slotlock 0.5.2 → 0.6.0

package/store.js

@@ -1,11 +1,11 @@
 // DB mechanics for the Slotlock core — explicit `postgres` client in, structured results out.
 // Domain policy (who may reserve, pricing, holds) belongs to future callers; this layer owns the
 // reliable how: idempotent schema apply, EXCLUDE-arbitrated inserts with a structured conflict.
-import { SLOTLOCK_CHANGE_RETENTION_DAYS, slotlockEventFeedMethods } from './event-feed.js';
-import { bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
+import { SLOTLOCK_CHANGE_ORIGINS, SLOTLOCK_CHANGE_RETENTION_DAYS, isSlotlockChangeOrigin, slotlockEventFeedMethods, } from './event-feed.js';
+import { bookingBufferBeforeMs, bookingSearchBlocked, bookingSearchReach, parseBookingRuleDefaults, parseEffectiveBookingRules, bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
 import { createHash, randomUUID } from 'node:crypto';
 import ICAL from 'ical.js';
-import { SLOTLOCK_CORE_DDL, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockTenantLockKey, } from './ddl.js';
+import { SLOTLOCK_CORE_DDL, SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockCoverageChangeRenameSql, slotlockTenantLockKey, } from './ddl.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
 import { SLOTLOCK_CALENDAR_HORIZON_DAYS, assertBoundedSearchWindow, expandRules, invalidWindowError, } from './rules.js';
 import { CalendarContractError, CalendarExpansionLimitError, expandCalendarEventSeries, normalizeCalendarEventContent, } from './sync.js';
@@ -24,6 +24,11 @@ const SERIALIZATION_FAILURE = '40001';
 const MAX_HOLD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 /** Turnaround cannot occupy a resource indefinitely because of a caller/unit error. */
 const MAX_BUFFER_AFTER_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * The longest leading buffer a row keeps (a day, as bufferBeforeMinutes allows): a row's occupied
+ * time starts at most this long before its start, so a read by start can still use the index.
+ */
+const MAX_BUFFER_BEFORE_MS = 24 * 60 * 60 * 1000;
 export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
 /**
  * Longest one-off event the store accepts (ten years and some leap days): long enough for any lease
@@ -338,8 +343,8 @@ function migrationSettings(options) {
 /**
  * Run one migration step: in a transaction (or a savepoint of the caller's), with names resolved
  * in pg_catalog only, serialized with every other migration of this database, and with the lock and
- * statement timeouts set. A step that waits past its lock timeout is rolled back and tried again
- * after a pause, up to `attempts` times. The caller's own timeouts are put back afterwards.
+ * statement timeouts set. A step that waits past its lock timeout, or is ended as a deadlock's
+ * victim, is rolled back and tried again after a pause, up to `attempts` times. The caller's own timeouts are put back afterwards.
  */
 async function inMigration(executor, options, step) {
     const settings = migrationSettings(options);
@@ -362,10 +367,14 @@ async function inMigration(executor, options, step) {
             }));
         }
         catch (error) {
-            if (pgCode(error) !== LOCK_NOT_AVAILABLE)
+            // A deadlock's victim (DEADLOCK_DETECTED: a caller's transaction took the outbox, then a
+            // coverage row, while a rename batch took them in the other order, say) lost its locks with
+            // it, so it is tried again like a step that timed out waiting.
+            const code = pgCode(error);
+            if (code !== LOCK_NOT_AVAILABLE && code !== DEADLOCK_DETECTED)
                 throw error;
             if (attempt >= settings.attempts) {
-                throw Object.assign(new Error(`Slotlock migration gave up after ${attempt} attempts to take its locks within ${settings.lockTimeoutMs} ms: a long transaction holds a slotlock table. Run it again once that transaction ends`, { cause: error }), { code: 'schema_lock_timeout' });
+                throw Object.assign(new Error(`Slotlock migration gave up after ${attempt} attempts to take its locks within ${settings.lockTimeoutMs} ms: a long transaction holds a slotlock table, or took them in another order. Run it again once that transaction ends`, { cause: error }), { code: 'schema_lock_timeout' });
             }
             await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 250, 2_000) + Math.floor(Math.random() * 250)));
         }
@@ -465,6 +474,105 @@ async function slotlockSchemaUpToDate(tx) {
     }
     return recorded.catalog_sha256 === (await slotlockCatalogDigest(tx));
 }
+/**
+ * Rename the coverage changes an earlier release wrote (ddl.ts, slotlockCoverageChangeRenameSql),
+ * in batches of SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH outbox ids, each a transaction of its own,
+ * from where the last pass stopped (`schema_version.coverage_changes_renamed_through`, saved with
+ * each batch) up to the last change when this pass starts. The first pass is the 0.6 upgrade's; an
+ * earlier release's server still running then can write more, so every later migration runs a pass
+ * too, until one finds nothing to rename: that marks the rename done and no migration reads the
+ * outbox for it again.
+ *
+ * The head is read only once every transaction already writing to the outbox has ended, so no
+ * change at or below it can commit after the pass has read past it. Forced RLS would hide every
+ * tenant's rows from the deployment role, so a role it binds lifts FORCE from calendar_coverage and
+ * outbox for each batch and puts it back before the batch commits: each batch holds ACCESS
+ * EXCLUSIVE on both, taken in the order writers take them (a source, then its change), for one
+ * primary-key range of the outbox. A table an operator left unforced stays so. A superuser or
+ * BYPASSRLS role reads every row as it is: it holds SHARE ROW EXCLUSIVE on the outbox (which waits
+ * for the writes in flight and holds off new ones, but no read) only for the short transaction that
+ * reads the head. Changes an earlier release's server writes after the upgrade are put in shape as
+ * they are inserted (ddl.ts, slotlock.outbox_coverage_in_shape); the passes are for those before.
+ */
+async function renameEarlierCoverageChanges(executor, options) {
+    /**
+     * Run `work` able to read every tenant's outbox and coverage rows: as it is for a superuser or a
+     * BYPASSRLS role, else with FORCE lifted from the tables that have it, under ACCESS EXCLUSIVE
+     * (calendar_coverage, then outbox: the order every writer locks them in), and put back after.
+     */
+    const everyTenant = async (tx, bypass, work) => {
+        const forced = bypass
+            ? []
+            : await tx `
+          SELECT rel.relname::text AS name
+            FROM pg_catalog.pg_class rel
+            JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace
+           WHERE ns.nspname = 'slotlock' AND rel.relname IN ('calendar_coverage', 'outbox')
+             AND rel.relforcerowsecurity
+           ORDER BY rel.relname`;
+        const lifted = forced.map(({ name }) => `slotlock.${name}`);
+        if (lifted.length > 0) {
+            await tx.unsafe(`LOCK TABLE ${lifted.join(', ')} IN ACCESS EXCLUSIVE MODE`);
+            for (const table of lifted)
+                await tx.unsafe(`ALTER TABLE ${table} NO FORCE ROW LEVEL SECURITY`);
+        }
+        const result = await work();
+        for (const table of lifted)
+            await tx.unsafe(`ALTER TABLE ${table} FORCE ROW LEVEL SECURITY`);
+        return result;
+    };
+    // The pass's head, in a short transaction of its own: once the writes in flight have ended (each
+    // holds ROW EXCLUSIVE from before it took its id), none at or below it can commit later.
