant_ref: null,
+        timezone: row.timezone,
+        availability_rules: row.availability_rules,
+        booking_rules: row.booking_rules,
+        pool_ref: null,
+        visibility: 'shared',
+        archived_at: null,
+    });
+    const hours = availabilityRules ?? defaultHours;
+    // Every sync covering the resource, and whether it was read within a day, by the same clock.
+    const coverage = rules?.requireCertain === true
+        ? await tx `
+          SELECT starts_at, ends_at,
+                 observed_at >= statement_timestamp()
+                   - make_interval(secs => ${CERTAIN_COVERAGE_MAX_AGE_MS / 1000}) AS fresh
+            FROM slotlock.calendar_coverage WHERE resource_id = ${resourceId}`
+        : [];
+    const turnaroundMs = bookingBufferAfterMs(rules);
+    // The booking and the turnaround it keeps, as a search judges the slot.
+    const uncertain = (interval) => coverage.some((source) => !source.fresh ||
+        source.starts_at > interval.start ||
+        source.ends_at.getTime() < interval.end.getTime() + turnaroundMs);
+    // A later occurrence of a series is judged on its step and hours only: notice and advance are
+    // about when the booking was made, which its first occurrence answers.
+    const later = rules === undefined
+        ? undefined
+        : {
+            ...(rules.slotStepMinutes !== undefined ? { slotStepMinutes: rules.slotStepMinutes } : {}),
+            ...(rules.enforceHours !== undefined ? { enforceHours: rules.enforceHours } : {}),
+        };
+    return {
+        broken: (interval, checks = { first: true }) => bookingRuleBroken({
+            rules: checks.first ? rules : later,
+            timezone: row.timezone,
+            hours,
+            interval,
+            now: row.now,
+        }) ?? (uncertain(interval) ? 'uncertain' : null),
+        turnaroundMs,
+    };
+}
+function sameExternalPayload(row, params, turnaroundMs = 0) {
+    const buffer = Number(row.buffer_after_ms);
     return (row.resource_id === params.resourceId &&
         row.starts_at.getTime() === params.start.getTime() &&
         row.ends_at.getTime() === params.end.getTime() &&
-        Number(row.buffer_after_ms) === params.bufferAfterMs &&
+        // As asked, or raised to the resource's turnaround when it was stored.
+        (buffer === params.bufferAfterMs || buffer === Math.max(params.bufferAfterMs, turnaroundMs)) &&
         Number(row.revision) === params.revision &&
         row.source === (params.source ?? null));
 }
@@ -607,12 +1161,18 @@ async function lockExternalIdentity(tx, tenantRef, externalRef) {
     // U+0000). The database hashes it to one transaction-scoped lock key.
     await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([tenantRef, externalRef])}, 0))`;
 }
-async function resourceBelongsToTenant(tx, resourceId, tenantRef) {
-    const rows = await tx `
-    SELECT id FROM slotlock.resources
+/**
+ * Whether the resource is the tenant's (`missing` when not), and whether it is archived. The row is
+ * share-locked to the end of the transaction, so it is neither archived nor deleted meanwhile.
+ */
+async function tenantResourceState(tx, resourceId, tenantRef) {
+    const [row] = await tx `
+    SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
      WHERE id = ${resourceId} AND tenant_ref = ${tenantRef}
      FOR SHARE`;
-    return rows.length === 1;
+    if (!row)
+        return 'missing';
+    return row.archived ? 'archived' : 'active';
 }
 function pgCode(err) {
     let cur = err;
@@ -623,13 +1183,45 @@ function pgCode(err) {
     }
     return undefined;
 }
+/** Members a pool booking or search considers at most, in id order. */
+export const SLOTLOCK_MAX_POOL_MEMBERS = 100;
+const WAITLIST_COLUMNS = 'id, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms, status, hold_id, offered_resource_id, offered_at, created_at';
+function toWaitlistEntry(row) {
+    return {
+        id: row.id,
+        resourceId: row.resource_id,
+        pool: row.pool_ref,
+        start: row.starts_at,
+        end: row.ends_at,
+        holderRef: row.holder_ref,
+        offerTtlMs: Number(row.offer_ttl_ms),
+        status: row.status,
+        holdId: row.hold_id,
+        offeredResourceId: row.offered_resource_id,
+        offeredAt: row.offered_at,
+        createdAt: row.created_at,
+    };
+}
+export function isPoolName(value) {
+    return typeof value === 'string' && /^[a-z0-9][a-z0-9._-]{0,99}$/.test(value);
+}
+function invalidPoolError() {
+    return Object.assign(new Error('Slotlock pool must be 1-100 of a-z, 0-9, ".", "_" and "-"'), {
+        code: 'invalid_pool',
+    });
+}
 function toResource(row) {
     const resource = {
         id: row.id,
         externalRef: row.external_ref,
         tenantRef: row.tenant_ref,
         timezone: row.timezone,
+        visibility: row.visibility,
     };
+    if (row.archived_at !== null)
+        resource.archivedAt = row.archived_at;
+    if (row.pool_ref !== null && row.pool_ref !== undefined)
+        resource.pool = row.pool_ref;
     if (row.availability_rules !== null && row.availability_rules !== undefined) {
         // Written through setResourceAvailability, which validates; anything else reads as closed.
         try {
@@ -639,6 +1231,16 @@ function toResource(row) {
             resource.availabilityRules = [];
         }
     }
+    if (row.booking_rules !== null && row.booking_rules !== undefined) {
+        // Written through setResourceBookingRules, which validates; anything else reads as refusing
+        // every booking, never as no rule.
+        try {
+            resource.bookingRules = parseBookingRules(row.booking_rules);
+        }
+        catch {
+            resource.bookingRules = { maxAdvanceDays: 1, minNoticeMinutes: 525_600 };
+        }
+    }
     return resource;
 }
 /** Validated rules as a jsonb parameter, or null for "use the default". */
@@ -653,42 +1255,453 @@ function availabilityParameter(sql, rules) {
     })));
 }
 async function upsertResource(executor, params) {
+    const visibility = params.visibility ?? 'shared';
+    const asked = params.visibility ?? null;
     let rows;
+    // An existing identity keeps the visibility it has: creating it again with none named returns it
+    // as it is, and with another one is refused, so a private one is never made shared that way.
     if (params.tenantRef !== undefined && params.externalRef !== undefined) {
         rows = await executor `
-      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone)
-      VALUES (${params.externalRef}, ${params.tenantRef}, ${params.timezone ?? 'UTC'})
+      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
+      VALUES (${params.externalRef}, ${params.tenantRef}, ${params.timezone ?? 'UTC'}, ${visibility})
       ON CONFLICT (tenant_ref, external_ref)
         WHERE tenant_ref IS NOT NULL AND external_ref IS NOT NULL
       DO UPDATE SET timezone = EXCLUDED.timezone
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules`;
+      WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
     }
     else if (params.externalRef !== undefined) {
         rows = await executor `
-      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone)
-      VALUES (${params.externalRef}, NULL, ${params.timezone ?? 'UTC'})
+      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
+      VALUES (${params.externalRef}, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
       ON CONFLICT (external_ref)
         WHERE tenant_ref IS NULL AND external_ref IS NOT NULL
       DO UPDATE SET external_ref = EXCLUDED.external_ref
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules`;
+      WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
     }
     else {
         rows = await executor `
-      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone)
-      VALUES (NULL, NULL, ${params.timezone ?? 'UTC'})
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules`;
+      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
+      VALUES (NULL, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
     }
     const row = rows[0];
     if (!row) {
-        throw new Error('slotlock: resource upsert returned no row');
+        throw Object.assign(new Error('Slotlock resource visibility cannot be changed by creating it'), {
+            code: 'resource_visibility_conflict',
+        });
     }
     return toResource(row);
 }
 /**
- * Delete expired held rows overlapping the requested window, in deterministic id order under
- * FOR UPDATE — two concurrent reapers lock the same rows in the same order (no deadlock), the
- * loser simply finds them gone. Runs inside the caller's transaction, immediately before its
- * INSERT, so the EXCLUDE arbiter only ever sees LIVE occupation.
+ * Rematerialize one stored recurring master over the window a roll to `horizon` gives it
+ * (rolledWindow): from where its last expansion stopped when that can be trusted, else its start.
+ * False when there is no such master or nothing to roll. A collision throws the database's 23P01,
+ * and a rule over the expansion budget CalendarExpansionLimitError; run it in a savepoint, which
+ * either rolls back whole.
+ */
+async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
+    const [row] = await tx `
+    SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
+           summary, description, location, status, transparency, organizer, attendees,
+           reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
+           materialized_ends_at, recurrence_cursor, revision, source, created_at,
+           updated_at, recurrence_ends_by IS NULL AS ends_by_missing, buffer_after_ms
+      FROM slotlock.calendar_events
+     WHERE id = ${eventId} AND tenant_ref = ${tenantRef}
+     FOR UPDATE`;
+    if (!row || row.recurrence_rule === null)
+        return false;
+    const rolled = rolledWindow({ start: row.materialized_starts_at, end: row.materialized_ends_at }, horizon);
+    if (!rolled)
+        return false;
+    const childMap = await loadCalendarEventChildren(tx, [row.id]);
+    const event = toCalendarEvent(row, childMap.get(row.id));
+    const { occurrences, cursor } = expandCalendarEventSeries(event, rolled, {
+        cursor: row.recurrence_cursor ?? null,
+        stored: true,
+    });
+    await replaceCalendarEventOccurrences(tx, {
+        tenantRef,
+        eventId: row.id,
+        resourceId: row.resource_id,
+        event,
+        occurrences,
+        revision: Number(row.revision),
+        bufferAfterMs: Number(row.buffer_after_ms ?? 0),
+    });
+    // A series stored before 0.3 learns when it ends at its first roll.
+    const endsBy = row.ends_by_missing ? recurrenceEndsByColumn(event) : null;
+    await tx `
+    UPDATE slotlock.calendar_events
+       SET materialized_starts_at = ${rolled.start},
+           materialized_ends_at = ${rolled.end},
+           recurrence_cursor = ${seriesCursorJson(tx, cursor)},
+           recurrence_ends_by = COALESCE(recurrence_ends_by, ${endsBy}::text::timestamptz),
+           roll_retry_at = NULL
+     WHERE id = ${row.id} AND tenant_ref = ${tenantRef}`;
+    return true;
+}
+/**
+ * Work out and store when a series stored before 0.3 ends (recurrence_ends_by), as its next roll
+ * would; its stored occurrences are left as they are.
+ */
+async function learnSeriesEnd(tx, tenantRef, eventId) {
+    const [row] = await tx `
+    SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
+           summary, description, location, status, transparency, organizer, attendees,
+           reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
+           materialized_ends_at, recurrence_cursor, revision, source, created_at,
+           updated_at
+      FROM slotlock.calendar_events
+     WHERE id = ${eventId} AND tenant_ref = ${tenantRef}
+       AND recurrence_rule IS NOT NULL AND recurrence_ends_by IS NULL
+     FOR UPDATE`;
+    if (!row)
+        return;
+    const childMap = await loadCalendarEventChildren(tx, [row.id]);
+    const event = toCalendarEvent(row, childMap.get(row.id));
+    await tx `
+    UPDATE slotlock.calendar_events
+       SET recurrence_ends_by = ${recurrenceEndsByColumn(event)}::text::timestamptz
+     WHERE id = ${row.id} AND tenant_ref = ${tenantRef} AND recurrence_ends_by IS NULL`;
+}
+/** Put a master the roll could not extend behind the others for an hour. */
+async function deferRoll(executor, tenantRef, eventId) {
+    await executor `
+    UPDATE slotlock.calendar_events
+       SET roll_retry_at = now() + interval '1 hour'
+     WHERE id = ${eventId} AND tenant_ref = ${tenantRef}`;
+}
+/**
+ * Whether every opaque recurring series on the resource (but `exceptEventId`) is stored over the
+ * part of [start, end) that a roll can ever reach: from the later of `start` and the rolling
+ * horizon's start. A write there must not land where such a series is not stored, or the series'
+ * next roll would collide with it and stop. A series known to end before that part
+ * (recurrence_ends_by) cannot meet the write and is left out, as is one stored through its end. A
+ * series behind is first rolled to the horizon, in a savepoint of the write's transaction, so the
+ * write meets its occurrences under the exclusion arbiter; false when one cannot be (it goes on
+ * past the horizon and so does the write, it collides, or its rule is over the budget). Series are
+ * rolled in id order; an event's update holds its own row while it rolls the others, so it and a
+ * write rolling the same series in that order can deadlock, which the database breaks (the writer
+ * retries once, then answers an overlap).
+ */
+async function recurrenceCoversWrite(tx, params) {
+    const horizon = calendarEventRollingHorizon();
+    if (params.end <= horizon.start)
+        return true;
+    const from = params.start > horizon.start ? params.start : horizon.start;
+    // LEAST and GREATEST ignore a NULL argument (PostgreSQL 16, Conditional Expressions): a series
+    // with no known end is behind wherever it is stored short of the write's end.
+    const behind = () => tx `
+    SELECT event.id, event.recurrence_ends_by IS NULL AS ends_by_unknown,
+           COALESCE(event.recurrence_ends_by <= ${horizon.end}::timestamptz, false)
+             AS ends_in_horizon
+      FROM slotlock.calendar_events event
+     WHERE event.tenant_ref = ${params.tenantRef}
+       AND event.resource_id = ${params.resourceId}
+       AND event.recurrence_rule IS NOT NULL
+       AND event.transparency = 'opaque'
+       AND event.id IS DISTINCT FROM ${params.exceptEventId ?? null}::uuid
+       AND (event.recurrence_ends_by IS NULL OR event.recurrence_ends_by > ${from}::timestamptz)
+       AND (
+         event.materialized_ends_at < LEAST(${params.end}::timestamptz, event.recurrence_ends_by)
+         OR event.materialized_starts_at > GREATEST(
+              ${from}::timestamptz,
+              LEAST(event.starts_at, COALESCE((
+                SELECT min(exception.starts_at)
+                  FROM slotlock.calendar_event_exceptions exception
+                 WHERE exception.tenant_ref = event.tenant_ref
+                   AND exception.event_id = event.id
+                   AND exception.cancelled = false
+              ), event.starts_at))
+            )
+       )
+     ORDER BY event.id`;
+    let due = await behind();
+    if (due.length === 0)
+        return true;
+    if (params.end > horizon.end) {
+        // A series stored before 0.3 has not worked out when it ends; it does so now, and is left out
+        // if it ends before the write or is stored through its end.
+        if (due.some((row) => row.ends_by_unknown)) {
+            for (const { id, ends_by_unknown } of due) {
+                if (ends_by_unknown)
+                    await learnSeriesEnd(tx, params.tenantRef, id);
+            }
+            due = await behind();
+            if (due.length === 0)
+                return true;
+        }
+        // No roll stores a series past the horizon: one going on past it stays behind such a write.
+        if (due.some((row) => !row.ends_in_horizon))
+            return false;
+    }
+    for (const { id } of due) {
+        try {
+            await tx.savepoint((sp) => rollStoredSeries(sp, params.tenantRef, id, horizon));
+        }
+        catch (error) {
+            if (error instanceof CalendarExpansionLimitError || pgCode(error) === EXCLUSION_VIOLATION) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    return (await behind()).length === 0;
+}
+/**
+ * Whether an event already occupies, on the resource, all the time `occurrences` would: such a
+ * write (a rename, a new description) takes no time a series could later need, so it is not held
+ * to where the series on the resource are stored.
+ */
+async function holdsEveryOccurrence(tx, eventId, resourceId, occurrences) {
+    const held = await tx `
+    SELECT reservation.starts_at AS start, reservation.ends_at AS end
+      FROM slotlock.calendar_event_occurrences occurrence
+      JOIN slotlock.reservations reservation ON reservation.id = occurrence.reservation_id
+     WHERE occurrence.event_id = ${eventId}
+       AND reservation.resource_id = ${resourceId}`;
+    return occurrences.every((occurrence) => held.some(({ start, end }) => start <= occurrence.start && occurrence.end <= end));
+}
+/** From the earliest start to the latest end of an event's occurrences, or null for none. */
+function occurrenceSpan(occurrences) {
+    const [first] = occurrences;
+    if (!first)
+        return null;
+    let start = first.start;
+    let end = first.end;
+    for (const occurrence of occurrences) {
+        if (occurrence.start < start)
+            start = occurrence.start;
+        if (occurrence.end > end)
+            end = occurrence.end;
+    }
+    return { start, end };
+}
+/**
+ * After a write lost to the exclusion arbiter: roll, in a transaction of its own, the series on the
+ * resource the write's transaction rolled with it (and lost), so they stay extended and the loss
+ * can name the occurrence that blocked it. A resource with no tenant has no series. Upkeep only: if
+ * it fails, the series are left to maintenance and the write is still answered as a loss.
+ */
+async function rollSeriesBehind(executor, resourceId, start, end, exceptEventId) {
+    try {
+        await inTransaction(executor, async (tx) => {
+            const [resource] = await tx `
+        SELECT tenant_ref FROM slotlock.resources WHERE id = ${resourceId}`;
+            if (!resource?.tenant_ref)
+                return;
+            await recurrenceCoversWrite(tx, {
+                tenantRef: resource.tenant_ref,
+                resourceId,
+                start,
+                end,
+                ...(exceptEventId !== undefined ? { exceptEventId } : {}),
+            });
+        });
+    }
+    catch {
+        // Rolled back whole (its own transaction, or a savepoint of the caller's).
+    }
+}
+const MAX_TENANT_LIMIT = 10_000_000;
+function tenantLimitsOption(limits) {
+    const valid = {};
+    for (const kind of ['resources', 'holds', 'reservations', 'events', 'coverage']) {
+        const value = limits?.[kind];
+        if (value === undefined)
+            continue;
+        const max = kind === 'resources' ? MAX_TENANT_RESOURCE_LIMIT : MAX_TENANT_LIMIT;
+        if (!Number.isSafeInteger(value) || value < 1 || value > max) {
+            throw Object.assign(new Error(`Slotlock tenant limit ${kind} must be a whole number from 1 to ${max}`), { code: 'invalid_tenant_limits' });
+        }
+        valid[kind] = value;
+    }
+    return valid;
+}
+/**
+ * Serialize one tenant's writes that add rows of one limited kind, so each counts what every
+ * earlier one committed. Taken before any row lock, after the write's identity locks.
+ */
+async function lockTenantLimit(tx, tenantRef, kind) {
+    // An object, so the key never equals a [tenantRef, externalRef] identity lock's.
+    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify({ tenantLimit: kind, tenantRef })}, 0))`;
+}
+/**
+ * Rows a tenant added within this many days count against its limits whatever time they hold, so
+ * bookings and events dated in the past, and cancellations, add at most the limit in any such
+ * window. Ended history is not pruned: over a longer time it can still grow. Maintenance keeps
+ * event idempotency records and stray retirements at least as long (the store's `retentionDays`).
