slotlock 0.3.0 → 0.5.0

package/store.js

@@ -1,6 +1,8 @@
 // DB mechanics for the Slotlock core — explicit `postgres` client in, structured results out.
 // Domain policy (who may reserve, pricing, holds) belongs to future callers; this layer owns the
 // reliable how: idempotent schema apply, EXCLUDE-arbitrated inserts with a structured conflict.
+import { SLOTLOCK_CHANGE_RETENTION_DAYS, slotlockEventFeedMethods } from './event-feed.js';
+import { bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
 import { createHash, randomUUID } from 'node:crypto';
 import ICAL from 'ical.js';
 import { SLOTLOCK_CORE_DDL, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockTenantLockKey, } from './ddl.js';
@@ -48,6 +50,19 @@ const MAX_COVERAGE_SOURCES = 64;
 const MAX_COVERAGE_AGE_MS = 30 * 24 * 60 * 60 * 1000;
 /** Trusted provider/maintenance namespace used by backwards-compatible store callers. */
 export const SLOTLOCK_INTERNAL_EVENT_OWNER_REF = 'internal';
+/** How many live holds one holder (a keyed hold's principal) may have in a tenant at once. */
+export const SLOTLOCK_MAX_HOLDS_PER_HOLDER = 20;
+/** Windows one holder may wait for at once (joinWaitlist). */
+export const SLOTLOCK_MAX_WAITLIST_PER_HOLDER = 20;
+/** Waiting entries one tenant may have. */
+export const SLOTLOCK_MAX_WAITLIST_PER_TENANT = 10_000;
+/** The longest window one waitlist entry may wait for. */
+const MAX_WAITLIST_WINDOW_MS = 31 * 24 * 60 * 60 * 1000;
+const DEFAULT_OFFER_TTL_MS = 15 * 60 * 1000;
+/** How long before its start a booking may be checked in. */
+export const SLOTLOCK_CHECK_IN_OPENS_MINUTES = 60;
+/** Free-looking resources one entry tries before the next entry: a race can take one first. */
+const OFFER_CANDIDATES = 3;
 /** Default hard ceiling for retained active + tombstoned identities per agent principal. */
 export const SLOTLOCK_AGENT_OWNER_EVENT_QUOTA = 1_000;
 /** Hard retained command ceiling; includes reserved cancellation capacity for every identity. */
@@ -621,6 +636,7 @@ function toHold(row) {
         bufferAfterMs: Number(row.buffer_after_ms),
         expiresAt: row.expires_at,
         source: row.source,
+        ...(row.hold_group_id ? { groupId: row.hold_group_id } : {}),
     };
 }
 /** A keyset cursor `{ start, id }` from the last row of a previous page, checked. */
@@ -854,7 +870,8 @@ async function replaceCalendarEventOccurrences(tx, params) {
     for (const occurrence of params.occurrences) {
         let reservationId = null;
         if ((params.event.transparency ?? 'opaque') === 'opaque') {
-            await reapExpiredHolds(tx, params.resourceId, occurrence.start, occurrence.end);
+            const occupied = new Date(occurrence.end.getTime() + (params.bufferAfterMs ?? 0));
+            await reapExpiredHolds(tx, params.resourceId, occurrence.start, occupied);
             const derivedExternalRef = `calendar:${params.eventId}:${createHash('sha256')
                 .update(occurrence.recurrenceId)
                 .digest('hex')}`;
@@ -864,7 +881,7 @@ async function replaceCalendarEventOccurrences(tx, params) {
           buffer_after_ms, revision, source, calendar_event_id
         ) VALUES (
           ${params.resourceId}, ${params.tenantRef}, ${derivedExternalRef},
-          ${occurrence.start}, ${occurrence.end}, 0, ${params.revision},
+          ${occurrence.start}, ${occurrence.end}, ${params.bufferAfterMs ?? 0}, ${params.revision},
           ${`calendar-event:${params.eventId}`}, ${params.eventId}
         )
         RETURNING id`;
@@ -918,8 +935,30 @@ function oneOffEventWindow(event, requested) {
 function calendarCommandHash(value) {
     return createHash('sha256').update(JSON.stringify(value)).digest('hex');
 }
+/**
+ * What makes a put the same request: its identity and the event it asks for. Not the window its
+ * occurrences are stored over, which for a series is the rolling horizon from the current UTC
+ * midnight: with it in the hash, a retry after midnight was refused as a different request.
+ */
 function putCommandHash(params) {
+    return calendarCommandHash(putCommandValue(params));
+}
+/**
+ * The hash 0.3.0 and earlier stored, with the window in it, so a command stored before the upgrade
+ * still replays: always for a one-off event, whose window is its own span, and on the same UTC day
+ * for a series. Remove once no stored command can be that old (commands are pruned after 30 days).
+ */
+export function legacyPutCommandHash(params) {
     return calendarCommandHash({
+        ...putCommandValue(params),
+        materializationWindow: {
+            start: params.window.start.toISOString(),
+            end: params.window.end.toISOString(),
+        },
+    });
+}
+function putCommandValue(params) {
+    return {
         operation: 'put',
         ownerRef: params.ownerRef,
         externalRef: params.command.externalRef,
@@ -927,6 +966,8 @@ function putCommandHash(params) {
         expectedRevision: params.command.expectedRevision,
         resourceId: params.command.resourceId,
         source: params.command.source ?? null,
+        // Only when present, so a create without a hold keeps the hash it always had.
+        ...(params.command.fromHold ? { fromHold: params.command.fromHold.holdId } : {}),
         event: {
             ...params.event,
             start: params.event.start.toISOString(),
@@ -938,11 +979,7 @@ function putCommandHash(params) {
                 }
                 : null,
         },
-        materializationWindow: {
-            start: params.window.start.toISOString(),
-            end: params.window.end.toISOString(),
-        },
-    });
+    };
 }
 function cancelCommandHash(params) {
     return calendarCommandHash({ operation: 'cancel', ...params });
@@ -1040,11 +1077,79 @@ async function findCalendarOverlap(sql, resourceId, occurrences, eventId) {
     }
     return { ok: false, code: 'overlap', conflictingReservationId: null };
 }
-function sameExternalPayload(row, params) {
+/**
+ * What the resource's booking rules say about a booking of `interval` made now (by the database's
+ * clock, at this statement): the rule it breaks, if any, and the turnaround it must keep after it.
+ * A resource without its own hours is judged against `defaultHours`.
+ */
+async function bookingRuling(tx, resourceId, interval, defaultHours) {
+    const judge = await bookingJudge(tx, resourceId, defaultHours);
+    return { rule: judge.broken(interval), turnaroundMs: judge.turnaroundMs };
+}
+/** How recently a sync must have read a resource whose booking rules require certainty. */
+const CERTAIN_COVERAGE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/**
+ * The resource's booking rules, read once, as a check of any interval booked now (by the database's
+ * clock at this statement) and the turnaround a booking keeps.
+ */
+async function bookingJudge(tx, resourceId, defaultHours) {
+    const [row] = await tx `
+    SELECT booking_rules, availability_rules, timezone, statement_timestamp() AS now
+      FROM slotlock.resources WHERE id = ${resourceId}`;
+    if (!row || row.booking_rules === null || row.booking_rules === undefined) {
+        return { broken: () => null, turnaroundMs: 0 };
+    }
+    const { bookingRules: rules, availabilityRules } = toResource({
+        id: resourceId,
+        external_ref: null,
+        tenant_ref: null,
+        timezone: row.timezone,
+        availability_rules: row.availability_rules,
+        booking_rules: row.booking_rules,
+        pool_ref: null,
+        visibility: 'shared',
+        archived_at: null,
+    });
+    const hours = availabilityRules ?? defaultHours;
+    // Every sync covering the resource, and whether it was read within a day, by the same clock.
+    const coverage = rules?.requireCertain === true
+        ? await tx `
+          SELECT starts_at, ends_at,
+                 observed_at >= statement_timestamp()
+                   - make_interval(secs => ${CERTAIN_COVERAGE_MAX_AGE_MS / 1000}) AS fresh
+            FROM slotlock.calendar_coverage WHERE resource_id = ${resourceId}`
+        : [];
+    const turnaroundMs = bookingBufferAfterMs(rules);
+    // The booking and the turnaround it keeps, as a search judges the slot.
+    const uncertain = (interval) => coverage.some((source) => !source.fresh ||
+        source.starts_at > interval.start ||
+        source.ends_at.getTime() < interval.end.getTime() + turnaroundMs);
+    // A later occurrence of a series is judged on its step and hours only: notice and advance are
+    // about when the booking was made, which its first occurrence answers.
+    const later = rules === undefined
+        ? undefined
+        : {
+            ...(rules.slotStepMinutes !== undefined ? { slotStepMinutes: rules.slotStepMinutes } : {}),
+            ...(rules.enforceHours !== undefined ? { enforceHours: rules.enforceHours } : {}),
+        };
+    return {
+        broken: (interval, checks = { first: true }) => bookingRuleBroken({
+            rules: checks.first ? rules : later,
+            timezone: row.timezone,
+            hours,
+            interval,
+            now: row.now,
+        }) ?? (uncertain(interval) ? 'uncertain' : null),
+        turnaroundMs,
+    };
+}
+function sameExternalPayload(row, params, turnaroundMs = 0) {
+    const buffer = Number(row.buffer_after_ms);
     return (row.resource_id === params.resourceId &&
         row.starts_at.getTime() === params.start.getTime() &&
         row.ends_at.getTime() === params.end.getTime() &&
-        Number(row.buffer_after_ms) === params.bufferAfterMs &&
+        // As asked, or raised to the resource's turnaround when it was stored.