+    const start = await inMigration(executor, options, async (tx) => {
+        const [state] = await tx `
+      SELECT version.coverage_changes_renamed AS renamed,
+             version.coverage_changes_renamed_through::text AS through,
+             EXISTS (SELECT 1 FROM pg_catalog.pg_roles
+                      WHERE rolname = current_user AND (rolsuper OR rolbypassrls)) AS bypass
+        FROM slotlock.schema_version version
+       WHERE version.singleton`;
+        if (state === undefined || state.renamed)
+            return null;
+        if (state.bypass)
+            await tx.unsafe('LOCK TABLE slotlock.outbox IN SHARE ROW EXCLUSIVE MODE');
+        const [top] = await everyTenant(tx, state.bypass, () => tx `SELECT COALESCE(max(id), 0)::text AS head FROM slotlock.outbox`);
+        return { head: top?.head ?? '0', through: state.through, bypass: state.bypass };
+    });
+    if (start === null)
+        return;
+    const { head, bypass } = start;
+    const firstPass = start.through === null;
+    const rename = slotlockCoverageChangeRenameSql('$1::bigint', '$2::bigint', '$3::int');
+    let after = start.through ?? '0';
+    let renamedTotal = 0;
+    for (;;) {
+        const last = await inMigration(executor, options, async (tx) => {
+            const [row] = await everyTenant(tx, bypass, () => tx.unsafe(rename, [
+                after,
+                head,
+                SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH,
+            ]));
+            const read = row?.last ?? null;
+            renamedTotal += row?.renamed ?? 0;
+            // Saved with the batch, so a pass stopped part way goes on from here.
+            await tx `
+        UPDATE slotlock.schema_version
+           SET coverage_changes_renamed_through = ${read ?? head}::bigint,
+               coverage_changes_renamed = ${read === null && !firstPass && renamedTotal === 0}
+         WHERE singleton`;
+            return read;
+        });
+        if (last === null)
+            return;
+        after = String(last);
+    }
+}
+/** Whether the rename of coverage changes earlier releases wrote still has a pass to run. */
+async function coverageChangesRenamePending(tx) {
+    const [row] = await tx `
+    SELECT coverage_changes_renamed AS renamed FROM slotlock.schema_version WHERE singleton`;
+    return row !== undefined && !row.renamed;
+}
 /** Whether a constraint in the `slotlock` schema is still NOT VALID (old rows broke it). */
 async function slotlockConstraintUnvalidated(tx) {
     const [row] = await tx `
@@ -870,18 +978,23 @@ async function replaceCalendarEventOccurrences(tx, params) {
     for (const occurrence of params.occurrences) {
         let reservationId = null;
         if ((params.event.transparency ?? 'opaque') === 'opaque') {
-            const occupied = new Date(occurrence.end.getTime() + (params.bufferAfterMs ?? 0));
-            await reapExpiredHolds(tx, params.resourceId, occurrence.start, occupied);
+            const occupied = occupiedTime({
+                ...occurrence,
+                bufferBeforeMs: params.bufferBeforeMs ?? 0,
+                bufferAfterMs: params.bufferAfterMs ?? 0,
+            });
+            await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
             const derivedExternalRef = `calendar:${params.eventId}:${createHash('sha256')
                 .update(occurrence.recurrenceId)
                 .digest('hex')}`;
             const reservations = await tx `
         INSERT INTO slotlock.reservations (
           resource_id, tenant_ref, external_ref, starts_at, ends_at,
-          buffer_after_ms, revision, source, calendar_event_id
+          buffer_after_ms, buffer_before_ms, revision, source, calendar_event_id
         ) VALUES (
           ${params.resourceId}, ${params.tenantRef}, ${derivedExternalRef},
-          ${occurrence.start}, ${occurrence.end}, ${params.bufferAfterMs ?? 0}, ${params.revision},
+          ${occurrence.start}, ${occurrence.end}, ${params.bufferAfterMs ?? 0},
+          ${params.bufferBeforeMs ?? 0}, ${params.revision},
           ${`calendar-event:${params.eventId}`}, ${params.eventId}
         )
         RETURNING id`;
@@ -1069,46 +1182,53 @@ async function finishCalendarCancel(tx, params) {
  * The row an event write lost to. The write was rolled back, so the event's own rows from before
  * it are still there and are left out: they were to be replaced, and never block the event.
  */
-async function findCalendarOverlap(sql, resourceId, occurrences, eventId) {
+async function findCalendarOverlap(sql, resourceId, occurrences, eventId, buffers = { bufferBeforeMs: 0, bufferAfterMs: 0 }) {
     for (const occurrence of occurrences) {
-        const result = await overlapLoss(sql, resourceId, occurrence.start, occurrence.end, 0, undefined, eventId);
+        const result = await overlapLoss(sql, resourceId, occurrence.start, occurrence.end, buffers.bufferAfterMs, undefined, eventId, buffers.bufferBeforeMs);
         if (result.conflictingReservationId !== null)
             return result;
     }
     return { ok: false, code: 'overlap', conflictingReservationId: null };
 }
 /**
- * What the resource's booking rules say about a booking of `interval` made now (by the database's
- * clock, at this statement): the rule it breaks, if any, and the turnaround it must keep after it.
- * A resource without its own hours is judged against `defaultHours`.
+ * What the resource's booking rules (as they apply: its own over its pool's and tenant's defaults)
+ * say about a booking of `interval` made now (by the database's clock, at this statement): the rule
+ * it breaks, if any, and the buffers it must keep before and after it. A resource without its own
+ * hours is judged against `defaultHours`.
  */
 async function bookingRuling(tx, resourceId, interval, defaultHours) {
     const judge = await bookingJudge(tx, resourceId, defaultHours);
-    return { rule: judge.broken(interval), turnaroundMs: judge.turnaroundMs };
+    return {
+        rule: judge.broken(interval),
+        turnaroundMs: judge.turnaroundMs,
+        bufferBeforeMs: judge.bufferBeforeMs,
+    };
 }
 /** How recently a sync must have read a resource whose booking rules require certainty. */
 const CERTAIN_COVERAGE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /**
- * The resource's booking rules, read once, as a check of any interval booked now (by the database's
- * clock at this statement) and the turnaround a booking keeps.
+ * The resource's booking rules as they apply, read once, as a check of any interval booked now (by
+ * the database's clock at this statement) and the buffers a booking keeps.
  */
 async function bookingJudge(tx, resourceId, defaultHours) {
     const [row] = await tx `
-    SELECT booking_rules, availability_rules, timezone, statement_timestamp() AS now
+    SELECT ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}, availability_rules, timezone,
+           statement_timestamp() AS now
       FROM slotlock.resources WHERE id = ${resourceId}`;
-    if (!row || row.booking_rules === null || row.booking_rules === undefined) {
-        return { broken: () => null, turnaroundMs: 0 };
+    if (!row || row.effective_booking_rules === null || row.effective_booking_rules === undefined) {
+        return { broken: () => null, turnaroundMs: 0, bufferBeforeMs: 0 };
     }
-    const { bookingRules: rules, availabilityRules } = toResource({
+    const { effectiveBookingRules: rules, availabilityRules } = toResource({
         id: resourceId,
         external_ref: null,
         tenant_ref: null,
         timezone: row.timezone,
         availability_rules: row.availability_rules,
-        booking_rules: row.booking_rules,
+        booking_rules: null,
         pool_ref: null,
         visibility: 'shared',
         archived_at: null,
+        effective_booking_rules: row.effective_booking_rules,
     });
     const hours = availabilityRules ?? defaultHours;
     // Every sync covering the resource, and whether it was read within a day, by the same clock.