+ */
+const TENANT_LIMIT_RECENT_DAYS = SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS;
+/**
+ * The rows a tenant has that its limit of `kind` counts: what is still to come, and what it added
+ * in the last TENANT_LIMIT_RECENT_DAYS days; what ended before then is history and does not count.
+ * Each part stops at `limit` rows, read through an index, so a count costs no more than the limit
+ * however much history the tenant keeps; the total is at least `limit` exactly when the tenant is
+ * at it.
+ */
+async function tenantLimitCount(tx, tenantRef, kind, limit) {
+    let rows;
+    switch (kind) {
+        case 'holds':
+            // Every held row, expired or not, until it is deleted: an expired hold no rival writes over
+            // stays stored until maintenance or a hold at the limit deletes it. And the answer kept for
+            // each keyed hold no longer held (released or confirmed, or its expired row deleted) until it
+            // is forgotten. An answer whose hold is still a held row is left out: that row counts.
+            rows = await tx `
+        SELECT (
+          (SELECT count(*) FROM (
+            SELECT 1
+              FROM slotlock.reservations hold
+              JOIN slotlock.resources resource ON resource.id = hold.resource_id
+             WHERE resource.tenant_ref = ${tenantRef} AND hold.status = 'held'
+             LIMIT ${limit}) held)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.hold_commands answer
+             WHERE answer.tenant_ref = ${tenantRef}
+               AND NOT EXISTS (
+                 SELECT 1 FROM slotlock.reservations hold
+                  WHERE hold.id = answer.hold_id AND hold.status = 'held'
+               )
+             LIMIT ${limit}) kept)
+        )::int AS count`;
+            break;
+        case 'reservations':
+            // Bookings still to come; bookings that have ended and cancellations, made recently; and
+            // references retired with no booking, until maintenance prunes them. A cancelled booking's
+            // tombstone is kept for good, and stops counting once it is no longer recent.
+            rows = await tx `
+        WITH recent AS (
+          SELECT now() - ${TENANT_LIMIT_RECENT_DAYS}::int * interval '1 day' AS since
+        )
+        SELECT (
+          (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.reservations
+             WHERE tenant_ref = ${tenantRef} AND external_ref IS NOT NULL
+               AND calendar_event_id IS NULL AND occupied_ends_at > now()
+             LIMIT ${limit}) live)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.reservations, recent
+             WHERE tenant_ref = ${tenantRef} AND external_ref IS NOT NULL
+               AND calendar_event_id IS NULL AND created_at > recent.since
+               AND occupied_ends_at <= now()
+             LIMIT ${limit}) ended)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.reservation_tombstones, recent
+             WHERE tenant_ref = ${tenantRef} AND cancelled_at > recent.since
+             LIMIT ${limit}) cancelled)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.reservation_tombstones, recent
+             WHERE tenant_ref = ${tenantRef} AND stray AND cancelled_at <= recent.since
+             LIMIT ${limit}) retired)
+        )::int AS count`;
+            break;
+        case 'events':
+            // One-off events still to come and series not known to have ended; events that have ended
+            // and cancellations of any owner, made recently; and agent cancellations until maintenance
+            // prunes them. The owner identity CHECK makes every owner but 'internal' an 'agent:' one.
+            rows = await tx `
+        WITH recent AS (
+          SELECT now() - ${TENANT_LIMIT_RECENT_DAYS}::int * interval '1 day' AS since
+        )
+        SELECT (
+          (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_events
+             WHERE tenant_ref = ${tenantRef} AND recurrence_rule IS NULL AND ends_at > now()
+             LIMIT ${limit}) one_off)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_events
+             WHERE tenant_ref = ${tenantRef} AND recurrence_rule IS NOT NULL
+               AND (recurrence_ends_by IS NULL OR recurrence_ends_by > now())
+             LIMIT ${limit}) series)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_events, recent
+             WHERE tenant_ref = ${tenantRef} AND created_at > recent.since
+               AND CASE WHEN recurrence_rule IS NULL THEN ends_at <= now()
+                        ELSE recurrence_ends_by <= now() END
+             LIMIT ${limit}) ended)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_event_tombstones, recent
+             WHERE tenant_ref = ${tenantRef} AND cancelled_at > recent.since
+             LIMIT ${limit}) cancelled)
+          + (SELECT count(*) FROM (
+            SELECT 1 FROM slotlock.calendar_event_tombstones, recent
+             WHERE tenant_ref = ${tenantRef} AND owner_ref LIKE 'agent:%'
+               AND cancelled_at <= recent.since
+             LIMIT ${limit}) agent_cancelled)
+        )::int AS count`;
+            break;
+        case 'coverage':
+            rows = await tx `
+        SELECT count(*)::int AS count FROM (
+          SELECT 1 FROM slotlock.calendar_coverage WHERE tenant_ref = ${tenantRef} LIMIT ${limit}
+        ) kept`;
+            break;
+    }
+    const count = Number(rows[0]?.count ?? 0);
+    if (!Number.isSafeInteger(count) || count < 0)
+        throw new Error('slotlock: invalid tenant row count');
+    return count;
+}
+/**
+ * Delete up to `limit` of a tenant's holds that have expired, oldest first; the number deleted. A
+ * writer reaping or confirming a hold locks it: such a row is skipped, and the delete repeats the
+ * predicate on the row as it now is.
+ */
+async function deleteExpiredHolds(tx, tenantRef, limit) {
+    const [row] = await tx `
+    WITH candidates AS MATERIALIZED (
+      SELECT hold.id
+        FROM slotlock.reservations hold
+        JOIN slotlock.resources resource ON resource.id = hold.resource_id
+       WHERE resource.tenant_ref = ${tenantRef}
+         AND hold.status = 'held' AND hold.expires_at <= statement_timestamp()
+       ORDER BY hold.expires_at, hold.id
+       LIMIT ${limit}
+       FOR UPDATE OF hold SKIP LOCKED
+    ), deleted AS (
+      DELETE FROM slotlock.reservations hold
+       USING candidates candidate
+       WHERE hold.id = candidate.id
+         AND hold.status = 'held' AND hold.expires_at <= statement_timestamp()
+      RETURNING 1
+    )
+    SELECT count(*)::int AS deleted FROM deleted`;
+    return Number(row?.deleted ?? 0);
+}
+/**
+ * Delete up to `limit` of a tenant's keyed hold answers whose hold has expired, so a retry with one
+ * of their keys makes a new hold; answers another transaction holds are skipped. The number deleted.
+ */
+async function forgetExpiredHoldAnswers(tx, tenantRef, limit) {
+    const [row] = await tx `
+    WITH candidates AS MATERIALIZED (
+      SELECT answer.principal_ref, answer.idempotency_key
+        FROM slotlock.hold_commands answer
+       WHERE answer.tenant_ref = ${tenantRef} AND answer.expires_at <= statement_timestamp()
+       ORDER BY answer.expires_at, answer.principal_ref, answer.idempotency_key
+       LIMIT ${limit}
+       FOR UPDATE OF answer SKIP LOCKED
+    ), deleted AS (
+      DELETE FROM slotlock.hold_commands answer
+       USING candidates candidate
+       WHERE answer.tenant_ref = ${tenantRef}
+         AND answer.principal_ref = candidate.principal_ref
+         AND answer.idempotency_key = candidate.idempotency_key
+      RETURNING 1
+    )
+    SELECT count(*)::int AS deleted FROM deleted`;
+    return Number(row?.deleted ?? 0);
+}
+/**
+ * Delete expired held rows whose occupied time (buffer included, as the EXCLUDE constraint reads
+ * it) overlaps the requested window, whose `end` is its own occupied end, in deterministic id
+ * order under FOR UPDATE — two concurrent reapers lock the same rows in the same order (no
+ * deadlock), the loser simply finds them gone. Runs inside the caller's transaction, immediately
+ * before its INSERT, so the EXCLUDE arbiter only ever sees LIVE occupation.
  */
 async function reapExpiredHolds(tx, resourceId, start, end) {
     await tx `
@@ -697,9 +1710,9 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
        SELECT id FROM slotlock.reservations
         WHERE resource_id = ${resourceId}
           AND status = 'held'
-          AND expires_at <= now()
+          AND expires_at <= statement_timestamp()
           AND starts_at < ${end}
-          AND ends_at > ${start}
+          AND COALESCE(occupied_ends_at, ends_at) > ${start}
         ORDER BY id
         FOR UPDATE
      )`;
@@ -710,11 +1723,13 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
  * loser's transaction start (constraint saw it) and this lookup (live filter hides it) — an
  * immediate retry reaps it and wins.
  */
-async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, excludeReservationId) {
+async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, excludeReservationId, excludeCalendarEventId) {
     const winners = await sql `
     SELECT id FROM slotlock.reservations
      WHERE resource_id = ${resourceId}
        AND (${excludeReservationId ?? null}::uuid IS NULL OR id <> ${excludeReservationId ?? null}::uuid)
+       AND (${excludeCalendarEventId ?? null}::uuid IS NULL
+            OR calendar_event_id IS DISTINCT FROM ${excludeCalendarEventId ?? null}::uuid)
        AND tstzrange(
              starts_at,
              COALESCE(occupied_ends_at, ends_at),
@@ -724,7 +1739,7 @@ async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, exclu
              ${end} + ${bufferAfterMs} * interval '1 millisecond',
              '[)'
            )
-       AND (status <> 'held' OR expires_at > now())
+       AND (status <> 'held' OR expires_at > statement_timestamp())
      ORDER BY starts_at
      LIMIT 1`;
     return { ok: false, code: 'overlap', conflictingReservationId: winners[0]?.id ?? null };
@@ -741,8 +1756,123 @@ function holdTenantRef(options) {
     }
     return tenantRef;
 }
+/**
+ * At most `max` holders per tenant at once; the rest wait in order. An aborted signal takes a
+ * waiter out of the line, rejecting with its reason. Each holder calls the release it gets once.
+ */
+export function createTenantSlots(max) {
+    const tenants = new Map();
+    return async (tenantRef, signal) => {
+        signal?.throwIfAborted();
+        let tenant = tenants.get(tenantRef);
+        if (!tenant) {
+            tenant = { running: 0, waiting: [] };
+            tenants.set(tenantRef, tenant);
+        }
+        const slots = tenant;
+        if (slots.running < max) {
+            slots.running += 1;
+        }
+        else {
+            await new Promise((resolve, reject) => {
+                const start = () => {
+                    signal?.removeEventListener('abort', abort);
+                    resolve();
+                };
+                const abort = () => {
+                    slots.waiting.splice(slots.waiting.indexOf(start), 1);
+                    reject(signal?.reason);
+                };
+                slots.waiting.push(start);
+                signal?.addEventListener('abort', abort, { once: true });
+            });
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            // Handed straight to the next in line, so the count stays as it is.
+            const next = slots.waiting.shift();
+            if (next) {
+                next();
+                return;
+            }
+            slots.running -= 1;
+            if (slots.running === 0)
+                tenants.delete(tenantRef);
+        };
+    };
+}
+function lockTimeoutError(cause) {
+    return Object.assign(new Error('Slotlock tenant transaction waited too long for a lock: retry later', { cause }), { code: 'lock_timeout' });
+}
 export function createSlotlockStore(sql, options = {}) {
+    return buildSlotlockStore(sql, options, null);
+}
+/**
+ * Every store method that writes for a tenant: what a suspended tenant's withTenant store refuses.
+ * Maintenance (rolling series, pruning, purging) and erasure are not among them.
+ */
+export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
+    'createResource',
+    'archiveResource',
+    'restoreResource',
+    'deleteResource',
+    'setResourceAvailability',
+    'setResourceBookingRules',
+    'setResourcePool',
+    'setTenantAvailability',
+    'createReservation',
+    'createExternalReservation',
+    'rescheduleExternalReservation',
+    'cancelExternalReservation',
+    'acquireHold',
+    'confirmHold',
+    'releaseHold',
+    'putCalendarEvent',
+    'cancelCalendarEvent',
+    'cancelCalendarEventById',
+    'recordCalendarCoverage',
+    'createWebhookEndpoint',
+    'deleteWebhookEndpoint',
+    'enableWebhookEndpoint',
+    'recordCoverageFailure',
+    'deleteCoverage',
+    'checkInReservation',
+    'joinWaitlist',
+    'leaveWaitlist',
+]);
+function tenantSuspendedError() {
+    return Object.assign(new Error('Slotlock tenant is suspended: it may read, and write nothing'), {
+        code: 'tenant_suspended',
+    });
+}
+function staleSuspensionCheckError() {
+    return Object.assign(new Error('Slotlock writes for a tenant only in a READ COMMITTED transaction, whose suspension check sees every suspension committed before the tenant lock'), { code: 'invalid_transaction_isolation' });
+}
+/**
+ * Reading a tenant's suspension needs EXECUTE on slotlock.tenant_suspended(text), which PUBLIC does
+ * not hold (SQLSTATE 42501 without it), and a schema this release migrated (42883 before then).
+ * Name the remedy for each; any other failure passes through.
+ */
+function suspensionCheckRefusal(error) {
+    const code = pgCode(error);
+    if (code === '42501') {
+        return Object.assign(new Error('Slotlock serving role may not run slotlock.tenant_suspended(text): grant it what this release needs with grantApplicationRole (`slotlock migrate` does), once per release', { cause: error }), { code: 'application_role_not_granted' });
+    }
+    if (code === '42883') {
+        return Object.assign(new Error('The slotlock schema predates this release (it has no slotlock.tenant_suspended(text)): run applySchema (`slotlock migrate`) with this release first', { cause: error }), { code: 'schema_outdated' });
+    }
+    return error;
+}
+/**
+ * A store on `sql`. With `refusal`, every method in SLOTLOCK_TENANT_WRITE_METHODS throws what it
+ * returns before any query (a suspended tenant, or a suspension check that could be stale).
+ */
+function buildSlotlockStore(sql, options, refusal) {
     const configuredTenantSetting = options.tenantContextSetting ?? SLOTLOCK_TENANT_CONTEXT_SETTING;
+    const defaultHours = parseAvailabilityRules([...(options.defaultAvailabilityRules ?? [])]);
     const configuredAgentOwnerEventQuota = options.agentOwnerEventQuota ?? SLOTLOCK_AGENT_OWNER_EVENT_QUOTA;
     const configuredAgentOwnerCommandQuota = options.agentOwnerCommandQuota ?? SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA;
     if (!Number.isSafeInteger(configuredAgentOwnerEventQuota) ||
@@ -757,56 +1887,145 @@ export function createSlotlockStore(sql, options = {}) {
         configuredAgentOwnerCommandQuota > MAX_CONFIGURED_AGENT_OWNER_COMMAND_QUOTA) {
         throw Object.assign(new Error('Slotlock agent owner command quota must exceed its event quota and be at most 1000000'), { code: 'invalid_agent_owner_command_quota' });
     }
+    const configuredTenantLimits = tenantLimitsOption(options.tenantLimits);
+    const { maxTenantTransactions, tenantLockTimeoutMs, maxHeldHoursPerHolder } = options;
+    const retentionDays = options.retentionDays ?? SLOTLOCK_CHANGE_RETENTION_DAYS;
+    if (!Number.isSafeInteger(retentionDays) || retentionDays < 1 || retentionDays > 3_650) {
+        throw Object.assign(new Error('Slotlock retentionDays must be a whole number from 1 to 3650'), {
+            code: 'invalid_retention',
+        });
+    }
+    const maxHoldsPerHolder = options.maxHoldsPerHolder ?? SLOTLOCK_MAX_HOLDS_PER_HOLDER;
+    if (!Number.isSafeInteger(maxHoldsPerHolder) ||
+        maxHoldsPerHolder < 1 ||
+        maxHoldsPerHolder > 10_000 ||
+        (maxHeldHoursPerHolder !== undefined &&
+            (!Number.isSafeInteger(maxHeldHoursPerHolder) ||
+                maxHeldHoursPerHolder < 1 ||
+                maxHeldHoursPerHolder > 876_000))) {
+        throw Object.assign(new Error('Slotlock maxHoldsPerHolder must be 1-10000 and maxHeldHoursPerHolder 1-876000, whole numbers'), { code: 'invalid_holder_limits' });
+    }
+    const whole = (value, max) => value === undefined || (Number.isSafeInteger(value) && value >= 1 && value <= max);
+    if (!whole(maxTenantTransactions, 1_000) || !whole(tenantLockTimeoutMs, 600_000)) {
+        throw Object.assign(new Error('Slotlock maxTenantTransactions must be 1-1000 and tenantLockTimeoutMs 1-600000, whole numbers'), { code: 'invalid_tenant_transaction_options' });
+    }
+    // Only a client opens transactions of its own; inside a caller's, neither applies.
+    const ownTransactions = 'begin' in sql;
+    const tenantSlots = ownTransactions && maxTenantTransactions !== undefined
+        ? createTenantSlots(maxTenantTransactions)
+        : undefined;
+    const lockTimeout = ownTransactions && tenantLockTimeoutMs !== undefined ? `${tenantLockTimeoutMs}ms` : undefined;
     createSlotlockTenantRlsDdl(configuredTenantSetting); // Validate once before any scoped query.
-    return {
-        async applySchema() {
+    const storeOptions = {
+        tenantContextSetting: configuredTenantSetting,
+        agentOwnerEventQuota: configuredAgentOwnerEventQuota,
+        agentOwnerCommandQuota: configuredAgentOwnerCommandQuota,
+        tenantLimits: configuredTenantLimits,
+        retentionDays,
+        maxHoldsPerHolder,
+        ...(maxHeldHoursPerHolder !== undefined ? { maxHeldHoursPerHolder } : {}),
+    };
+    /**
+     * Under the tenant's lock for `kind`: the limit when the tenant is at it, else null. No limit for
+     * `kind`, or no tenant, takes no lock. Writes that only lower the count take no lock, so a count
+     * read early stays an upper bound for the rest of the transaction.
+     */
+    async function tenantLimitReached(tx, tenantRef, kind) {
+        const limit = configuredTenantLimits[kind];
+        if (limit === undefined || tenantRef === null)
+            return null;
+        await assertReadCommitted(tx);
+        await lockTenantLimit(tx, tenantRef, kind);
+        if ((await tenantLimitCount(tx, tenantRef, kind, limit)) < limit)
+            return null;
+        // A hold, and a keyed hold's answer, keep their place only until the hold expires; at the
+        // limit, the expired holds and their answers are deleted, as maintenance would, and the count
+        // is read again. Counting expired rows until then keeps what a tenant stores within the limit
+        // between maintenance passes, however short its holds.
+        if (kind !== 'holds' ||
+            (await deleteExpiredHolds(tx, tenantRef, limit)) +
+                (await forgetExpiredHoldAnswers(tx, tenantRef, limit)) ===
+                0) {
+            return limit;
+        }
+        return (await tenantLimitCount(tx, tenantRef, kind, limit)) >= limit ? limit : null;
+    }
+    /**
+     * The tenant whose limit a write on the resource counts against: the caller's, else the
+     * resource's (a resource never changes tenant, so it is read before any lock). Null with no limit.