+        (buffer === params.bufferAfterMs || buffer === Math.max(params.bufferAfterMs, turnaroundMs)) &&
         Number(row.revision) === params.revision &&
         row.source === (params.source ?? null));
 }
@@ -1078,6 +1183,33 @@ function pgCode(err) {
     }
     return undefined;
 }
+/** Members a pool booking or search considers at most, in id order. */
+export const SLOTLOCK_MAX_POOL_MEMBERS = 100;
+const WAITLIST_COLUMNS = 'id, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms, status, hold_id, offered_resource_id, offered_at, created_at';
+function toWaitlistEntry(row) {
+    return {
+        id: row.id,
+        resourceId: row.resource_id,
+        pool: row.pool_ref,
+        start: row.starts_at,
+        end: row.ends_at,
+        holderRef: row.holder_ref,
+        offerTtlMs: Number(row.offer_ttl_ms),
+        status: row.status,
+        holdId: row.hold_id,
+        offeredResourceId: row.offered_resource_id,
+        offeredAt: row.offered_at,
+        createdAt: row.created_at,
+    };
+}
+export function isPoolName(value) {
+    return typeof value === 'string' && /^[a-z0-9][a-z0-9._-]{0,99}$/.test(value);
+}
+function invalidPoolError() {
+    return Object.assign(new Error('Slotlock pool must be 1-100 of a-z, 0-9, ".", "_" and "-"'), {
+        code: 'invalid_pool',
+    });
+}
 function toResource(row) {
     const resource = {
         id: row.id,
@@ -1088,6 +1220,8 @@ function toResource(row) {
     };
     if (row.archived_at !== null)
         resource.archivedAt = row.archived_at;
+    if (row.pool_ref !== null && row.pool_ref !== undefined)
+        resource.pool = row.pool_ref;
     if (row.availability_rules !== null && row.availability_rules !== undefined) {
         // Written through setResourceAvailability, which validates; anything else reads as closed.
         try {
@@ -1097,6 +1231,16 @@ function toResource(row) {
             resource.availabilityRules = [];
         }
     }
+    if (row.booking_rules !== null && row.booking_rules !== undefined) {
+        // Written through setResourceBookingRules, which validates; anything else reads as refusing
+        // every booking, never as no rule.
+        try {
+            resource.bookingRules = parseBookingRules(row.booking_rules);
+        }
+        catch {
+            resource.bookingRules = { maxAdvanceDays: 1, minNoticeMinutes: 525_600 };
+        }
+    }
     return resource;
 }
 /** Validated rules as a jsonb parameter, or null for "use the default". */
@@ -1124,7 +1268,7 @@ async function upsertResource(executor, params) {
         WHERE tenant_ref IS NOT NULL AND external_ref IS NOT NULL
       DO UPDATE SET timezone = EXCLUDED.timezone
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
     }
     else if (params.externalRef !== undefined) {
         rows = await executor `
@@ -1134,13 +1278,13 @@ async function upsertResource(executor, params) {
         WHERE tenant_ref IS NULL AND external_ref IS NOT NULL
       DO UPDATE SET external_ref = EXCLUDED.external_ref
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
     }
     else {
         rows = await executor `
       INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
       VALUES (NULL, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
     }
     const row = rows[0];
     if (!row) {
@@ -1163,7 +1307,7 @@ async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
            summary, description, location, status, transparency, organizer, attendees,
            reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
            materialized_ends_at, recurrence_cursor, revision, source, created_at,
-           updated_at, recurrence_ends_by IS NULL AS ends_by_missing
+           updated_at, recurrence_ends_by IS NULL AS ends_by_missing, buffer_after_ms
       FROM slotlock.calendar_events
      WHERE id = ${eventId} AND tenant_ref = ${tenantRef}
      FOR UPDATE`;
@@ -1185,6 +1329,7 @@ async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
         event,
         occurrences,
         revision: Number(row.revision),
+        bufferAfterMs: Number(row.buffer_after_ms ?? 0),
     });
     // A series stored before 0.3 learns when it ends at its first roll.
     const endsBy = row.ends_by_missing ? recurrenceEndsByColumn(event) : null;
@@ -1387,8 +1532,8 @@ async function lockTenantLimit(tx, tenantRef, kind) {
 /**
  * Rows a tenant added within this many days count against its limits whatever time they hold, so
  * bookings and events dated in the past, and cancellations, add at most the limit in any such
- * window. Ended history is not pruned: over a longer time it can still grow. The same window
- * maintenance keeps event idempotency records and stray retirements for.
+ * window. Ended history is not pruned: over a longer time it can still grow. Maintenance keeps
+ * event idempotency records and stray retirements at least as long (the store's `retentionDays`).
  */
 const TENANT_LIMIT_RECENT_DAYS = SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS;
 /**
@@ -1513,7 +1658,7 @@ async function deleteExpiredHolds(tx, tenantRef, limit) {
         FROM slotlock.reservations hold
         JOIN slotlock.resources resource ON resource.id = hold.resource_id
        WHERE resource.tenant_ref = ${tenantRef}
-         AND hold.status = 'held' AND hold.expires_at <= now()
+         AND hold.status = 'held' AND hold.expires_at <= statement_timestamp()
        ORDER BY hold.expires_at, hold.id
        LIMIT ${limit}
        FOR UPDATE OF hold SKIP LOCKED
@@ -1521,7 +1666,7 @@ async function deleteExpiredHolds(tx, tenantRef, limit) {
       DELETE FROM slotlock.reservations hold
        USING candidates candidate
        WHERE hold.id = candidate.id
-         AND hold.status = 'held' AND hold.expires_at <= now()
+         AND hold.status = 'held' AND hold.expires_at <= statement_timestamp()
       RETURNING 1
     )
     SELECT count(*)::int AS deleted FROM deleted`;
@@ -1536,7 +1681,7 @@ async function forgetExpiredHoldAnswers(tx, tenantRef, limit) {
     WITH candidates AS MATERIALIZED (
       SELECT answer.principal_ref, answer.idempotency_key
         FROM slotlock.hold_commands answer
-       WHERE answer.tenant_ref = ${tenantRef} AND answer.expires_at <= now()
+       WHERE answer.tenant_ref = ${tenantRef} AND answer.expires_at <= statement_timestamp()
        ORDER BY answer.expires_at, answer.principal_ref, answer.idempotency_key
        LIMIT ${limit}
        FOR UPDATE OF answer SKIP LOCKED
@@ -1565,7 +1710,7 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
        SELECT id FROM slotlock.reservations
         WHERE resource_id = ${resourceId}
           AND status = 'held'
-          AND expires_at <= now()
+          AND expires_at <= statement_timestamp()
           AND starts_at < ${end}
           AND COALESCE(occupied_ends_at, ends_at) > ${start}
         ORDER BY id
@@ -1594,7 +1739,7 @@ async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, exclu
              ${end} + ${bufferAfterMs} * interval '1 millisecond',
              '[)'
            )
-       AND (status <> 'held' OR expires_at > now())
+       AND (status <> 'held' OR expires_at > statement_timestamp())
      ORDER BY starts_at
      LIMIT 1`;
     return { ok: false, code: 'overlap', conflictingReservationId: winners[0]?.id ?? null };
@@ -1675,6 +1820,8 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'restoreResource',
     'deleteResource',
     'setResourceAvailability',
+    'setResourceBookingRules',
+    'setResourcePool',
     'setTenantAvailability',
     'createReservation',
     'createExternalReservation',
@@ -1687,6 +1834,14 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'cancelCalendarEvent',
     'cancelCalendarEventById',
     'recordCalendarCoverage',
+    'createWebhookEndpoint',
+    'deleteWebhookEndpoint',
+    'enableWebhookEndpoint',
+    'recordCoverageFailure',
+    'deleteCoverage',
+    'checkInReservation',
+    'joinWaitlist',
+    'leaveWaitlist',
 ]);
 function tenantSuspendedError() {
     return Object.assign(new Error('Slotlock tenant is suspended: it may read, and write nothing'), {
@@ -1717,6 +1872,7 @@ function suspensionCheckRefusal(error) {
  */
 function buildSlotlockStore(sql, options, refusal) {
     const configuredTenantSetting = options.tenantContextSetting ?? SLOTLOCK_TENANT_CONTEXT_SETTING;
+    const defaultHours = parseAvailabilityRules([...(options.defaultAvailabilityRules ?? [])]);
     const configuredAgentOwnerEventQuota = options.agentOwnerEventQuota ?? SLOTLOCK_AGENT_OWNER_EVENT_QUOTA;
     const configuredAgentOwnerCommandQuota = options.agentOwnerCommandQuota ?? SLOTLOCK_AGENT_OWNER_COMMAND_QUOTA;
     if (!Number.isSafeInteger(configuredAgentOwnerEventQuota) ||
@@ -1732,7 +1888,23 @@ function buildSlotlockStore(sql, options, refusal) {
         throw Object.assign(new Error('Slotlock agent owner command quota must exceed its event quota and be at most 1000000'), { code: 'invalid_agent_owner_command_quota' });
     }
     const configuredTenantLimits = tenantLimitsOption(options.tenantLimits);
-    const { maxTenantTransactions, tenantLockTimeoutMs } = options;
+    const { maxTenantTransactions, tenantLockTimeoutMs, maxHeldHoursPerHolder } = options;
+    const retentionDays = options.retentionDays ?? SLOTLOCK_CHANGE_RETENTION_DAYS;
+    if (!Number.isSafeInteger(retentionDays) || retentionDays < 1 || retentionDays > 3_650) {
+        throw Object.assign(new Error('Slotlock retentionDays must be a whole number from 1 to 3650'), {
+            code: 'invalid_retention',
+        });
+    }
+    const maxHoldsPerHolder = options.maxHoldsPerHolder ?? SLOTLOCK_MAX_HOLDS_PER_HOLDER;
+    if (!Number.isSafeInteger(maxHoldsPerHolder) ||
+        maxHoldsPerHolder < 1 ||
+        maxHoldsPerHolder > 10_000 ||
+        (maxHeldHoursPerHolder !== undefined &&
+            (!Number.isSafeInteger(maxHeldHoursPerHolder) ||
+                maxHeldHoursPerHolder < 1 ||
+                maxHeldHoursPerHolder > 876_000))) {
+        throw Object.assign(new Error('Slotlock maxHoldsPerHolder must be 1-10000 and maxHeldHoursPerHolder 1-876000, whole numbers'), { code: 'invalid_holder_limits' });
+    }
     const whole = (value, max) => value === undefined || (Number.isSafeInteger(value) && value >= 1 && value <= max);
     if (!whole(maxTenantTransactions, 1_000) || !whole(tenantLockTimeoutMs, 600_000)) {
         throw Object.assign(new Error('Slotlock maxTenantTransactions must be 1-1000 and tenantLockTimeoutMs 1-600000, whole numbers'), { code: 'invalid_tenant_transaction_options' });
@@ -1749,6 +1921,9 @@ function buildSlotlockStore(sql, options, refusal) {
         agentOwnerEventQuota: configuredAgentOwnerEventQuota,
         agentOwnerCommandQuota: configuredAgentOwnerCommandQuota,
         tenantLimits: configuredTenantLimits,
+        retentionDays,
+        maxHoldsPerHolder,
+        ...(maxHeldHoursPerHolder !== undefined ? { maxHeldHoursPerHolder } : {}),
     };
     /**
      * Under the tenant's lock for `kind`: the limit when the tenant is at it, else null. No limit for
@@ -1789,6 +1964,7 @@ function buildSlotlockStore(sql, options, refusal) {
         return resource?.tenant_ref ?? null;
     }
     const store = {
+        ...slotlockEventFeedMethods(sql, retentionDays),
         async applySchema(migrationOptions) {
             // PostgreSQL's IF NOT EXISTS DDL is idempotent after commit but not race-free: two fresh
             // application instances can still collide on pg_namespace/pg_extension unique indexes.
