slotlock 0.5.1 → 0.5.3

package/store.js

@@ -1,8 +1,8 @@
 // DB mechanics for the Slotlock core — explicit `postgres` client in, structured results out.
 // Domain policy (who may reserve, pricing, holds) belongs to future callers; this layer owns the
 // reliable how: idempotent schema apply, EXCLUDE-arbitrated inserts with a structured conflict.
-import { SLOTLOCK_CHANGE_RETENTION_DAYS, slotlockEventFeedMethods } from './event-feed.js';
-import { bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
+import { SLOTLOCK_CHANGE_ORIGINS, SLOTLOCK_CHANGE_RETENTION_DAYS, isSlotlockChangeOrigin, slotlockCoverageSourceId, slotlockCoverageSourceIdSql, slotlockEventFeedMethods, } from './event-feed.js';
+import { bookingBufferBeforeMs, bookingSearchBlocked, bookingSearchReach, parseBookingRuleDefaults, parseEffectiveBookingRules, bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
 import { createHash, randomUUID } from 'node:crypto';
 import ICAL from 'ical.js';
 import { SLOTLOCK_CORE_DDL, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockTenantLockKey, } from './ddl.js';
@@ -24,6 +24,11 @@ const SERIALIZATION_FAILURE = '40001';
 const MAX_HOLD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 /** Turnaround cannot occupy a resource indefinitely because of a caller/unit error. */
 const MAX_BUFFER_AFTER_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * The longest leading buffer a row keeps (a day, as bufferBeforeMinutes allows): a row's occupied
+ * time starts at most this long before its start, so a read by start can still use the index.
+ */
+const MAX_BUFFER_BEFORE_MS = 24 * 60 * 60 * 1000;
 export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
 /**
  * Longest one-off event the store accepts (ten years and some leap days): long enough for any lease
@@ -77,6 +82,8 @@ const MAX_CONFIGURED_AGENT_OWNER_EVENT_QUOTA = 100_000;
 const MAX_CONFIGURED_AGENT_OWNER_COMMAND_QUOTA = 1_000_000;
 const SCHEMA_APPLY_LOCK = 'slotlock:schema-apply:v1';
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+// A coverage source as the feed names it (coverage.stale): its digest, never the source itself.
+const COVERAGE_SOURCE_ID = slotlockCoverageSourceIdSql('tenant_ref', 'source');
 const AGENT_EVENT_OWNER_PATTERN = /^agent:[0-9a-f]{64}$/;
 /** Store-owned coverage source for bounded, locally materialized recurring events. */
 export const SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE = 'slotlock:local-recurrence-materialization';
@@ -870,18 +877,23 @@ async function replaceCalendarEventOccurrences(tx, params) {
     for (const occurrence of params.occurrences) {
         let reservationId = null;
         if ((params.event.transparency ?? 'opaque') === 'opaque') {
-            const occupied = new Date(occurrence.end.getTime() + (params.bufferAfterMs ?? 0));
-            await reapExpiredHolds(tx, params.resourceId, occurrence.start, occupied);
+            const occupied = occupiedTime({
+                ...occurrence,
+                bufferBeforeMs: params.bufferBeforeMs ?? 0,
+                bufferAfterMs: params.bufferAfterMs ?? 0,
+            });
+            await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
             const derivedExternalRef = `calendar:${params.eventId}:${createHash('sha256')
                 .update(occurrence.recurrenceId)
                 .digest('hex')}`;
             const reservations = await tx `
         INSERT INTO slotlock.reservations (
           resource_id, tenant_ref, external_ref, starts_at, ends_at,
-          buffer_after_ms, revision, source, calendar_event_id
+          buffer_after_ms, buffer_before_ms, revision, source, calendar_event_id
         ) VALUES (
           ${params.resourceId}, ${params.tenantRef}, ${derivedExternalRef},
-          ${occurrence.start}, ${occurrence.end}, ${params.bufferAfterMs ?? 0}, ${params.revision},
+          ${occurrence.start}, ${occurrence.end}, ${params.bufferAfterMs ?? 0},
+          ${params.bufferBeforeMs ?? 0}, ${params.revision},
           ${`calendar-event:${params.eventId}`}, ${params.eventId}
         )
         RETURNING id`;
@@ -1069,46 +1081,53 @@ async function finishCalendarCancel(tx, params) {
  * The row an event write lost to. The write was rolled back, so the event's own rows from before
  * it are still there and are left out: they were to be replaced, and never block the event.
  */
-async function findCalendarOverlap(sql, resourceId, occurrences, eventId) {
+async function findCalendarOverlap(sql, resourceId, occurrences, eventId, buffers = { bufferBeforeMs: 0, bufferAfterMs: 0 }) {
     for (const occurrence of occurrences) {
-        const result = await overlapLoss(sql, resourceId, occurrence.start, occurrence.end, 0, undefined, eventId);
+        const result = await overlapLoss(sql, resourceId, occurrence.start, occurrence.end, buffers.bufferAfterMs, undefined, eventId, buffers.bufferBeforeMs);
         if (result.conflictingReservationId !== null)
             return result;
     }
     return { ok: false, code: 'overlap', conflictingReservationId: null };
 }
 /**
- * What the resource's booking rules say about a booking of `interval` made now (by the database's
- * clock, at this statement): the rule it breaks, if any, and the turnaround it must keep after it.
- * A resource without its own hours is judged against `defaultHours`.
+ * What the resource's booking rules (as they apply: its own over its pool's and tenant's defaults)
+ * say about a booking of `interval` made now (by the database's clock, at this statement): the rule
+ * it breaks, if any, and the buffers it must keep before and after it. A resource without its own
+ * hours is judged against `defaultHours`.
  */
 async function bookingRuling(tx, resourceId, interval, defaultHours) {
     const judge = await bookingJudge(tx, resourceId, defaultHours);
-    return { rule: judge.broken(interval), turnaroundMs: judge.turnaroundMs };
+    return {
+        rule: judge.broken(interval),
+        turnaroundMs: judge.turnaroundMs,
+        bufferBeforeMs: judge.bufferBeforeMs,
+    };
 }
 /** How recently a sync must have read a resource whose booking rules require certainty. */
 const CERTAIN_COVERAGE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /**
- * The resource's booking rules, read once, as a check of any interval booked now (by the database's
- * clock at this statement) and the turnaround a booking keeps.
+ * The resource's booking rules as they apply, read once, as a check of any interval booked now (by
+ * the database's clock at this statement) and the buffers a booking keeps.