+     */
+    async function limitTenant(tx, kind, resourceId, tenantRef) {
+        if (configuredTenantLimits[kind] === undefined)
+            return null;
+        if (tenantRef !== undefined)
+            return tenantRef;
+        const [resource] = await tx `
+      SELECT tenant_ref FROM slotlock.resources WHERE id = ${resourceId}`;
+        return resource?.tenant_ref ?? null;
+    }
+    const store = {
+        ...slotlockEventFeedMethods(sql, retentionDays),
+        async applySchema(migrationOptions) {
             // PostgreSQL's IF NOT EXISTS DDL is idempotent after commit but not race-free: two fresh
             // application instances can still collide on pg_namespace/pg_extension unique indexes.
-            // Serialize bootstrap per database and let the transaction release the lock on crashes.
-            await inTransaction(sql, (tx) => withPinnedSearchPath(tx, async () => {
-                await tx `SELECT pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended(${SCHEMA_APPLY_LOCK}, 0))`;
-                await tx.unsafe(SLOTLOCK_CORE_DDL).catch((error) => {
+            // inMigration serializes bootstrap per database and the transaction releases the lock on
+            // crashes. A schema this release already left as it is changes nothing and locks no table,
+            // unless old rows kept one of its constraints NOT VALID: then only the validation runs again.
+            const validate = await inMigration(sql, migrationOptions, async (tx) => {
+                await tx.unsafe(SLOTLOCK_DEPLOYMENT_CHECKS).catch((error) => {
                     throw schemaControlRefusal(error);
                 });
-            }));
+                if (await slotlockSchemaUpToDate(tx))
+                    return slotlockConstraintUnvalidated(tx);
+                await tx.unsafe(SLOTLOCK_STRUCTURE_DDL).catch((error) => {
+                    throw schemaControlRefusal(error);
+                });
+                return true;
+            });
+            if (!validate)
+                return;
+            // Once the DDL has committed, its ACCESS EXCLUSIVE locks are gone: validating holds none that
+            // a serving query waits for (ddl.ts, DEPLOYMENT_VALIDATE_CONSTRAINTS). Inside a caller's
+            // transaction both steps share it, and its locks, until it ends. The digests go last, so a
+            // migration stopped before them runs whole again.
+            await inMigration(sql, migrationOptions, async (tx) => {
+                await tx.unsafe(SLOTLOCK_VALIDATION_DDL);
+                await tx `
+          UPDATE slotlock.schema_version
+             SET ddl_sha256 = ${SLOTLOCK_CORE_DDL_SHA256},
+                 catalog_sha256 = ${await slotlockCatalogDigest(tx)}
+           WHERE singleton`;
+            });
         },
         async applyTenantRls(applyOptions) {
             const ddl = createSlotlockTenantRlsDdl(configuredTenantSetting);
-            await inTransaction(sql, (tx) => withPinnedSearchPath(tx, async () => {
-                await tx `SELECT pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended(${SCHEMA_APPLY_LOCK}, 0))`;
+            const { allowRebind, ...migrationOptions } = applyOptions ?? {};
+            await inMigration(sql, migrationOptions, async (tx) => {
+                await tx.unsafe(SLOTLOCK_DEPLOYMENT_CHECKS).catch((error) => {
+                    throw schemaControlRefusal(error);
+                });
+                if (await tenantRlsUpToDate(tx, configuredTenantSetting))
+                    return;
                 const bindings = await tx `
-            SELECT DISTINCT obj_description(policy.oid, 'pg_policy') AS binding
-              FROM pg_policy policy
-              JOIN pg_class table_class ON table_class.oid = policy.polrelid
-              JOIN pg_namespace namespace ON namespace.oid = table_class.relnamespace
-             WHERE namespace.nspname = 'slotlock'
-               AND table_class.relname IN (
-                 'resources',
-                 'reservations',
-                 'reservation_tombstones',
-                 'reservation_conflict_archive',
-                 'calendar_events',
-                 'calendar_event_attendees',
-                 'calendar_event_reminders',
-                 'calendar_event_exceptions',
-                 'calendar_event_occurrences',
-                 'calendar_event_tombstones',
-                 'calendar_event_commands',
-                 'calendar_coverage'
-               )
-               AND obj_description(policy.oid, 'pg_policy') LIKE 'slotlock:tenant-context:%'`;
+          SELECT DISTINCT obj_description(policy.oid, 'pg_policy') AS binding
+            FROM pg_policy policy
+            JOIN pg_class table_class ON table_class.oid = policy.polrelid
+            JOIN pg_namespace namespace ON namespace.oid = table_class.relnamespace
+           WHERE namespace.nspname = 'slotlock'
+             AND table_class.relname IN ${tx([...SLOTLOCK_TENANT_TABLES])}
+             AND obj_description(policy.oid, 'pg_policy') LIKE 'slotlock:tenant-context:%'`;
                 const conflictingBinding = bindings.find(({ binding }) => binding !== `slotlock:tenant-context:${configuredTenantSetting}`);
-                if (conflictingBinding && applyOptions?.allowRebind !== true) {
+                if (conflictingBinding && allowRebind !== true) {
                     throw Object.assign(new Error(`Slotlock tenant RLS is already bound to ${conflictingBinding.binding.slice('slotlock:tenant-context:'.length)}`), { code: 'tenant_context_conflict' });
                 }
                 await tx.unsafe(ddl).catch((error) => {
                     throw schemaControlRefusal(error);
                 });
-            }));
+            });
         },
-        async grantApplicationRole(role) {
+        async grantApplicationRole(role, migrationOptions) {
             const ddl = createSlotlockApplicationRoleGrantsDdl(role);
-            await inTransaction(sql, (tx) => withPinnedSearchPath(tx, async () => {
+            await inMigration(sql, migrationOptions, (tx) => (async () => {
                 // Every role the target belongs to counts, not only the target: a member can SET ROLE to
                 // it or use its privileges, and one holding only ADMIN OPTION can grant itself either.
                 // MEMBER also counts a PostgreSQL 16 grant made with none of ADMIN, INHERIT or SET, which
@@ -910,7 +2129,7 @@ export function createSlotlockStore(sql, options = {}) {
                     throw Object.assign(new Error(`Slotlock application role ${role} could get around forced RLS or the exclusion arbiter, itself, through a role it belongs to or through PUBLIC (${check.reasons.join('; ')}); use a plain NOBYPASSRLS login role that owns nothing and can create nothing`), { code: 'unsafe_application_role', reasons: check.reasons });
                 }
                 await tx.unsafe(ddl);
-            }));
+            })());
         },
         async withTenant(tenantRef, callback, options) {
             if (!isValidIdentity(tenantRef)) {
@@ -921,45 +2140,99 @@ export function createSlotlockStore(sql, options = {}) {
             const isolation = options?.isolation;
             if (isolation !== undefined && isolation !== 'read committed')
                 throw invalidIsolationError();
+            const actor = options?.actor;
+            if (actor !== undefined && !/^[^\u0000-\u001f\u007f]{1,200}$/u.test(actor)) {
+                throw Object.assign(new Error('Slotlock actor must be 1-200 characters without control characters'), {
+                    code: 'invalid_identity',
+                });
+            }
+            const release = await tenantSlots?.(tenantRef, options?.signal);
+            // A lock wait that timed out leaves the transaction unusable, so the reset below fails with
+            // another error in its place: noted here as it happens.
+            let timedOut = false;
             return inTransaction(sql, async (tx) => {
+                if (lockTimeout !== undefined) {
+                    await tx `SELECT set_config('lock_timeout', ${lockTimeout}, true)`;
+                }
                 if (isolation !== undefined)
                     await assertReadCommitted(tx);
+                // Held shared until the transaction ends: suspension and erasure, which take it
+                // exclusively, wait for this transaction, and one that starts after them reads them below
+                // (READ COMMITTED: a statement after the lock sees what committed before it was granted).
                 const previous = await tx `
-          SELECT current_setting(${configuredTenantSetting}, true) AS value`;
-                await tx `SELECT set_config(${configuredTenantSetting}, ${tenantRef}, true)`;
+            SELECT current_setting(${configuredTenantSetting}, true) AS value,
+                   current_setting('slotlock.actor', true) AS actor,
+                   current_setting('transaction_isolation') AS isolation,
+                   pg_advisory_xact_lock_shared(
+                     hashtextextended(${slotlockTenantLockKey(tenantRef)}, 0)
+                   ) AS locked`;
+                const [context] = await tx `
+            SELECT set_config(${configuredTenantSetting}, ${tenantRef}, true) AS tenant,
+                   set_config('slotlock.actor', ${actor ?? ''}, true) AS actor,
+                   slotlock.tenant_suspended(${tenantRef}) AS suspended`.catch((error) => {
+                    throw suspensionCheckRefusal(error);
+                });
+                // A caller's REPEATABLE READ or SERIALIZABLE snapshot was taken before the lock was
+                // granted, so it may not show a suspension that committed while this transaction waited:
+                // its writes are refused, and it may read.
+                const refusal = context?.suspended === true
+                    ? tenantSuspendedError
+                    : previous[0]?.isolation !== 'read committed'
+                        ? staleSuspensionCheckError
+                        : null;
                 try {
-                    return await callback(createSlotlockStore(tx, {
-                        tenantContextSetting: configuredTenantSetting,
-                        agentOwnerEventQuota: configuredAgentOwnerEventQuota,
-                        agentOwnerCommandQuota: configuredAgentOwnerCommandQuota,
-                    }));
+                    return await callback(buildSlotlockStore(tx, storeOptions, refusal));
+                }
+                catch (error) {
+                    if (pgCode(error) === LOCK_NOT_AVAILABLE)
+                        timedOut = true;
+                    throw error;
                 }
                 finally {
-                    await tx `SELECT set_config(${configuredTenantSetting}, ${previous[0]?.value ?? ''}, true)`;
+                    await tx `SELECT set_config(${configuredTenantSetting}, ${previous[0]?.value ?? ''}, true),
+                            set_config('slotlock.actor', ${previous[0]?.actor ?? ''}, true)`;
+                }
+            }, 'read committed')
+                .catch((error) => {
+                if (lockTimeout !== undefined && (timedOut || pgCode(error) === LOCK_NOT_AVAILABLE)) {
+                    throw lockTimeoutError(error);
                 }
-            }, isolation);
+                throw error;
+            })
+                .finally(() => release?.());
         },
         async createResource(params) {
             assertValidResourceInput(params);
-            const max = params.maxTenantResources;
-            if (max === undefined)
+            const requested = params.maxTenantResources;
+            const configured = params.tenantRef === undefined ? undefined : configuredTenantLimits.resources;
+            if (requested === undefined && configured === undefined)
                 return upsertResource(sql, params);
-            if (!Number.isSafeInteger(max) ||
-                max < 1 ||
-                max > MAX_TENANT_RESOURCE_LIMIT ||
-                params.tenantRef === undefined ||
-                params.externalRef === undefined) {
+            if (requested !== undefined &&
+                (!Number.isSafeInteger(requested) ||
+                    requested < 1 ||
+                    requested > MAX_TENANT_RESOURCE_LIMIT ||
+                    params.tenantRef === undefined ||
+                    params.externalRef === undefined)) {
                 throw Object.assign(new Error(`Slotlock maxTenantResources must be a whole number from 1 to ${MAX_TENANT_RESOURCE_LIMIT}, for a tenant-owned resource`), { code: 'invalid_resource_limit' });
             }
-            const { tenantRef, externalRef } = params;
+            const max = requested === undefined
+                ? configured
+                : configured === undefined
+                    ? requested
+                    : Math.min(requested, configured);
+            const tenantRef = params.tenantRef;
+            const externalRef = params.externalRef ?? null;
             return inTransaction(sql, async (tx) => {
                 await assertReadCommitted(tx);
                 // An object, so the key never equals a [tenantRef, externalRef] identity lock's.
                 await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify({ resourceCount: tenantRef })}, 0))`;
                 // READ COMMITTED: each statement below sees every create committed before the lock.
-                const known = await tx `
-            SELECT id FROM slotlock.resources
-             WHERE tenant_ref = ${tenantRef} AND external_ref = ${externalRef}`;
+                // Re-creating a resource the tenant has (by its reference) adds none.
+                const known = externalRef === null
+                    ? []
+                    : await tx `
+                  SELECT id FROM slotlock.resources
+                   WHERE tenant_ref = ${tenantRef} AND external_ref = ${externalRef}`;
                 if (known.length === 0) {
                     const [counted] = await tx `
               SELECT count(*) AS count FROM slotlock.resources WHERE tenant_ref = ${tenantRef}`;
@@ -971,15 +2244,17 @@ export function createSlotlockStore(sql, options = {}) {
             }, 'read committed');
         },
         async getResource(params) {
+            assertValidVisibility(params.visibility);
             if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
                 throw Object.assign(new Error('Slotlock resource identity is invalid'), {
                     code: 'invalid_identity',
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at
           FROM slotlock.resources
-         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}`;
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+           AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -994,10 +2269,87 @@ export function createSlotlockStore(sql, options = {}) {
         UPDATE slotlock.resources
            SET availability_rules = ${rules}::jsonb
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
+        async setResourceBookingRules(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw Object.assign(new Error('Slotlock resource identity is invalid'), {
+                    code: 'invalid_identity',
+                });
+            }
+            let rules = null;
+            if (params.rules !== null) {
+                try {
+                    rules = parseBookingRules(params.rules);
+                }
+                catch (error) {
+                    throw Object.assign(new Error(error.message), {
+                        code: 'invalid_booking_rules',
+                    });
+                }
+            }
+            const rows = await sql `
+        UPDATE slotlock.resources
+           SET booking_rules = ${rules === null ? null : sql.json({ ...rules })}::jsonb,
+               -- Kept while check-in stays asked for, from the moment it first was; cleared without.
+               check_in_since = CASE
+                 WHEN ${rules?.checkInMinutes ?? null}::int IS NULL THEN NULL
+                 WHEN booking_rules ? 'checkInMinutes' THEN COALESCE(check_in_since, statement_timestamp())
+                 ELSE statement_timestamp()
+               END
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
+                  visibility, archived_at`;
+            const row = rows[0];
+            return row ? toResource(row) : null;
+        },
+        async setResourcePool(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw Object.assign(new Error('Slotlock resource identity is invalid'), {
+                    code: 'invalid_identity',
+                });
+            }
+            if (params.pool !== null && !isPoolName(params.pool))
+                throw invalidPoolError();
+            const rows = await sql `
+        UPDATE slotlock.resources SET pool_ref = ${params.pool}
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
+                  visibility, archived_at`;
+            const row = rows[0];
+            return row ? toResource(row) : null;
+        },
+        async listPoolMembers(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            if (!isPoolName(params.pool))
+                throw invalidPoolError();
+            const rows = await sql `
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
+               visibility, archived_at
+          FROM slotlock.resources
+         WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
+           AND archived_at IS NULL
+           AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
+         ORDER BY id
+         LIMIT ${SLOTLOCK_MAX_POOL_MEMBERS}`;
+            return rows.map(toResource);
+        },
+        async listPools(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            const rows = await sql `
+        SELECT pool_ref AS pool, count(*)::int AS capacity
+          FROM slotlock.resources
+         WHERE tenant_ref = ${params.tenantRef} AND pool_ref IS NOT NULL AND archived_at IS NULL
+           AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
+         GROUP BY pool_ref
+         ORDER BY pool_ref
+         LIMIT 1000`;
+            return rows;
+        },
         async setTenantAvailability(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
@@ -1029,42 +2381,130 @@ export function createSlotlockStore(sql, options = {}) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef}
+           AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
+           AND (${params.includeArchived === true} OR archived_at IS NULL)
            AND (${params.after ?? null}::uuid IS NULL OR id > ${params.after ?? null}::uuid)
          ORDER BY id
          LIMIT ${limit}`;
             return rows.map(toResource);
         },
+        async archiveResource(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw invalidIdentityError('Slotlock resource identity is invalid');
+            }
+            // Its clock time, not the transaction's start: a booking that committed holding the row's
+            // share lock went in before this.
+            const [row] = await sql `
+        UPDATE slotlock.resources
+           SET archived_at = COALESCE(archived_at, clock_timestamp())
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+            return row ? toResource(row) : null;
+        },
+        async restoreResource(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw invalidIdentityError('Slotlock resource identity is invalid');
+            }
+            const [row] = await sql `
+        UPDATE slotlock.resources
+           SET archived_at = NULL
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+            return row ? toResource(row) : null;
+        },
+        async deleteResource(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw invalidIdentityError('Slotlock resource identity is invalid');
+            }
+            return inTransaction(sql, async (tx) => {
+                // The row lock waits for writers holding its share lock and keeps new ones out until done.
+                const [resource] = await tx `
+          SELECT id FROM slotlock.resources
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+           FOR UPDATE`;
+                if (!resource)
+                    return { ok: true, deleted: false };
+                const [live] = await tx `
+          SELECT EXISTS (
+                   SELECT 1 FROM slotlock.reservations
+                    WHERE resource_id = ${params.id}
+                      AND calendar_event_id IS NULL
+                      AND (CASE WHEN status = 'held' THEN expires_at > statement_timestamp()
+                                ELSE COALESCE(occupied_ends_at, ends_at) > now() END)
+                 )
+                 OR EXISTS (
+                   SELECT 1 FROM slotlock.calendar_events
+                    WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.id}
+                      AND (recurrence_rule IS NOT NULL OR ends_at > now())
+                 ) AS live`;
+                if (live?.live)
+                    return { ok: false, code: 'resource_in_use' };
+                // Its rows go with it: reservations, events and their children, coverage and hold answers
+                // all cascade from the resource.
+                await tx `DELETE FROM slotlock.resources WHERE id = ${params.id}`;
+                return { ok: true, deleted: true };
+            });
+        },
         async createReservation(params) {
             if (!isFiniteWindow({ start: params.start, end: params.end })) {
                 return { ok: false, code: 'invalid_window' };
             }
+            if (!isValidResourceId(params.resourceId))
+                return { ok: false, code: 'resource_not_found' };
+            if (params.tenantRef !== undefined && !isValidIdentity(params.tenantRef)) {
+                return { ok: false, code: 'resource_not_found' };
+            }
+            // A booking on a tenant's resource takes the tenant and its own id as reference, so it can be
+            // cancelled and moved like any other; one on a resource with no tenant stays tenantless.