@@ -1964,6 +2140,12 @@ function buildSlotlockStore(sql, options, refusal) {
             const isolation = options?.isolation;
             if (isolation !== undefined && isolation !== 'read committed')
                 throw invalidIsolationError();
+            const actor = options?.actor;
+            if (actor !== undefined && !/^[^\u0000-\u001f\u007f]{1,200}$/u.test(actor)) {
+                throw Object.assign(new Error('Slotlock actor must be 1-200 characters without control characters'), {
+                    code: 'invalid_identity',
+                });
+            }
             const release = await tenantSlots?.(tenantRef, options?.signal);
             // A lock wait that timed out leaves the transaction unusable, so the reset below fails with
             // another error in its place: noted here as it happens.
@@ -1979,12 +2161,14 @@ function buildSlotlockStore(sql, options, refusal) {
                 // (READ COMMITTED: a statement after the lock sees what committed before it was granted).
                 const previous = await tx `
             SELECT current_setting(${configuredTenantSetting}, true) AS value,
+                   current_setting('slotlock.actor', true) AS actor,
                    current_setting('transaction_isolation') AS isolation,
                    pg_advisory_xact_lock_shared(
                      hashtextextended(${slotlockTenantLockKey(tenantRef)}, 0)
                    ) AS locked`;
                 const [context] = await tx `
             SELECT set_config(${configuredTenantSetting}, ${tenantRef}, true) AS tenant,
+                   set_config('slotlock.actor', ${actor ?? ''}, true) AS actor,
                    slotlock.tenant_suspended(${tenantRef}) AS suspended`.catch((error) => {
                     throw suspensionCheckRefusal(error);
                 });
@@ -2005,7 +2189,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     throw error;
                 }
                 finally {
-                    await tx `SELECT set_config(${configuredTenantSetting}, ${previous[0]?.value ?? ''}, true)`;
+                    await tx `SELECT set_config(${configuredTenantSetting}, ${previous[0]?.value ?? ''}, true),
+                            set_config('slotlock.actor', ${previous[0]?.actor ?? ''}, true)`;
                 }
             }, 'read committed')
                 .catch((error) => {
@@ -2066,7 +2251,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})`;
@@ -2084,10 +2269,87 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET availability_rules = ${rules}::jsonb
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+            const row = rows[0];
+            return row ? toResource(row) : null;
+        },
+        async setResourceBookingRules(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw Object.assign(new Error('Slotlock resource identity is invalid'), {
+                    code: 'invalid_identity',
+                });
+            }
+            let rules = null;
+            if (params.rules !== null) {
+                try {
+                    rules = parseBookingRules(params.rules);
+                }
+                catch (error) {
+                    throw Object.assign(new Error(error.message), {
+                        code: 'invalid_booking_rules',
+                    });
+                }
+            }
+            const rows = await sql `
+        UPDATE slotlock.resources
+           SET booking_rules = ${rules === null ? null : sql.json({ ...rules })}::jsonb,
+               -- Kept while check-in stays asked for, from the moment it first was; cleared without.
+               check_in_since = CASE
+                 WHEN ${rules?.checkInMinutes ?? null}::int IS NULL THEN NULL
+                 WHEN booking_rules ? 'checkInMinutes' THEN COALESCE(check_in_since, statement_timestamp())
+                 ELSE statement_timestamp()
+               END
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
+                  visibility, archived_at`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
+        async setResourcePool(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw Object.assign(new Error('Slotlock resource identity is invalid'), {
+                    code: 'invalid_identity',
+                });
+            }
+            if (params.pool !== null && !isPoolName(params.pool))
+                throw invalidPoolError();
+            const rows = await sql `
+        UPDATE slotlock.resources SET pool_ref = ${params.pool}
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
+                  visibility, archived_at`;
+            const row = rows[0];
+            return row ? toResource(row) : null;
+        },
+        async listPoolMembers(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            if (!isPoolName(params.pool))
+                throw invalidPoolError();
+            const rows = await sql `
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
+               visibility, archived_at
+          FROM slotlock.resources
+         WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
+           AND archived_at IS NULL
+           AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
+         ORDER BY id
+         LIMIT ${SLOTLOCK_MAX_POOL_MEMBERS}`;
+            return rows.map(toResource);
+        },
+        async listPools(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            const rows = await sql `
+        SELECT pool_ref AS pool, count(*)::int AS capacity
+          FROM slotlock.resources
+         WHERE tenant_ref = ${params.tenantRef} AND pool_ref IS NOT NULL AND archived_at IS NULL
+           AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
+         GROUP BY pool_ref
+         ORDER BY pool_ref
+         LIMIT 1000`;
+            return rows;
+        },
         async setTenantAvailability(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
@@ -2119,7 +2381,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
@@ -2139,7 +2401,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET archived_at = COALESCE(archived_at, clock_timestamp())
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
             return row ? toResource(row) : null;
         },
         async restoreResource(params) {
@@ -2150,7 +2412,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET archived_at = NULL
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
             return row ? toResource(row) : null;
         },
         async deleteResource(params) {
@@ -2170,7 +2432,7 @@ function buildSlotlockStore(sql, options, refusal) {
                    SELECT 1 FROM slotlock.reservations
                     WHERE resource_id = ${params.id}
                       AND calendar_event_id IS NULL
-                      AND (CASE WHEN status = 'held' THEN expires_at > now()
+                      AND (CASE WHEN status = 'held' THEN expires_at > statement_timestamp()
                                 ELSE COALESCE(occupied_ends_at, ends_at) > now() END)
                  )
                  OR EXISTS (
@@ -2215,23 +2477,27 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (bookingLimit !== null && resource.tenant_ref !== null) {
                             return { ok: false, code: 'reservation_limit_reached', limit: bookingLimit };
                         }
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
+                        if (ruling.rule)
+                            return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
+                        const occupied = new Date(params.end.getTime() + ruling.turnaroundMs);
                         if (resource.tenant_ref !== null &&
                             !(await recurrenceCoversWrite(tx, {
                                 tenantRef: resource.tenant_ref,
                                 resourceId: params.resourceId,
                                 start: params.start,
-                                end: params.end,
+                                end: occupied,
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, params.end);
+                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
-                id, resource_id, tenant_ref, external_ref, starts_at, ends_at, source
+                id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms, source
               ) VALUES (
                 ${id}, ${params.resourceId}, ${resource.tenant_ref},
                 ${resource.tenant_ref === null ? null : id},
-                ${params.start}, ${params.end}, ${params.source ?? null}
+                ${params.start}, ${params.end}, ${ruling.turnaroundMs}, ${params.source ?? null}
               )
               RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                         buffer_after_ms, revision, source`;
@@ -2263,6 +2529,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 return invalid;
             if (params.revision !== 1)
                 return { ok: false, code: 'invalid_revision' };
+            let written = params.bufferAfterMs;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2283,12 +2550,13 @@ function buildSlotlockStore(sql, options, refusal) {
                  AND calendar_event_id IS NULL
                FOR UPDATE`;
                         const found = existing[0];
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
                         if (found) {
                             // The booking has moved on since: a delayed create is stale, as a delayed move is.