  */
 async function bookingJudge(tx, resourceId, defaultHours) {
     const [row] = await tx `
-    SELECT booking_rules, availability_rules, timezone, statement_timestamp() AS now
+    SELECT ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}, availability_rules, timezone,
+           statement_timestamp() AS now
       FROM slotlock.resources WHERE id = ${resourceId}`;
-    if (!row || row.booking_rules === null || row.booking_rules === undefined) {
-        return { broken: () => null, turnaroundMs: 0 };
+    if (!row || row.effective_booking_rules === null || row.effective_booking_rules === undefined) {
+        return { broken: () => null, turnaroundMs: 0, bufferBeforeMs: 0 };
     }
-    const { bookingRules: rules, availabilityRules } = toResource({
+    const { effectiveBookingRules: rules, availabilityRules } = toResource({
         id: resourceId,
         external_ref: null,
         tenant_ref: null,
         timezone: row.timezone,
         availability_rules: row.availability_rules,
-        booking_rules: row.booking_rules,
+        booking_rules: null,
         pool_ref: null,
         visibility: 'shared',
         archived_at: null,
+        effective_booking_rules: row.effective_booking_rules,
     });
     const hours = availabilityRules ?? defaultHours;
     // Every sync covering the resource, and whether it was read within a day, by the same clock.
@@ -1120,9 +1139,10 @@ async function bookingJudge(tx, resourceId, defaultHours) {
             FROM slotlock.calendar_coverage WHERE resource_id = ${resourceId}`
         : [];
     const turnaroundMs = bookingBufferAfterMs(rules);
-    // The booking and the turnaround it keeps, as a search judges the slot.
+    const bufferBeforeMs = bookingBufferBeforeMs(rules);
+    // The booking and the buffers it keeps, as a search judges the slot.
     const uncertain = (interval) => coverage.some((source) => !source.fresh ||
-        source.starts_at > interval.start ||
+        source.starts_at.getTime() > interval.start.getTime() - bufferBeforeMs ||
         source.ends_at.getTime() < interval.end.getTime() + turnaroundMs);
     // A later occurrence of a series is judged on its step and hours only: notice and advance are
     // about when the booking was made, which its first occurrence answers.
@@ -1130,6 +1150,7 @@ async function bookingJudge(tx, resourceId, defaultHours) {
         ? undefined
         : {
             ...(rules.slotStepMinutes !== undefined ? { slotStepMinutes: rules.slotStepMinutes } : {}),
+            ...(rules.stepOffsetMinutes !== undefined ? { stepOffsetMinutes: rules.stepOffsetMinutes } : {}),
             ...(rules.enforceHours !== undefined ? { enforceHours: rules.enforceHours } : {}),
         };
     return {
@@ -1141,6 +1162,7 @@ async function bookingJudge(tx, resourceId, defaultHours) {
             now: row.now,
         }) ?? (uncertain(interval) ? 'uncertain' : null),
         turnaroundMs,
+        bufferBeforeMs,
     };
 }
 function sameExternalPayload(row, params, turnaroundMs = 0) {
@@ -1153,9 +1175,6 @@ function sameExternalPayload(row, params, turnaroundMs = 0) {
         Number(row.revision) === params.revision &&
         row.source === (params.source ?? null));
 }
-function occupiedEnd(params) {
-    return new Date(params.end.getTime() + params.bufferAfterMs);
-}
 async function lockExternalIdentity(tx, tenantRef, externalRef) {
     // JSON encoding is unambiguous for this pair and contains no NUL byte (Postgres text rejects
     // U+0000). The database hashes it to one transaction-scoped lock key.
@@ -1185,6 +1204,8 @@ function pgCode(err) {
 }
 /** Members a pool booking or search considers at most, in id order. */
 export const SLOTLOCK_MAX_POOL_MEMBERS = 100;
+/** The most pools of one tenant that may have default booking rules (`setBookingRuleDefaults`). */
+export const SLOTLOCK_MAX_POOL_RULE_DEFAULTS = 1_000;
 const WAITLIST_COLUMNS = 'id, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms, status, hold_id, offered_resource_id, offered_at, created_at';
 function toWaitlistEntry(row) {
     return {
@@ -1210,6 +1231,30 @@ function invalidPoolError() {
         code: 'invalid_pool',
     });
 }
+/**
+ * A resource row's booking rules as they apply (jsonb; NULL for none): the tenant's defaults,
+ * overlaid by its pool's, overlaid by its own, field by field, so one set at a narrower level wins.
+ * Read from a row of slotlock.resources named `resources` (no alias).
+ */
+const EFFECTIVE_BOOKING_RULES = `NULLIF(
+  COALESCE((SELECT defaults.rules FROM slotlock.booking_rule_defaults defaults
+             WHERE defaults.tenant_ref = resources.tenant_ref AND defaults.pool_ref = ''), '{}'::jsonb)
+  || COALESCE((SELECT defaults.rules FROM slotlock.booking_rule_defaults defaults
+                WHERE defaults.tenant_ref = resources.tenant_ref
+                  AND defaults.pool_ref = resources.pool_ref), '{}'::jsonb)
+  || COALESCE(resources.booking_rules, '{}'::jsonb),
+  '{}'::jsonb) AS effective_booking_rules`;
+/** What rules Slotlock did not write read as: no booking passes them. */
+const REFUSE_EVERY_BOOKING = Object.freeze({ maxAdvanceDays: 1, minNoticeMinutes: 525_600 });
+/** Rules read back from storage: written validated, so anything else refuses every booking. */
+function storedBookingRules(value) {
+    try {
+        return parseBookingRules(value);
+    }
+    catch {
+        return { ...REFUSE_EVERY_BOOKING };
+    }
+}
 function toResource(row) {
     const resource = {
         id: row.id,
@@ -1234,11 +1279,19 @@ function toResource(row) {
     if (row.booking_rules !== null && row.booking_rules !== undefined) {
         // Written through setResourceBookingRules, which validates; anything else reads as refusing
         // every booking, never as no rule.
-        try {
-            resource.bookingRules = parseBookingRules(row.booking_rules);
+        resource.bookingRules = storedBookingRules(row.booking_rules);
+    }
+    if (row.effective_booking_rules !== null && row.effective_booking_rules !== undefined) {
+        // Merged from levels each validated alone, so only their combination can disagree (an offset
+        // from one level over a shorter step from another): that one is read modulo the step. A field
+        // invalid in itself was not written by Slotlock, and refuses every booking, as stored rules do.
+        const { rules, dropped } = parseEffectiveBookingRules(row.effective_booking_rules);
+        if (dropped.length > 0) {
+            console.warn(JSON.stringify({ message: 'slotlock refused invalid booking rules', resource: row.id, dropped }));
+            resource.effectiveBookingRules = { ...REFUSE_EVERY_BOOKING };
         }
-        catch {
-            resource.bookingRules = { maxAdvanceDays: 1, minNoticeMinutes: 525_600 };
+        else if (Object.keys(rules).length > 0) {
+            resource.effectiveBookingRules = rules;
         }
     }
     return resource;
@@ -1268,7 +1321,7 @@ async function upsertResource(executor, params) {
         WHERE tenant_ref IS NOT NULL AND external_ref IS NOT NULL
       DO UPDATE SET timezone = EXCLUDED.timezone
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     else if (params.externalRef !== undefined) {
         rows = await executor `
@@ -1278,13 +1331,13 @@ async function upsertResource(executor, params) {
         WHERE tenant_ref IS NULL AND external_ref IS NOT NULL
       DO UPDATE SET external_ref = EXCLUDED.external_ref
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     else {
         rows = await executor `
       INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
       VALUES (NULL, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     const row = rows[0];
     if (!row) {
@@ -1307,7 +1360,7 @@ async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
            summary, description, location, status, transparency, organizer, attendees,
            reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
            materialized_ends_at, recurrence_cursor, revision, source, created_at,
-           updated_at, recurrence_ends_by IS NULL AS ends_by_missing, buffer_after_ms
+           updated_at, recurrence_ends_by IS NULL AS ends_by_missing, buffer_after_ms, buffer_before_ms
       FROM slotlock.calendar_events
      WHERE id = ${eventId} AND tenant_ref = ${tenantRef}
      FOR UPDATE`;
@@ -1330,6 +1383,7 @@ async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
         occurrences,
         revision: Number(row.revision),
         bufferAfterMs: Number(row.buffer_after_ms ?? 0),
+        bufferBeforeMs: Number(row.buffer_before_ms ?? 0),
     });
     // A series stored before 0.3 learns when it ends at its first roll.