+            const id = randomUUID();
             for (let attempt = 1;; attempt++) {
                 try {
-                    const rows = await inTransaction(sql, async (tx) => {
-                        await reapExpiredHolds(tx, params.resourceId, params.start, params.end);
-                        return tx `
-              INSERT INTO slotlock.reservations (resource_id, starts_at, ends_at, source)
-              VALUES (${params.resourceId}, ${params.start}, ${params.end}, ${params.source ?? null})
-              RETURNING id, resource_id, starts_at, ends_at, source`;
+                    return await inTransaction(sql, async (tx) => {
+                        const bookingLimit = await tenantLimitReached(tx, await limitTenant(tx, 'reservations', params.resourceId, params.tenantRef), 'reservations');
+                        const [resource] = await tx `
+              SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
+               WHERE id = ${params.resourceId}
+                 AND (${params.tenantRef ?? null}::text IS NULL
+                      OR tenant_ref = ${params.tenantRef ?? null})
+               FOR SHARE`;
+                        if (!resource)
+                            return { ok: false, code: 'resource_not_found' };
+                        if (resource.archived)
+                            return { ok: false, code: 'resource_archived' };
+                        if (bookingLimit !== null && resource.tenant_ref !== null) {
+                            return { ok: false, code: 'reservation_limit_reached', limit: bookingLimit };
+                        }
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
+                        if (ruling.rule)
+                            return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
+                        const occupied = new Date(params.end.getTime() + ruling.turnaroundMs);
+                        if (resource.tenant_ref !== null &&
+                            !(await recurrenceCoversWrite(tx, {
+                                tenantRef: resource.tenant_ref,
+                                resourceId: params.resourceId,
+                                start: params.start,
+                                end: occupied,
+                            }))) {
+                            return { ok: false, code: 'recurrence_not_materialized' };
+                        }
+                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
+                        const [row] = await tx `
+              INSERT INTO slotlock.reservations (
+                id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms, source
+              ) VALUES (
+                ${id}, ${params.resourceId}, ${resource.tenant_ref},
+                ${resource.tenant_ref === null ? null : id},
+                ${params.start}, ${params.end}, ${ruling.turnaroundMs}, ${params.source ?? null}
+              )
+              RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
+                        buffer_after_ms, revision, source`;
+                        if (!row)
+                            throw new Error('slotlock: reservation insert returned no row');
+                        return { ok: true, reservation: toReservation(row) };
                     });
-                    const row = rows[0];
-                    if (!row)
-                        throw new Error('slotlock: reservation insert returned no row');
-                    const reservation = {
-                        id: row.id,
-                        resourceId: row.resource_id,
-                        tenantRef: null,
-                        externalRef: null,
-                        start: row.starts_at,
-                        end: row.ends_at,
-                        bufferAfterMs: 0,
-                        revision: 1,
-                        source: row.source,
-                    };
-                    return { ok: true, reservation };
                 }
                 catch (err) {
                     const code = pgCode(err);
@@ -1078,6 +2518,7 @@ export function createSlotlockStore(sql, options = {}) {
                     }
                     // A SECOND contention abort is treated as a loss too (structured, possibly with a null
                     // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
+                    await rollSeriesBehind(sql, params.resourceId, params.start, params.end);
                     return overlapLoss(sql, params.resourceId, params.start, params.end);
                 }
             }
@@ -1088,6 +2529,7 @@ export function createSlotlockStore(sql, options = {}) {
                 return invalid;
             if (params.revision !== 1)
                 return { ok: false, code: 'invalid_revision' };
+            let written = params.bufferAfterMs;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -1108,27 +2550,47 @@ export function createSlotlockStore(sql, options = {}) {
                  AND calendar_event_id IS NULL
                FOR UPDATE`;
                         const found = existing[0];
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
                         if (found) {
                             // The booking has moved on since: a delayed create is stale, as a delayed move is.
                             if (params.revision < Number(found.revision)) {
                                 return { ok: false, code: 'stale_revision' };
                             }
-                            if (!sameExternalPayload(found, params)) {
+                            if (!sameExternalPayload(found, params, ruling.turnaroundMs)) {
                                 return { ok: false, code: 'idempotency_conflict' };
                             }
                             return { ok: true, reservation: toReservation(found), idempotent: true };
                         }
-                        if (!(await resourceBelongsToTenant(tx, params.resourceId, params.tenantRef))) {
+                        const bookingLimit = await tenantLimitReached(tx, params.tenantRef, 'reservations');
+                        const resourceState = await tenantResourceState(tx, params.resourceId, params.tenantRef);
+                        if (resourceState === 'missing')
                             return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (resourceState === 'archived')
+                            return { ok: false, code: 'resource_archived' };
+                        if (bookingLimit !== null) {
+                            return { ok: false, code: 'reservation_limit_reached', limit: bookingLimit };
+                        }
+                        if (ruling.rule)
+                            return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
+                        const bufferAfterMs = Math.max(params.bufferAfterMs, ruling.turnaroundMs);
+                        written = bufferAfterMs;
+                        const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
+                        if (!(await recurrenceCoversWrite(tx, {
+                            tenantRef: params.tenantRef,
+                            resourceId: params.resourceId,
+                            start: params.start,
+                            end: occupied,
+                        }))) {
+                            return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd(params));
+                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
                         const rows = await tx `
               INSERT INTO slotlock.reservations (
                 resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
                 revision, source
               ) VALUES (
                 ${params.resourceId}, ${params.tenantRef}, ${params.externalRef}, ${params.start},
-                ${params.end}, ${params.bufferAfterMs}, ${params.revision}, ${params.source ?? null}
+                ${params.end}, ${bufferAfterMs}, ${params.revision}, ${params.source ?? null}
               )
               RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                         buffer_after_ms, revision, source`;
@@ -1148,7 +2610,8 @@ export function createSlotlockStore(sql, options = {}) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, params.bufferAfterMs);
+                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs: written }));
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, written);
                 }
             }
         },
@@ -1157,6 +2620,7 @@ export function createSlotlockStore(sql, options = {}) {
             if (invalid)
                 return invalid;
             let currentReservationId;
+            let bufferAfterMs = params.bufferAfterMs;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -1169,6 +2633,7 @@ export function createSlotlockStore(sql, options = {}) {
                  AND calendar_event_id IS NULL
                FOR UPDATE`;
                         const found = existing[0];
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
                         if (!found) {
                             const cancelled = await tx `
                 SELECT revision FROM slotlock.reservation_tombstones
@@ -1181,7 +2646,7 @@ export function createSlotlockStore(sql, options = {}) {
                         const currentRevision = Number(found.revision);
                         if (params.revision < currentRevision)
                             return { ok: false, code: 'stale_revision' };
-                        if (sameExternalPayload(found, params)) {
+                        if (sameExternalPayload(found, params, ruling.turnaroundMs)) {
                             return { ok: true, reservation: toReservation(found), idempotent: true };
                         }
                         if (params.revision === currentRevision) {
@@ -1190,18 +2655,36 @@ export function createSlotlockStore(sql, options = {}) {
                         if (params.revision !== currentRevision + 1) {
                             return { ok: false, code: 'revision_conflict' };
                         }
-                        if (!(await resourceBelongsToTenant(tx, params.resourceId, params.tenantRef))) {
+                        const resourceState = await tenantResourceState(tx, params.resourceId, params.tenantRef);
+                        if (resourceState === 'missing')
                             return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (resourceState === 'archived')
+                            return { ok: false, code: 'resource_archived' };
+                        if (ruling.rule)
+                            return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
+                        bufferAfterMs = Math.max(params.bufferAfterMs, ruling.turnaroundMs);
+                        if (!(await recurrenceCoversWrite(tx, {
+                            tenantRef: params.tenantRef,
+                            resourceId: params.resourceId,
+                            start: params.start,
+                            end: occupiedEnd({ end: params.end, bufferAfterMs }),
+                        }))) {
+                            return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd(params));
+                        await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs }));
                         const rows = await tx `
               UPDATE slotlock.reservations
                  SET resource_id = ${params.resourceId},
                      starts_at = ${params.start},
                      ends_at = ${params.end},
-                     buffer_after_ms = ${params.bufferAfterMs},
+                     buffer_after_ms = ${bufferAfterMs},
                      revision = ${params.revision},
-                     source = ${params.source ?? null}
+                     source = ${params.source ?? null},
+                     -- A check-in is for the time it was made for: a move to another start clears it.
+                     checked_in_at = CASE
+                       WHEN starts_at = ${params.start} AND resource_id = ${params.resourceId}
+                       THEN checked_in_at
+                     END
                WHERE id = ${found.id}
                RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                          buffer_after_ms, revision, source`;
@@ -1221,7 +2704,9 @@ export function createSlotlockStore(sql, options = {}) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, params.bufferAfterMs, currentReservationId);
+                    const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
+                    await rollSeriesBehind(sql, params.resourceId, params.start, occupied);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs, currentReservationId);
                 }
             }
         },
@@ -1262,9 +2747,26 @@ export function createSlotlockStore(sql, options = {}) {
                         return { ok: false, code: 'revision_conflict' };
                     }
                 }
+                if (!found) {
+                    // A calendar event's occupation row carries this reference: it is the event's, not a
+                    // booking's. Nothing is cancelled, and nothing retired: a tombstone would only grow.
+                    const [occupation] = await tx `
+            SELECT id FROM slotlock.reservations
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
+               AND calendar_event_id IS NOT NULL
+             LIMIT 1`;
+                    if (occupation)
+                        return { ok: true, cancelled: false, revision: params.revision };
+                    // Retiring a reference no booking holds adds a row; cancelling a booking replaces one.
+                    const limit = await tenantLimitReached(tx, params.tenantRef, 'reservations');
+                    if (limit !== null)
+                        return { ok: false, code: 'reservation_limit_reached', limit };
+                }
+                // A reference no booking holds yet is retired too, so a create delivered after its cancel
+                // cannot bring the booking back. Only such a stray retirement is pruned past retention.
                 await tx `
-          INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision)
-          VALUES (${params.tenantRef}, ${params.externalRef}, ${params.revision})`;
+          INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray)
+          VALUES (${params.tenantRef}, ${params.externalRef}, ${params.revision}, ${!found})`;
                 if (!found)
                     return { ok: true, cancelled: false, revision: params.revision };
                 const deleted = await tx `
@@ -1282,31 +2784,151 @@ export function createSlotlockStore(sql, options = {}) {
             if (!Number.isFinite(params.ttlMs) || params.ttlMs <= 0 || params.ttlMs > MAX_HOLD_TTL_MS) {
                 return { ok: false, code: 'invalid_ttl' };
             }
+            const bufferAfterMs = params.bufferAfterMs ?? 0;
+            if (!Number.isSafeInteger(bufferAfterMs) ||
+                bufferAfterMs < 0 ||
+                bufferAfterMs > MAX_BUFFER_AFTER_MS) {
+                return { ok: false, code: 'invalid_buffer' };
+            }
+            const { tenantRef, principalRef, idempotencyKey } = params;
+            if (tenantRef !== undefined && !isValidIdentity(tenantRef)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            const keyed = idempotencyKey !== undefined || principalRef !== undefined;
+            if (keyed &&
+                (tenantRef === undefined || !isValidIdentity(principalRef) || !isValidIdentity(idempotencyKey))) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            if (!isValidResourceId(params.resourceId))
+                return { ok: false, code: 'resource_not_found' };
+            if (params.groupId !== undefined && !isValidResourceId(params.groupId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            const { holderRef } = params;
+            if (holderRef !== undefined && (tenantRef === undefined || !isValidIdentity(holderRef))) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            const payloadHash = calendarCommandHash({
+                operation: 'hold',
+                resourceId: params.resourceId,
+                start: params.start.toISOString(),
+                end: params.end.toISOString(),
+                ttlMs: params.ttlMs,
+                bufferAfterMs,
+                source: params.source ?? null,
+                ...(params.groupId !== undefined ? { groupId: params.groupId } : {}),
+                ...(holderRef !== undefined ? { holderRef } : {}),
+            });
             const ttlSeconds = params.ttlMs / 1000;
+            // The buffer written: the one asked for, raised to the resource's turnaround.
+            let written = bufferAfterMs;
             for (let attempt = 1;; attempt++) {
                 try {
-                    const rows = await inTransaction(sql, async (tx) => {
-                        await reapExpiredHolds(tx, params.resourceId, params.start, params.end);
-                        return tx `
-              INSERT INTO slotlock.reservations (resource_id, starts_at, ends_at, status, expires_at, source)
-              VALUES (${params.resourceId}, ${params.start}, ${params.end}, 'held',
-                      now() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null})
-              RETURNING id, resource_id, starts_at, ends_at, expires_at, source`;
+                    return await inTransaction(sql, async (tx) => {
+                        if (keyed) {
+                            await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([
+                                'slotlock-hold-command',
+                                tenantRef,
+                                principalRef,
+                                idempotencyKey,
+                            ])}, 0))`;
+                            const [prior] = await tx `
+                SELECT hold_id AS id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at,
+                       source, payload_hash,
+                       (SELECT hold_group_id FROM slotlock.reservations WHERE id = hold_id) AS hold_group_id
+                  FROM slotlock.hold_commands
+                 WHERE tenant_ref = ${tenantRef ?? null} AND principal_ref = ${principalRef ?? null}
+                   AND idempotency_key = ${idempotencyKey ?? null}`;
+                            if (prior) {
+                                return prior.payload_hash === payloadHash
+                                    ? { ok: true, hold: toHold(prior), idempotent: true }
+                                    : { ok: false, code: 'idempotency_conflict' };
+                            }
+                        }
+                        const holdLimit = await tenantLimitReached(tx, await limitTenant(tx, 'holds', params.resourceId, tenantRef), 'holds');
+                        const [resource] = await tx `
+              SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
+               WHERE id = ${params.resourceId}
+                 AND (${tenantRef ?? null}::text IS NULL OR tenant_ref = ${tenantRef ?? null})
+               FOR SHARE`;
+                        if (!resource)
+                            return { ok: false, code: 'resource_not_found' };
+                        if (resource.archived)
+                            return { ok: false, code: 'resource_archived' };
+                        if (holdLimit !== null)
+                            return { ok: false, code: 'hold_limit_reached', limit: holdLimit };
+                        // Seconds the holder already holds, turnaround included, when its time is capped.
+                        let heldSeconds = null;
+                        if (holderRef !== undefined) {
+                            // One holder's live holds, counted under a lock on the holder so racing holds stop
+                            // at the cap: an agent cannot hold a resource's whole week.
+                            await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([
+                                'slotlock-holder',
+                                tenantRef,
+                                holderRef,
+                            ])}, 0))`;
+                            const [held] = await tx `
+                SELECT count(*)::int AS count,
+                       COALESCE(sum(extract(epoch FROM
+                         ends_at + buffer_after_ms * interval '1 millisecond' - starts_at)), 0)::float8
+                         AS seconds
+                  FROM slotlock.reservations
+                 WHERE holder_ref = ${holderRef} AND tenant_ref IS NULL AND status = 'held'
+                   AND expires_at > statement_timestamp()
+                   AND resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef ?? null})`;
+                            if ((held?.count ?? 0) >= maxHoldsPerHolder) {
+                                return { ok: false, code: 'hold_limit_reached', limit: maxHoldsPerHolder };
+                            }
+                            if (maxHeldHoursPerHolder !== undefined)
+                                heldSeconds = held?.seconds ?? 0;
+                        }
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
+                        if (ruling.rule)
+                            return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
+                        written = Math.max(bufferAfterMs, ruling.turnaroundMs);
+                        const reach = occupiedEnd({ end: params.end, bufferAfterMs: written });
+                        if (heldSeconds !== null &&
+                            maxHeldHoursPerHolder !== undefined &&
+                            heldSeconds + (reach.getTime() - params.start.getTime()) / 1000 >
+                                maxHeldHoursPerHolder * 3_600) {
+                            return { ok: false, code: 'held_time_limit_reached', limit: maxHeldHoursPerHolder };
+                        }
+                        if (resource.tenant_ref !== null &&
+                            !(await recurrenceCoversWrite(tx, {
+                                tenantRef: resource.tenant_ref,
+                                resourceId: params.resourceId,
+                                start: params.start,
+                                end: reach,
+                            }))) {
+                            return { ok: false, code: 'recurrence_not_materialized' };
+                        }
+                        await reapExpiredHolds(tx, params.resourceId, params.start, reach);
+                        const [row] = await tx `
+              INSERT INTO slotlock.reservations (
+                resource_id, starts_at, ends_at, buffer_after_ms, status, expires_at, source,
+                holder_ref, hold_group_id
+              ) VALUES (
+                ${params.resourceId}, ${params.start}, ${params.end}, ${written}, 'held',
+                statement_timestamp() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null},
+                ${holderRef ?? null}, ${params.groupId ?? null}
+              )
+              RETURNING id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at, source,
+                        hold_group_id`;
+                        if (!row)
+                            throw new Error('slotlock: hold insert returned no row');
+                        if (keyed) {
+                            await tx `
+                INSERT INTO slotlock.hold_commands (
+                  tenant_ref, principal_ref, idempotency_key, payload_hash, hold_id, resource_id,
+                  starts_at, ends_at, buffer_after_ms, expires_at, source
+                ) VALUES (
+                  ${tenantRef ?? null}, ${principalRef ?? null}, ${idempotencyKey ?? null},
+                  ${payloadHash}, ${row.id}, ${row.resource_id}, ${row.starts_at}, ${row.ends_at},
+                  ${row.buffer_after_ms}, ${row.expires_at}, ${row.source}
+                )`;
+                        }
+                        return { ok: true, hold: toHold(row), idempotent: false };
                     });
-                    const row = rows[0];
-                    if (!row)
-                        throw new Error('slotlock: hold insert returned no row');
-                    return {
-                        ok: true,
-                        hold: {
-                            id: row.id,
-                            resourceId: row.resource_id,
-                            start: row.starts_at,
-                            end: row.ends_at,
-                            expiresAt: row.expires_at,
-                            source: row.source,
-                        },
-                    };
                 }
                 catch (err) {
                     const code = pgCode(err);
@@ -1320,74 +2942,224 @@ export function createSlotlockStore(sql, options = {}) {
                     }
                     // A SECOND contention abort is treated as a loss too (structured, possibly with a null
                     // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
-                    return overlapLoss(sql, params.resourceId, params.start, params.end);
+                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs: written }));
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, written);
                 }
             }
         },
-        async confirmHold(holdId, options = {}) {
-            const tenantRef = holdTenantRef(options);
+        async getHold(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.holdId))
+                return null;
+            const [row] = await sql `
+        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+               hold.expires_at, hold.source
+          FROM slotlock.reservations hold
+          JOIN slotlock.resources resource ON resource.id = hold.resource_id
+         WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
+           AND hold.status = 'held' AND hold.expires_at > statement_timestamp()`;
+            return row ? toHold(row) : null;
+        },
+        async listHolds(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.resourceId)) {
+                throw invalidIdentityError('Slotlock resource id must be a UUID');
+            }
+            const limit = pageLimit(params.limit);
+            const after = pageCursor(params.after);
             const rows = await sql `
-        UPDATE slotlock.reservations
-           SET status = 'confirmed', expires_at = NULL
-         WHERE id = ${holdId} AND status = 'held' AND expires_at > now()
-           AND (${tenantRef}::text IS NULL
-                OR resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef}))
-         RETURNING id, resource_id, starts_at, ends_at, source`;
-            const row = rows[0];
-            if (row) {
-                return {
-                    ok: true,
-                    reservation: {
-                        id: row.id,
-                        resourceId: row.resource_id,
-                        tenantRef: null,
-                        externalRef: null,
-                        start: row.starts_at,
-                        end: row.ends_at,
-                        bufferAfterMs: 0,
-                        revision: 1,
-                        source: row.source,
-                    },
-                };
+        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+               hold.expires_at, hold.source
+          FROM slotlock.reservations hold
+          JOIN slotlock.resources resource ON resource.id = hold.resource_id
+         WHERE hold.resource_id = ${params.resourceId} AND resource.tenant_ref = ${params.tenantRef}
+           AND hold.status = 'held' AND hold.expires_at > statement_timestamp()
+           AND (${after.start}::timestamptz IS NULL
+                OR (hold.starts_at, hold.id) > (${after.start}::timestamptz, ${after.id}::uuid))
+         ORDER BY hold.starts_at, hold.id
+         LIMIT ${limit}`;
+            return rows.map(toHold);
+        },
+        async listAgenda(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             }
-            const present = await sql `
-        SELECT status, (status = 'held' AND expires_at <= now()) AS expired,
-               resource_id, starts_at, ends_at, source
+            const window = calendarWindow(params.window);
+            const limit = pageLimit(params.limit);
+            // A confirmed row without a tenant is a parity shadow, not a booking.