                             if (params.revision < Number(found.revision)) {
                                 return { ok: false, code: 'stale_revision' };
                             }
-                            if (!sameExternalPayload(found, params)) {
+                            if (!sameExternalPayload(found, params, ruling.turnaroundMs)) {
                                 return { ok: false, code: 'idempotency_conflict' };
                             }
                             return { ok: true, reservation: toReservation(found), idempotent: true };
@@ -2302,22 +2570,27 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (bookingLimit !== null) {
                             return { ok: false, code: 'reservation_limit_reached', limit: bookingLimit };
                         }
+                        if (ruling.rule)
+                            return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
+                        const bufferAfterMs = Math.max(params.bufferAfterMs, ruling.turnaroundMs);
+                        written = bufferAfterMs;
+                        const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
                         if (!(await recurrenceCoversWrite(tx, {
                             tenantRef: params.tenantRef,
                             resourceId: params.resourceId,
                             start: params.start,
-                            end: occupiedEnd(params),
+                            end: occupied,
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd(params));
+                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
                         const rows = await tx `
               INSERT INTO slotlock.reservations (
                 resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
                 revision, source
               ) VALUES (
                 ${params.resourceId}, ${params.tenantRef}, ${params.externalRef}, ${params.start},
-                ${params.end}, ${params.bufferAfterMs}, ${params.revision}, ${params.source ?? null}
+                ${params.end}, ${bufferAfterMs}, ${params.revision}, ${params.source ?? null}
               )
               RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                         buffer_after_ms, revision, source`;
@@ -2337,8 +2610,8 @@ function buildSlotlockStore(sql, options, refusal) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd(params));
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, params.bufferAfterMs);
+                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs: written }));
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, written);
                 }
             }
         },
@@ -2347,6 +2620,7 @@ function buildSlotlockStore(sql, options, refusal) {
             if (invalid)
                 return invalid;
             let currentReservationId;
+            let bufferAfterMs = params.bufferAfterMs;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2359,6 +2633,7 @@ function buildSlotlockStore(sql, options, refusal) {
                  AND calendar_event_id IS NULL
                FOR UPDATE`;
                         const found = existing[0];
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
                         if (!found) {
                             const cancelled = await tx `
                 SELECT revision FROM slotlock.reservation_tombstones
@@ -2371,7 +2646,7 @@ function buildSlotlockStore(sql, options, refusal) {
                         const currentRevision = Number(found.revision);
                         if (params.revision < currentRevision)
                             return { ok: false, code: 'stale_revision' };
-                        if (sameExternalPayload(found, params)) {
+                        if (sameExternalPayload(found, params, ruling.turnaroundMs)) {
                             return { ok: true, reservation: toReservation(found), idempotent: true };
                         }
                         if (params.revision === currentRevision) {
@@ -2385,23 +2660,31 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'resource_tenant_mismatch' };
                         if (resourceState === 'archived')
                             return { ok: false, code: 'resource_archived' };
+                        if (ruling.rule)
+                            return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
+                        bufferAfterMs = Math.max(params.bufferAfterMs, ruling.turnaroundMs);
                         if (!(await recurrenceCoversWrite(tx, {
                             tenantRef: params.tenantRef,
                             resourceId: params.resourceId,
                             start: params.start,
-                            end: occupiedEnd(params),
+                            end: occupiedEnd({ end: params.end, bufferAfterMs }),
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd(params));
+                        await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs }));
                         const rows = await tx `
               UPDATE slotlock.reservations
                  SET resource_id = ${params.resourceId},
                      starts_at = ${params.start},
                      ends_at = ${params.end},
-                     buffer_after_ms = ${params.bufferAfterMs},
+                     buffer_after_ms = ${bufferAfterMs},
                      revision = ${params.revision},
-                     source = ${params.source ?? null}
+                     source = ${params.source ?? null},
+                     -- A check-in is for the time it was made for: a move to another start clears it.
+                     checked_in_at = CASE
+                       WHEN starts_at = ${params.start} AND resource_id = ${params.resourceId}
+                       THEN checked_in_at
+                     END
                WHERE id = ${found.id}
                RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                          buffer_after_ms, revision, source`;
@@ -2421,8 +2704,9 @@ function buildSlotlockStore(sql, options, refusal) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd(params));
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, params.bufferAfterMs, currentReservationId);
+                    const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
+                    await rollSeriesBehind(sql, params.resourceId, params.start, occupied);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs, currentReservationId);
                 }
             }
         },
@@ -2517,7 +2801,13 @@ function buildSlotlockStore(sql, options, refusal) {
             }
             if (!isValidResourceId(params.resourceId))
                 return { ok: false, code: 'resource_not_found' };
-            const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
+            if (params.groupId !== undefined && !isValidResourceId(params.groupId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            const { holderRef } = params;
+            if (holderRef !== undefined && (tenantRef === undefined || !isValidIdentity(holderRef))) {
+                return { ok: false, code: 'invalid_identity' };
+            }
             const payloadHash = calendarCommandHash({
                 operation: 'hold',
                 resourceId: params.resourceId,
@@ -2526,8 +2816,12 @@ function buildSlotlockStore(sql, options, refusal) {
                 ttlMs: params.ttlMs,
                 bufferAfterMs,
                 source: params.source ?? null,
+                ...(params.groupId !== undefined ? { groupId: params.groupId } : {}),
+                ...(holderRef !== undefined ? { holderRef } : {}),
             });
             const ttlSeconds = params.ttlMs / 1000;
+            // The buffer written: the one asked for, raised to the resource's turnaround.
+            let written = bufferAfterMs;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2540,7 +2834,8 @@ function buildSlotlockStore(sql, options, refusal) {
                             ])}, 0))`;
                             const [prior] = await tx `
                 SELECT hold_id AS id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at,
-                       source, payload_hash
+                       source, payload_hash,
+                       (SELECT hold_group_id FROM slotlock.reservations WHERE id = hold_id) AS hold_group_id
                   FROM slotlock.hold_commands
                  WHERE tenant_ref = ${tenantRef ?? null} AND principal_ref = ${principalRef ?? null}
                    AND idempotency_key = ${idempotencyKey ?? null}`;
@@ -2562,24 +2857,63 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'resource_archived' };
                         if (holdLimit !== null)
                             return { ok: false, code: 'hold_limit_reached', limit: holdLimit };
+                        // Seconds the holder already holds, turnaround included, when its time is capped.
+                        let heldSeconds = null;
+                        if (holderRef !== undefined) {
+                            // One holder's live holds, counted under a lock on the holder so racing holds stop
+                            // at the cap: an agent cannot hold a resource's whole week.
+                            await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([
+                                'slotlock-holder',
+                                tenantRef,
+                                holderRef,
+                            ])}, 0))`;
+                            const [held] = await tx `
+                SELECT count(*)::int AS count,
+                       COALESCE(sum(extract(epoch FROM
+                         ends_at + buffer_after_ms * interval '1 millisecond' - starts_at)), 0)::float8
+                         AS seconds
+                  FROM slotlock.reservations
+                 WHERE holder_ref = ${holderRef} AND tenant_ref IS NULL AND status = 'held'
+                   AND expires_at > statement_timestamp()
+                   AND resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef ?? null})`;
+                            if ((held?.count ?? 0) >= maxHoldsPerHolder) {
+                                return { ok: false, code: 'hold_limit_reached', limit: maxHoldsPerHolder };
+                            }
+                            if (maxHeldHoursPerHolder !== undefined)
+                                heldSeconds = held?.seconds ?? 0;
+                        }
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
+                        if (ruling.rule)
+                            return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
+                        written = Math.max(bufferAfterMs, ruling.turnaroundMs);
+                        const reach = occupiedEnd({ end: params.end, bufferAfterMs: written });
+                        if (heldSeconds !== null &&
+                            maxHeldHoursPerHolder !== undefined &&
+                            heldSeconds + (reach.getTime() - params.start.getTime()) / 1000 >
+                                maxHeldHoursPerHolder * 3_600) {
+                            return { ok: false, code: 'held_time_limit_reached', limit: maxHeldHoursPerHolder };
+                        }
                         if (resource.tenant_ref !== null &&
                             !(await recurrenceCoversWrite(tx, {
                                 tenantRef: resource.tenant_ref,
                                 resourceId: params.resourceId,
                                 start: params.start,
-                                end: occupied,
+                                end: reach,
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
+                        await reapExpiredHolds(tx, params.resourceId, params.start, reach);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
-                resource_id, starts_at, ends_at, buffer_after_ms, status, expires_at, source
+                resource_id, starts_at, ends_at, buffer_after_ms, status, expires_at, source,
+                holder_ref, hold_group_id
               ) VALUES (
-                ${params.resourceId}, ${params.start}, ${params.end}, ${bufferAfterMs}, 'held',
-                now() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null}
+                ${params.resourceId}, ${params.start}, ${params.end}, ${written}, 'held',
+                statement_timestamp() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null},
+                ${holderRef ?? null}, ${params.groupId ?? null}
               )
-              RETURNING id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at, source`;
+              RETURNING id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at, source,
+                        hold_group_id`;
                         if (!row)
                             throw new Error('slotlock: hold insert returned no row');
                         if (keyed) {
@@ -2608,8 +2942,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     }
                     // A SECOND contention abort is treated as a loss too (structured, possibly with a null
                     // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
-                    await rollSeriesBehind(sql, params.resourceId, params.start, occupied);
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs);
+                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs: written }));
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, written);
                 }
             }
         },
@@ -2625,7 +2959,7 @@ function buildSlotlockStore(sql, options, refusal) {
           FROM slotlock.reservations hold
           JOIN slotlock.resources resource ON resource.id = hold.resource_id
          WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
-           AND hold.status = 'held' AND hold.expires_at > now()`;
+           AND hold.status = 'held' AND hold.expires_at > statement_timestamp()`;
             return row ? toHold(row) : null;
         },
         async listHolds(params) {
@@ -2643,13 +2977,45 @@ function buildSlotlockStore(sql, options, refusal) {
           FROM slotlock.reservations hold
           JOIN slotlock.resources resource ON resource.id = hold.resource_id
          WHERE hold.resource_id = ${params.resourceId} AND resource.tenant_ref = ${params.tenantRef}
-           AND hold.status = 'held' AND hold.expires_at > now()
+           AND hold.status = 'held' AND hold.expires_at > statement_timestamp()
            AND (${after.start}::timestamptz IS NULL
                 OR (hold.starts_at, hold.id) > (${after.start}::timestamptz, ${after.id}::uuid))
          ORDER BY hold.starts_at, hold.id
          LIMIT ${limit}`;
             return rows.map(toHold);
         },
+        async listAgenda(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const window = calendarWindow(params.window);
+            const limit = pageLimit(params.limit);
+            // A confirmed row without a tenant is a parity shadow, not a booking.