     const endsBy = row.ends_by_missing ? recurrenceEndsByColumn(event) : null;
@@ -1697,8 +1751,28 @@ async function forgetExpiredHoldAnswers(tx, tenantRef, limit) {
     return Number(row?.deleted ?? 0);
 }
 /**
- * Delete expired held rows whose occupied time (buffer included, as the EXCLUDE constraint reads
- * it) overlaps the requested window, whose `end` is its own occupied end, in deterministic id
+ * The time a booking of [start, end) keeping these buffers occupies, as the exclusion constraint
+ * reads it: from its start less its leading buffer to its end plus its trailing one.
+ */
+function occupiedTime(params) {
+    return {
+        start: new Date(params.start.getTime() - (params.bufferBeforeMs ?? 0)),
+        end: new Date(params.end.getTime() + (params.bufferAfterMs ?? 0)),
+    };
+}
+/**
+ * A row's occupied time starts before `end`: a condition on its occupied start that still reads the
+ * (resource_id, starts_at, ends_at) index, since no row starts more than a day after it.
+ */
+function occupiedStartsBefore(executor, end, alias) {
+    const column = (name) => executor.unsafe(alias === undefined ? name : `${alias}.${name}`);
+    return executor `(${column('starts_at')} < ${new Date(end.getTime() + MAX_BUFFER_BEFORE_MS)}
+                   AND COALESCE(${column('occupied_starts_at')}, ${column('starts_at')}) < ${end})`;
+}
+/**
+ * Delete expired held rows whose occupied time (buffers included, as the EXCLUDE constraint reads
+ * it) overlaps the requested window, whose `start` and `end` are its own occupied start and end
+ * (`occupiedTime`), in deterministic id
  * order under FOR UPDATE — two concurrent reapers lock the same rows in the same order (no
  * deadlock), the loser simply finds them gone. Runs inside the caller's transaction, immediately
  * before its INSERT, so the EXCLUDE arbiter only ever sees LIVE occupation.
@@ -1711,7 +1785,7 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
         WHERE resource_id = ${resourceId}
           AND status = 'held'
           AND expires_at <= statement_timestamp()
-          AND starts_at < ${end}
+          AND ${occupiedStartsBefore(tx, end)}
           AND COALESCE(occupied_ends_at, ends_at) > ${start}
         ORDER BY id
         FOR UPDATE
@@ -1723,7 +1797,7 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
  * loser's transaction start (constraint saw it) and this lookup (live filter hides it) — an
  * immediate retry reaps it and wins.
  */
-async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, excludeReservationId, excludeCalendarEventId) {
+async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, excludeReservationId, excludeCalendarEventId, bufferBeforeMs = 0) {
     const winners = await sql `
     SELECT id FROM slotlock.reservations
      WHERE resource_id = ${resourceId}
@@ -1731,12 +1805,12 @@ async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, exclu
        AND (${excludeCalendarEventId ?? null}::uuid IS NULL
             OR calendar_event_id IS DISTINCT FROM ${excludeCalendarEventId ?? null}::uuid)
        AND tstzrange(
-             starts_at,
+             COALESCE(occupied_starts_at, starts_at),
              COALESCE(occupied_ends_at, ends_at),
              '[)'
            ) && tstzrange(
-             ${start},
-             ${end} + ${bufferAfterMs} * interval '1 millisecond',
+             ${start}::timestamptz - ${bufferBeforeMs} * interval '1 millisecond',
+             ${end}::timestamptz + ${bufferAfterMs} * interval '1 millisecond',
              '[)'
            )
        AND (status <> 'held' OR expires_at > statement_timestamp())
@@ -1821,6 +1895,7 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'deleteResource',
     'setResourceAvailability',
     'setResourceBookingRules',
+    'setBookingRuleDefaults',
     'setResourcePool',
     'setTenantAvailability',
     'createReservation',
@@ -1842,6 +1917,11 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'checkInReservation',
     'joinWaitlist',
     'leaveWaitlist',
+    'putAssistantSettings',
+    'deleteAssistantSettings',
+    'putAssistantConversation',
+    'settleAssistantAction',
+    'deleteAssistantConversation',
 ]);
 function tenantSuspendedError() {
     return Object.assign(new Error('Slotlock tenant is suspended: it may read, and write nothing'), {
@@ -2146,6 +2226,16 @@ function buildSlotlockStore(sql, options, refusal) {
                     code: 'invalid_identity',
                 });
             }
+            const origin = options?.origin;
+            if (origin !== undefined && !isSlotlockChangeOrigin(origin)) {
+                throw Object.assign(new Error(`Slotlock origin must be one of ${SLOTLOCK_CHANGE_ORIGINS.join(', ')}`), {
+                    code: 'invalid_identity',
+                });
+            }
+            const keyId = options?.keyId;
+            if (keyId !== undefined && !isValidResourceId(keyId)) {
+                throw Object.assign(new Error('Slotlock key id must be a UUID'), { code: 'invalid_identity' });
+            }
             const release = await tenantSlots?.(tenantRef, options?.signal);
             // A lock wait that timed out leaves the transaction unusable, so the reset below fails with
             // another error in its place: noted here as it happens.