@@ -1120,9 +1240,10 @@ async function bookingJudge(tx, resourceId, defaultHours) {
             FROM slotlock.calendar_coverage WHERE resource_id = ${resourceId}`
         : [];
     const turnaroundMs = bookingBufferAfterMs(rules);
-    // The booking and the turnaround it keeps, as a search judges the slot.
+    const bufferBeforeMs = bookingBufferBeforeMs(rules);
+    // The booking and the buffers it keeps, as a search judges the slot.
     const uncertain = (interval) => coverage.some((source) => !source.fresh ||
-        source.starts_at > interval.start ||
+        source.starts_at.getTime() > interval.start.getTime() - bufferBeforeMs ||
         source.ends_at.getTime() < interval.end.getTime() + turnaroundMs);
     // A later occurrence of a series is judged on its step and hours only: notice and advance are
     // about when the booking was made, which its first occurrence answers.
@@ -1130,6 +1251,7 @@ async function bookingJudge(tx, resourceId, defaultHours) {
         ? undefined
         : {
             ...(rules.slotStepMinutes !== undefined ? { slotStepMinutes: rules.slotStepMinutes } : {}),
+            ...(rules.stepOffsetMinutes !== undefined ? { stepOffsetMinutes: rules.stepOffsetMinutes } : {}),
             ...(rules.enforceHours !== undefined ? { enforceHours: rules.enforceHours } : {}),
         };
     return {
@@ -1141,6 +1263,7 @@ async function bookingJudge(tx, resourceId, defaultHours) {
             now: row.now,
         }) ?? (uncertain(interval) ? 'uncertain' : null),
         turnaroundMs,
+        bufferBeforeMs,
     };
 }
 function sameExternalPayload(row, params, turnaroundMs = 0) {
@@ -1153,9 +1276,6 @@ function sameExternalPayload(row, params, turnaroundMs = 0) {
         Number(row.revision) === params.revision &&
         row.source === (params.source ?? null));
 }
-function occupiedEnd(params) {
-    return new Date(params.end.getTime() + params.bufferAfterMs);
-}
 async function lockExternalIdentity(tx, tenantRef, externalRef) {
     // JSON encoding is unambiguous for this pair and contains no NUL byte (Postgres text rejects
     // U+0000). The database hashes it to one transaction-scoped lock key.
@@ -1185,6 +1305,8 @@ function pgCode(err) {
 }
 /** Members a pool booking or search considers at most, in id order. */
 export const SLOTLOCK_MAX_POOL_MEMBERS = 100;
+/** The most pools of one tenant that may have default booking rules (`setBookingRuleDefaults`). */
+export const SLOTLOCK_MAX_POOL_RULE_DEFAULTS = 1_000;
 const WAITLIST_COLUMNS = 'id, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms, status, hold_id, offered_resource_id, offered_at, created_at';
 function toWaitlistEntry(row) {
     return {
@@ -1210,6 +1332,30 @@ function invalidPoolError() {
         code: 'invalid_pool',
     });
 }
+/**
+ * A resource row's booking rules as they apply (jsonb; NULL for none): the tenant's defaults,
+ * overlaid by its pool's, overlaid by its own, field by field, so one set at a narrower level wins.
+ * Read from a row of slotlock.resources named `resources` (no alias).
+ */
+const EFFECTIVE_BOOKING_RULES = `NULLIF(
+  COALESCE((SELECT defaults.rules FROM slotlock.booking_rule_defaults defaults
+             WHERE defaults.tenant_ref = resources.tenant_ref AND defaults.pool_ref = ''), '{}'::jsonb)
+  || COALESCE((SELECT defaults.rules FROM slotlock.booking_rule_defaults defaults
+                WHERE defaults.tenant_ref = resources.tenant_ref
+                  AND defaults.pool_ref = resources.pool_ref), '{}'::jsonb)
+  || COALESCE(resources.booking_rules, '{}'::jsonb),
+  '{}'::jsonb) AS effective_booking_rules`;
+/** What rules Slotlock did not write read as: no booking passes them. */
+const REFUSE_EVERY_BOOKING = Object.freeze({ maxAdvanceDays: 1, minNoticeMinutes: 525_600 });
+/** Rules read back from storage: written validated, so anything else refuses every booking. */
+function storedBookingRules(value) {
+    try {
+        return parseBookingRules(value);
+    }
+    catch {
+        return { ...REFUSE_EVERY_BOOKING };
+    }
+}
 function toResource(row) {
     const resource = {
         id: row.id,
@@ -1234,11 +1380,19 @@ function toResource(row) {
     if (row.booking_rules !== null && row.booking_rules !== undefined) {
         // Written through setResourceBookingRules, which validates; anything else reads as refusing
         // every booking, never as no rule.
-        try {
-            resource.bookingRules = parseBookingRules(row.booking_rules);
+        resource.bookingRules = storedBookingRules(row.booking_rules);
+    }
+    if (row.effective_booking_rules !== null && row.effective_booking_rules !== undefined) {
+        // Merged from levels each validated alone, so only their combination can disagree (an offset
+        // from one level over a shorter step from another): that one is read modulo the step. A field
+        // invalid in itself was not written by Slotlock, and refuses every booking, as stored rules do.
+        const { rules, dropped } = parseEffectiveBookingRules(row.effective_booking_rules);
+        if (dropped.length > 0) {
+            console.warn(JSON.stringify({ message: 'slotlock refused invalid booking rules', resource: row.id, dropped }));
+            resource.effectiveBookingRules = { ...REFUSE_EVERY_BOOKING };
         }
-        catch {
-            resource.bookingRules = { maxAdvanceDays: 1, minNoticeMinutes: 525_600 };
+        else if (Object.keys(rules).length > 0) {
+            resource.effectiveBookingRules = rules;
         }
     }
     return resource;
@@ -1268,7 +1422,7 @@ async function upsertResource(executor, params) {
         WHERE tenant_ref IS NOT NULL AND external_ref IS NOT NULL
       DO UPDATE SET timezone = EXCLUDED.timezone
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     else if (params.externalRef !== undefined) {
         rows = await executor `
@@ -1278,13 +1432,13 @@ async function upsertResource(executor, params) {
         WHERE tenant_ref IS NULL AND external_ref IS NOT NULL
       DO UPDATE SET external_ref = EXCLUDED.external_ref
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     else {
         rows = await executor `
       INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
       VALUES (NULL, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     const row = rows[0];
     if (!row) {
@@ -1307,7 +1461,7 @@ async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
            summary, description, location, status, transparency, organizer, attendees,
            reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
            materialized_ends_at, recurrence_cursor, revision, source, created_at,
-           updated_at, recurrence_ends_by IS NULL AS ends_by_missing, buffer_after_ms
+           updated_at, recurrence_ends_by IS NULL AS ends_by_missing, buffer_after_ms, buffer_before_ms
       FROM slotlock.calendar_events
      WHERE id = ${eventId} AND tenant_ref = ${tenantRef}
      FOR UPDATE`;
@@ -1330,6 +1484,7 @@ async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
         occurrences,
         revision: Number(row.revision),
         bufferAfterMs: Number(row.buffer_after_ms ?? 0),
+        bufferBeforeMs: Number(row.buffer_before_ms ?? 0),
     });
     // A series stored before 0.3 learns when it ends at its first roll.
     const endsBy = row.ends_by_missing ? recurrenceEndsByColumn(event) : null;
@@ -1697,8 +1852,28 @@ async function forgetExpiredHoldAnswers(tx, tenantRef, limit) {
     return Number(row?.deleted ?? 0);
 }
 /**
- * Delete expired held rows whose occupied time (buffer included, as the EXCLUDE constraint reads
- * it) overlaps the requested window, whose `end` is its own occupied end, in deterministic id
+ * The time a booking of [start, end) keeping these buffers occupies, as the exclusion constraint
+ * reads it: from its start less its leading buffer to its end plus its trailing one.