+            const rows = await sql `
+        SELECT entry.id, entry.resource_id, entry.starts_at, entry.ends_at, entry.status,
+               entry.external_ref, entry.expires_at, entry.source, entry.calendar_event_id,
+               event.summary
+          FROM slotlock.reservations entry
+          JOIN slotlock.resources resource ON resource.id = entry.resource_id
+          LEFT JOIN slotlock.calendar_events event ON event.id = entry.calendar_event_id
+         WHERE resource.tenant_ref = ${params.tenantRef}
+           AND entry.starts_at < ${window.end} AND entry.ends_at > ${window.start}
+           AND ((entry.status = 'held' AND entry.expires_at > statement_timestamp())
+                OR (entry.status = 'confirmed' AND entry.tenant_ref = ${params.tenantRef}))
+         ORDER BY entry.starts_at, entry.id
+         LIMIT ${limit}`;
+            return rows.map((row) => ({
+                id: row.id,
+                resourceId: row.resource_id,
+                start: row.starts_at,
+                end: row.ends_at,
+                kind: row.status === 'held' ? 'hold' : row.calendar_event_id ? 'event' : 'booking',
+                reference: row.status === 'held' || row.calendar_event_id ? null : row.external_ref,
+                summary: row.summary,
+                expiresAt: row.status === 'held' ? row.expires_at : null,
+                source: row.source,
+            }));
+        },
+        async getReservation(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.externalRef)) {
+                throw invalidIdentityError('Slotlock booking identity must be 1-500 UTF-8 bytes');
+            }
+            const [row] = await sql `
+        SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
+               revision, source
           FROM slotlock.reservations
-         WHERE id = ${holdId}
-           -- A hold has no external identity, before or after it is confirmed; a booking that has
-           -- one is not a hold, and confirming it again would describe it wrongly.
-           AND tenant_ref IS NULL
-           AND (${tenantRef}::text IS NULL
-                OR resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef}))`;
-            const found = present[0];
-            // Idempotent confirm: a retried confirm (network replay) of an already-confirmed hold is
-            // SUCCESS — the booking exists; reporting failure would make callers double-book elsewhere.
-            if (found && found.status === 'confirmed') {
-                return {
-                    ok: true,
-                    reservation: {
-                        id: holdId,
-                        resourceId: found.resource_id,
-                        tenantRef: null,
-                        externalRef: null,
-                        start: found.starts_at,
-                        end: found.ends_at,
-                        bufferAfterMs: 0,
-                        revision: 1,
-                        source: found.source,
-                    },
-                };
+         WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
+           AND calendar_event_id IS NULL`;
+            return row ? toReservation(row) : null;
+        },
+        async listReservations(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             }
-            if (found?.expired)
-                return { ok: false, code: 'hold_expired' };
-            // NOTE: a hold reaped mid-flight by a rival (expired while this confirm waited on the
-            // reaper's lock) reads as hold_not_found — the row is gone and the space was legitimately
-            // taken; both refusal codes are terminal for the caller.
-            return { ok: false, code: 'hold_not_found' };
+            if (!isValidResourceId(params.resourceId)) {
+                throw invalidIdentityError('Slotlock resource id must be a UUID');
+            }
+            const window = calendarWindow(params.window);
+            const limit = pageLimit(params.limit);
+            const after = pageCursor(params.after);
+            const rows = await sql `
+        SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
+               revision, source
+          FROM slotlock.reservations
+         WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+           AND calendar_event_id IS NULL
+           AND starts_at < ${window.end}
+           AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
+           AND (${after.start}::timestamptz IS NULL
+                OR (starts_at, id) > (${after.start}::timestamptz, ${after.id}::uuid))
+         ORDER BY starts_at, id
+         LIMIT ${limit}`;
+            return rows.map(toReservation);
+        },
+        async confirmHold(holdId, options = {}) {
+            const tenantRef = holdTenantRef(options);
+            // Not an id the store issues: it names no hold (and would be a raw 22P02 in the query).
+            if (!isValidResourceId(holdId))
+                return { ok: false, code: 'hold_not_found' };
+            return inTransaction(sql, async (tx) => {
+                // The tenant whose booking the hold becomes is its resource's; a hold never changes
+                // resource, so it is read before the identity lock, which is taken before the row lock as
+                // every booking write takes them.
+                const [owner] = await tx `
+          SELECT hold.resource_id, resource.tenant_ref AS resource_tenant
+            FROM slotlock.reservations hold
+            JOIN slotlock.resources resource ON resource.id = hold.resource_id
+           WHERE hold.id = ${holdId} AND hold.calendar_event_id IS NULL
+             AND (${tenantRef}::text IS NULL OR resource.tenant_ref = ${tenantRef})`;
+                if (!owner)
+                    return { ok: false, code: 'hold_not_found' };
+                const bookingTenant = owner.resource_tenant;
+                if (bookingTenant !== null)
+                    await lockExternalIdentity(tx, bookingTenant, holdId);
+                const bookingLimit = await tenantLimitReached(tx, bookingTenant, 'reservations');
+                // The resource's share lock, as every booking write takes it: an archive waits for this
+                // confirmation, and one that committed first is read here.
+                const [resource] = await tx `
+          SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
+           WHERE id = ${owner.resource_id}
+           FOR SHARE`;
+                const [row] = await tx `
+          SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
+                 revision, source, status, (status = 'held' AND expires_at > statement_timestamp()) AS live
+            FROM slotlock.reservations
+           WHERE id = ${holdId}
+           FOR UPDATE`;
+                if (!row) {
+                    // NOTE: a hold reaped mid-flight by a rival (expired while this confirm waited on the
+                    // reaper's lock) reads as hold_not_found: the row is gone and the space was legitimately
+                    // taken; both refusal codes are terminal for the caller.
+                    return { ok: false, code: 'hold_not_found' };
+                }
+                if (row.status === 'confirmed') {
+                    // Idempotent confirm: a retried confirm (network replay) of an already-confirmed hold is
+                    // SUCCESS, the booking as it now is; reporting failure would make callers double-book
+                    // elsewhere. A confirmed hold's reference is its own id (none without a tenant); a
+                    // booking with another reference was never this hold.
+                    if (row.external_ref !== null && row.external_ref !== row.id) {
+                        return { ok: false, code: 'hold_not_found' };
+                    }
+                    return { ok: true, reservation: toReservation(row) };
+                }
+                if (!row.live)
+                    return { ok: false, code: 'hold_expired' };
+                // Archived since the hold was taken: a confirmation would be a new booking on it.
+                if (resource?.archived !== false)
+                    return { ok: false, code: 'resource_archived' };
+                if (bookingTenant !== null) {
+                    const [retired] = await tx `
+            SELECT revision FROM slotlock.reservation_tombstones
+             WHERE tenant_ref = ${bookingTenant} AND external_ref = ${holdId}`;
+                    if (retired)
+                        return { ok: false, code: 'reservation_cancelled' };
+                    const [taken] = await tx `
+            SELECT id FROM slotlock.reservations
+             WHERE tenant_ref = ${bookingTenant} AND external_ref = ${holdId}
+               AND calendar_event_id IS NULL`;
+                    if (taken)
+                        return { ok: false, code: 'idempotency_conflict' };
+                }
+                if (bookingLimit !== null) {
+                    return { ok: false, code: 'reservation_limit_reached', limit: bookingLimit };
+                }
+                // The occupied end is already the end plus the hold's buffer (the trigger set it); the
+                // tenant and reference make the hold a booking that cancel and reschedule reach.
+                const [confirmed] = await tx `
+          UPDATE slotlock.reservations
+             SET status = 'confirmed', expires_at = NULL,
+                 tenant_ref = ${bookingTenant}, external_ref = ${bookingTenant === null ? null : holdId}
+           WHERE id = ${holdId}
+          RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
+                    buffer_after_ms, revision, source`;
+                if (!confirmed)
+                    throw new Error('slotlock: hold confirmation returned no row');
+                return { ok: true, reservation: toReservation(confirmed) };
+            });
         },
         async releaseHold(holdId, options = {}) {
             const tenantRef = holdTenantRef(options);
+            if (!isValidResourceId(holdId))
+                return { ok: true, released: false };
+            if (options.holderRef !== undefined) {
+                if (!isValidIdentity(options.holderRef))
+                    return { ok: true, released: false };
+                const released = await sql `
+          WITH taken AS (
+            SELECT id, hold_group_id FROM slotlock.reservations
+             WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${options.holderRef}
+               AND (${tenantRef}::text IS NULL
+                    OR resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef}))
+          )
+          DELETE FROM slotlock.reservations hold
+           USING taken
+           WHERE hold.status = 'held' AND hold.holder_ref = ${options.holderRef}
+             AND (${tenantRef}::text IS NULL
+                  OR hold.resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef}))
+             AND (hold.id = taken.id
+                  OR (taken.hold_group_id IS NOT NULL AND hold.hold_group_id = taken.hold_group_id))
+          RETURNING hold.id`;
+                return { ok: true, released: released.some(({ id }) => id === holdId) };
+            }
             const rows = await sql `
         DELETE FROM slotlock.reservations
          WHERE id = ${holdId} AND status = 'held'
@@ -1396,9 +3168,30 @@ export function createSlotlockStore(sql, options = {}) {
          RETURNING id`;
             return { ok: true, released: rows.length > 0 };
         },
-        async listBusy(resourceId, window) {
+        async listBusy(resourceId, window, options = {}) {
             if (!isFiniteWindow(window))
                 throw invalidWindowError();
+            if (!isValidResourceId(resourceId)) {
+                throw invalidIdentityError('Slotlock resource id must be a UUID');
+            }
+            if (options.limit !== undefined && !(Number.isSafeInteger(options.limit) && options.limit > 0)) {
+                throw Object.assign(new Error('Slotlock busy read limit must be a positive whole number'), {
+                    code: 'invalid_limit',
+                });
+            }
+            if (options.tenantRef !== undefined) {
+                if (!isValidIdentity(options.tenantRef)) {
+                    throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+                }
+                const [owned] = await sql `
+          SELECT id FROM slotlock.resources
+           WHERE id = ${resourceId} AND tenant_ref = ${options.tenantRef}`;
+                if (!owned) {
+                    throw Object.assign(new Error('Slotlock resource not found in this tenant'), {
+                        code: 'resource_not_found',
+                    });
+                }
+            }
             // Expired holds are dead occupation: excluded here so findNextAvailable can offer their
             // space (the acquiring transaction reaps the row itself when it takes the window).
             const rows = await sql `
@@ -1407,12 +3200,16 @@ export function createSlotlockStore(sql, options = {}) {
          WHERE resource_id = ${resourceId}
            AND starts_at < ${window.end}
            AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
-           AND (status <> 'held' OR expires_at > now())
-         ORDER BY starts_at`;
+           AND (status <> 'held' OR expires_at > statement_timestamp())
+         ORDER BY starts_at
+         LIMIT ${options.limit ?? null}`;
             return rows.map((r) => ({ start: r.starts_at, end: r.occupied_ends_at }));
         },
         async putCalendarEvent(params) {
             const ownerRef = params.ownerRef ?? SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
+            if (params.expectedResourceId !== undefined && !isValidResourceId(params.expectedResourceId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
             if (!isValidIdentity(params.tenantRef) ||
                 !isValidEventOwnerRef(ownerRef) ||
                 !isValidIdentity(params.externalRef) ||
@@ -1432,7 +3229,7 @@ export function createSlotlockStore(sql, options = {}) {
                 if (event.recurrence) {
                     if (!params.materializationWindow)
                         return { ok: false, code: 'invalid_event' };
-                    materializationWindow = calendarWindow(params.materializationWindow);
+                    materializationWindow = seriesWindow(params.materializationWindow);
                 }
                 else {
                     materializationWindow = oneOffEventWindow(event, params.materializationWindow);
@@ -1455,13 +3252,16 @@ export function createSlotlockStore(sql, options = {}) {
                     return { ok: false, code: 'invalid_event' };
                 throw error;
             }
-            const payloadHash = putCommandHash({
+            const payloadHash = putCommandHash({ command: params, ownerRef, event });
+            const legacyPayloadHash = legacyPutCommandHash({
                 command: params,
                 ownerRef,
                 event,
                 window: materializationWindow,
             });
+            const recurrenceEndsBy = recurrenceEndsByColumn(event);
             let attempted = expanded?.occurrences ?? [];
+            let storedEventId;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -1477,7 +3277,9 @@ export function createSlotlockStore(sql, options = {}) {
                FOR UPDATE`;
                         const priorCommand = commands[0];
                         if (priorCommand) {
-                            if (priorCommand.operation !== 'put' || priorCommand.payload_hash !== payloadHash) {
+                            if (priorCommand.operation !== 'put' ||
+                                (priorCommand.payload_hash !== payloadHash &&
+                                    priorCommand.payload_hash !== legacyPayloadHash)) {
                                 return { ok: false, code: 'idempotency_conflict' };
                             }
                             return commandResult(priorCommand, true);
@@ -1509,9 +3311,11 @@ export function createSlotlockStore(sql, options = {}) {
                                 currentRevision: Number(tombstones[0].revision),
                             };
                         }
-                        if (!(await resourceBelongsToTenant(tx, params.resourceId, params.tenantRef))) {
+                        const resourceState = await tenantResourceState(tx, params.resourceId, params.tenantRef);
+                        if (resourceState === 'missing')
                             return { ok: false, code: 'resource_tenant_mismatch' };
-                        }
+                        if (resourceState === 'archived')
+                            return { ok: false, code: 'resource_archived' };
                         const existing = await tx `
               SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
                      summary, description, location, status, transparency, organizer, attendees,
@@ -1523,6 +3327,11 @@ export function createSlotlockStore(sql, options = {}) {
                  AND external_ref = ${params.externalRef}
                FOR UPDATE`;
                         const found = existing[0];
+                        storedEventId = found?.id;
+                        if (params.expectedResourceId !== undefined &&
+                            found?.resource_id !== params.expectedResourceId) {
+                            return { ok: false, code: 'resource_tenant_mismatch' };
+                        }
                         const currentRevision = found ? Number(found.revision) : 0;
                         if (params.expectedRevision !== currentRevision) {
                             return { ok: false, code: 'revision_conflict', currentRevision };
@@ -1553,8 +3362,66 @@ export function createSlotlockStore(sql, options = {}) {
                                 };
                             }
                         }
+                        if (!found) {
+                            const limit = await tenantLimitReached(tx, params.tenantRef, 'events');
+                            if (limit !== null)
+                                return { ok: false, code: 'event_limit_reached', limit };
+                        }
                         const eventId = found?.id ?? randomUUID();
                         const revision = currentRevision + 1;
+                        if (params.fromHold) {
+                            const { holdId, holderRef } = params.fromHold;
+                            if (!isValidResourceId(holdId) || !isValidIdentity(holderRef)) {
+                                return { ok: false, code: 'hold_not_found' };
+                            }
+                            const [hold] = await tx `
+                SELECT resource_id, starts_at, ends_at, hold_group_id FROM slotlock.reservations
+                 WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${holderRef}
+                   AND expires_at > statement_timestamp()
+                 FOR UPDATE`;
+                            if (!hold)
+                                return { ok: false, code: 'hold_not_found' };
+                            const [only] = occurrences;
+                            if (hold.resource_id !== params.resourceId ||
+                                occurrences.length !== 1 ||
+                                !only ||
+                                only.start < hold.starts_at ||
+                                only.end > hold.ends_at) {
+                                return { ok: false, code: 'hold_mismatch' };
+                            }
+                            // The hold and its alternatives give way to the event in this transaction.
+                            await tx `
+                DELETE FROM slotlock.reservations
+                 WHERE status = 'held' AND holder_ref = ${holderRef}
+                   AND (id = ${holdId}
+                        OR (${hold.hold_group_id}::uuid IS NOT NULL
+                            AND hold_group_id = ${hold.hold_group_id}::uuid))`;
+                        }
+                        let turnaroundMs = 0;
+                        if (params.enforceBookingRules === true && (event.transparency ?? 'opaque') === 'opaque') {
+                            const judge = await bookingJudge(tx, params.resourceId, defaultHours);
+                            for (const [index, occurrence] of occurrences.entries()) {
+                                // A held time's notice and advance were judged when it was held.