@@ -2162,6 +2252,8 @@ function buildSlotlockStore(sql, options, refusal) {
                 const previous = await tx `
             SELECT current_setting(${configuredTenantSetting}, true) AS value,
                    current_setting('slotlock.actor', true) AS actor,
+                   current_setting('slotlock.origin', true) AS origin,
+                   current_setting('slotlock.key_id', true) AS key,
                    current_setting('transaction_isolation') AS isolation,
                    pg_advisory_xact_lock_shared(
                      hashtextextended(${slotlockTenantLockKey(tenantRef)}, 0)
@@ -2169,6 +2261,9 @@ function buildSlotlockStore(sql, options, refusal) {
                 const [context] = await tx `
             SELECT set_config(${configuredTenantSetting}, ${tenantRef}, true) AS tenant,
                    set_config('slotlock.actor', ${actor ?? ''}, true) AS actor,
+                   set_config('slotlock.origin', COALESCE(${origin ?? null}::text,
+                     NULLIF(current_setting('slotlock.origin', true), ''), 'library'), true) AS origin,
+                   set_config('slotlock.key_id', ${keyId ?? ''}, true) AS key,
                    slotlock.tenant_suspended(${tenantRef}) AS suspended`.catch((error) => {
                     throw suspensionCheckRefusal(error);
                 });
@@ -2190,7 +2285,9 @@ function buildSlotlockStore(sql, options, refusal) {
                 }
                 finally {
                     await tx `SELECT set_config(${configuredTenantSetting}, ${previous[0]?.value ?? ''}, true),
-                            set_config('slotlock.actor', ${previous[0]?.actor ?? ''}, true)`;
+                            set_config('slotlock.actor', ${previous[0]?.actor ?? ''}, true),
+                            set_config('slotlock.origin', ${previous[0]?.origin ?? ''}, true),
+                            set_config('slotlock.key_id', ${previous[0]?.key ?? ''}, true)`;
                 }
             }, 'read committed')
                 .catch((error) => {
@@ -2251,7 +2348,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})`;
@@ -2269,7 +2366,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET availability_rules = ${rules}::jsonb
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2301,10 +2398,74 @@ function buildSlotlockStore(sql, options, refusal) {
                END
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
         RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-                  visibility, archived_at`;
+                  visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
+        async setBookingRuleDefaults(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (params.pool !== null && !isPoolName(params.pool))
+                throw invalidPoolError();
+            const pool = params.pool ?? '';
+            if (params.rules === null) {
+                await sql `
+          DELETE FROM slotlock.booking_rule_defaults
+           WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${pool}`;
+                return null;
+            }
+            let rules;
+            try {
+                rules = parseBookingRuleDefaults(params.rules);
+            }
+            catch (error) {
+                throw Object.assign(new Error(error.message), {
+                    code: 'invalid_booking_rules',
+                });
+            }
+            const tenantRef = params.tenantRef;
+            return inTransaction(sql, async (tx) => {
+                if (pool !== '') {
+                    // Counted under the tenant's lock, so racing writes stop at the cap.
+                    // The count after the lock sees every committed row only under READ COMMITTED.
+                    await assertReadCommitted(tx);
+                    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${`slotlock:rule-defaults:${tenantRef}`}, 0))`;
+                    const [counted] = await tx `
+            SELECT count(*)::int AS pools, bool_or(pool_ref = ${pool}) IS TRUE AS exists
+              FROM slotlock.booking_rule_defaults
+             WHERE tenant_ref = ${tenantRef} AND pool_ref <> ''`;
+                    if (!counted?.exists && (counted?.pools ?? 0) >= SLOTLOCK_MAX_POOL_RULE_DEFAULTS) {
+                        throw Object.assign(new Error(`Slotlock keeps default booking rules for at most ${SLOTLOCK_MAX_POOL_RULE_DEFAULTS} pools a tenant`), { code: 'pool_rules_limit_reached', limit: SLOTLOCK_MAX_POOL_RULE_DEFAULTS });
+                    }
+                }
+                await tx `
+          INSERT INTO slotlock.booking_rule_defaults (tenant_ref, pool_ref, rules)
+          VALUES (${tenantRef}, ${pool}, ${tx.json({ ...rules })}::jsonb)
+          ON CONFLICT (tenant_ref, pool_ref)
+          DO UPDATE SET rules = EXCLUDED.rules, updated_at = statement_timestamp()`;
+                return rules;
+            });
+        },
+        async getBookingRuleDefaults(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const rows = await sql `
+        SELECT pool_ref, rules FROM slotlock.booking_rule_defaults
+         WHERE tenant_ref = ${params.tenantRef}
+         ORDER BY pool_ref
+         LIMIT ${SLOTLOCK_MAX_POOL_RULE_DEFAULTS + 1}`;
+            const defaults = { tenant: null, pools: {} };
+            for (const row of rows) {
+                const rules = storedBookingRules(row.rules);
+                if (row.pool_ref === '')
+                    defaults.tenant = rules;
+                else
+                    defaults.pools[row.pool_ref] = rules;
+            }
+            return defaults;
+        },
         async setResourcePool(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
                 throw Object.assign(new Error('Slotlock resource identity is invalid'), {
@@ -2317,7 +2478,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources SET pool_ref = ${params.pool}
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
         RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-                  visibility, archived_at`;
+                  visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2328,7 +2489,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 throw invalidPoolError();
             const rows = await sql `
         SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-               visibility, archived_at
+               visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
            AND archived_at IS NULL
@@ -2381,7 +2542,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
@@ -2401,7 +2562,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET archived_at = COALESCE(archived_at, clock_timestamp())
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             return row ? toResource(row) : null;
         },
         async restoreResource(params) {
@@ -2412,7 +2573,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET archived_at = NULL
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             return row ? toResource(row) : null;
         },
         async deleteResource(params) {
@@ -2460,6 +2621,9 @@ function buildSlotlockStore(sql, options, refusal) {
             // A booking on a tenant's resource takes the tenant and its own id as reference, so it can be
             // cancelled and moved like any other; one on a resource with no tenant stays tenantless.
             const id = randomUUID();
+            // The buffers written, for the overlap answer if the write loses.