+            const rows = await sql `
+        SELECT entry.id, entry.resource_id, entry.starts_at, entry.ends_at, entry.status,
+               entry.external_ref, entry.expires_at, entry.source, entry.calendar_event_id,
+               event.summary
+          FROM slotlock.reservations entry
+          JOIN slotlock.resources resource ON resource.id = entry.resource_id
+          LEFT JOIN slotlock.calendar_events event ON event.id = entry.calendar_event_id
+         WHERE resource.tenant_ref = ${params.tenantRef}
+           AND entry.starts_at < ${window.end} AND entry.ends_at > ${window.start}
+           AND ((entry.status = 'held' AND entry.expires_at > statement_timestamp())
+                OR (entry.status = 'confirmed' AND entry.tenant_ref = ${params.tenantRef}))
+         ORDER BY entry.starts_at, entry.id
+         LIMIT ${limit}`;
+            return rows.map((row) => ({
+                id: row.id,
+                resourceId: row.resource_id,
+                start: row.starts_at,
+                end: row.ends_at,
+                kind: row.status === 'held' ? 'hold' : row.calendar_event_id ? 'event' : 'booking',
+                reference: row.status === 'held' || row.calendar_event_id ? null : row.external_ref,
+                summary: row.summary,
+                expiresAt: row.status === 'held' ? row.expires_at : null,
+                source: row.source,
+            }));
+        },
         async getReservation(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.externalRef)) {
                 throw invalidIdentityError('Slotlock booking identity must be 1-500 UTF-8 bytes');
@@ -2715,7 +3081,7 @@ function buildSlotlockStore(sql, options, refusal) {
            FOR SHARE`;
                 const [row] = await tx `
           SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
-                 revision, source, status, (status = 'held' AND expires_at > now()) AS live
+                 revision, source, status, (status = 'held' AND expires_at > statement_timestamp()) AS live
             FROM slotlock.reservations
            WHERE id = ${holdId}
            FOR UPDATE`;
@@ -2774,6 +3140,26 @@ function buildSlotlockStore(sql, options, refusal) {
             const tenantRef = holdTenantRef(options);
             if (!isValidResourceId(holdId))
                 return { ok: true, released: false };
+            if (options.holderRef !== undefined) {
+                if (!isValidIdentity(options.holderRef))
+                    return { ok: true, released: false };
+                const released = await sql `
+          WITH taken AS (
+            SELECT id, hold_group_id FROM slotlock.reservations
+             WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${options.holderRef}
+               AND (${tenantRef}::text IS NULL
+                    OR resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef}))
+          )
+          DELETE FROM slotlock.reservations hold
+           USING taken
+           WHERE hold.status = 'held' AND hold.holder_ref = ${options.holderRef}
+             AND (${tenantRef}::text IS NULL
+                  OR hold.resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef}))
+             AND (hold.id = taken.id
+                  OR (taken.hold_group_id IS NOT NULL AND hold.hold_group_id = taken.hold_group_id))
+          RETURNING hold.id`;
+                return { ok: true, released: released.some(({ id }) => id === holdId) };
+            }
             const rows = await sql `
         DELETE FROM slotlock.reservations
          WHERE id = ${holdId} AND status = 'held'
@@ -2814,7 +3200,7 @@ function buildSlotlockStore(sql, options, refusal) {
          WHERE resource_id = ${resourceId}
            AND starts_at < ${window.end}
            AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
-           AND (status <> 'held' OR expires_at > now())
+           AND (status <> 'held' OR expires_at > statement_timestamp())
          ORDER BY starts_at
          LIMIT ${options.limit ?? null}`;
             return rows.map((r) => ({ start: r.starts_at, end: r.occupied_ends_at }));
@@ -2866,7 +3252,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     return { ok: false, code: 'invalid_event' };
                 throw error;
             }
-            const payloadHash = putCommandHash({
+            const payloadHash = putCommandHash({ command: params, ownerRef, event });
+            const legacyPayloadHash = legacyPutCommandHash({
                 command: params,
                 ownerRef,
                 event,
@@ -2890,7 +3277,9 @@ function buildSlotlockStore(sql, options, refusal) {
                FOR UPDATE`;
                         const priorCommand = commands[0];
                         if (priorCommand) {
-                            if (priorCommand.operation !== 'put' || priorCommand.payload_hash !== payloadHash) {
+                            if (priorCommand.operation !== 'put' ||
+                                (priorCommand.payload_hash !== payloadHash &&
+                                    priorCommand.payload_hash !== legacyPayloadHash)) {
                                 return { ok: false, code: 'idempotency_conflict' };
                             }
                             return commandResult(priorCommand, true);
@@ -2980,7 +3369,47 @@ function buildSlotlockStore(sql, options, refusal) {
                         }
                         const eventId = found?.id ?? randomUUID();
                         const revision = currentRevision + 1;
-                        const reach = occurrenceSpan(occurrences);
+                        if (params.fromHold) {
+                            const { holdId, holderRef } = params.fromHold;
+                            if (!isValidResourceId(holdId) || !isValidIdentity(holderRef)) {
+                                return { ok: false, code: 'hold_not_found' };
+                            }
+                            const [hold] = await tx `
+                SELECT resource_id, starts_at, ends_at, hold_group_id FROM slotlock.reservations
+                 WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${holderRef}
+                   AND expires_at > statement_timestamp()
+                 FOR UPDATE`;
+                            if (!hold)
+                                return { ok: false, code: 'hold_not_found' };
+                            const [only] = occurrences;
+                            if (hold.resource_id !== params.resourceId ||
+                                occurrences.length !== 1 ||
+                                !only ||
+                                only.start < hold.starts_at ||
+                                only.end > hold.ends_at) {
+                                return { ok: false, code: 'hold_mismatch' };
+                            }
+                            // The hold and its alternatives give way to the event in this transaction.
+                            await tx `
+                DELETE FROM slotlock.reservations
+                 WHERE status = 'held' AND holder_ref = ${holderRef}
+                   AND (id = ${holdId}
+                        OR (${hold.hold_group_id}::uuid IS NOT NULL
+                            AND hold_group_id = ${hold.hold_group_id}::uuid))`;
+                        }
+                        let turnaroundMs = 0;
+                        if (params.enforceBookingRules === true && (event.transparency ?? 'opaque') === 'opaque') {
+                            const judge = await bookingJudge(tx, params.resourceId, defaultHours);
+                            for (const [index, occurrence] of occurrences.entries()) {
+                                // A held time's notice and advance were judged when it was held.
+                                const rule = judge.broken(occurrence, { first: index === 0 && !params.fromHold });
+                                if (rule)
+                                    return { ok: false, code: 'booking_rule_violated', rule };
+                            }
+                            turnaroundMs = judge.turnaroundMs;
+                        }
+                        const span = occurrenceSpan(occurrences);
+                        const reach = span && { start: span.start, end: new Date(span.end.getTime() + turnaroundMs) };
                         if ((event.transparency ?? 'opaque') === 'opaque' &&
                             reach &&
                             !(found && (await holdsEveryOccurrence(tx, found.id, params.resourceId, occurrences)))) {
@@ -3017,6 +3446,7 @@ function buildSlotlockStore(sql, options, refusal) {
                        roll_retry_at = NULL,
                        revision = ${revision},
                        source = ${params.source ?? null},
+                       buffer_after_ms = ${turnaroundMs},
                        updated_at = now()
                  WHERE id = ${eventId}
                    AND tenant_ref = ${params.tenantRef}
@@ -3028,7 +3458,8 @@ function buildSlotlockStore(sql, options, refusal) {
                   id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
                   summary, description, location, status, transparency, organizer, attendees,
                   reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
-                  materialized_ends_at, recurrence_cursor, recurrence_ends_by, revision, source
+                  materialized_ends_at, recurrence_cursor, recurrence_ends_by, revision, source,
+                  buffer_after_ms
                 ) VALUES (
                   ${eventId}, ${params.tenantRef}, ${ownerRef}, ${params.externalRef},
                   ${params.resourceId},
@@ -3042,7 +3473,7 @@ function buildSlotlockStore(sql, options, refusal) {
                   ${tx.json(eventExceptionsForJson(event.recurrence?.exceptions))},
                   ${materializationWindow.start}, ${materializationWindow.end},
                   ${seriesCursorJson(tx, series.cursor)}, ${recurrenceEndsBy}::text::timestamptz,
-                  ${revision}, ${params.source ?? null}
+                  ${revision}, ${params.source ?? null}, ${turnaroundMs}
                 )`;
                         }
                         // The normalized children are the queryable/canonical representation. The JSON
@@ -3055,6 +3486,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             event,
                             occurrences,
                             revision,
+                            bufferAfterMs: turnaroundMs,
                         });
                         await tx `
               INSERT INTO slotlock.calendar_event_commands (
@@ -3482,6 +3914,87 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             });
         },
+        async followZoneRules(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 100;
+            if (!(Number.isSafeInteger(limit) && limit >= 1 && limit <= 1_000)) {
+                throw new RangeError('Slotlock zone-rule batch must be 1-1,000 events');
+            }
+            const shifted = await sql `
+        SELECT event.id, event.resource_id, event.transparency, event.revision, event.starts_at, event.ends_at,
+               slotlock.zoned_instant(event.wall_starts_at, event.timezone) AS moved_start,
+               slotlock.zoned_instant(event.wall_ends_at, event.timezone) AS moved_end,
+               COALESCE((SELECT max(booking.buffer_after_ms) FROM slotlock.reservations booking
+                          WHERE booking.calendar_event_id = event.id), 0) AS buffer
+          FROM slotlock.calendar_events event
+         WHERE event.tenant_ref = ${params.tenantRef}
+           AND event.recurrence_rule IS NULL
+           AND event.starts_at > now()
+           AND event.zone_shift_reported_at IS NULL
+           AND slotlock.zoned_instant(event.wall_starts_at, event.timezone) IS NOT NULL
+           AND slotlock.zoned_instant(event.wall_ends_at, event.timezone) IS NOT NULL
+           AND (slotlock.zoned_instant(event.wall_starts_at, event.timezone) <> event.starts_at
+                OR slotlock.zoned_instant(event.wall_ends_at, event.timezone) <> event.ends_at)
+         ORDER BY event.starts_at, event.id
+         LIMIT ${limit}
+         FOR UPDATE OF event SKIP LOCKED`;
+            let moved = 0;
+            let conflicts = 0;
+            const report = async (event, type) => {
+                await sql `UPDATE slotlock.calendar_events SET zone_shift_reported_at = now() WHERE id = ${event.id}`;
+                await sql `
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          VALUES (${params.tenantRef}, ${event.resource_id}, ${type}, ${event.id},
+                  ${sql.json({
+                    id: event.id,
+                    resource_id: event.resource_id,
+                    start: event.starts_at.toISOString(),
+                    end: event.ends_at.toISOString(),
+                    zone_start: event.moved_start.toISOString(),
+                    zone_end: event.moved_end.toISOString(),
+                })}, 'slotlock:tzdata')`;
+            };
+            for (const event of shifted) {
+                if (!params.move) {
+                    await report(event, 'event.timezone_shifted');
+                    continue;
+                }
+                try {
+                    await inTransaction(sql, async (tx) => {
+                        const revision = Number(event.revision) + 1;
+                        await tx `SELECT set_config('slotlock.actor', 'slotlock:tzdata', true)`;
+                        await tx `
+              UPDATE slotlock.calendar_events
+                 SET starts_at = ${event.moved_start}, ends_at = ${event.moved_end},
+                     materialized_starts_at = ${event.moved_start}, materialized_ends_at = ${event.moved_end},
+                     revision = ${revision}, updated_at = now()
+               WHERE id = ${event.id}`;
+                        await replaceCalendarEventOccurrences(tx, {
+                            tenantRef: params.tenantRef,
+                            eventId: event.id,
+                            resourceId: event.resource_id,
+                            event: { transparency: event.transparency },
+                            occurrences: [
+                                { recurrenceId: event.moved_start.toISOString(), start: event.moved_start, end: event.moved_end },
+                            ],
+                            revision,
+                            bufferAfterMs: Number(event.buffer),
+                        });
+                    });
+                    moved++;
+                }
+                catch (error) {
+                    if (pgCode(error) !== EXCLUSION_VIOLATION)
+                        throw error;
+                    // It stays where it was; whoever owns it decides.