+                                const rule = judge.broken(occurrence, { first: index === 0 && !params.fromHold });
+                                if (rule)
+                                    return { ok: false, code: 'booking_rule_violated', rule };
+                            }
+                            turnaroundMs = judge.turnaroundMs;
+                        }
+                        const span = occurrenceSpan(occurrences);
+                        const reach = span && { start: span.start, end: new Date(span.end.getTime() + turnaroundMs) };
+                        if ((event.transparency ?? 'opaque') === 'opaque' &&
+                            reach &&
+                            !(found && (await holdsEveryOccurrence(tx, found.id, params.resourceId, occurrences)))) {
+                            if (!(await recurrenceCoversWrite(tx, {
+                                tenantRef: params.tenantRef,
+                                resourceId: params.resourceId,
+                                ...reach,
+                                ...(found ? { exceptEventId: found.id } : {}),
+                            }))) {
+                                return { ok: false, code: 'recurrence_not_materialized' };
+                            }
+                        }
                         if (found) {
                             await tx `
                 UPDATE slotlock.calendar_events
@@ -1575,8 +3442,11 @@ export function createSlotlockStore(sql, options = {}) {
                        materialized_starts_at = ${materializationWindow.start},
                        materialized_ends_at = ${materializationWindow.end},
                        recurrence_cursor = ${seriesCursorJson(tx, series.cursor)},
+                       recurrence_ends_by = ${recurrenceEndsBy}::text::timestamptz,
+                       roll_retry_at = NULL,
                        revision = ${revision},
                        source = ${params.source ?? null},
+                       buffer_after_ms = ${turnaroundMs},
                        updated_at = now()
                  WHERE id = ${eventId}
                    AND tenant_ref = ${params.tenantRef}
@@ -1588,7 +3458,8 @@ export function createSlotlockStore(sql, options = {}) {
                   id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
                   summary, description, location, status, transparency, organizer, attendees,
                   reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
-                  materialized_ends_at, recurrence_cursor, revision, source
+                  materialized_ends_at, recurrence_cursor, recurrence_ends_by, revision, source,
+                  buffer_after_ms
                 ) VALUES (
                   ${eventId}, ${params.tenantRef}, ${ownerRef}, ${params.externalRef},
                   ${params.resourceId},
@@ -1601,8 +3472,8 @@ export function createSlotlockStore(sql, options = {}) {
                   ${event.recurrence?.rrule ?? null},
                   ${tx.json(eventExceptionsForJson(event.recurrence?.exceptions))},
                   ${materializationWindow.start}, ${materializationWindow.end},
-                  ${seriesCursorJson(tx, series.cursor)}, ${revision},
-                  ${params.source ?? null}
+                  ${seriesCursorJson(tx, series.cursor)}, ${recurrenceEndsBy}::text::timestamptz,
+                  ${revision}, ${params.source ?? null}, ${turnaroundMs}
                 )`;
                         }
                         // The normalized children are the queryable/canonical representation. The JSON
@@ -1615,6 +3486,7 @@ export function createSlotlockStore(sql, options = {}) {
                             event,
                             occurrences,
                             revision,
+                            bufferAfterMs: turnaroundMs,
                         });
                         await tx `
               INSERT INTO slotlock.calendar_event_commands (
@@ -1645,7 +3517,11 @@ export function createSlotlockStore(sql, options = {}) {
                         code !== SERIALIZATION_FAILURE) {
                         throw error;
                     }
-                    return findCalendarOverlap(sql, params.resourceId, attempted);
+                    const reach = occurrenceSpan(attempted);
+                    if (reach) {
+                        await rollSeriesBehind(sql, params.resourceId, reach.start, reach.end, storedEventId);
+                    }
+                    return findCalendarOverlap(sql, params.resourceId, attempted, storedEventId);
                 }
             }
         },
@@ -1673,7 +3549,31 @@ export function createSlotlockStore(sql, options = {}) {
             const children = await loadCalendarEventChildren(sql, [row.id]);
             return toCalendarEvent(row, children.get(row.id));
         },
+        async getCalendarEventById(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.eventId)) {
+                throw invalidIdentityError('Slotlock event id must be a UUID');
+            }
+            const rows = await sql `
+        SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
+               summary, description, location, status, transparency, organizer, attendees,
+               reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
+               materialized_ends_at, revision, source, created_at, updated_at
+          FROM slotlock.calendar_events
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}`;
+            const row = rows[0];
+            if (!row)
+                return null;
+            const children = await loadCalendarEventChildren(sql, [row.id]);
+            return toCalendarEvent(row, children.get(row.id));
+        },
         async listCalendarEvents(params) {
+            if (params.allOwners === true && params.ownerRef !== undefined) {
+                throw invalidIdentityError('Slotlock lists one owner or every owner, not both');
+            }
+            const allOwners = params.allOwners === true;
             const ownerRef = params.ownerRef ?? SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
             if (!isValidIdentity(params.tenantRef) || !isValidEventOwnerRef(ownerRef)) {
                 throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
@@ -1711,7 +3611,7 @@ export function createSlotlockStore(sql, options = {}) {
                event.source, event.created_at, event.updated_at
           FROM slotlock.calendar_events event
          WHERE event.tenant_ref = ${params.tenantRef}
-           AND event.owner_ref = ${ownerRef}
+           AND (${allOwners}::boolean OR event.owner_ref = ${ownerRef})
            AND event.resource_id = ${params.resourceId}
            AND EXISTS (
              SELECT 1 FROM slotlock.calendar_event_occurrences occurrence
@@ -1738,7 +3638,7 @@ export function createSlotlockStore(sql, options = {}) {
                     code: 'invalid_identity',
                 });
             }
-            const window = calendarWindow(params.window);
+            const window = seriesWindow(params.window);
             const limit = params.limit ?? 100;
             if (!Number.isSafeInteger(limit) || limit <= 0 || limit > MAX_CALENDAR_LIST_LIMIT) {
                 throw Object.assign(new Error('Slotlock horizon batch limit must be 1-1000'), {
@@ -1747,9 +3647,12 @@ export function createSlotlockStore(sql, options = {}) {
             }
             const after = rollCursor(params.after);
             // Due: the masters rolledWindow rolls, which do not cover the window and end within the cap
-            // of its start.
+            // of its start. Those it has never put back come first, then those it has, longest waiting
+            // first: however many it cannot extend, they never stand in front of one it has not tried,
+            // so every pass that is not capped by such new ones reaches the healthy series, and the ones
+            // put back take turns.
             const candidates = await sql `
-        SELECT id, materialized_ends_at
+        SELECT id, materialized_ends_at, roll_retry_at
           FROM slotlock.calendar_events
          WHERE tenant_ref = ${params.tenantRef}
            AND recurrence_rule IS NOT NULL
@@ -1757,71 +3660,40 @@ export function createSlotlockStore(sql, options = {}) {
              materialized_starts_at > ${window.start}
              OR materialized_ends_at < ${window.end}
            )
-           AND materialized_ends_at <= ${new Date(window.start.getTime() + MAX_CALENDAR_WINDOW_MS)}
+           AND materialized_ends_at <= ${new Date(window.start.getTime() + MAX_MATERIALIZATION_WINDOW_MS)}
+           -- One it could not extend waits its turn behind the ones it can.
+           AND (roll_retry_at IS NULL OR roll_retry_at <= now())
            AND (
              ${after?.materializedEndsAt ?? null}::timestamptz IS NULL
-             OR (materialized_ends_at, id) >
-                (${after?.materializedEndsAt ?? null}::timestamptz, ${after?.eventId ?? null}::uuid)
+             OR (COALESCE(roll_retry_at, '-infinity'), materialized_ends_at, id) >
+                (COALESCE(${after?.rollRetryAt ?? null}::timestamptz, '-infinity'),
+                 ${after?.materializedEndsAt ?? null}::timestamptz, ${after?.eventId ?? null}::uuid)
            )
-         ORDER BY materialized_ends_at, id
+         ORDER BY COALESCE(roll_retry_at, '-infinity'), materialized_ends_at, id
          LIMIT ${limit + 1}`;
             const due = candidates.slice(0, limit);
             let extended = 0;
             let conflicts = 0;
             let refused = 0;
             const refusedEventIds = [];
+            const conflictEventIds = [];
             for (const candidate of due) {
                 for (let attempt = 1; attempt <= 2; attempt++) {
                     try {
-                        const changed = await inTransaction(sql, async (tx) => {
-                            const [row] = await tx `
-                SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
-                       summary, description, location, status, transparency, organizer, attendees,
-                       reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
-                       materialized_ends_at, recurrence_cursor, revision, source, created_at,
-                       updated_at
-                  FROM slotlock.calendar_events
-                 WHERE id = ${candidate.id} AND tenant_ref = ${params.tenantRef}
-                 FOR UPDATE`;
-                            if (!row || row.recurrence_rule === null)
-                                return false;
-                            const rolled = rolledWindow({ start: row.materialized_starts_at, end: row.materialized_ends_at }, window);
-                            if (!rolled)
-                                return false;
-                            const childMap = await loadCalendarEventChildren(tx, [row.id]);
-                            const event = toCalendarEvent(row, childMap.get(row.id));
-                            // From where its last expansion stopped, when that can be trusted; else its start.
-                            const { occurrences, cursor } = expandCalendarEventSeries(event, rolled, {
-                                cursor: row.recurrence_cursor ?? null,
-                                stored: true,
-                            });
-                            await replaceCalendarEventOccurrences(tx, {
-                                tenantRef: params.tenantRef,
-                                eventId: row.id,
-                                resourceId: row.resource_id,
-                                event,
-                                occurrences,
-                                revision: Number(row.revision),
-                            });
-                            await tx `
-                UPDATE slotlock.calendar_events
-                   SET materialized_starts_at = ${rolled.start},
-                       materialized_ends_at = ${rolled.end},
-                       recurrence_cursor = ${seriesCursorJson(tx, cursor)}
-                 WHERE id = ${row.id} AND tenant_ref = ${params.tenantRef}`;
-                            return true;
-                        });
+                        const changed = await inTransaction(sql, (tx) => rollStoredSeries(tx, params.tenantRef, candidate.id, window));
                         if (changed)
                             extended += 1;
                         break;
                     }
                     catch (error) {
                         if (error instanceof CalendarExpansionLimitError) {
-                            // It takes more than Slotlock expands: a rule that never occurs again, or one with no
-                            // cursor to resume from whose search from its start has outgrown the budget. Nothing
-                            // was written; its old coverage stays, and the masters after it still roll.
+                            // It takes more than Slotlock expands: a rule that never occurs again, one with no
+                            // cursor to resume from whose search from its start has outgrown the budget, or one an
+                            // earlier Slotlock stored that this one refuses. Nothing was written; its old coverage
+                            // stays, and the masters after it still roll.
                             refused += 1;
                             refusedEventIds.push(candidate.id);
+                            await deferRoll(sql, params.tenantRef, candidate.id);
                             break;
                         }
                         const code = pgCode(error);
@@ -1834,9 +3706,17 @@ export function createSlotlockStore(sql, options = {}) {
                             // The savepoint rolled every delete/insert back, so the previous materialized
                             // coverage remains truthful and callers will fail closed beyond it.
                             conflicts += 1;
+                            conflictEventIds.push(candidate.id);
+                            await deferRoll(sql, params.tenantRef, candidate.id);
                             break;
                         }
-                        throw error;
+                        // Anything else this one series meets (a row no Slotlock would write, a constraint it
+                        // trips) was rolled back with its savepoint too: it is put back like one over the
+                        // budget, so no single row stops the tenant's roll.
+                        refused += 1;
+                        refusedEventIds.push(candidate.id);
+                        await deferRoll(sql, params.tenantRef, candidate.id);
+                        break;
                     }
                 }
             }
@@ -1846,14 +3726,24 @@ export function createSlotlockStore(sql, options = {}) {
                 examined: due.length,
                 extended,
                 conflicts,
+                conflictEventIds,
                 refused,
                 refusedEventIds,
                 hasMore,
-                next: hasMore && last ? { materializedEndsAt: last.materialized_ends_at, eventId: last.id } : null,
+                next: hasMore && last
+                    ? {
+                        rollRetryAt: last.roll_retry_at,
+                        materializedEndsAt: last.materialized_ends_at,
+                        eventId: last.id,
+                    }
+                    : null,
             };
         },
         async cancelCalendarEvent(params) {
             const ownerRef = params.ownerRef ?? SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
+            if (params.expectedResourceId !== undefined && !isValidResourceId(params.expectedResourceId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
             if (!isValidIdentity(params.tenantRef) ||
                 !isValidEventOwnerRef(ownerRef) ||
                 !isValidIdentity(params.externalRef) ||
@@ -1918,12 +3808,16 @@ export function createSlotlockStore(sql, options = {}) {
                     };
                 }
                 const events = await tx `
-          SELECT id, revision FROM slotlock.calendar_events
+          SELECT id, resource_id, revision FROM slotlock.calendar_events
            WHERE tenant_ref = ${params.tenantRef}
              AND owner_ref = ${ownerRef}
              AND external_ref = ${params.externalRef}
            FOR UPDATE`;
                 const found = events[0];
+                if (params.expectedResourceId !== undefined &&
+                    found?.resource_id !== params.expectedResourceId) {
+                    return { ok: false, code: 'event_not_found' };
+                }
                 const currentRevision = found ? Number(found.revision) : 0;
                 if (!found && ownerRef !== SLOTLOCK_INTERNAL_EVENT_OWNER_REF) {
                     return { ok: false, code: 'event_not_found' };
@@ -1931,41 +3825,266 @@ export function createSlotlockStore(sql, options = {}) {
                 if (params.expectedRevision !== currentRevision) {
                     return { ok: false, code: 'revision_conflict', currentRevision };
                 }
-                const eventId = found?.id ?? randomUUID();
-                const revision = currentRevision + 1;
-                if (found) {
+                return finishCalendarCancel(tx, {
+                    tenantRef: params.tenantRef,
+                    ownerRef,
+                    externalRef: params.externalRef,
+                    eventId: found?.id ?? null,
+                    revision: currentRevision + 1,
+                    commandOwnerRef: ownerRef,
+                    idempotencyKey: params.idempotencyKey,
+                    payloadHash,
+                });
+            });
+        },
+        async cancelCalendarEventById(params) {
+            if (!isValidIdentity(params.tenantRef) ||
+                !isValidResourceId(params.eventId) ||
+                !isValidIdentity(params.idempotencyKey) ||
+                (params.expectedResourceId !== undefined && !isValidResourceId(params.expectedResourceId))) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            if (!Number.isSafeInteger(params.expectedRevision) || params.expectedRevision < 0) {
+                return { ok: false, code: 'invalid_revision' };
+            }
+            const commandOwnerRef = SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
+            // Its own operation in the hash: an owner-scoped cancel under the same key never replays it.
+            const payloadHash = calendarCommandHash({
+                operation: 'cancel-by-id',
+                eventId: params.eventId,
+                idempotencyKey: params.idempotencyKey,
+                expectedRevision: params.expectedRevision,
+                expectedResourceId: params.expectedResourceId ?? null,
+            });
+            return inTransaction(sql, async (tx) => {
+                await lockCalendarIdempotency(tx, params.tenantRef, commandOwnerRef, params.idempotencyKey);
+                const commands = await tx `
+          SELECT operation, payload_hash, event_id, external_ref,
+                 result_revision, occurrence_count
+            FROM slotlock.calendar_event_commands
+           WHERE tenant_ref = ${params.tenantRef}
+             AND owner_ref = ${commandOwnerRef}
+             AND idempotency_key = ${params.idempotencyKey}
+           FOR UPDATE`;
+                const priorCommand = commands[0];
+                if (priorCommand) {
+                    if (priorCommand.operation !== 'cancel' || priorCommand.payload_hash !== payloadHash) {
+                        return { ok: false, code: 'idempotency_conflict' };
+                    }
+                    return {
+                        ok: true,
+                        eventId: priorCommand.event_id,
+                        externalRef: priorCommand.external_ref,
+                        revision: Number(priorCommand.result_revision),
+                        idempotent: true,
+                    };
+                }
+                // An event's owner and reference never change, so they are read before its identity lock,
+                // which is taken before its row lock as every event write takes them.
+                const [identity] = await tx `
+          SELECT owner_ref, external_ref FROM slotlock.calendar_events
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}`;
+                if (!identity)
+                    return { ok: false, code: 'event_not_found' };
+                await lockCalendarEventIdentity(tx, params.tenantRef, identity.owner_ref, identity.external_ref);
+                const [found] = await tx `
+          SELECT id, resource_id, revision FROM slotlock.calendar_events
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}
+           FOR UPDATE`;
+                // Cancelled while this waited on its lock.
+                if (!found)
+                    return { ok: false, code: 'event_not_found' };
+                if (params.expectedResourceId !== undefined &&
+                    found.resource_id !== params.expectedResourceId) {
+                    return { ok: false, code: 'event_not_found' };
+                }
+                const currentRevision = Number(found.revision);
+                if (params.expectedRevision !== currentRevision) {
+                    return { ok: false, code: 'revision_conflict', currentRevision };
+                }
+                return finishCalendarCancel(tx, {
+                    tenantRef: params.tenantRef,
+                    ownerRef: identity.owner_ref,
+                    externalRef: identity.external_ref,
+                    eventId: found.id,
+                    revision: currentRevision + 1,
+                    commandOwnerRef,
+                    idempotencyKey: params.idempotencyKey,
+                    payloadHash,
+                });
+            });
+        },
+        async followZoneRules(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 100;
+            if (!(Number.isSafeInteger(limit) && limit >= 1 && limit <= 1_000)) {
+                throw new RangeError('Slotlock zone-rule batch must be 1-1,000 events');
+            }
+            const shifted = await sql `
+        SELECT event.id, event.resource_id, event.transparency, event.revision, event.starts_at, event.ends_at,
+               slotlock.zoned_instant(event.wall_starts_at, event.timezone) AS moved_start,
+               slotlock.zoned_instant(event.wall_ends_at, event.timezone) AS moved_end,
+               COALESCE((SELECT max(booking.buffer_after_ms) FROM slotlock.reservations booking
+                          WHERE booking.calendar_event_id = event.id), 0) AS buffer
+          FROM slotlock.calendar_events event
+         WHERE event.tenant_ref = ${params.tenantRef}
+           AND event.recurrence_rule IS NULL
+           AND event.starts_at > now()
+           AND event.zone_shift_reported_at IS NULL
+           AND slotlock.zoned_instant(event.wall_starts_at, event.timezone) IS NOT NULL
+           AND slotlock.zoned_instant(event.wall_ends_at, event.timezone) IS NOT NULL
+           AND (slotlock.zoned_instant(event.wall_starts_at, event.timezone) <> event.starts_at
+                OR slotlock.zoned_instant(event.wall_ends_at, event.timezone) <> event.ends_at)
+         ORDER BY event.starts_at, event.id
+         LIMIT ${limit}
+         FOR UPDATE OF event SKIP LOCKED`;
+            let moved = 0;
+            let conflicts = 0;
+            const report = async (event, type) => {
+                await sql `UPDATE slotlock.calendar_events SET zone_shift_reported_at = now() WHERE id = ${event.id}`;
+                await sql `
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          VALUES (${params.tenantRef}, ${event.resource_id}, ${type}, ${event.id},
+                  ${sql.json({
+                    id: event.id,
+                    resource_id: event.resource_id,
+                    start: event.starts_at.toISOString(),
+                    end: event.ends_at.toISOString(),
+                    zone_start: event.moved_start.toISOString(),
+                    zone_end: event.moved_end.toISOString(),
+                })}, 'slotlock:tzdata')`;
+            };
+            for (const event of shifted) {
+                if (!params.move) {
+                    await report(event, 'event.timezone_shifted');
+                    continue;
+                }
+                try {
+                    await inTransaction(sql, async (tx) => {
+                        const revision = Number(event.revision) + 1;
+                        await tx `SELECT set_config('slotlock.actor', 'slotlock:tzdata', true)`;
+                        await tx `
+              UPDATE slotlock.calendar_events
+                 SET starts_at = ${event.moved_start}, ends_at = ${event.moved_end},
+                     materialized_starts_at = ${event.moved_start}, materialized_ends_at = ${event.moved_end},
+                     revision = ${revision}, updated_at = now()
+               WHERE id = ${event.id}`;
+                        await replaceCalendarEventOccurrences(tx, {
+                            tenantRef: params.tenantRef,
+                            eventId: event.id,
+                            resourceId: event.resource_id,
+                            event: { transparency: event.transparency },
+                            occurrences: [
+                                { recurrenceId: event.moved_start.toISOString(), start: event.moved_start, end: event.moved_end },
+                            ],
+                            revision,
+                            bufferAfterMs: Number(event.buffer),
+                        });
+                    });
+                    moved++;
+                }
+                catch (error) {
+                    if (pgCode(error) !== EXCLUSION_VIOLATION)
+                        throw error;
+                    // It stays where it was; whoever owns it decides.