+            let bufferBeforeMs = 0;
+            let bufferAfterMs = 0;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2480,24 +2644,27 @@ function buildSlotlockStore(sql, options, refusal) {
                         const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
                         if (ruling.rule)
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
-                        const occupied = new Date(params.end.getTime() + ruling.turnaroundMs);
+                        bufferBeforeMs = ruling.bufferBeforeMs;
+                        bufferAfterMs = ruling.turnaroundMs;
+                        const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
                         if (resource.tenant_ref !== null &&
                             !(await recurrenceCoversWrite(tx, {
                                 tenantRef: resource.tenant_ref,
                                 resourceId: params.resourceId,
-                                start: params.start,
-                                end: occupied,
+                                ...occupied,
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
+                        await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
-                id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms, source
+                id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
+                buffer_before_ms, source
               ) VALUES (
                 ${id}, ${params.resourceId}, ${resource.tenant_ref},
                 ${resource.tenant_ref === null ? null : id},
-                ${params.start}, ${params.end}, ${ruling.turnaroundMs}, ${params.source ?? null}
+                ${params.start}, ${params.end}, ${ruling.turnaroundMs}, ${ruling.bufferBeforeMs},
+                ${params.source ?? null}
               )
               RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                         buffer_after_ms, revision, source`;
@@ -2518,8 +2685,9 @@ function buildSlotlockStore(sql, options, refusal) {
                     }
                     // A SECOND contention abort is treated as a loss too (structured, possibly with a null
                     // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
-                    await rollSeriesBehind(sql, params.resourceId, params.start, params.end);
-                    return overlapLoss(sql, params.resourceId, params.start, params.end);
+                    const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
+                    await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs, undefined, undefined, bufferBeforeMs);
                 }
             }
         },
@@ -2530,6 +2698,7 @@ function buildSlotlockStore(sql, options, refusal) {
             if (params.revision !== 1)
                 return { ok: false, code: 'invalid_revision' };
             let written = params.bufferAfterMs;
+            let writtenBefore = 0;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2574,23 +2743,24 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
                         const bufferAfterMs = Math.max(params.bufferAfterMs, ruling.turnaroundMs);
                         written = bufferAfterMs;
-                        const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
+                        writtenBefore = ruling.bufferBeforeMs;
+                        const occupied = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs });
                         if (!(await recurrenceCoversWrite(tx, {
                             tenantRef: params.tenantRef,
                             resourceId: params.resourceId,
-                            start: params.start,
-                            end: occupied,
+                            ...occupied,
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
+                        await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               INSERT INTO slotlock.reservations (
                 resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
-                revision, source
+                buffer_before_ms, revision, source
               ) VALUES (
                 ${params.resourceId}, ${params.tenantRef}, ${params.externalRef}, ${params.start},
-                ${params.end}, ${bufferAfterMs}, ${params.revision}, ${params.source ?? null}
+                ${params.end}, ${bufferAfterMs}, ${writtenBefore}, ${params.revision},
+                ${params.source ?? null}
               )
               RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                         buffer_after_ms, revision, source`;
@@ -2610,8 +2780,9 @@ function buildSlotlockStore(sql, options, refusal) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs: written }));
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, written);
+                    const occupied = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs: written });
+                    await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, written, undefined, undefined, writtenBefore);
                 }
             }
         },
@@ -2621,6 +2792,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 return invalid;
             let currentReservationId;
             let bufferAfterMs = params.bufferAfterMs;
+            let bufferBeforeMs = 0;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2663,21 +2835,23 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (ruling.rule)
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
                         bufferAfterMs = Math.max(params.bufferAfterMs, ruling.turnaroundMs);
+                        bufferBeforeMs = ruling.bufferBeforeMs;
+                        const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
                         if (!(await recurrenceCoversWrite(tx, {
                             tenantRef: params.tenantRef,
                             resourceId: params.resourceId,
-                            start: params.start,
-                            end: occupiedEnd({ end: params.end, bufferAfterMs }),
+                            ...occupied,
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs }));
+                        await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               UPDATE slotlock.reservations
                  SET resource_id = ${params.resourceId},
                      starts_at = ${params.start},
                      ends_at = ${params.end},
                      buffer_after_ms = ${bufferAfterMs},
+                     buffer_before_ms = ${bufferBeforeMs},
                      revision = ${params.revision},
                      source = ${params.source ?? null},
                      -- A check-in is for the time it was made for: a move to another start clears it.
@@ -2704,9 +2878,9 @@ function buildSlotlockStore(sql, options, refusal) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
-                    await rollSeriesBehind(sql, params.resourceId, params.start, occupied);
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs, currentReservationId);
+                    const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
+                    await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs, currentReservationId, undefined, bufferBeforeMs);
                 }
             }
         },
@@ -2820,8 +2994,10 @@ function buildSlotlockStore(sql, options, refusal) {
                 ...(holderRef !== undefined ? { holderRef } : {}),
             });
             const ttlSeconds = params.ttlMs / 1000;
-            // The buffer written: the one asked for, raised to the resource's turnaround.
+            // The buffers written: the one asked for, raised to the resource's turnaround, and its rule's
+            // leading buffer.
             let written = bufferAfterMs;
+            let writtenBefore = 0;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2870,7 +3046,8 @@ function buildSlotlockStore(sql, options, refusal) {
                             const [held] = await tx `
                 SELECT count(*)::int AS count,
                        COALESCE(sum(extract(epoch FROM
-                         ends_at + buffer_after_ms * interval '1 millisecond' - starts_at)), 0)::float8
+                         ends_at + (buffer_after_ms + buffer_before_ms) * interval '1 millisecond'
+                           - starts_at)), 0)::float8
                          AS seconds
                   FROM slotlock.reservations
                  WHERE holder_ref = ${holderRef} AND tenant_ref IS NULL AND status = 'held'
@@ -2886,10 +3063,11 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (ruling.rule)
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
                         written = Math.max(bufferAfterMs, ruling.turnaroundMs);
-                        const reach = occupiedEnd({ end: params.end, bufferAfterMs: written });
+                        writtenBefore = ruling.bufferBeforeMs;
+                        const reach = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs: written });
                         if (heldSeconds !== null &&
                             maxHeldHoursPerHolder !== undefined &&
-                            heldSeconds + (reach.getTime() - params.start.getTime()) / 1000 >
+                            heldSeconds + (reach.end.getTime() - reach.start.getTime()) / 1000 >
                                 maxHeldHoursPerHolder * 3_600) {
                             return { ok: false, code: 'held_time_limit_reached', limit: maxHeldHoursPerHolder };
                         }
@@ -2897,18 +3075,17 @@ function buildSlotlockStore(sql, options, refusal) {
                             !(await recurrenceCoversWrite(tx, {
                                 tenantRef: resource.tenant_ref,
                                 resourceId: params.resourceId,
-                                start: params.start,
-                                end: reach,
+                                ...reach,
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, reach);
+                        await reapExpiredHolds(tx, params.resourceId, reach.start, reach.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
-                resource_id, starts_at, ends_at, buffer_after_ms, status, expires_at, source,
-                holder_ref, hold_group_id
+                resource_id, starts_at, ends_at, buffer_after_ms, buffer_before_ms, status,
+                expires_at, source, holder_ref, hold_group_id
               ) VALUES (
-                ${params.resourceId}, ${params.start}, ${params.end}, ${written}, 'held',
+                ${params.resourceId}, ${params.start}, ${params.end}, ${written}, ${writtenBefore}, 'held',
                 statement_timestamp() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null},
                 ${holderRef ?? null}, ${params.groupId ?? null}
               )
@@ -2942,8 +3119,9 @@ function buildSlotlockStore(sql, options, refusal) {
                     }
                     // A SECOND contention abort is treated as a loss too (structured, possibly with a null
                     // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
-                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs: written }));
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, written);
+                    const occupied = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs: written });
+                    await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, written, undefined, undefined, writtenBefore);
                 }
             }
         },
@@ -3195,15 +3373,16 @@ function buildSlotlockStore(sql, options, refusal) {
             // Expired holds are dead occupation: excluded here so findNextAvailable can offer their
             // space (the acquiring transaction reaps the row itself when it takes the window).
             const rows = await sql `
-        SELECT starts_at, COALESCE(occupied_ends_at, ends_at) AS occupied_ends_at
+        SELECT COALESCE(occupied_starts_at, starts_at) AS occupied_starts_at,
+               COALESCE(occupied_ends_at, ends_at) AS occupied_ends_at
           FROM slotlock.reservations
          WHERE resource_id = ${resourceId}
-           AND starts_at < ${window.end}
+           AND ${occupiedStartsBefore(sql, window.end)}
            AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
            AND (status <> 'held' OR expires_at > statement_timestamp())
-         ORDER BY starts_at
+         ORDER BY COALESCE(occupied_starts_at, starts_at)
          LIMIT ${options.limit ?? null}`;
-            return rows.map((r) => ({ start: r.starts_at, end: r.occupied_ends_at }));
+            return rows.map((r) => ({ start: r.occupied_starts_at, end: r.occupied_ends_at }));
         },
         async putCalendarEvent(params) {
             const ownerRef = params.ownerRef ?? SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
@@ -3261,6 +3440,8 @@ function buildSlotlockStore(sql, options, refusal) {
             });
             const recurrenceEndsBy = recurrenceEndsByColumn(event);
             let attempted = expanded?.occurrences ?? [];
+            // The buffers the attempt kept, for the overlap answer if it loses.