+ */
+function occupiedTime(params) {
+    return {
+        start: new Date(params.start.getTime() - (params.bufferBeforeMs ?? 0)),
+        end: new Date(params.end.getTime() + (params.bufferAfterMs ?? 0)),
+    };
+}
+/**
+ * A row's occupied time starts before `end`: a condition on its occupied start that still reads the
+ * (resource_id, starts_at, ends_at) index, since no row starts more than a day after it.
+ */
+function occupiedStartsBefore(executor, end, alias) {
+    const column = (name) => executor.unsafe(alias === undefined ? name : `${alias}.${name}`);
+    return executor `(${column('starts_at')} < ${new Date(end.getTime() + MAX_BUFFER_BEFORE_MS)}
+                   AND COALESCE(${column('occupied_starts_at')}, ${column('starts_at')}) < ${end})`;
+}
+/**
+ * Delete expired held rows whose occupied time (buffers included, as the EXCLUDE constraint reads
+ * it) overlaps the requested window, whose `start` and `end` are its own occupied start and end
+ * (`occupiedTime`), in deterministic id
  * order under FOR UPDATE — two concurrent reapers lock the same rows in the same order (no
  * deadlock), the loser simply finds them gone. Runs inside the caller's transaction, immediately
  * before its INSERT, so the EXCLUDE arbiter only ever sees LIVE occupation.
@@ -1711,7 +1886,7 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
         WHERE resource_id = ${resourceId}
           AND status = 'held'
           AND expires_at <= statement_timestamp()
-          AND starts_at < ${end}
+          AND ${occupiedStartsBefore(tx, end)}
           AND COALESCE(occupied_ends_at, ends_at) > ${start}
         ORDER BY id
         FOR UPDATE
@@ -1723,7 +1898,7 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
  * loser's transaction start (constraint saw it) and this lookup (live filter hides it) — an
  * immediate retry reaps it and wins.
  */
-async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, excludeReservationId, excludeCalendarEventId) {
+async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, excludeReservationId, excludeCalendarEventId, bufferBeforeMs = 0) {
     const winners = await sql `
     SELECT id FROM slotlock.reservations
      WHERE resource_id = ${resourceId}
@@ -1731,12 +1906,12 @@ async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, exclu
        AND (${excludeCalendarEventId ?? null}::uuid IS NULL
             OR calendar_event_id IS DISTINCT FROM ${excludeCalendarEventId ?? null}::uuid)
        AND tstzrange(
-             starts_at,
+             COALESCE(occupied_starts_at, starts_at),
              COALESCE(occupied_ends_at, ends_at),
              '[)'
            ) && tstzrange(
-             ${start},
-             ${end} + ${bufferAfterMs} * interval '1 millisecond',
+             ${start}::timestamptz - ${bufferBeforeMs} * interval '1 millisecond',
+             ${end}::timestamptz + ${bufferAfterMs} * interval '1 millisecond',
              '[)'
            )
        AND (status <> 'held' OR expires_at > statement_timestamp())
@@ -1821,6 +1996,7 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'deleteResource',
     'setResourceAvailability',
     'setResourceBookingRules',
+    'setBookingRuleDefaults',
     'setResourcePool',
     'setTenantAvailability',
     'createReservation',
@@ -1975,19 +2151,30 @@ function buildSlotlockStore(sql, options, refusal) {
             // application instances can still collide on pg_namespace/pg_extension unique indexes.
             // inMigration serializes bootstrap per database and the transaction releases the lock on
             // crashes. A schema this release already left as it is changes nothing and locks no table,
-            // unless old rows kept one of its constraints NOT VALID: then only the validation runs again.
-            const validate = await inMigration(sql, migrationOptions, async (tx) => {
+            // unless old rows kept one of its constraints NOT VALID (then only the validation runs again)
+            // or the rename of earlier coverage changes is not done (then only a pass of it runs).
+            const next = await inMigration(sql, migrationOptions, async (tx) => {
                 await tx.unsafe(SLOTLOCK_DEPLOYMENT_CHECKS).catch((error) => {
                     throw schemaControlRefusal(error);
                 });
-                if (await slotlockSchemaUpToDate(tx))
-                    return slotlockConstraintUnvalidated(tx);
+                if (await slotlockSchemaUpToDate(tx)) {
+                    return {
+                        validate: await slotlockConstraintUnvalidated(tx),
+                        rename: await coverageChangesRenamePending(tx),
+                    };
+                }
                 await tx.unsafe(SLOTLOCK_STRUCTURE_DDL).catch((error) => {
                     throw schemaControlRefusal(error);
                 });
-                return true;
+                return { validate: true, rename: await coverageChangesRenamePending(tx) };
             });
-            if (!validate)
+            // Changes an earlier release wrote are renamed in short batches once the structure commits,
+            // never under its locks, by this migration and the next ones until a pass finds none
+            // (renameEarlierCoverageChanges); the feed serves any not renamed yet redacted (event-feed.ts,
+            // slotlockServedChange).
+            if (next.rename)
+                await renameEarlierCoverageChanges(sql, migrationOptions);
+            if (!next.validate)
                 return;
             // Once the DDL has committed, its ACCESS EXCLUSIVE locks are gone: validating holds none that
             // a serving query waits for (ddl.ts, DEPLOYMENT_VALIDATE_CONSTRAINTS). Inside a caller's
@@ -2151,6 +2338,16 @@ function buildSlotlockStore(sql, options, refusal) {
                     code: 'invalid_identity',
                 });
             }
+            const origin = options?.origin;
+            if (origin !== undefined && !isSlotlockChangeOrigin(origin)) {
+                throw Object.assign(new Error(`Slotlock origin must be one of ${SLOTLOCK_CHANGE_ORIGINS.join(', ')}`), {
+                    code: 'invalid_identity',
+                });
+            }
+            const keyId = options?.keyId;
+            if (keyId !== undefined && !isValidResourceId(keyId)) {
+                throw Object.assign(new Error('Slotlock key id must be a UUID'), { code: 'invalid_identity' });
+            }
             const release = await tenantSlots?.(tenantRef, options?.signal);
             // A lock wait that timed out leaves the transaction unusable, so the reset below fails with
             // another error in its place: noted here as it happens.