+                    await report(event, 'event.timezone_conflict');
+                    conflicts++;
+                }
+            }
+            return { shifted: shifted.length, moved, conflicts };
+        },
         async pruneBookingRetention(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
@@ -3492,10 +4005,12 @@ function buildSlotlockStore(sql, options, refusal) {
                     code: 'invalid_limit',
                 });
             }
-            const retentionDays = params.retentionDays ?? SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS;
-            if (!Number.isSafeInteger(retentionDays) ||
-                retentionDays < 1 ||
-                retentionDays > MAX_EVENT_COMMAND_RETENTION_DAYS) {
+            // Never under the default: a shorter retention trims the feed, not how long a retried write
+            // is answered as the first was.
+            const keepDays = params.retentionDays ?? Math.max(retentionDays, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS);
+            if (!Number.isSafeInteger(keepDays) ||
+                keepDays < 1 ||
+                keepDays > MAX_EVENT_COMMAND_RETENTION_DAYS) {
                 throw Object.assign(new Error('Slotlock retention window must be 1-3650 days'), {
                     code: 'invalid_retention_window',
                 });
@@ -3548,7 +4063,7 @@ function buildSlotlockStore(sql, options, refusal) {
              WHERE tombstone.tenant_ref = ${params.tenantRef}
                AND tombstone.stray
                AND tombstone.cancelled_at <
-                   clock_timestamp() - (${retentionDays}::int * interval '1 day')
+                   clock_timestamp() - (${keepDays}::int * interval '1 day')
              ORDER BY tombstone.cancelled_at, tombstone.external_ref
              LIMIT ${limit}
              FOR UPDATE OF tombstone SKIP LOCKED
@@ -3585,10 +4100,12 @@ function buildSlotlockStore(sql, options, refusal) {
                     code: 'invalid_limit',
                 });
             }
-            const retentionDays = params.retentionDays ?? SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS;
-            if (!Number.isSafeInteger(retentionDays) ||
-                retentionDays < 1 ||
-                retentionDays > MAX_EVENT_COMMAND_RETENTION_DAYS) {
+            // Never under the default: a shorter retention trims the feed, not how long a retried write
+            // is answered as the first was.
+            const keepDays = params.retentionDays ?? Math.max(retentionDays, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS);
+            if (!Number.isSafeInteger(keepDays) ||
+                keepDays < 1 ||
+                keepDays > MAX_EVENT_COMMAND_RETENTION_DAYS) {
                 throw Object.assign(new Error('Slotlock retention window must be 1-3650 days'), {
                     code: 'invalid_retention_window',
                 });
@@ -3602,7 +4119,7 @@ function buildSlotlockStore(sql, options, refusal) {
               FROM slotlock.calendar_event_commands command
              WHERE command.tenant_ref = ${params.tenantRef}
                AND command.created_at <
-                   clock_timestamp() - (${retentionDays}::int * interval '1 day')
+                   clock_timestamp() - (${keepDays}::int * interval '1 day')
              ORDER BY command.created_at, command.owner_ref, command.idempotency_key
              LIMIT ${limit}
              FOR UPDATE OF command SKIP LOCKED
@@ -3625,7 +4142,7 @@ function buildSlotlockStore(sql, options, refusal) {
              WHERE tombstone.tenant_ref = ${params.tenantRef}
                AND tombstone.owner_ref LIKE 'agent:%'
                AND tombstone.cancelled_at <
-                   clock_timestamp() - (${retentionDays}::int * interval '1 day')
+                   clock_timestamp() - (${keepDays}::int * interval '1 day')
                AND NOT EXISTS (
                  SELECT 1 FROM slotlock.calendar_event_commands command
                   WHERE command.tenant_ref = tombstone.tenant_ref
@@ -3644,7 +4161,7 @@ function buildSlotlockStore(sql, options, refusal) {
                AND tombstone.external_ref = candidate.external_ref
                AND tombstone.owner_ref LIKE 'agent:%'
                AND tombstone.cancelled_at <
-                   clock_timestamp() - (${retentionDays}::int * interval '1 day')
+                   clock_timestamp() - (${keepDays}::int * interval '1 day')
                AND NOT EXISTS (
                  SELECT 1 FROM slotlock.calendar_event_commands command
                   WHERE command.tenant_ref = tombstone.tenant_ref
@@ -3713,10 +4230,11 @@ function buildSlotlockStore(sql, options, refusal) {
                     if (params.revision !== currentRevision + 1) {
                         return { ok: false, code: 'revision_conflict' };
                     }
+                    // A fresh read ends a staleness: the next one is reported again.
                     await tx `
             UPDATE slotlock.calendar_coverage
                SET starts_at = ${window.start}, ends_at = ${window.end},
-                   revision = ${params.revision}, observed_at = now()
+                   revision = ${params.revision}, observed_at = now(), stale_reported_at = NULL
              WHERE tenant_ref = ${params.tenantRef}
                AND resource_id = ${params.resourceId}
                AND source = ${params.source}`;
@@ -3738,6 +4256,382 @@ function buildSlotlockStore(sql, options, refusal) {
                 return { ok: true, revision: params.revision, idempotent: false };
             });
         },
+        async recordCoverageFailure(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.source) || !isValidResourceId(params.resourceId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            const rows = await sql `
+        UPDATE slotlock.calendar_coverage
+           SET last_error = left(${String(params.error).replace(/[\u0000-\u001f\u007f]/g, ' ')}, 500),
+               last_error_at = now()
+         WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+           AND source = ${params.source}
+         RETURNING source`;
+            return rows.length > 0 ? { ok: true } : { ok: false, code: 'coverage_not_found' };
+        },
+        async deleteCoverage(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.source) || !isValidResourceId(params.resourceId)) {
+                return false;
+            }
+            const rows = await sql `
+        DELETE FROM slotlock.calendar_coverage
+         WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+           AND source = ${params.source}
+         RETURNING source`;
+            return rows.length > 0;
+        },
+        async listCoverage(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.resourceId)) {
+                throw invalidIdentityError('Slotlock coverage identity is invalid');
+            }
+            const maxAgeMs = params.maxAgeMs ?? 24 * 60 * 60 * 1000;
+            const rows = await sql `
+        SELECT source, starts_at, ends_at, revision, observed_at, last_error, last_error_at,
+               observed_at < now() - make_interval(secs => ${maxAgeMs / 1_000}) AS stale
+          FROM slotlock.calendar_coverage
+         WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+         ORDER BY source`;
+            return rows.map((row) => ({
+                source: row.source,
+                start: row.starts_at,
+                end: row.ends_at,
+                revision: Number(row.revision),
+                observedAt: row.observed_at,
+                lastError: row.last_error,
+                lastErrorAt: row.last_error_at,
+                stale: row.stale,
+            }));
+        },
+        async reportStaleCoverage(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const maxAgeMs = params.maxAgeMs ?? 24 * 60 * 60 * 1000;
+            const rows = await sql `
+        WITH stale AS (
+          UPDATE slotlock.calendar_coverage coverage SET stale_reported_at = now()
+           WHERE (coverage.tenant_ref, coverage.resource_id, coverage.source) IN (
+             SELECT tenant_ref, resource_id, source FROM slotlock.calendar_coverage
+              WHERE tenant_ref = ${params.tenantRef} AND stale_reported_at IS NULL
+                AND observed_at < now() - make_interval(secs => ${maxAgeMs / 1_000})
+              ORDER BY observed_at LIMIT ${params.limit ?? 100}
+              FOR UPDATE SKIP LOCKED)
+          RETURNING coverage.resource_id, coverage.source, coverage.observed_at, coverage.last_error
+        ), reported AS (
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          SELECT ${params.tenantRef}, stale.resource_id, 'coverage.stale', stale.source,
+                 jsonb_strip_nulls(jsonb_build_object(
+                   'resource_id', stale.resource_id, 'source', stale.source,
+                   'observed_at', stale.observed_at, 'last_error', stale.last_error)),
+                 'slotlock:maintenance'
+            FROM stale
+          RETURNING 1
+        )
+        SELECT count(*)::int AS count FROM reported`;
+            return rows[0]?.count ?? 0;
+        },
+        async checkInReservation(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.externalRef)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            return inTransaction(sql, async (tx) => {
+                const [row] = await tx `
+          WITH booking AS (
+            SELECT id, checked_in_at, ends_at <= statement_timestamp() AS ended,
+                   starts_at - make_interval(mins => ${SLOTLOCK_CHECK_IN_OPENS_MINUTES}) > statement_timestamp() AS early
+              FROM slotlock.reservations
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
+               AND calendar_event_id IS NULL AND status = 'confirmed'
+             FOR UPDATE
+          )
+          UPDATE slotlock.reservations reservation
+             SET checked_in_at = COALESCE(reservation.checked_in_at, statement_timestamp())
+            FROM booking
+           WHERE reservation.id = booking.id AND NOT booking.ended AND NOT booking.early
+          RETURNING reservation.id, reservation.resource_id, reservation.checked_in_at,
+                    false AS ended, booking.checked_in_at IS NULL AS first`;
+                if (!row) {
+                    const [booking] = await tx `
+            SELECT ends_at <= statement_timestamp() AS ended FROM slotlock.reservations
+             WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
+               AND calendar_event_id IS NULL AND status = 'confirmed'`;
+                    if (!booking)
+                        return { ok: false, code: 'reservation_not_found' };
+                    return { ok: false, code: booking.ended ? 'reservation_ended' : 'check_in_not_open' };
+                }
+                if (row.first) {
+                    await tx `
+            INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+            VALUES (${params.tenantRef}, ${row.resource_id}, 'reservation.checked_in', ${params.externalRef},
+                    jsonb_build_object('id', ${row.id}::uuid, 'reference', ${params.externalRef}::text,
+                                       'resource_id', ${row.resource_id}::uuid,
+                                       'checked_in_at', ${row.checked_in_at}::timestamptz),
+                    NULLIF(current_setting('slotlock.actor', true), ''))`;
+                }
+                return { ok: true, reference: params.externalRef, checkedInAt: row.checked_in_at };
+            });
+        },
+        async releaseNoShows(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 100;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1_000) {
+                throw invalidIdentityError('Slotlock no-show limit must be 1-1,000');
+            }
+            // A suspended tenant's bookings stay as they are.