+            let attemptedBuffers = { bufferBeforeMs: 0, bufferAfterMs: 0 };
             let storedEventId;
             for (let attempt = 1;; attempt++) {
                 try {
@@ -3398,6 +3579,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             AND hold_group_id = ${hold.hold_group_id}::uuid))`;
                         }
                         let turnaroundMs = 0;
+                        let bufferBeforeMs = 0;
                         if (params.enforceBookingRules === true && (event.transparency ?? 'opaque') === 'opaque') {
                             const judge = await bookingJudge(tx, params.resourceId, defaultHours);
                             for (const [index, occurrence] of occurrences.entries()) {
@@ -3407,9 +3589,11 @@ function buildSlotlockStore(sql, options, refusal) {
                                     return { ok: false, code: 'booking_rule_violated', rule };
                             }
                             turnaroundMs = judge.turnaroundMs;
+                            bufferBeforeMs = judge.bufferBeforeMs;
                         }
+                        attemptedBuffers = { bufferBeforeMs, bufferAfterMs: turnaroundMs };
                         const span = occurrenceSpan(occurrences);
-                        const reach = span && { start: span.start, end: new Date(span.end.getTime() + turnaroundMs) };
+                        const reach = span && occupiedTime({ ...span, bufferBeforeMs, bufferAfterMs: turnaroundMs });
                         if ((event.transparency ?? 'opaque') === 'opaque' &&
                             reach &&
                             !(found && (await holdsEveryOccurrence(tx, found.id, params.resourceId, occurrences)))) {
@@ -3447,6 +3631,7 @@ function buildSlotlockStore(sql, options, refusal) {
                        revision = ${revision},
                        source = ${params.source ?? null},
                        buffer_after_ms = ${turnaroundMs},
+                       buffer_before_ms = ${bufferBeforeMs},
                        updated_at = now()
                  WHERE id = ${eventId}
                    AND tenant_ref = ${params.tenantRef}
@@ -3459,7 +3644,7 @@ function buildSlotlockStore(sql, options, refusal) {
                   summary, description, location, status, transparency, organizer, attendees,
                   reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
                   materialized_ends_at, recurrence_cursor, recurrence_ends_by, revision, source,
-                  buffer_after_ms
+                  buffer_after_ms, buffer_before_ms
                 ) VALUES (
                   ${eventId}, ${params.tenantRef}, ${ownerRef}, ${params.externalRef},
                   ${params.resourceId},
@@ -3473,7 +3658,7 @@ function buildSlotlockStore(sql, options, refusal) {
                   ${tx.json(eventExceptionsForJson(event.recurrence?.exceptions))},
                   ${materializationWindow.start}, ${materializationWindow.end},
                   ${seriesCursorJson(tx, series.cursor)}, ${recurrenceEndsBy}::text::timestamptz,
-                  ${revision}, ${params.source ?? null}, ${turnaroundMs}
+                  ${revision}, ${params.source ?? null}, ${turnaroundMs}, ${bufferBeforeMs}
                 )`;
                         }
                         // The normalized children are the queryable/canonical representation. The JSON
@@ -3487,6 +3672,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             occurrences,
                             revision,
                             bufferAfterMs: turnaroundMs,
+                            bufferBeforeMs,
                         });
                         await tx `
               INSERT INTO slotlock.calendar_event_commands (
@@ -3517,11 +3703,12 @@ function buildSlotlockStore(sql, options, refusal) {
                         code !== SERIALIZATION_FAILURE) {
                         throw error;
                     }
-                    const reach = occurrenceSpan(attempted);
-                    if (reach) {
+                    const span = occurrenceSpan(attempted);
+                    if (span) {
+                        const reach = occupiedTime({ ...span, ...attemptedBuffers });
                         await rollSeriesBehind(sql, params.resourceId, reach.start, reach.end, storedEventId);
                     }
-                    return findCalendarOverlap(sql, params.resourceId, attempted, storedEventId);
+                    return findCalendarOverlap(sql, params.resourceId, attempted, storedEventId, attemptedBuffers);
                 }
             }
         },
@@ -3927,7 +4114,9 @@ function buildSlotlockStore(sql, options, refusal) {
                slotlock.zoned_instant(event.wall_starts_at, event.timezone) AS moved_start,
                slotlock.zoned_instant(event.wall_ends_at, event.timezone) AS moved_end,
                COALESCE((SELECT max(booking.buffer_after_ms) FROM slotlock.reservations booking
-                          WHERE booking.calendar_event_id = event.id), 0) AS buffer
+                          WHERE booking.calendar_event_id = event.id), 0) AS buffer,
+               COALESCE((SELECT max(booking.buffer_before_ms) FROM slotlock.reservations booking
+                          WHERE booking.calendar_event_id = event.id), 0) AS buffer_before
           FROM slotlock.calendar_events event
          WHERE event.tenant_ref = ${params.tenantRef}
            AND event.recurrence_rule IS NULL
@@ -3981,6 +4170,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             ],
                             revision,
                             bufferAfterMs: Number(event.buffer),
+                            bufferBeforeMs: Number(event.buffer_before),
                         });
                     });
                     moved++;
@@ -4293,6 +4483,7 @@ function buildSlotlockStore(sql, options, refusal) {
          ORDER BY source`;
             return rows.map((row) => ({
                 source: row.source,
+                sourceId: slotlockCoverageSourceId(params.tenantRef, row.source),
                 start: row.starts_at,
                 end: row.ends_at,
                 revision: Number(row.revision),
@@ -4316,15 +4507,15 @@ function buildSlotlockStore(sql, options, refusal) {
                 AND observed_at < now() - make_interval(secs => ${maxAgeMs / 1_000})
               ORDER BY observed_at LIMIT ${params.limit ?? 100}
               FOR UPDATE SKIP LOCKED)
-          RETURNING coverage.resource_id, coverage.source, coverage.observed_at, coverage.last_error
+          RETURNING coverage.tenant_ref, coverage.resource_id, coverage.source, coverage.observed_at
         ), reported AS (
           INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
-          SELECT ${params.tenantRef}, stale.resource_id, 'coverage.stale', stale.source,
-                 jsonb_strip_nulls(jsonb_build_object(
-                   'resource_id', stale.resource_id, 'source', stale.source,
-                   'observed_at', stale.observed_at, 'last_error', stale.last_error)),
+          SELECT ${params.tenantRef}, named.resource_id, 'coverage.stale', named.source_id,
+                 jsonb_build_object(
+                   'resource_id', named.resource_id, 'source_id', named.source_id,
+                   'observed_at', named.observed_at),
                  'slotlock:maintenance'
-            FROM stale
+            FROM (SELECT resource_id, observed_at, ${sql.unsafe(COVERAGE_SOURCE_ID)} AS source_id FROM stale) named
           RETURNING 1
         )
         SELECT count(*)::int AS count FROM reported`;
@@ -4525,6 +4716,159 @@ function buildSlotlockStore(sql, options, refusal) {
                 return true;
             });
         },
+        async getAssistantSettings(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            const [row] = await sql `