@@ -2167,6 +2364,8 @@ function buildSlotlockStore(sql, options, refusal) {
                 const previous = await tx `
             SELECT current_setting(${configuredTenantSetting}, true) AS value,
                    current_setting('slotlock.actor', true) AS actor,
+                   current_setting('slotlock.origin', true) AS origin,
+                   current_setting('slotlock.key_id', true) AS key,
                    current_setting('transaction_isolation') AS isolation,
                    pg_advisory_xact_lock_shared(
                      hashtextextended(${slotlockTenantLockKey(tenantRef)}, 0)
@@ -2174,6 +2373,9 @@ function buildSlotlockStore(sql, options, refusal) {
                 const [context] = await tx `
             SELECT set_config(${configuredTenantSetting}, ${tenantRef}, true) AS tenant,
                    set_config('slotlock.actor', ${actor ?? ''}, true) AS actor,
+                   set_config('slotlock.origin', COALESCE(${origin ?? null}::text,
+                     NULLIF(current_setting('slotlock.origin', true), ''), 'library'), true) AS origin,
+                   set_config('slotlock.key_id', ${keyId ?? ''}, true) AS key,
                    slotlock.tenant_suspended(${tenantRef}) AS suspended`.catch((error) => {
                     throw suspensionCheckRefusal(error);
                 });
@@ -2195,7 +2397,9 @@ function buildSlotlockStore(sql, options, refusal) {
                 }
                 finally {
                     await tx `SELECT set_config(${configuredTenantSetting}, ${previous[0]?.value ?? ''}, true),
-                            set_config('slotlock.actor', ${previous[0]?.actor ?? ''}, true)`;
+                            set_config('slotlock.actor', ${previous[0]?.actor ?? ''}, true),
+                            set_config('slotlock.origin', ${previous[0]?.origin ?? ''}, true),
+                            set_config('slotlock.key_id', ${previous[0]?.key ?? ''}, true)`;
                 }
             }, 'read committed')
                 .catch((error) => {
@@ -2256,7 +2460,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})`;
@@ -2274,7 +2478,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET availability_rules = ${rules}::jsonb
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2306,10 +2510,74 @@ function buildSlotlockStore(sql, options, refusal) {
                END
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
         RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-                  visibility, archived_at`;
+                  visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
+        async setBookingRuleDefaults(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (params.pool !== null && !isPoolName(params.pool))
+                throw invalidPoolError();
+            const pool = params.pool ?? '';
+            if (params.rules === null) {
+                await sql `
+          DELETE FROM slotlock.booking_rule_defaults
+           WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${pool}`;
+                return null;
+            }
+            let rules;
+            try {
+                rules = parseBookingRuleDefaults(params.rules);
+            }
+            catch (error) {
+                throw Object.assign(new Error(error.message), {
+                    code: 'invalid_booking_rules',
+                });
+            }
+            const tenantRef = params.tenantRef;
+            return inTransaction(sql, async (tx) => {
+                if (pool !== '') {
+                    // Counted under the tenant's lock, so racing writes stop at the cap.
+                    // The count after the lock sees every committed row only under READ COMMITTED.
+                    await assertReadCommitted(tx);
+                    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${`slotlock:rule-defaults:${tenantRef}`}, 0))`;
+                    const [counted] = await tx `
+            SELECT count(*)::int AS pools, bool_or(pool_ref = ${pool}) IS TRUE AS exists
+              FROM slotlock.booking_rule_defaults
+             WHERE tenant_ref = ${tenantRef} AND pool_ref <> ''`;
+                    if (!counted?.exists && (counted?.pools ?? 0) >= SLOTLOCK_MAX_POOL_RULE_DEFAULTS) {
+                        throw Object.assign(new Error(`Slotlock keeps default booking rules for at most ${SLOTLOCK_MAX_POOL_RULE_DEFAULTS} pools a tenant`), { code: 'pool_rules_limit_reached', limit: SLOTLOCK_MAX_POOL_RULE_DEFAULTS });
+                    }
+                }
+                await tx `
+          INSERT INTO slotlock.booking_rule_defaults (tenant_ref, pool_ref, rules)
+          VALUES (${tenantRef}, ${pool}, ${tx.json({ ...rules })}::jsonb)
+          ON CONFLICT (tenant_ref, pool_ref)
+          DO UPDATE SET rules = EXCLUDED.rules, updated_at = statement_timestamp()`;
+                return rules;
+            });
+        },
+        async getBookingRuleDefaults(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const rows = await sql `
+        SELECT pool_ref, rules FROM slotlock.booking_rule_defaults
+         WHERE tenant_ref = ${params.tenantRef}
+         ORDER BY pool_ref
+         LIMIT ${SLOTLOCK_MAX_POOL_RULE_DEFAULTS + 1}`;
+            const defaults = { tenant: null, pools: {} };
+            for (const row of rows) {
+                const rules = storedBookingRules(row.rules);
+                if (row.pool_ref === '')
+                    defaults.tenant = rules;
+                else
+                    defaults.pools[row.pool_ref] = rules;
+            }
+            return defaults;
+        },
         async setResourcePool(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
                 throw Object.assign(new Error('Slotlock resource identity is invalid'), {
@@ -2322,7 +2590,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources SET pool_ref = ${params.pool}
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
         RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-                  visibility, archived_at`;
+                  visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2333,7 +2601,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 throw invalidPoolError();
             const rows = await sql `
         SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-               visibility, archived_at
+               visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
            AND archived_at IS NULL
@@ -2386,7 +2654,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at
+        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
@@ -2406,7 +2674,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET archived_at = COALESCE(archived_at, clock_timestamp())
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             return row ? toResource(row) : null;
         },
         async restoreResource(params) {
@@ -2417,7 +2685,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET archived_at = NULL
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at`;
+        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             return row ? toResource(row) : null;
         },
         async deleteResource(params) {
@@ -2465,6 +2733,9 @@ function buildSlotlockStore(sql, options, refusal) {
             // A booking on a tenant's resource takes the tenant and its own id as reference, so it can be
             // cancelled and moved like any other; one on a resource with no tenant stays tenantless.
             const id = randomUUID();
+            // The buffers written, for the overlap answer if the write loses.