+                    await report(event, 'event.timezone_conflict');
+                    conflicts++;
+                }
+            }
+            return { shifted: shifted.length, moved, conflicts };
+        },
+        async pruneBookingRetention(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 100;
+            if (!Number.isSafeInteger(limit) || limit <= 0 || limit > MAX_CALENDAR_LIST_LIMIT) {
+                throw Object.assign(new Error('Slotlock retention batch limit must be 1-1000'), {
+                    code: 'invalid_limit',
+                });
+            }
+            // Never under the default: a shorter retention trims the feed, not how long a retried write
+            // is answered as the first was.
+            const keepDays = params.retentionDays ?? Math.max(retentionDays, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS);
+            if (!Number.isSafeInteger(keepDays) ||
+                keepDays < 1 ||
+                keepDays > MAX_EVENT_COMMAND_RETENTION_DAYS) {
+                throw Object.assign(new Error('Slotlock retention window must be 1-3650 days'), {
+                    code: 'invalid_retention_window',
+                });
+            }
+            return inTransaction(sql, async (tx) => {
+                // A 0.2 server still serving after the migration wrote its confirmed holds (and
+                // createReservation bookings) on the tenant's resources without the tenant or a reference,
+                // so no cancel or move reaches them; the migration gives those it finds the tenant and
+                // their own id, and this gives later ones the same. Each takes its reference's identity lock
+                // first, as every booking write does; a tombstone of its id retired nothing and goes.
+                const legacy = await tx `
+          SELECT booking.id
+            FROM slotlock.reservations booking
+            JOIN slotlock.resources resource ON resource.id = booking.resource_id
+           WHERE resource.tenant_ref = ${params.tenantRef}
+             AND booking.tenant_ref IS NULL AND booking.status = 'confirmed'
+             AND booking.calendar_event_id IS NULL
+             AND NOT EXISTS (
+               SELECT 1 FROM slotlock.reservations taken
+                WHERE taken.tenant_ref = ${params.tenantRef}
+                  AND taken.external_ref = booking.id::text
+                  AND taken.calendar_event_id IS NULL
+             )
+           ORDER BY booking.id
+           LIMIT ${limit}`;
+                for (const { id } of legacy) {
+                    await lockExternalIdentity(tx, params.tenantRef, id);
+                    const [taken] = await tx `
+            SELECT id FROM slotlock.reservations
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${id}
+               AND calendar_event_id IS NULL`;
+                    if (taken)
+                        continue;
                     await tx `
-            DELETE FROM slotlock.reservations
-             WHERE id IN (
-               SELECT reservation_id FROM slotlock.calendar_event_occurrences
-                WHERE event_id = ${eventId} AND reservation_id IS NOT NULL
-             )`;
+            DELETE FROM slotlock.reservation_tombstones
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${id}`;
                     await tx `
-            DELETE FROM slotlock.calendar_events
-             WHERE id = ${eventId}
-               AND tenant_ref = ${params.tenantRef}
-               AND owner_ref = ${ownerRef}`;
+            UPDATE slotlock.reservations
+               SET tenant_ref = ${params.tenantRef}, external_ref = id::text,
+                   occupied_ends_at = ends_at + buffer_after_ms * interval '1 millisecond'
+             WHERE id = ${id} AND tenant_ref IS NULL AND status = 'confirmed'`;
                 }
-                await tx `
-          INSERT INTO slotlock.calendar_event_tombstones (
-            tenant_ref, owner_ref, external_ref, event_id, revision
-          ) VALUES (
-            ${params.tenantRef}, ${ownerRef}, ${params.externalRef}, ${eventId}, ${revision}
-          )`;
-                await tx `
-          INSERT INTO slotlock.calendar_event_commands (
-            tenant_ref, owner_ref, idempotency_key, operation, payload_hash, event_id, external_ref,
-            result_revision, occurrence_count
-          ) VALUES (
-            ${params.tenantRef}, ${ownerRef}, ${params.idempotencyKey}, 'cancel', ${payloadHash},
-            ${eventId}, ${params.externalRef}, ${revision}, 0
-          )`;
+                const expiredHoldsDeleted = await deleteExpiredHolds(tx, params.tenantRef, limit);
+                const holdCommandsDeleted = await forgetExpiredHoldAnswers(tx, params.tenantRef, limit);
+                // Only references retired with no booking: a cancelled booking's tombstone is kept.
+                const [tombstones] = await tx `
+          WITH candidates AS MATERIALIZED (
+            SELECT tombstone.external_ref
+              FROM slotlock.reservation_tombstones tombstone
+             WHERE tombstone.tenant_ref = ${params.tenantRef}
+               AND tombstone.stray
+               AND tombstone.cancelled_at <
+                   clock_timestamp() - (${keepDays}::int * interval '1 day')
+             ORDER BY tombstone.cancelled_at, tombstone.external_ref
+             LIMIT ${limit}
+             FOR UPDATE OF tombstone SKIP LOCKED
+          ), deleted AS (
+            DELETE FROM slotlock.reservation_tombstones tombstone
+             USING candidates candidate
+             WHERE tombstone.tenant_ref = ${params.tenantRef}
+               AND tombstone.external_ref = candidate.external_ref
+               AND tombstone.stray
+            RETURNING 1
+          )
+          SELECT count(*)::int AS deleted FROM deleted`;
+                const tombstonesDeleted = Number(tombstones?.deleted ?? 0);
                 return {
-                    ok: true,
-                    eventId,
-                    externalRef: params.externalRef,
-                    revision,
-                    idempotent: false,
+                    expiredHoldsDeleted,
+                    holdCommandsDeleted,
+                    tombstonesDeleted,
+                    hasMore: legacy.length === limit ||
+                        expiredHoldsDeleted === limit ||
+                        holdCommandsDeleted === limit ||
+                        tombstonesDeleted === limit,
                 };
             });
         },
@@ -1981,10 +4100,12 @@ export function createSlotlockStore(sql, options = {}) {
                     code: 'invalid_limit',
                 });
             }
-            const retentionDays = params.retentionDays ?? SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS;
-            if (!Number.isSafeInteger(retentionDays) ||
-                retentionDays < 1 ||
-                retentionDays > MAX_EVENT_COMMAND_RETENTION_DAYS) {
+            // Never under the default: a shorter retention trims the feed, not how long a retried write
+            // is answered as the first was.
+            const keepDays = params.retentionDays ?? Math.max(retentionDays, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS);
+            if (!Number.isSafeInteger(keepDays) ||
+                keepDays < 1 ||
+                keepDays > MAX_EVENT_COMMAND_RETENTION_DAYS) {
                 throw Object.assign(new Error('Slotlock retention window must be 1-3650 days'), {
                     code: 'invalid_retention_window',
                 });
@@ -1998,7 +4119,7 @@ export function createSlotlockStore(sql, options = {}) {
               FROM slotlock.calendar_event_commands command
              WHERE command.tenant_ref = ${params.tenantRef}
                AND command.created_at <
-                   clock_timestamp() - (${retentionDays}::int * interval '1 day')
+                   clock_timestamp() - (${keepDays}::int * interval '1 day')
              ORDER BY command.created_at, command.owner_ref, command.idempotency_key
              LIMIT ${limit}
              FOR UPDATE OF command SKIP LOCKED
@@ -2021,7 +4142,7 @@ export function createSlotlockStore(sql, options = {}) {
              WHERE tombstone.tenant_ref = ${params.tenantRef}
                AND tombstone.owner_ref LIKE 'agent:%'
                AND tombstone.cancelled_at <
-                   clock_timestamp() - (${retentionDays}::int * interval '1 day')
+                   clock_timestamp() - (${keepDays}::int * interval '1 day')
                AND NOT EXISTS (
                  SELECT 1 FROM slotlock.calendar_event_commands command
                   WHERE command.tenant_ref = tombstone.tenant_ref
@@ -2040,7 +4161,7 @@ export function createSlotlockStore(sql, options = {}) {
                AND tombstone.external_ref = candidate.external_ref
                AND tombstone.owner_ref LIKE 'agent:%'
                AND tombstone.cancelled_at <
-                   clock_timestamp() - (${retentionDays}::int * interval '1 day')
+                   clock_timestamp() - (${keepDays}::int * interval '1 day')
                AND NOT EXISTS (
                  SELECT 1 FROM slotlock.calendar_event_commands command
                   WHERE command.tenant_ref = tombstone.tenant_ref
@@ -2084,7 +4205,8 @@ export function createSlotlockStore(sql, options = {}) {
             }
             return inTransaction(sql, async (tx) => {
                 await lockExternalIdentity(tx, params.tenantRef, `calendar-coverage:${params.resourceId}:${params.source}`);
-                if (!(await resourceBelongsToTenant(tx, params.resourceId, params.tenantRef))) {
+                // Coverage of an archived resource may still be recorded: it books nothing.
+                if ((await tenantResourceState(tx, params.resourceId, params.tenantRef)) === 'missing') {
                     return { ok: false, code: 'resource_tenant_mismatch' };
                 }
                 const rows = await tx `
@@ -2108,10 +4230,11 @@ export function createSlotlockStore(sql, options = {}) {
                     if (params.revision !== currentRevision + 1) {
                         return { ok: false, code: 'revision_conflict' };
                     }
+                    // A fresh read ends a staleness: the next one is reported again.
                     await tx `
             UPDATE slotlock.calendar_coverage
                SET starts_at = ${window.start}, ends_at = ${window.end},
-                   revision = ${params.revision}, observed_at = now()
+                   revision = ${params.revision}, observed_at = now(), stale_reported_at = NULL
              WHERE tenant_ref = ${params.tenantRef}
                AND resource_id = ${params.resourceId}
                AND source = ${params.source}`;
@@ -2119,6 +4242,9 @@ export function createSlotlockStore(sql, options = {}) {
                 else {
                     if (params.revision !== 1)
                         return { ok: false, code: 'revision_conflict' };
+                    const limit = await tenantLimitReached(tx, params.tenantRef, 'coverage');
+                    if (limit !== null)
+                        return { ok: false, code: 'coverage_limit_reached', limit };
                     await tx `
             INSERT INTO slotlock.calendar_coverage (
               tenant_ref, resource_id, source, starts_at, ends_at, revision
@@ -2130,6 +4256,382 @@ export function createSlotlockStore(sql, options = {}) {
                 return { ok: true, revision: params.revision, idempotent: false };
             });
         },
+        async recordCoverageFailure(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.source) || !isValidResourceId(params.resourceId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            const rows = await sql `
+        UPDATE slotlock.calendar_coverage
+           SET last_error = left(${String(params.error).replace(/[\u0000-\u001f\u007f]/g, ' ')}, 500),
+               last_error_at = now()
+         WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+           AND source = ${params.source}
+         RETURNING source`;
+            return rows.length > 0 ? { ok: true } : { ok: false, code: 'coverage_not_found' };
+        },
+        async deleteCoverage(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.source) || !isValidResourceId(params.resourceId)) {
+                return false;
+            }
+            const rows = await sql `
+        DELETE FROM slotlock.calendar_coverage
+         WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+           AND source = ${params.source}
+         RETURNING source`;
+            return rows.length > 0;
+        },
+        async listCoverage(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.resourceId)) {
+                throw invalidIdentityError('Slotlock coverage identity is invalid');
+            }
+            const maxAgeMs = params.maxAgeMs ?? 24 * 60 * 60 * 1000;
+            const rows = await sql `
+        SELECT source, starts_at, ends_at, revision, observed_at, last_error, last_error_at,
+               observed_at < now() - make_interval(secs => ${maxAgeMs / 1_000}) AS stale
+          FROM slotlock.calendar_coverage
+         WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+         ORDER BY source`;
+            return rows.map((row) => ({
+                source: row.source,
+                start: row.starts_at,
+                end: row.ends_at,
+                revision: Number(row.revision),
+                observedAt: row.observed_at,
+                lastError: row.last_error,
+                lastErrorAt: row.last_error_at,
+                stale: row.stale,
+            }));
+        },
+        async reportStaleCoverage(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const maxAgeMs = params.maxAgeMs ?? 24 * 60 * 60 * 1000;
+            const rows = await sql `
+        WITH stale AS (
+          UPDATE slotlock.calendar_coverage coverage SET stale_reported_at = now()
+           WHERE (coverage.tenant_ref, coverage.resource_id, coverage.source) IN (
+             SELECT tenant_ref, resource_id, source FROM slotlock.calendar_coverage
+              WHERE tenant_ref = ${params.tenantRef} AND stale_reported_at IS NULL
+                AND observed_at < now() - make_interval(secs => ${maxAgeMs / 1_000})
+              ORDER BY observed_at LIMIT ${params.limit ?? 100}
+              FOR UPDATE SKIP LOCKED)
+          RETURNING coverage.resource_id, coverage.source, coverage.observed_at, coverage.last_error
+        ), reported AS (
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          SELECT ${params.tenantRef}, stale.resource_id, 'coverage.stale', stale.source,
+                 jsonb_strip_nulls(jsonb_build_object(
+                   'resource_id', stale.resource_id, 'source', stale.source,
+                   'observed_at', stale.observed_at, 'last_error', stale.last_error)),
+                 'slotlock:maintenance'
+            FROM stale
+          RETURNING 1
+        )
+        SELECT count(*)::int AS count FROM reported`;
+            return rows[0]?.count ?? 0;
+        },
+        async checkInReservation(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.externalRef)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            return inTransaction(sql, async (tx) => {
+                const [row] = await tx `
+          WITH booking AS (
+            SELECT id, checked_in_at, ends_at <= statement_timestamp() AS ended,
+                   starts_at - make_interval(mins => ${SLOTLOCK_CHECK_IN_OPENS_MINUTES}) > statement_timestamp() AS early
+              FROM slotlock.reservations
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
+               AND calendar_event_id IS NULL AND status = 'confirmed'
+             FOR UPDATE
+          )
+          UPDATE slotlock.reservations reservation
+             SET checked_in_at = COALESCE(reservation.checked_in_at, statement_timestamp())
+            FROM booking
+           WHERE reservation.id = booking.id AND NOT booking.ended AND NOT booking.early
+          RETURNING reservation.id, reservation.resource_id, reservation.checked_in_at,
+                    false AS ended, booking.checked_in_at IS NULL AS first`;
+                if (!row) {
+                    const [booking] = await tx `
+            SELECT ends_at <= statement_timestamp() AS ended FROM slotlock.reservations
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
+               AND calendar_event_id IS NULL AND status = 'confirmed'`;
+                    if (!booking)
+                        return { ok: false, code: 'reservation_not_found' };
+                    return { ok: false, code: booking.ended ? 'reservation_ended' : 'check_in_not_open' };
+                }
+                if (row.first) {
+                    await tx `
+            INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+            VALUES (${params.tenantRef}, ${row.resource_id}, 'reservation.checked_in', ${params.externalRef},
+                    jsonb_build_object('id', ${row.id}::uuid, 'reference', ${params.externalRef}::text,
+                                       'resource_id', ${row.resource_id}::uuid,
+                                       'checked_in_at', ${row.checked_in_at}::timestamptz),
+                    NULLIF(current_setting('slotlock.actor', true), ''))`;
+                }
+                return { ok: true, reference: params.externalRef, checkedInAt: row.checked_in_at };
+            });
+        },
+        async releaseNoShows(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 100;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1_000) {
+                throw invalidIdentityError('Slotlock no-show limit must be 1-1,000');
+            }
+            // A suspended tenant's bookings stay as they are.
+            if (refusal)
+                return 0;
+            const tenantRef = params.tenantRef;
+            // The same test twice: to find them, then under each reference's lock, as a cancel takes it.
+            const due = (tx, externalRef) => tx `
+        SELECT reservation.id, reservation.external_ref, reservation.revision, reservation.resource_id,
+               (resource.booking_rules->>'checkInMinutes')::int AS minutes
+          FROM slotlock.reservations reservation
+          JOIN slotlock.resources resource ON resource.id = reservation.resource_id
+         WHERE reservation.tenant_ref = ${tenantRef} AND resource.tenant_ref = ${tenantRef}
+           AND (${externalRef}::text IS NULL OR reservation.external_ref = ${externalRef})
+           AND reservation.status = 'confirmed' AND reservation.calendar_event_id IS NULL
+           AND reservation.checked_in_at IS NULL
+           AND resource.check_in_since IS NOT NULL AND resource.booking_rules ? 'checkInMinutes'
+           AND reservation.created_at >= resource.check_in_since
+           -- A booking made after its start (a walk-in) has its window from when it was made.
+           AND GREATEST(reservation.starts_at, reservation.created_at)
+               + make_interval(mins => (resource.booking_rules->>'checkInMinutes')::int)
+               <= statement_timestamp()
+           AND reservation.ends_at > statement_timestamp()
+         ORDER BY reservation.starts_at, reservation.id
+         LIMIT ${externalRef === null ? limit : 1}
+         ${externalRef === null ? tx `` : tx `FOR UPDATE OF reservation`}`;
+            let released = 0;
+            for (const candidate of await due(sql, null)) {
+                const done = await inTransaction(sql, async (tx) => {
+                    await lockExternalIdentity(tx, tenantRef, candidate.external_ref);
+                    const [row] = await due(tx, candidate.external_ref);
+                    if (!row || row.id !== candidate.id)
+                        return false;
+                    const revision = Number(row.revision) + 1;
+                    await tx `
+            INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray)
+            VALUES (${tenantRef}, ${row.external_ref}, ${revision}, false)`;
+                    await tx `DELETE FROM slotlock.reservations WHERE id = ${row.id}`;
+                    await tx `
+            INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+            VALUES (${tenantRef}, ${row.resource_id}, 'reservation.no_show', ${row.external_ref},
+                    jsonb_build_object('id', ${row.id}::uuid, 'reference', ${row.external_ref}::text,
+                                       'resource_id', ${row.resource_id}::uuid, 'revision', ${revision}::bigint,
+                                       'check_in_minutes', ${row.minutes}::int),
+                    'slotlock:maintenance')`;
+                    return true;
+                });
+                if (done)
+                    released += 1;
+            }
+            return released;
+        },
+        async joinWaitlist(params) {
+            const { tenantRef, holderRef } = params;
+            if (!isValidIdentity(tenantRef) || !isValidIdentity(holderRef))
+                return { ok: false, code: 'invalid_identity' };
+            if ((params.resourceId === undefined) === (params.pool === undefined)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            if (params.resourceId !== undefined && !isValidResourceId(params.resourceId)) {
+                return { ok: false, code: 'resource_not_found' };
+            }
+            if (params.pool !== undefined && !isPoolName(params.pool))
+                return { ok: false, code: 'invalid_pool' };
+            const window = { start: params.start, end: params.end };
+            if (!isFiniteWindow(window) ||
+                window.end.getTime() - window.start.getTime() > MAX_WAITLIST_WINDOW_MS) {
+                return { ok: false, code: 'invalid_window' };
+            }
+            const offerTtlMs = params.offerTtlMs ?? DEFAULT_OFFER_TTL_MS;
+            if (!Number.isSafeInteger(offerTtlMs) || offerTtlMs < 60_000 || offerTtlMs > 86_400_000) {
+                return { ok: false, code: 'invalid_ttl' };
+            }
+            return inTransaction(sql, async (tx) => {
+                if (params.resourceId !== undefined) {
+                    const [resource] = await tx `
+            SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
+             WHERE id = ${params.resourceId} AND tenant_ref = ${tenantRef}`;
+                    if (!resource)
+                        return { ok: false, code: 'resource_not_found' };
+                    if (resource.archived)
+                        return { ok: false, code: 'resource_archived' };
+                }
+                else {
+                    const [member] = await tx `
+            SELECT 1 FROM slotlock.resources
+             WHERE tenant_ref = ${tenantRef} AND pool_ref = ${params.pool ?? null} AND archived_at IS NULL
+             LIMIT 1`;
+                    if (!member)
+                        return { ok: false, code: 'pool_not_found' };
+                }
+                // Counted under the tenant's waitlist lock, which offers take too, so racing joins stop at the cap.