+        SELECT provider, base_url, model, sealed_key, key_hint, updated_by, updated_at
+          FROM slotlock.assistant_settings WHERE tenant_ref = ${params.tenantRef}`;
+            if (!row)
+                return null;
+            return {
+                provider: row.provider,
+                baseUrl: row.base_url,
+                model: row.model,
+                sealedKey: row.sealed_key,
+                keyHint: row.key_hint,
+                updatedBy: row.updated_by,
+                updatedAt: row.updated_at,
+            };
+        },
+        async putAssistantSettings(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            const keep = params.key === 'keep';
+            const key = params.key === 'keep' ? null : params.key;
+            const saved = await sql `
+        INSERT INTO slotlock.assistant_settings AS stored
+          (tenant_ref, provider, base_url, model, sealed_key, key_hint, updated_by, updated_at)
+        VALUES (${params.tenantRef}, ${params.provider}, ${params.baseUrl}, ${params.model},
+                ${key?.sealed ?? null}, ${key?.hint ?? null}, ${params.updatedBy ?? null},
+                statement_timestamp())
+        ON CONFLICT (tenant_ref) DO UPDATE SET
+          provider = EXCLUDED.provider,
+          base_url = EXCLUDED.base_url,
+          model = EXCLUDED.model,
+          sealed_key = CASE WHEN ${keep}::boolean THEN stored.sealed_key ELSE EXCLUDED.sealed_key END,
+          key_hint = CASE WHEN ${keep}::boolean THEN stored.key_hint ELSE EXCLUDED.key_hint END,
+          updated_by = EXCLUDED.updated_by,
+          updated_at = EXCLUDED.updated_at
+        WHERE NOT ${keep}::boolean
+           OR stored.sealed_key IS NULL
+           OR (stored.provider = EXCLUDED.provider AND stored.base_url = EXCLUDED.base_url)
+        RETURNING 1`;
+            return { saved: saved.length > 0 };
+        },
+        async deleteAssistantSettings(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return false;
+            const rows = await sql `
+        DELETE FROM slotlock.assistant_settings WHERE tenant_ref = ${params.tenantRef} RETURNING 1`;
+            return rows.length > 0;
+        },
+        async getAssistantConversation(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef))
+                return null;
+            const [row] = await sql `
+        SELECT messages, actions, updated_at, expires_at FROM slotlock.assistant_conversations
+         WHERE tenant_ref = ${params.tenantRef} AND member_ref = ${params.memberRef}
+           AND expires_at > statement_timestamp()`;
+            if (!row)
+                return null;
+            return {
+                messages: row.messages,
+                actions: row.actions,
+                updatedAt: row.updated_at,
+                expiresAt: row.expires_at,
+            };
+        },
+        async putAssistantConversation(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef)) {
+                throw invalidIdentityError('Slotlock tenant and member references must be 1-500 UTF-8 bytes');
+            }
+            if (!Number.isSafeInteger(params.ttlMs) || params.ttlMs < 1_000 || params.ttlMs > 86_400_000) {
+                throw invalidIdentityError('Slotlock assistant conversation ttlMs must be 1 second to a day');
+            }
+            const messages = sql.json(params.messages);
+            const added = sql.json(params.added);
+            const keep = [...params.keep];
+            await sql `
+        DELETE FROM slotlock.assistant_conversations
+         WHERE tenant_ref = ${params.tenantRef} AND expires_at <= statement_timestamp()`;
+            await sql `
+        INSERT INTO slotlock.assistant_conversations AS stored
+          (tenant_ref, member_ref, messages, actions, updated_at, expires_at)
+        VALUES (${params.tenantRef}, ${params.memberRef}, ${messages}, ${added},
+                statement_timestamp(),
+                statement_timestamp() + make_interval(secs => ${params.ttlMs / 1_000}))
+        ON CONFLICT (tenant_ref, member_ref) DO UPDATE SET
+          messages = EXCLUDED.messages,
+          -- The stored ones kept, as they stand, then the new ones: never a settled one again.
+          actions = (
+            SELECT coalesce(jsonb_object_agg(existing.key, existing.value), '{}'::jsonb)
+              FROM jsonb_each(stored.actions) AS existing
+             WHERE existing.key = ANY(${keep}::text[])
+          ) || (
+            SELECT coalesce(jsonb_object_agg(fresh.key, fresh.value), '{}'::jsonb)
+              FROM jsonb_each(EXCLUDED.actions) AS fresh
+             WHERE NOT stored.actions ? fresh.key
+          ),
+          updated_at = EXCLUDED.updated_at,
+          expires_at = EXCLUDED.expires_at`;
+            await sql `
+        SELECT slotlock.register_assistant_tenant(
+          ${params.tenantRef}::text,
+          statement_timestamp() + make_interval(secs => ${params.ttlMs / 1_000}))`;
+        },
+        async settleAssistantAction(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef))
+                return null;
+            const patch = sql.json(params.patch);
+            const [row] = await sql `
+        UPDATE slotlock.assistant_conversations
+           SET actions = jsonb_set(actions, ARRAY[${params.actionId}::text],
+                                   (actions -> ${params.actionId}::text) || ${patch}::jsonb)
+         WHERE tenant_ref = ${params.tenantRef} AND member_ref = ${params.memberRef}
+           AND expires_at > statement_timestamp()
+           AND actions -> ${params.actionId}::text ->> 'status' = ${params.from}
+        RETURNING actions -> ${params.actionId}::text AS action`;
+            return row?.action ?? null;
+        },
+        async pruneAssistantConversations(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return 0;
+            const limit = params.limit ?? 1_000;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 10_000) {
+                throw invalidIdentityError('Slotlock assistant prune limit must be 1-10,000');
+            }
+            const rows = await sql `
+        DELETE FROM slotlock.assistant_conversations
+         WHERE tenant_ref = ${params.tenantRef}
+           AND member_ref IN (
+             SELECT member_ref FROM slotlock.assistant_conversations
+              WHERE tenant_ref = ${params.tenantRef} AND expires_at <= statement_timestamp()
+              LIMIT ${limit})
+           AND expires_at <= statement_timestamp()
+        RETURNING 1`;
+            return rows.length;
+        },
+        async sweepAssistantConversations(params) {
+            const limit = params?.limit ?? 10_000;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100_000) {
+                throw invalidIdentityError('Slotlock assistant sweep limit must be 1-100,000');
+            }
+            const [row] = await sql `
+        SELECT slotlock.sweep_assistant_conversations(${limit}::integer) AS deleted`;
+            return Number(row?.deleted ?? 0);
+        },
+        async deleteAssistantConversation(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef))
+                return false;
+            const rows = await sql `
+        DELETE FROM slotlock.assistant_conversations
+         WHERE tenant_ref = ${params.tenantRef} AND member_ref = ${params.memberRef} RETURNING 1`;
+            return rows.length > 0;
+        },
         async offerWaitlist(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
@@ -4584,18 +4928,28 @@ function buildSlotlockStore(sql, options, refusal) {
                         continue;
                     // Only resources whose window looks free are tried: a hold refused keeps its locks
                     // until the transaction ends, so trying every member of a full pool would pile them up.