+            let bufferBeforeMs = 0;
+            let bufferAfterMs = 0;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2485,24 +2756,27 @@ function buildSlotlockStore(sql, options, refusal) {
                         const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
                         if (ruling.rule)
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
-                        const occupied = new Date(params.end.getTime() + ruling.turnaroundMs);
+                        bufferBeforeMs = ruling.bufferBeforeMs;
+                        bufferAfterMs = ruling.turnaroundMs;
+                        const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
                         if (resource.tenant_ref !== null &&
                             !(await recurrenceCoversWrite(tx, {
                                 tenantRef: resource.tenant_ref,
                                 resourceId: params.resourceId,
-                                start: params.start,
-                                end: occupied,
+                                ...occupied,
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
+                        await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
-                id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms, source
+                id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
+                buffer_before_ms, source
               ) VALUES (
                 ${id}, ${params.resourceId}, ${resource.tenant_ref},
                 ${resource.tenant_ref === null ? null : id},
-                ${params.start}, ${params.end}, ${ruling.turnaroundMs}, ${params.source ?? null}
+                ${params.start}, ${params.end}, ${ruling.turnaroundMs}, ${ruling.bufferBeforeMs},
+                ${params.source ?? null}
               )
               RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                         buffer_after_ms, revision, source`;
@@ -2523,8 +2797,9 @@ function buildSlotlockStore(sql, options, refusal) {
                     }
                     // A SECOND contention abort is treated as a loss too (structured, possibly with a null
                     // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
-                    await rollSeriesBehind(sql, params.resourceId, params.start, params.end);
-                    return overlapLoss(sql, params.resourceId, params.start, params.end);
+                    const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
+                    await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs, undefined, undefined, bufferBeforeMs);
                 }
             }
         },
@@ -2535,6 +2810,7 @@ function buildSlotlockStore(sql, options, refusal) {
             if (params.revision !== 1)
                 return { ok: false, code: 'invalid_revision' };
             let written = params.bufferAfterMs;
+            let writtenBefore = 0;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2579,23 +2855,24 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
                         const bufferAfterMs = Math.max(params.bufferAfterMs, ruling.turnaroundMs);
                         written = bufferAfterMs;
-                        const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
+                        writtenBefore = ruling.bufferBeforeMs;
+                        const occupied = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs });
                         if (!(await recurrenceCoversWrite(tx, {
                             tenantRef: params.tenantRef,
                             resourceId: params.resourceId,
-                            start: params.start,
-                            end: occupied,
+                            ...occupied,
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupied);
+                        await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               INSERT INTO slotlock.reservations (
                 resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
-                revision, source
+                buffer_before_ms, revision, source
               ) VALUES (
                 ${params.resourceId}, ${params.tenantRef}, ${params.externalRef}, ${params.start},
-                ${params.end}, ${bufferAfterMs}, ${params.revision}, ${params.source ?? null}
+                ${params.end}, ${bufferAfterMs}, ${writtenBefore}, ${params.revision},
+                ${params.source ?? null}
               )
               RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                         buffer_after_ms, revision, source`;
@@ -2615,8 +2892,9 @@ function buildSlotlockStore(sql, options, refusal) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs: written }));
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, written);
+                    const occupied = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs: written });
+                    await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, written, undefined, undefined, writtenBefore);
                 }
             }
         },
@@ -2626,6 +2904,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 return invalid;
             let currentReservationId;
             let bufferAfterMs = params.bufferAfterMs;
+            let bufferBeforeMs = 0;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2668,21 +2947,23 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (ruling.rule)
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
                         bufferAfterMs = Math.max(params.bufferAfterMs, ruling.turnaroundMs);
+                        bufferBeforeMs = ruling.bufferBeforeMs;
+                        const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
                         if (!(await recurrenceCoversWrite(tx, {
                             tenantRef: params.tenantRef,
                             resourceId: params.resourceId,
-                            start: params.start,
-                            end: occupiedEnd({ end: params.end, bufferAfterMs }),
+                            ...occupied,
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs }));
+                        await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               UPDATE slotlock.reservations
                  SET resource_id = ${params.resourceId},
                      starts_at = ${params.start},
                      ends_at = ${params.end},
                      buffer_after_ms = ${bufferAfterMs},
+                     buffer_before_ms = ${bufferBeforeMs},
                      revision = ${params.revision},
                      source = ${params.source ?? null},
                      -- A check-in is for the time it was made for: a move to another start clears it.
@@ -2709,9 +2990,9 @@ function buildSlotlockStore(sql, options, refusal) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    const occupied = occupiedEnd({ end: params.end, bufferAfterMs });
-                    await rollSeriesBehind(sql, params.resourceId, params.start, occupied);
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs, currentReservationId);
+                    const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
+                    await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs, currentReservationId, undefined, bufferBeforeMs);
                 }
             }
         },
@@ -2825,8 +3106,10 @@ function buildSlotlockStore(sql, options, refusal) {
                 ...(holderRef !== undefined ? { holderRef } : {}),
             });
             const ttlSeconds = params.ttlMs / 1000;
-            // The buffer written: the one asked for, raised to the resource's turnaround.
+            // The buffers written: the one asked for, raised to the resource's turnaround, and its rule's
+            // leading buffer.
             let written = bufferAfterMs;
+            let writtenBefore = 0;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
@@ -2875,7 +3158,8 @@ function buildSlotlockStore(sql, options, refusal) {
                             const [held] = await tx `
                 SELECT count(*)::int AS count,
                        COALESCE(sum(extract(epoch FROM
-                         ends_at + buffer_after_ms * interval '1 millisecond' - starts_at)), 0)::float8
+                         ends_at + (buffer_after_ms + buffer_before_ms) * interval '1 millisecond'
+                           - starts_at)), 0)::float8
                          AS seconds
                   FROM slotlock.reservations
                  WHERE holder_ref = ${holderRef} AND tenant_ref IS NULL AND status = 'held'
@@ -2891,10 +3175,11 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (ruling.rule)
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
                         written = Math.max(bufferAfterMs, ruling.turnaroundMs);
-                        const reach = occupiedEnd({ end: params.end, bufferAfterMs: written });
+                        writtenBefore = ruling.bufferBeforeMs;
+                        const reach = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs: written });
                         if (heldSeconds !== null &&
                             maxHeldHoursPerHolder !== undefined &&
-                            heldSeconds + (reach.getTime() - params.start.getTime()) / 1000 >
+                            heldSeconds + (reach.end.getTime() - reach.start.getTime()) / 1000 >
                                 maxHeldHoursPerHolder * 3_600) {
                             return { ok: false, code: 'held_time_limit_reached', limit: maxHeldHoursPerHolder };
                         }
@@ -2902,18 +3187,17 @@ function buildSlotlockStore(sql, options, refusal) {
                             !(await recurrenceCoversWrite(tx, {
                                 tenantRef: resource.tenant_ref,
                                 resourceId: params.resourceId,
-                                start: params.start,
-                                end: reach,
+                                ...reach,
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
-                        await reapExpiredHolds(tx, params.resourceId, params.start, reach);
+                        await reapExpiredHolds(tx, params.resourceId, reach.start, reach.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
-                resource_id, starts_at, ends_at, buffer_after_ms, status, expires_at, source,
-                holder_ref, hold_group_id
+                resource_id, starts_at, ends_at, buffer_after_ms, buffer_before_ms, status,
+                expires_at, source, holder_ref, hold_group_id
               ) VALUES (
-                ${params.resourceId}, ${params.start}, ${params.end}, ${written}, 'held',
+                ${params.resourceId}, ${params.start}, ${params.end}, ${written}, ${writtenBefore}, 'held',
                 statement_timestamp() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null},
                 ${holderRef ?? null}, ${params.groupId ?? null}
               )
@@ -2947,8 +3231,9 @@ function buildSlotlockStore(sql, options, refusal) {
                     }
                     // A SECOND contention abort is treated as a loss too (structured, possibly with a null
                     // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
-                    await rollSeriesBehind(sql, params.resourceId, params.start, occupiedEnd({ end: params.end, bufferAfterMs: written }));
-                    return overlapLoss(sql, params.resourceId, params.start, params.end, written);
+                    const occupied = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs: written });
+                    await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
+                    return overlapLoss(sql, params.resourceId, params.start, params.end, written, undefined, undefined, writtenBefore);
                 }
             }
         },
@@ -3200,15 +3485,16 @@ function buildSlotlockStore(sql, options, refusal) {
             // Expired holds are dead occupation: excluded here so findNextAvailable can offer their
             // space (the acquiring transaction reaps the row itself when it takes the window).
             const rows = await sql `
-        SELECT starts_at, COALESCE(occupied_ends_at, ends_at) AS occupied_ends_at
+        SELECT COALESCE(occupied_starts_at, starts_at) AS occupied_starts_at,
+               COALESCE(occupied_ends_at, ends_at) AS occupied_ends_at
           FROM slotlock.reservations
          WHERE resource_id = ${resourceId}
-           AND starts_at < ${window.end}
+           AND ${occupiedStartsBefore(sql, window.end)}
            AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
            AND (status <> 'held' OR expires_at > statement_timestamp())
-         ORDER BY starts_at
+         ORDER BY COALESCE(occupied_starts_at, starts_at)
          LIMIT ${options.limit ?? null}`;
-            return rows.map((r) => ({ start: r.starts_at, end: r.occupied_ends_at }));
+            return rows.map((r) => ({ start: r.occupied_starts_at, end: r.occupied_ends_at }));
         },
         async putCalendarEvent(params) {
             const ownerRef = params.ownerRef ?? SLOTLOCK_INTERNAL_EVENT_OWNER_REF;
@@ -3266,6 +3552,8 @@ function buildSlotlockStore(sql, options, refusal) {
             });
             const recurrenceEndsBy = recurrenceEndsByColumn(event);
             let attempted = expanded?.occurrences ?? [];
+            // The buffers the attempt kept, for the overlap answer if it loses.