+            if (refusal)
+                return 0;
+            const tenantRef = params.tenantRef;
+            // The same test twice: to find them, then under each reference's lock, as a cancel takes it.
+            const due = (tx, externalRef) => tx `
+        SELECT reservation.id, reservation.external_ref, reservation.revision, reservation.resource_id,
+               (resource.booking_rules->>'checkInMinutes')::int AS minutes
+          FROM slotlock.reservations reservation
+          JOIN slotlock.resources resource ON resource.id = reservation.resource_id
+         WHERE reservation.tenant_ref = ${tenantRef} AND resource.tenant_ref = ${tenantRef}
+           AND (${externalRef}::text IS NULL OR reservation.external_ref = ${externalRef})
+           AND reservation.status = 'confirmed' AND reservation.calendar_event_id IS NULL
+           AND reservation.checked_in_at IS NULL
+           AND resource.check_in_since IS NOT NULL AND resource.booking_rules ? 'checkInMinutes'
+           AND reservation.created_at >= resource.check_in_since
+           -- A booking made after its start (a walk-in) has its window from when it was made.
+           AND GREATEST(reservation.starts_at, reservation.created_at)
+               + make_interval(mins => (resource.booking_rules->>'checkInMinutes')::int)
+               <= statement_timestamp()
+           AND reservation.ends_at > statement_timestamp()
+         ORDER BY reservation.starts_at, reservation.id
+         LIMIT ${externalRef === null ? limit : 1}
+         ${externalRef === null ? tx `` : tx `FOR UPDATE OF reservation`}`;
+            let released = 0;
+            for (const candidate of await due(sql, null)) {
+                const done = await inTransaction(sql, async (tx) => {
+                    await lockExternalIdentity(tx, tenantRef, candidate.external_ref);
+                    const [row] = await due(tx, candidate.external_ref);
+                    if (!row || row.id !== candidate.id)
+                        return false;
+                    const revision = Number(row.revision) + 1;
+                    await tx `
+            INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray)
+            VALUES (${tenantRef}, ${row.external_ref}, ${revision}, false)`;
+                    await tx `DELETE FROM slotlock.reservations WHERE id = ${row.id}`;
+                    await tx `
+            INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+            VALUES (${tenantRef}, ${row.resource_id}, 'reservation.no_show', ${row.external_ref},
+                    jsonb_build_object('id', ${row.id}::uuid, 'reference', ${row.external_ref}::text,
+                                       'resource_id', ${row.resource_id}::uuid, 'revision', ${revision}::bigint,
+                                       'check_in_minutes', ${row.minutes}::int),
+                    'slotlock:maintenance')`;
+                    return true;
+                });
+                if (done)
+                    released += 1;
+            }
+            return released;
+        },
+        async joinWaitlist(params) {
+            const { tenantRef, holderRef } = params;
+            if (!isValidIdentity(tenantRef) || !isValidIdentity(holderRef))
+                return { ok: false, code: 'invalid_identity' };
+            if ((params.resourceId === undefined) === (params.pool === undefined)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            if (params.resourceId !== undefined && !isValidResourceId(params.resourceId)) {
+                return { ok: false, code: 'resource_not_found' };
+            }
+            if (params.pool !== undefined && !isPoolName(params.pool))
+                return { ok: false, code: 'invalid_pool' };
+            const window = { start: params.start, end: params.end };
+            if (!isFiniteWindow(window) ||
+                window.end.getTime() - window.start.getTime() > MAX_WAITLIST_WINDOW_MS) {
+                return { ok: false, code: 'invalid_window' };
+            }
+            const offerTtlMs = params.offerTtlMs ?? DEFAULT_OFFER_TTL_MS;
+            if (!Number.isSafeInteger(offerTtlMs) || offerTtlMs < 60_000 || offerTtlMs > 86_400_000) {
+                return { ok: false, code: 'invalid_ttl' };
+            }
+            return inTransaction(sql, async (tx) => {
+                if (params.resourceId !== undefined) {
+                    const [resource] = await tx `
+            SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
+             WHERE id = ${params.resourceId} AND tenant_ref = ${tenantRef}`;
+                    if (!resource)
+                        return { ok: false, code: 'resource_not_found' };
+                    if (resource.archived)
+                        return { ok: false, code: 'resource_archived' };
+                }
+                else {
+                    const [member] = await tx `
+            SELECT 1 FROM slotlock.resources
+             WHERE tenant_ref = ${tenantRef} AND pool_ref = ${params.pool ?? null} AND archived_at IS NULL
+             LIMIT 1`;
+                    if (!member)
+                        return { ok: false, code: 'pool_not_found' };
+                }
+                // Counted under the tenant's waitlist lock, which offers take too, so racing joins stop at the cap.
+                await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-waitlist', tenantRef])}, 0))`;
+                const [counts] = await tx `
+          SELECT count(*)::int AS tenant, count(*) FILTER (WHERE holder_ref = ${holderRef})::int AS holder
+            FROM slotlock.waitlist_entries WHERE tenant_ref = ${tenantRef} AND status = 'waiting'`;
+                if ((counts?.holder ?? 0) >= SLOTLOCK_MAX_WAITLIST_PER_HOLDER ||
+                    (counts?.tenant ?? 0) >= SLOTLOCK_MAX_WAITLIST_PER_TENANT) {
+                    return { ok: false, code: 'waitlist_limit_reached' };
+                }
+                const [row] = await tx `
+          INSERT INTO slotlock.waitlist_entries
+            (tenant_ref, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms)
+          VALUES (${tenantRef}, ${params.resourceId ?? null}, ${params.pool ?? null}, ${window.start},
+                  ${window.end}, ${holderRef}, ${offerTtlMs})
+          RETURNING ${tx.unsafe(WAITLIST_COLUMNS)}`;
+                return { ok: true, entry: toWaitlistEntry(row) };
+            });
+        },
+        async listWaitlist(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            if (params.resourceId !== undefined && !isValidResourceId(params.resourceId))
+                return [];
+            const limit = params.limit ?? 100;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1_000) {
+                throw invalidIdentityError('Slotlock waitlist limit must be 1-1,000');
+            }
+            const rows = await sql `
+        SELECT ${sql.unsafe(WAITLIST_COLUMNS)} FROM slotlock.waitlist_entries
+         WHERE tenant_ref = ${params.tenantRef}
+           AND (${params.resourceId ?? null}::uuid IS NULL OR resource_id = ${params.resourceId ?? null}::uuid)
+           AND (${params.pool ?? null}::text IS NULL OR pool_ref = ${params.pool ?? null})
+           AND (${params.holderRef ?? null}::text IS NULL OR holder_ref = ${params.holderRef ?? null})
+         ORDER BY created_at, id
+         LIMIT ${limit}`;
+            return rows.map(toWaitlistEntry);
+        },
+        async leaveWaitlist(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id))
+                return false;
+            return inTransaction(sql, async (tx) => {
+                // Waits for an offer pass that has this entry locked, so it leaves what that pass decided.
+                const [left] = await tx `
+          DELETE FROM slotlock.waitlist_entries
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+             AND (${params.holderRef ?? null}::text IS NULL OR holder_ref = ${params.holderRef ?? null})
+          RETURNING hold_id`;
+                if (!left)
+                    return false;
+                // An offer not yet taken goes too, freeing the time for the next who waits; a confirmed
+                // one is a booking now and stays.
+                if (left.hold_id) {
+                    await buildSlotlockStore(tx, options, null).releaseHold(left.hold_id, { tenantRef: params.tenantRef });
+                }
+                return true;
+            });
+        },
+        async offerWaitlist(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 50;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+                throw invalidIdentityError('Slotlock waitlist offer limit must be 1-100');
+            }
+            // A suspended tenant gets no new holds.