+                    // A hold there keeps the resource's buffers (its rules as they apply), so they must be free too.
                     const candidates = await tx `
-            SELECT resource.id FROM slotlock.resources resource
-             WHERE resource.tenant_ref = ${tenantRef} AND resource.archived_at IS NULL
-               AND (resource.id = ${entry.resource_id}::uuid
-                    OR (${entry.resource_id}::uuid IS NULL AND resource.pool_ref = ${entry.pool_ref}))
+            SELECT resources.id
+              FROM slotlock.resources,
+                   LATERAL (SELECT ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}) effective,
+                   LATERAL (SELECT
+                     COALESCE(least(greatest((effective.effective_booking_rules->>'bufferBeforeMinutes')::numeric, 0), 1440)::int, 0)
+                       AS before_minutes,
+                     COALESCE(least(greatest((effective.effective_booking_rules->>'turnaroundMinutes')::numeric, 0), 1440)::int, 0)
+                       AS after_minutes) buffers
+             WHERE resources.tenant_ref = ${tenantRef} AND resources.archived_at IS NULL
+               AND (resources.id = ${entry.resource_id}::uuid
+                    OR (${entry.resource_id}::uuid IS NULL AND resources.pool_ref = ${entry.pool_ref}))
                AND NOT EXISTS (
                  SELECT 1 FROM slotlock.reservations taken
-                  WHERE taken.resource_id = resource.id
-                    AND tstzrange(taken.starts_at, COALESCE(taken.occupied_ends_at, taken.ends_at), '[)')
-                        && tstzrange(${entry.starts_at}::timestamptz, ${entry.ends_at}::timestamptz, '[)')
+                  WHERE taken.resource_id = resources.id
+                    AND tstzrange(COALESCE(taken.occupied_starts_at, taken.starts_at),
+                                  COALESCE(taken.occupied_ends_at, taken.ends_at), '[)')
+                        && tstzrange(${entry.starts_at}::timestamptz - make_interval(mins => buffers.before_minutes),
+                                     ${entry.ends_at}::timestamptz + make_interval(mins => buffers.after_minutes), '[)')
                     AND (taken.status <> 'held' OR taken.expires_at > statement_timestamp()))
-             ORDER BY resource.id
+             ORDER BY resources.id
              LIMIT ${OFFER_CANDIDATES}`;
                     for (const { id: resourceId } of candidates) {
                         const hold = await inner.acquireHold({
@@ -4660,23 +5014,26 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const owner = await sql `
-        SELECT id, COALESCE((booking_rules->>'requireCertain')::boolean, false) AS require_certain
-          FROM slotlock.resources
+        SELECT id, COALESCE((effective.effective_booking_rules->>'requireCertain')::boolean, false)
+                 AS require_certain
+          FROM slotlock.resources,
+               LATERAL (SELECT ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}) effective
          WHERE id = ${params.resourceId} AND tenant_ref = ${params.tenantRef}`;
             if (!owner[0]) {
                 throw Object.assign(new Error('Slotlock resource belongs to another tenant'), {
                     code: 'resource_tenant_mismatch',
                 });
             }
+            // Each row's occupied time: its buffers are as busy as the booking.
             const busyRows = await sql `
-        SELECT reservation.starts_at,
+        SELECT COALESCE(reservation.occupied_starts_at, reservation.starts_at) AS starts_at,
                COALESCE(reservation.occupied_ends_at, reservation.ends_at) AS occupied_ends_at
           FROM slotlock.reservations reservation
          WHERE reservation.resource_id = ${params.resourceId}
-           AND reservation.starts_at < ${window.end}
+           AND ${occupiedStartsBefore(sql, window.end, 'reservation')}
            AND COALESCE(reservation.occupied_ends_at, reservation.ends_at) > ${window.start}
            AND (reservation.status <> 'held' OR reservation.expires_at > statement_timestamp())
-         ORDER BY reservation.starts_at
+         ORDER BY 1
          LIMIT ${MAX_FREE_BUSY_INTERVALS + 1}`;
             if (busyRows.length > MAX_FREE_BUSY_INTERVALS) {
                 throw Object.assign(new Error('Slotlock free/busy work limit exceeded'), {
@@ -4795,7 +5152,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 throw notFound();
             const [row] = await sql `
         SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility,
-               archived_at, statement_timestamp() AS now
+               archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}, statement_timestamp() AS now
           FROM slotlock.resources
          WHERE id = ${params.resourceId} AND tenant_ref IS NOT DISTINCT FROM ${tenantRef}`;
             if (!row)
@@ -4804,9 +5161,10 @@ function buildSlotlockStore(sql, options, refusal) {
                 return null;
             const resource = toResource(row);
             const rules = params.rules ?? resource.availabilityRules ?? [];
-            // Only what a booking made now may take: the resource's booking rules bound the search.
+            // Only what a booking made now may take: the resource's booking rules (as they apply) bound
+            // the search.
             const search = bookingSearch({
-                rules: resource.bookingRules,
+                rules: resource.effectiveBookingRules,
                 timezone: resource.timezone,
                 window: asked,
                 now: row.now,
@@ -4814,9 +5172,9 @@ function buildSlotlockStore(sql, options, refusal) {
             });
             if (!search)
                 return null;
-            const { window, bufferAfterMs } = search;
-            // A slot's buffer may run past the window: the time it can reach must be proven free too.
-            const reach = { start: window.start, end: new Date(window.end.getTime() + bufferAfterMs) };
+            const { window } = search;
+            // A slot's buffers may run past the window: the time they can reach must be proven free too.
+            const reach = bookingSearchReach(search);
             let busy;
             if (tenantRef === null) {
                 // No event, coverage or series can belong to a resource with no tenant: only its rows.
@@ -4824,7 +5182,11 @@ function buildSlotlockStore(sql, options, refusal) {
             }
             else {
                 busy = [];
-                const parts = bufferAfterMs > 0 ? [window, { start: window.end, end: reach.end }] : [window];
+                const parts = [
+                    ...(reach.start < window.start ? [{ start: reach.start, end: window.start }] : []),
+                    window,
+                    ...(reach.end > window.end ? [{ start: window.end, end: reach.end }] : []),
+                ];
                 for (const part of parts) {
                     const freeBusy = await this.getFreeBusy({
                         tenantRef,
@@ -4843,12 +5205,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     busy.push(...freeBusy.busy);
                 }
             }
-            // A slot [s, s + d) with its buffer meets busy [b, e) exactly when [s, s + d) meets [b - buffer, e).
             return findNextAvailable({
-                busy: busy.map((interval) => ({
-                    start: new Date(interval.start.getTime() - bufferAfterMs),
-                    end: interval.end,
-                })),
+                busy: bookingSearchBlocked(busy, search),
                 windows: expandRules(rules, window, resource.timezone),
                 durationMs: params.durationMs,
                 ...(search.align ? { align: search.align } : {}),