+            let attemptedBuffers = { bufferBeforeMs: 0, bufferAfterMs: 0 };
             let storedEventId;
             for (let attempt = 1;; attempt++) {
                 try {
@@ -3403,6 +3691,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             AND hold_group_id = ${hold.hold_group_id}::uuid))`;
                         }
                         let turnaroundMs = 0;
+                        let bufferBeforeMs = 0;
                         if (params.enforceBookingRules === true && (event.transparency ?? 'opaque') === 'opaque') {
                             const judge = await bookingJudge(tx, params.resourceId, defaultHours);
                             for (const [index, occurrence] of occurrences.entries()) {
@@ -3412,9 +3701,11 @@ function buildSlotlockStore(sql, options, refusal) {
                                     return { ok: false, code: 'booking_rule_violated', rule };
                             }
                             turnaroundMs = judge.turnaroundMs;
+                            bufferBeforeMs = judge.bufferBeforeMs;
                         }
+                        attemptedBuffers = { bufferBeforeMs, bufferAfterMs: turnaroundMs };
                         const span = occurrenceSpan(occurrences);
-                        const reach = span && { start: span.start, end: new Date(span.end.getTime() + turnaroundMs) };
+                        const reach = span && occupiedTime({ ...span, bufferBeforeMs, bufferAfterMs: turnaroundMs });
                         if ((event.transparency ?? 'opaque') === 'opaque' &&
                             reach &&
                             !(found && (await holdsEveryOccurrence(tx, found.id, params.resourceId, occurrences)))) {
@@ -3452,6 +3743,7 @@ function buildSlotlockStore(sql, options, refusal) {
                        revision = ${revision},
                        source = ${params.source ?? null},
                        buffer_after_ms = ${turnaroundMs},
+                       buffer_before_ms = ${bufferBeforeMs},
                        updated_at = now()
                  WHERE id = ${eventId}
                    AND tenant_ref = ${params.tenantRef}
@@ -3464,7 +3756,7 @@ function buildSlotlockStore(sql, options, refusal) {
                   summary, description, location, status, transparency, organizer, attendees,
                   reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
                   materialized_ends_at, recurrence_cursor, recurrence_ends_by, revision, source,
-                  buffer_after_ms
+                  buffer_after_ms, buffer_before_ms
                 ) VALUES (
                   ${eventId}, ${params.tenantRef}, ${ownerRef}, ${params.externalRef},
                   ${params.resourceId},
@@ -3478,7 +3770,7 @@ function buildSlotlockStore(sql, options, refusal) {
                   ${tx.json(eventExceptionsForJson(event.recurrence?.exceptions))},
                   ${materializationWindow.start}, ${materializationWindow.end},
                   ${seriesCursorJson(tx, series.cursor)}, ${recurrenceEndsBy}::text::timestamptz,
-                  ${revision}, ${params.source ?? null}, ${turnaroundMs}
+                  ${revision}, ${params.source ?? null}, ${turnaroundMs}, ${bufferBeforeMs}
                 )`;
                         }
                         // The normalized children are the queryable/canonical representation. The JSON
@@ -3492,6 +3784,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             occurrences,
                             revision,
                             bufferAfterMs: turnaroundMs,
+                            bufferBeforeMs,
                         });
                         await tx `
               INSERT INTO slotlock.calendar_event_commands (
@@ -3522,11 +3815,12 @@ function buildSlotlockStore(sql, options, refusal) {
                         code !== SERIALIZATION_FAILURE) {
                         throw error;
                     }
-                    const reach = occurrenceSpan(attempted);
-                    if (reach) {
+                    const span = occurrenceSpan(attempted);
+                    if (span) {
+                        const reach = occupiedTime({ ...span, ...attemptedBuffers });
                         await rollSeriesBehind(sql, params.resourceId, reach.start, reach.end, storedEventId);
                     }
-                    return findCalendarOverlap(sql, params.resourceId, attempted, storedEventId);
+                    return findCalendarOverlap(sql, params.resourceId, attempted, storedEventId, attemptedBuffers);
                 }
             }
         },
@@ -3932,7 +4226,9 @@ function buildSlotlockStore(sql, options, refusal) {
                slotlock.zoned_instant(event.wall_starts_at, event.timezone) AS moved_start,
                slotlock.zoned_instant(event.wall_ends_at, event.timezone) AS moved_end,
                COALESCE((SELECT max(booking.buffer_after_ms) FROM slotlock.reservations booking
-                          WHERE booking.calendar_event_id = event.id), 0) AS buffer
+                          WHERE booking.calendar_event_id = event.id), 0) AS buffer,
+               COALESCE((SELECT max(booking.buffer_before_ms) FROM slotlock.reservations booking
+                          WHERE booking.calendar_event_id = event.id), 0) AS buffer_before
           FROM slotlock.calendar_events event
          WHERE event.tenant_ref = ${params.tenantRef}
            AND event.recurrence_rule IS NULL
@@ -3986,6 +4282,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             ],
                             revision,
                             bufferAfterMs: Number(event.buffer),
+                            bufferBeforeMs: Number(event.buffer_before),
                         });
                     });
                     moved++;
@@ -4291,13 +4588,14 @@ function buildSlotlockStore(sql, options, refusal) {
             }
             const maxAgeMs = params.maxAgeMs ?? 24 * 60 * 60 * 1000;
             const rows = await sql `
-        SELECT source, starts_at, ends_at, revision, observed_at, last_error, last_error_at,
+        SELECT source, source_id, starts_at, ends_at, revision, observed_at, last_error, last_error_at,
                observed_at < now() - make_interval(secs => ${maxAgeMs / 1_000}) AS stale
           FROM slotlock.calendar_coverage
          WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
          ORDER BY source`;
             return rows.map((row) => ({
                 source: row.source,
+                sourceId: row.source_id,
                 start: row.starts_at,
                 end: row.ends_at,
                 revision: Number(row.revision),
@@ -4321,13 +4619,13 @@ function buildSlotlockStore(sql, options, refusal) {
                 AND observed_at < now() - make_interval(secs => ${maxAgeMs / 1_000})
               ORDER BY observed_at LIMIT ${params.limit ?? 100}
               FOR UPDATE SKIP LOCKED)
-          RETURNING coverage.resource_id, coverage.source, coverage.observed_at, coverage.last_error
+          RETURNING coverage.resource_id, coverage.source_id, coverage.observed_at
         ), reported AS (
           INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
-          SELECT ${params.tenantRef}, stale.resource_id, 'coverage.stale', stale.source,
-                 jsonb_strip_nulls(jsonb_build_object(
-                   'resource_id', stale.resource_id, 'source', stale.source,
-                   'observed_at', stale.observed_at, 'last_error', stale.last_error)),
+          SELECT ${params.tenantRef}, stale.resource_id, 'coverage.stale', stale.source_id,
+                 jsonb_build_object(
+                   'resource_id', stale.resource_id, 'source_id', stale.source_id,
+                   'observed_at', stale.observed_at),
                  'slotlock:maintenance'
             FROM stale
           RETURNING 1
@@ -4742,18 +5040,28 @@ function buildSlotlockStore(sql, options, refusal) {
                         continue;
                     // Only resources whose window looks free are tried: a hold refused keeps its locks
                     // until the transaction ends, so trying every member of a full pool would pile them up.