+            if (refusal)
+                return { offered: 0, expired: 0, next: null };
+            const tenantRef = params.tenantRef;
+            const after = params.after ?? null;
+            return inTransaction(sql, async (tx) => {
+                await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-waitlist', tenantRef])}, 0))`;
+                let expired = 0;
+                if (!after) {
+                    const [gone] = await tx `
+            WITH gone AS (
+              UPDATE slotlock.waitlist_entries SET status = 'expired'
+               WHERE tenant_ref = ${tenantRef} AND status = 'waiting' AND starts_at <= statement_timestamp()
+              RETURNING id, resource_id, pool_ref, starts_at, ends_at, holder_ref
+            ), reported AS (
+              INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+              SELECT ${tenantRef}, gone.resource_id, 'waitlist.expired', gone.id::text,
+                     jsonb_strip_nulls(jsonb_build_object(
+                       'id', gone.id, 'resource_id', gone.resource_id, 'pool', gone.pool_ref,
+                       'start', gone.starts_at, 'end', gone.ends_at, 'holder_ref', gone.holder_ref)),
+                     'slotlock:maintenance'
+                FROM gone
+              RETURNING 1
+            )
+            SELECT count(*)::int AS count FROM reported`;
+                    expired = gone?.count ?? 0;
+                    await tx `
+            DELETE FROM slotlock.waitlist_entries
+             WHERE tenant_ref = ${tenantRef} AND status <> 'waiting'
+               AND ends_at < statement_timestamp() - make_interval(days => ${retentionDays})`;
+                }
+                // One page in join order; the caller passes `next` back for the rest.
+                const waiting = await tx `
+          SELECT ${tx.unsafe(WAITLIST_COLUMNS)} FROM slotlock.waitlist_entries
+           WHERE tenant_ref = ${tenantRef} AND status = 'waiting'
+             AND (${after?.createdAt ?? null}::timestamptz IS NULL
+                  OR (created_at, id) > (${after?.createdAt ?? null}::timestamptz, ${after?.id ?? null}::uuid))
+           ORDER BY created_at, id
+           LIMIT ${limit}`;
+                // Holds made through a store on this transaction, each in a savepoint of its own.
+                const inner = buildSlotlockStore(tx, options, null);
+                let offered = 0;
+                for (const entry of waiting) {
+                    // Locked so a leave waits for this offer, and skipped if it left first.
+                    const [still] = await tx `
+            SELECT 1 FROM slotlock.waitlist_entries
+             WHERE id = ${entry.id} AND status = 'waiting' FOR UPDATE`;
+                    if (!still)
+                        continue;
+                    // Only resources whose window looks free are tried: a hold refused keeps its locks
+                    // until the transaction ends, so trying every member of a full pool would pile them up.
+                    const candidates = await tx `
+            SELECT resource.id FROM slotlock.resources resource
+             WHERE resource.tenant_ref = ${tenantRef} AND resource.archived_at IS NULL
+               AND (resource.id = ${entry.resource_id}::uuid
+                    OR (${entry.resource_id}::uuid IS NULL AND resource.pool_ref = ${entry.pool_ref}))
+               AND NOT EXISTS (
+                 SELECT 1 FROM slotlock.reservations taken
+                  WHERE taken.resource_id = resource.id
+                    AND tstzrange(taken.starts_at, COALESCE(taken.occupied_ends_at, taken.ends_at), '[)')
+                        && tstzrange(${entry.starts_at}::timestamptz, ${entry.ends_at}::timestamptz, '[)')
+                    AND (taken.status <> 'held' OR taken.expires_at > statement_timestamp()))
+             ORDER BY resource.id
+             LIMIT ${OFFER_CANDIDATES}`;
+                    for (const { id: resourceId } of candidates) {
+                        const hold = await inner.acquireHold({
+                            resourceId,
+                            start: entry.starts_at,
+                            end: entry.ends_at,
+                            ttlMs: Number(entry.offer_ttl_ms),
+                            tenantRef,
+                            holderRef: entry.holder_ref,
+                            source: 'slotlock:waitlist',
+                        });
+                        if (!hold.ok)
+                            continue;
+                        await tx `
+              UPDATE slotlock.waitlist_entries
+                 SET status = 'offered', hold_id = ${hold.hold.id}, offered_resource_id = ${resourceId},
+                     offered_at = statement_timestamp()
+               WHERE id = ${entry.id}`;
+                        await tx `
+              INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+              VALUES (${tenantRef}, ${resourceId}, 'waitlist.offered', ${entry.id},
+                      jsonb_strip_nulls(jsonb_build_object(
+                        'id', ${entry.id}::uuid, 'hold_id', ${hold.hold.id}::uuid,
+                        'resource_id', ${resourceId}::uuid, 'pool', ${entry.pool_ref}::text,
+                        'start', ${entry.starts_at}::timestamptz, 'end', ${entry.ends_at}::timestamptz,
+                        'expires_at', ${hold.hold.expiresAt}::timestamptz,
+                        'holder_ref', ${entry.holder_ref}::text)),
+                      'slotlock:maintenance')`;
+                        offered += 1;
+                        break;
+                    }
+                }
+                const last = waiting.length === limit ? waiting[waiting.length - 1] : undefined;
+                return { offered, expired, next: last ? { createdAt: last.created_at, id: last.id } : null };
+            });
+        },
         async getFreeBusy(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
@@ -3766,7 +4660,8 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const owner = await sql `
-        SELECT id FROM slotlock.resources
+        SELECT id, COALESCE((booking_rules->>'requireCertain')::boolean, false) AS require_certain
+          FROM slotlock.resources
          WHERE id = ${params.resourceId} AND tenant_ref = ${params.tenantRef}`;
             if (!owner[0]) {
                 throw Object.assign(new Error('Slotlock resource belongs to another tenant'), {
@@ -3780,7 +4675,7 @@ function buildSlotlockStore(sql, options, refusal) {
          WHERE reservation.resource_id = ${params.resourceId}
            AND reservation.starts_at < ${window.end}
            AND COALESCE(reservation.occupied_ends_at, reservation.ends_at) > ${window.start}
-           AND (reservation.status <> 'held' OR reservation.expires_at > now())
+           AND (reservation.status <> 'held' OR reservation.expires_at > statement_timestamp())
          ORDER BY reservation.starts_at
          LIMIT ${MAX_FREE_BUSY_INTERVALS + 1}`;
             if (busyRows.length > MAX_FREE_BUSY_INTERVALS) {
@@ -3823,7 +4718,15 @@ function buildSlotlockStore(sql, options, refusal) {
           FROM recurring_sources
          WHERE earliest_possible_at < ${window.end}`;
             const localRecurrenceRequired = Number(localRecurrenceCoverage?.source_count ?? 0) > 0;
-            const providerRequiredSources = callerRequiredSources.filter((source) => source !== SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE);
+            // A resource that requires certainty requires every sync recording coverage of it, as its
+            // writes do (bookingJudge), and judges them by the same day.
+            const requireCertain = owner[0].require_certain;
+            const recordedSources = requireCertain
+                ? (await sql `
+              SELECT source FROM slotlock.calendar_coverage
+               WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}`).map(({ source }) => source)
+                : [];
+            const providerRequiredSources = [...new Set([...callerRequiredSources, ...recordedSources])].filter((source) => source !== SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE);
             if (!localRecurrenceRequired && providerRequiredSources.length === 0) {
                 return {
                     busy: mergeIntervals(busyRows.map((row) => ({
@@ -3833,7 +4736,7 @@ function buildSlotlockStore(sql, options, refusal) {
                     coverage: { state: 'complete', missingSources: [] },
                 };
             }
-            const ageSeconds = coverageMaxAgeMs / 1000;
+            const ageSeconds = (requireCertain ? Math.min(coverageMaxAgeMs, CERTAIN_COVERAGE_MAX_AGE_MS) : coverageMaxAgeMs) / 1000;
             const coverageRows = providerRequiredSources.length === 0
                 ? []
                 : await sql `
@@ -3869,18 +4772,18 @@ function buildSlotlockStore(sql, options, refusal) {
             };
         },
         async findNextAvailableFor(params) {
-            const window = params.searchWindow;
-            if (!isFiniteWindow(window))
+            const asked = params.searchWindow;
+            if (!isFiniteWindow(asked))
                 throw invalidWindowError();
-            assertBoundedSearchWindow(window);
+            assertBoundedSearchWindow(asked);
             const { tenantRef } = params;
             if (tenantRef !== null && !isValidIdentity(tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             }
-            const bufferAfterMs = params.bufferAfterMs ?? 0;
-            if (!Number.isSafeInteger(bufferAfterMs) ||
-                bufferAfterMs < 0 ||
-                bufferAfterMs > MAX_BUFFER_AFTER_MS) {
+            const askedBufferMs = params.bufferAfterMs ?? 0;
+            if (!Number.isSafeInteger(askedBufferMs) ||
+                askedBufferMs < 0 ||
+                askedBufferMs > MAX_BUFFER_AFTER_MS) {
                 throw Object.assign(new Error('Slotlock bufferAfterMs must be a whole 0-30 days'), {
                     code: 'invalid_buffer',
                 });
@@ -3891,7 +4794,8 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!isValidResourceId(params.resourceId))
                 throw notFound();
             const [row] = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, visibility, archived_at
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility,
+               archived_at, statement_timestamp() AS now
           FROM slotlock.resources
          WHERE id = ${params.resourceId} AND tenant_ref IS NOT DISTINCT FROM ${tenantRef}`;
             if (!row)
@@ -3900,6 +4804,17 @@ function buildSlotlockStore(sql, options, refusal) {
                 return null;
             const resource = toResource(row);
             const rules = params.rules ?? resource.availabilityRules ?? [];
+            // Only what a booking made now may take: the resource's booking rules bound the search.
+            const search = bookingSearch({
+                rules: resource.bookingRules,
+                timezone: resource.timezone,
+                window: asked,
+                now: row.now,
+                bufferAfterMs: askedBufferMs,
+            });
+            if (!search)
+                return null;
+            const { window, bufferAfterMs } = search;
             // A slot's buffer may run past the window: the time it can reach must be proven free too.
             const reach = { start: window.start, end: new Date(window.end.getTime() + bufferAfterMs) };
             let busy;
@@ -3936,6 +4851,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 })),
                 windows: expandRules(rules, window, resource.timezone),
                 durationMs: params.durationMs,
+                ...(search.align ? { align: search.align } : {}),
             });
         },
         async suspendTenant(params) {