+                await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-waitlist', tenantRef])}, 0))`;
+                const [counts] = await tx `
+          SELECT count(*)::int AS tenant, count(*) FILTER (WHERE holder_ref = ${holderRef})::int AS holder
+            FROM slotlock.waitlist_entries WHERE tenant_ref = ${tenantRef} AND status = 'waiting'`;
+                if ((counts?.holder ?? 0) >= SLOTLOCK_MAX_WAITLIST_PER_HOLDER ||
+                    (counts?.tenant ?? 0) >= SLOTLOCK_MAX_WAITLIST_PER_TENANT) {
+                    return { ok: false, code: 'waitlist_limit_reached' };
+                }
+                const [row] = await tx `
+          INSERT INTO slotlock.waitlist_entries
+            (tenant_ref, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms)
+          VALUES (${tenantRef}, ${params.resourceId ?? null}, ${params.pool ?? null}, ${window.start},
+                  ${window.end}, ${holderRef}, ${offerTtlMs})
+          RETURNING ${tx.unsafe(WAITLIST_COLUMNS)}`;
+                return { ok: true, entry: toWaitlistEntry(row) };
+            });
+        },
+        async listWaitlist(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            if (params.resourceId !== undefined && !isValidResourceId(params.resourceId))
+                return [];
+            const limit = params.limit ?? 100;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1_000) {
+                throw invalidIdentityError('Slotlock waitlist limit must be 1-1,000');
+            }
+            const rows = await sql `
+        SELECT ${sql.unsafe(WAITLIST_COLUMNS)} FROM slotlock.waitlist_entries
+         WHERE tenant_ref = ${params.tenantRef}
+           AND (${params.resourceId ?? null}::uuid IS NULL OR resource_id = ${params.resourceId ?? null}::uuid)
+           AND (${params.pool ?? null}::text IS NULL OR pool_ref = ${params.pool ?? null})
+           AND (${params.holderRef ?? null}::text IS NULL OR holder_ref = ${params.holderRef ?? null})
+         ORDER BY created_at, id
+         LIMIT ${limit}`;
+            return rows.map(toWaitlistEntry);
+        },
+        async leaveWaitlist(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id))
+                return false;
+            return inTransaction(sql, async (tx) => {
+                // Waits for an offer pass that has this entry locked, so it leaves what that pass decided.
+                const [left] = await tx `
+          DELETE FROM slotlock.waitlist_entries
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+             AND (${params.holderRef ?? null}::text IS NULL OR holder_ref = ${params.holderRef ?? null})
+          RETURNING hold_id`;
+                if (!left)
+                    return false;
+                // An offer not yet taken goes too, freeing the time for the next who waits; a confirmed
+                // one is a booking now and stays.
+                if (left.hold_id) {
+                    await buildSlotlockStore(tx, options, null).releaseHold(left.hold_id, { tenantRef: params.tenantRef });
+                }
+                return true;
+            });
+        },
+        async offerWaitlist(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 50;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+                throw invalidIdentityError('Slotlock waitlist offer limit must be 1-100');
+            }
+            // A suspended tenant gets no new holds.
+            if (refusal)
+                return { offered: 0, expired: 0, next: null };
+            const tenantRef = params.tenantRef;
+            const after = params.after ?? null;
+            return inTransaction(sql, async (tx) => {
+                await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-waitlist', tenantRef])}, 0))`;
+                let expired = 0;
+                if (!after) {
+                    const [gone] = await tx `
+            WITH gone AS (
+              UPDATE slotlock.waitlist_entries SET status = 'expired'
+               WHERE tenant_ref = ${tenantRef} AND status = 'waiting' AND starts_at <= statement_timestamp()
+              RETURNING id, resource_id, pool_ref, starts_at, ends_at, holder_ref
+            ), reported AS (
+              INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+              SELECT ${tenantRef}, gone.resource_id, 'waitlist.expired', gone.id::text,
+                     jsonb_strip_nulls(jsonb_build_object(
+                       'id', gone.id, 'resource_id', gone.resource_id, 'pool', gone.pool_ref,
+                       'start', gone.starts_at, 'end', gone.ends_at, 'holder_ref', gone.holder_ref)),
+                     'slotlock:maintenance'
+                FROM gone
+              RETURNING 1
+            )
+            SELECT count(*)::int AS count FROM reported`;
+                    expired = gone?.count ?? 0;
+                    await tx `
+            DELETE FROM slotlock.waitlist_entries
+             WHERE tenant_ref = ${tenantRef} AND status <> 'waiting'
+               AND ends_at < statement_timestamp() - make_interval(days => ${retentionDays})`;
+                }
+                // One page in join order; the caller passes `next` back for the rest.
+                const waiting = await tx `
+          SELECT ${tx.unsafe(WAITLIST_COLUMNS)} FROM slotlock.waitlist_entries
+           WHERE tenant_ref = ${tenantRef} AND status = 'waiting'
+             AND (${after?.createdAt ?? null}::timestamptz IS NULL
+                  OR (created_at, id) > (${after?.createdAt ?? null}::timestamptz, ${after?.id ?? null}::uuid))
+           ORDER BY created_at, id
+           LIMIT ${limit}`;
+                // Holds made through a store on this transaction, each in a savepoint of its own.
+                const inner = buildSlotlockStore(tx, options, null);
+                let offered = 0;
+                for (const entry of waiting) {
+                    // Locked so a leave waits for this offer, and skipped if it left first.
+                    const [still] = await tx `
+            SELECT 1 FROM slotlock.waitlist_entries
+             WHERE id = ${entry.id} AND status = 'waiting' FOR UPDATE`;
+                    if (!still)
+                        continue;
+                    // Only resources whose window looks free are tried: a hold refused keeps its locks
+                    // until the transaction ends, so trying every member of a full pool would pile them up.
+                    const candidates = await tx `
+            SELECT resource.id FROM slotlock.resources resource
+             WHERE resource.tenant_ref = ${tenantRef} AND resource.archived_at IS NULL
+               AND (resource.id = ${entry.resource_id}::uuid
+                    OR (${entry.resource_id}::uuid IS NULL AND resource.pool_ref = ${entry.pool_ref}))
+               AND NOT EXISTS (
+                 SELECT 1 FROM slotlock.reservations taken
+                  WHERE taken.resource_id = resource.id
+                    AND tstzrange(taken.starts_at, COALESCE(taken.occupied_ends_at, taken.ends_at), '[)')
+                        && tstzrange(${entry.starts_at}::timestamptz, ${entry.ends_at}::timestamptz, '[)')
+                    AND (taken.status <> 'held' OR taken.expires_at > statement_timestamp()))
+             ORDER BY resource.id
+             LIMIT ${OFFER_CANDIDATES}`;
+                    for (const { id: resourceId } of candidates) {
+                        const hold = await inner.acquireHold({
+                            resourceId,
+                            start: entry.starts_at,
+                            end: entry.ends_at,
+                            ttlMs: Number(entry.offer_ttl_ms),
+                            tenantRef,
+                            holderRef: entry.holder_ref,
+                            source: 'slotlock:waitlist',
+                        });
+                        if (!hold.ok)
+                            continue;
+                        await tx `
+              UPDATE slotlock.waitlist_entries
+                 SET status = 'offered', hold_id = ${hold.hold.id}, offered_resource_id = ${resourceId},
+                     offered_at = statement_timestamp()
+               WHERE id = ${entry.id}`;
+                        await tx `
+              INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+              VALUES (${tenantRef}, ${resourceId}, 'waitlist.offered', ${entry.id},
+                      jsonb_strip_nulls(jsonb_build_object(
+                        'id', ${entry.id}::uuid, 'hold_id', ${hold.hold.id}::uuid,
+                        'resource_id', ${resourceId}::uuid, 'pool', ${entry.pool_ref}::text,
+                        'start', ${entry.starts_at}::timestamptz, 'end', ${entry.ends_at}::timestamptz,
+                        'expires_at', ${hold.hold.expiresAt}::timestamptz,
+                        'holder_ref', ${entry.holder_ref}::text)),
+                      'slotlock:maintenance')`;
+                        offered += 1;
+                        break;
+                    }
+                }
+                const last = waiting.length === limit ? waiting[waiting.length - 1] : undefined;
+                return { offered, expired, next: last ? { createdAt: last.created_at, id: last.id } : null };
+            });
+        },
         async getFreeBusy(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
@@ -2158,7 +4660,8 @@ export function createSlotlockStore(sql, options = {}) {
                 });
             }
             const owner = await sql `
-        SELECT id FROM slotlock.resources
+        SELECT id, COALESCE((booking_rules->>'requireCertain')::boolean, false) AS require_certain
+          FROM slotlock.resources
          WHERE id = ${params.resourceId} AND tenant_ref = ${params.tenantRef}`;
             if (!owner[0]) {
                 throw Object.assign(new Error('Slotlock resource belongs to another tenant'), {
@@ -2172,7 +4675,7 @@ export function createSlotlockStore(sql, options = {}) {
          WHERE reservation.resource_id = ${params.resourceId}
            AND reservation.starts_at < ${window.end}
            AND COALESCE(reservation.occupied_ends_at, reservation.ends_at) > ${window.start}
-           AND (reservation.status <> 'held' OR reservation.expires_at > now())
+           AND (reservation.status <> 'held' OR reservation.expires_at > statement_timestamp())
          ORDER BY reservation.starts_at
          LIMIT ${MAX_FREE_BUSY_INTERVALS + 1}`;
             if (busyRows.length > MAX_FREE_BUSY_INTERVALS) {
@@ -2215,7 +4718,15 @@ export function createSlotlockStore(sql, options = {}) {
           FROM recurring_sources
          WHERE earliest_possible_at < ${window.end}`;
             const localRecurrenceRequired = Number(localRecurrenceCoverage?.source_count ?? 0) > 0;
-            const providerRequiredSources = callerRequiredSources.filter((source) => source !== SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE);
+            // A resource that requires certainty requires every sync recording coverage of it, as its
+            // writes do (bookingJudge), and judges them by the same day.
+            const requireCertain = owner[0].require_certain;
+            const recordedSources = requireCertain
+                ? (await sql `
+              SELECT source FROM slotlock.calendar_coverage
+               WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}`).map(({ source }) => source)
+                : [];
+            const providerRequiredSources = [...new Set([...callerRequiredSources, ...recordedSources])].filter((source) => source !== SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE);
             if (!localRecurrenceRequired && providerRequiredSources.length === 0) {
                 return {
                     busy: mergeIntervals(busyRows.map((row) => ({
@@ -2225,7 +4736,7 @@ export function createSlotlockStore(sql, options = {}) {
                     coverage: { state: 'complete', missingSources: [] },
                 };
             }
-            const ageSeconds = coverageMaxAgeMs / 1000;
+            const ageSeconds = (requireCertain ? Math.min(coverageMaxAgeMs, CERTAIN_COVERAGE_MAX_AGE_MS) : coverageMaxAgeMs) / 1000;
             const coverageRows = providerRequiredSources.length === 0
                 ? []
                 : await sql `
@@ -2261,17 +4772,161 @@ export function createSlotlockStore(sql, options = {}) {
             };
         },
         async findNextAvailableFor(params) {
-            if (!isFiniteWindow(params.searchWindow))
+            const asked = params.searchWindow;
+            if (!isFiniteWindow(asked))
                 throw invalidWindowError();
-            assertBoundedSearchWindow(params.searchWindow);
+            assertBoundedSearchWindow(asked);
+            const { tenantRef } = params;
+            if (tenantRef !== null && !isValidIdentity(tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const askedBufferMs = params.bufferAfterMs ?? 0;
+            if (!Number.isSafeInteger(askedBufferMs) ||
+                askedBufferMs < 0 ||
+                askedBufferMs > MAX_BUFFER_AFTER_MS) {
+                throw Object.assign(new Error('Slotlock bufferAfterMs must be a whole 0-30 days'), {
+                    code: 'invalid_buffer',
+                });
+            }
+            const notFound = () => Object.assign(new Error('Slotlock resource not found in this tenant'), {
+                code: 'resource_not_found',
+            });
+            if (!isValidResourceId(params.resourceId))
+                throw notFound();
+            const [row] = await sql `
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility,
+               archived_at, statement_timestamp() AS now
+          FROM slotlock.resources
+         WHERE id = ${params.resourceId} AND tenant_ref IS NOT DISTINCT FROM ${tenantRef}`;
+            if (!row)
+                throw notFound();
             if (!Number.isFinite(params.durationMs) || params.durationMs <= 0)
                 return null;
-            // Rules are authored in the resource's zone — expansion must honour it (DST-correct).
-            const tzRows = await sql `
-        SELECT timezone FROM slotlock.resources WHERE id = ${params.resourceId}`;
-            const busy = await this.listBusy(params.resourceId, params.searchWindow);
-            const windows = expandRules(params.rules, params.searchWindow, tzRows[0]?.timezone ?? 'UTC');
-            return findNextAvailable({ busy, windows, durationMs: params.durationMs });
+            const resource = toResource(row);
+            const rules = params.rules ?? resource.availabilityRules ?? [];
+            // Only what a booking made now may take: the resource's booking rules bound the search.
+            const search = bookingSearch({
+                rules: resource.bookingRules,
+                timezone: resource.timezone,
+                window: asked,
+                now: row.now,
+                bufferAfterMs: askedBufferMs,
+            });
+            if (!search)
+                return null;
+            const { window, bufferAfterMs } = search;
+            // A slot's buffer may run past the window: the time it can reach must be proven free too.
+            const reach = { start: window.start, end: new Date(window.end.getTime() + bufferAfterMs) };
+            let busy;
+            if (tenantRef === null) {
+                // No event, coverage or series can belong to a resource with no tenant: only its rows.
+                busy = await this.listBusy(params.resourceId, reach);
+            }
+            else {
+                busy = [];
+                const parts = bufferAfterMs > 0 ? [window, { start: window.end, end: reach.end }] : [window];
+                for (const part of parts) {
+                    const freeBusy = await this.getFreeBusy({
+                        tenantRef,
+                        resourceId: params.resourceId,
+                        window: part,
+                        ...(params.requiredSources !== undefined
+                            ? { requiredSources: params.requiredSources }
+                            : {}),
+                        ...(params.coverageMaxAgeMs !== undefined
+                            ? { coverageMaxAgeMs: params.coverageMaxAgeMs }
+                            : {}),
+                    });
+                    // Absence is never treated as free time: what cannot be proven gives no slot.
+                    if (freeBusy.coverage.state !== 'complete')
+                        return null;
+                    busy.push(...freeBusy.busy);
+                }
+            }
+            // A slot [s, s + d) with its buffer meets busy [b, e) exactly when [s, s + d) meets [b - buffer, e).
+            return findNextAvailable({
+                busy: busy.map((interval) => ({
+                    start: new Date(interval.start.getTime() - bufferAfterMs),
+                    end: interval.end,
+                })),
+                windows: expandRules(rules, window, resource.timezone),
+                durationMs: params.durationMs,
+                ...(search.align ? { align: search.align } : {}),
+            });
+        },
+        async suspendTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const reason = params.reason;
+            if (reason !== undefined &&
+                (typeof reason !== 'string' ||
+                    reason.length === 0 ||
+                    Array.from(reason).length > 500 ||
+                    Array.from(reason).some((character) => {
+                        const codePoint = character.codePointAt(0) ?? 0;
+                        return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+                    }))) {
+                throw Object.assign(new Error('Slotlock suspension reason must be 1-500 characters without control characters'), { code: 'invalid_suspension_reason' });
+            }
+            try {
+                const [row] = await sql `
+          SELECT slotlock.suspend_tenant(${params.tenantRef}::text, ${reason ?? null}::text) AS suspended`;
+                return { suspended: row?.suspended === true };
+            }
+            catch (error) {
+                throw suspensionRefusal(error);
+            }
+        },
+        async unsuspendTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            try {
+                const [row] = await sql `
+          SELECT slotlock.unsuspend_tenant(${params.tenantRef}::text) AS unsuspended`;
+                return { unsuspended: row?.unsuspended === true };
+            }
+            catch (error) {
+                throw suspensionRefusal(error);
+            }
+        },
+        async isTenantSuspended(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const [row] = await sql `
+        SELECT slotlock.tenant_suspended(${params.tenantRef}::text) AS suspended`.catch((error) => {
+                throw suspensionCheckRefusal(error);
+            });
+            return row?.suspended === true;
+        },
+        async eraseTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const erased = await sql `
+        SELECT erased_table, erased_rows FROM slotlock.erase_tenant(${params.tenantRef}::text)`;
+            const rows = {};
+            let total = 0;
+            for (const row of erased) {
+                const count = Number(row.erased_rows);
+                rows[row.erased_table] = count;
+                total += count;
+            }
+            return { rows, total };
         },
     };
+    if (refusal === null)
+        return store;
+    const refuse = async () => {
+        throw refusal();
+    };
+    return Object.assign(store, Object.fromEntries(SLOTLOCK_TENANT_WRITE_METHODS.map((name) => [name, refuse])));
+}
+/** The deployment role alone may suspend: another role is refused EXECUTE on the functions. */
+function suspensionRefusal(error) {
+    if (pgCode(error) !== '42501')
+        return error;
+    return Object.assign(new Error('Slotlock suspends tenants and lifts suspensions only as the deployment role'), { code: 'tenant_suspension_not_permitted', cause: error });
 }