+                    // A hold there keeps the resource's buffers (its rules as they apply), so they must be free too.
                     const candidates = await tx `
-            SELECT resource.id FROM slotlock.resources resource
-             WHERE resource.tenant_ref = ${tenantRef} AND resource.archived_at IS NULL
-               AND (resource.id = ${entry.resource_id}::uuid
-                    OR (${entry.resource_id}::uuid IS NULL AND resource.pool_ref = ${entry.pool_ref}))
+            SELECT resources.id
+              FROM slotlock.resources,
+                   LATERAL (SELECT ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}) effective,
+                   LATERAL (SELECT
+                     COALESCE(least(greatest((effective.effective_booking_rules->>'bufferBeforeMinutes')::numeric, 0), 1440)::int, 0)
+                       AS before_minutes,
+                     COALESCE(least(greatest((effective.effective_booking_rules->>'turnaroundMinutes')::numeric, 0), 1440)::int, 0)
+                       AS after_minutes) buffers
+             WHERE resources.tenant_ref = ${tenantRef} AND resources.archived_at IS NULL
+               AND (resources.id = ${entry.resource_id}::uuid
+                    OR (${entry.resource_id}::uuid IS NULL AND resources.pool_ref = ${entry.pool_ref}))
                AND NOT EXISTS (
                  SELECT 1 FROM slotlock.reservations taken
-                  WHERE taken.resource_id = resource.id
-                    AND tstzrange(taken.starts_at, COALESCE(taken.occupied_ends_at, taken.ends_at), '[)')
-                        && tstzrange(${entry.starts_at}::timestamptz, ${entry.ends_at}::timestamptz, '[)')
+                  WHERE taken.resource_id = resources.id
+                    AND tstzrange(COALESCE(taken.occupied_starts_at, taken.starts_at),
+                                  COALESCE(taken.occupied_ends_at, taken.ends_at), '[)')
+                        && tstzrange(${entry.starts_at}::timestamptz - make_interval(mins => buffers.before_minutes),
+                                     ${entry.ends_at}::timestamptz + make_interval(mins => buffers.after_minutes), '[)')
                     AND (taken.status <> 'held' OR taken.expires_at > statement_timestamp()))
-             ORDER BY resource.id
+             ORDER BY resources.id
              LIMIT ${OFFER_CANDIDATES}`;
                     for (const { id: resourceId } of candidates) {
                         const hold = await inner.acquireHold({
@@ -4818,23 +5126,26 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const owner = await sql `
-        SELECT id, COALESCE((booking_rules->>'requireCertain')::boolean, false) AS require_certain
-          FROM slotlock.resources
+        SELECT id, COALESCE((effective.effective_booking_rules->>'requireCertain')::boolean, false)
+                 AS require_certain
+          FROM slotlock.resources,
+               LATERAL (SELECT ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}) effective
          WHERE id = ${params.resourceId} AND tenant_ref = ${params.tenantRef}`;
             if (!owner[0]) {
                 throw Object.assign(new Error('Slotlock resource belongs to another tenant'), {
                     code: 'resource_tenant_mismatch',
                 });
             }
+            // Each row's occupied time: its buffers are as busy as the booking.
             const busyRows = await sql `
-        SELECT reservation.starts_at,
+        SELECT COALESCE(reservation.occupied_starts_at, reservation.starts_at) AS starts_at,
                COALESCE(reservation.occupied_ends_at, reservation.ends_at) AS occupied_ends_at
           FROM slotlock.reservations reservation
          WHERE reservation.resource_id = ${params.resourceId}
-           AND reservation.starts_at < ${window.end}
+           AND ${occupiedStartsBefore(sql, window.end, 'reservation')}
            AND COALESCE(reservation.occupied_ends_at, reservation.ends_at) > ${window.start}
            AND (reservation.status <> 'held' OR reservation.expires_at > statement_timestamp())
-         ORDER BY reservation.starts_at
+         ORDER BY 1
          LIMIT ${MAX_FREE_BUSY_INTERVALS + 1}`;
             if (busyRows.length > MAX_FREE_BUSY_INTERVALS) {
                 throw Object.assign(new Error('Slotlock free/busy work limit exceeded'), {
@@ -4953,7 +5264,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 throw notFound();
             const [row] = await sql `
         SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility,
-               archived_at, statement_timestamp() AS now
+               archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}, statement_timestamp() AS now
           FROM slotlock.resources
          WHERE id = ${params.resourceId} AND tenant_ref IS NOT DISTINCT FROM ${tenantRef}`;
             if (!row)
@@ -4962,9 +5273,10 @@ function buildSlotlockStore(sql, options, refusal) {
                 return null;
             const resource = toResource(row);
             const rules = params.rules ?? resource.availabilityRules ?? [];
-            // Only what a booking made now may take: the resource's booking rules bound the search.
+            // Only what a booking made now may take: the resource's booking rules (as they apply) bound
+            // the search.
             const search = bookingSearch({
-                rules: resource.bookingRules,
+                rules: resource.effectiveBookingRules,
                 timezone: resource.timezone,
                 window: asked,
                 now: row.now,
@@ -4972,9 +5284,9 @@ function buildSlotlockStore(sql, options, refusal) {
             });
             if (!search)
                 return null;
-            const { window, bufferAfterMs } = search;
-            // A slot's buffer may run past the window: the time it can reach must be proven free too.
-            const reach = { start: window.start, end: new Date(window.end.getTime() + bufferAfterMs) };
+            const { window } = search;
+            // A slot's buffers may run past the window: the time they can reach must be proven free too.
+            const reach = bookingSearchReach(search);
             let busy;
             if (tenantRef === null) {
                 // No event, coverage or series can belong to a resource with no tenant: only its rows.
@@ -4982,7 +5294,11 @@ function buildSlotlockStore(sql, options, refusal) {
             }
             else {
                 busy = [];
-                const parts = bufferAfterMs > 0 ? [window, { start: window.end, end: reach.end }] : [window];
+                const parts = [
+                    ...(reach.start < window.start ? [{ start: reach.start, end: window.start }] : []),
+                    window,
+                    ...(reach.end > window.end ? [{ start: window.end, end: reach.end }] : []),
+                ];
                 for (const part of parts) {
                     const freeBusy = await this.getFreeBusy({
                         tenantRef,
@@ -5001,12 +5317,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     busy.push(...freeBusy.busy);
                 }
             }
-            // A slot [s, s + d) with its buffer meets busy [b, e) exactly when [s, s + d) meets [b - buffer, e).
             return findNextAvailable({
-                busy: busy.map((interval) => ({
-                    start: new Date(interval.start.getTime() - bufferAfterMs),
-                    end: interval.end,
-                })),
+                busy: bookingSearchBlocked(busy, search),
                 windows: expandRules(rules, window, resource.timezone),
                 durationMs: params.durationMs,
                 ...(search.align ? { align: search.align } : {}),