slotlock 0.6.2 → 0.6.3

package/event-feed.js

@@ -1,7 +1,6 @@
-// The event feed (RFC 0002 P1-5): what changed for a tenant, read by position, and the webhook
-// endpoints it is delivered to. Rows are appended by triggers in the same transaction as the change
-// (ddl.ts, SLOTLOCK_OUTBOX_DDL). These are the store's methods for reading them and for keeping each
-// endpoint's delivery state; webhooks.ts signs and sends.
+// The event feed: what changed for a tenant, read by position, and the webhook endpoints it is
+// delivered to. Rows are appended by triggers in the changing transaction (ddl.ts,
+// SLOTLOCK_OUTBOX_DDL); webhooks.ts signs and sends.
 import { randomBytes } from 'node:crypto';
 /** A transaction on a client, or a savepoint inside the caller's (a tenant's, say). */
 async function inTransaction(sql, callback) {
@@ -28,8 +27,7 @@ export const SLOTLOCK_CHANGE_TYPES = Object.freeze([
     'waitlist.offered',
     'waitlist.expired',
     'webhook.disabled',
-    // Configuration: what a resource is and how it books, the sources it is read from, where the
-    // feed is delivered and the keys that reach the tenant. Ids and states, never a secret or a URL.
+    // Configuration changes: ids and states, never a secret or a URL.
     'resource.created',
     'resource.updated',
     'resource.archived',
@@ -45,10 +43,9 @@ export const SLOTLOCK_CHANGE_TYPES = Object.freeze([
     'key.revoked',
 ]);
 /**
- * Where a change came from, as the history and the feed record it (withTenant's `origin`): an agent
- * protocol (`mcp`, `a2a`), the REST API's agent routes (`rest`) or its application operations
- * (`application`), the dashboard, a member's dashboard assistant, maintenance, or code calling the
- * store itself (`library`). Never an address or anything else about a person.
+ * Where a change came from (withTenant's `origin`): an agent protocol (`mcp`, `a2a`), the REST
+ * API's agent routes (`rest`) or application operations (`application`), the dashboard, its
+ * assistant, maintenance, or direct store calls (`library`). Never anything about a person.
  */
 export const SLOTLOCK_CHANGE_ORIGINS = Object.freeze([
     'mcp',
@@ -65,20 +62,16 @@ export function isSlotlockChangeOrigin(value) {
     return typeof value === 'string' && SLOTLOCK_CHANGE_ORIGINS.includes(value);
 }
 /**
- * The digest 0.5.3 named a coverage source by on the feed: `src_` and the first 24 hex digits of
- * sha256(tenant, newline, source). Unkeyed, so anyone who knows the tenant could confirm a guessed
- * source against it; 0.6 names a source by a random id instead (`calendar_coverage.source_id`), and
- * the upgrade uses this only to find the changes 0.5.3 wrote and rename them. `tenant` and `source`
- * are SQL expressions.
+ * The unkeyed digest 0.5.3 named a coverage source by (`src_` + 24 hex of sha256(tenant, newline,
+ * source)); anyone knowing the tenant could confirm a guess. Used only by the upgrade to find and
+ * rename those changes. `tenant` and `source` are SQL expressions.
  */
 export function legacyCoverageSourceDigestSql(tenant, source) {
     return `'src_' || pg_catalog.left(pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(${tenant} || E'\\n' || ${source}, 'UTF8')), 'hex'), 24)`;
 }
 /**
- * 0.5.3 worked out a source's id here: an unkeyed digest of the tenant and the source, which let
- * anyone who saw a change confirm a guessed source. Since 0.6 a source's `source_id` is random and
- * only the database knows it, so this throws (`coverage_source_id_unavailable`) rather than give a
- * digest nothing carries any more.
+ * Throws `coverage_source_id_unavailable`: since 0.6 a source's `source_id` is random and only the
+ * database knows it (0.5.3's unkeyed digest let anyone confirm a guessed source).
  *
  * @deprecated Read `sourceId` from `listCoverage` (`source_id` of `slotlock_get_coverage`). It may
  * be removed in 0.7.0.
@@ -89,17 +82,15 @@ export function slotlockCoverageSourceId(_tenantRef, _source) {
 /** What a coverage source's `source_id` is: `src_` and 32 random hex digits. */
 const SLOTLOCK_COVERAGE_SOURCE_ID = /^src_[0-9a-f]{32}$/;
 /**
- * The `source_id` of a `coverage.*` change whose source could not be named any more: one an
- * earlier release recorded by the source itself (or by its 0.5.3 digest) after the source was
- * deleted, or one not yet renamed when it is read.
+ * The `source_id` of a `coverage.*` change whose source can no longer be named: an earlier
+ * release's change whose source was deleted, or one not yet renamed.
  */
 const SLOTLOCK_REDACTED_SOURCE_ID = 'src_redacted';
 /**
- * A change's subject and data as the feed serves them. A `coverage.*` change never carries its
- * source (`source`) or the error read from it (`last_error`, which can quote it), and is named by a
- * `source_id` of this release or `src_redacted`: an earlier release wrote both, and the upgrade
- * renames those rows in batches after it commits, so a row it has not reached yet, or one an
- * earlier release's server writes during a rolling upgrade, is served redacted.
+ * A change's subject and data as the feed serves them. A `coverage.*` change never carries `source`
+ * or `last_error` (which can quote it), and is named by a current `source_id` or `src_redacted`:
+ * rows an earlier release wrote are renamed in batches after upgrade, so one not reached yet is
+ * served redacted.
  */
 export function slotlockServedChange(type, subject, data) {
     if (!type.startsWith('coverage.'))
@@ -136,7 +127,7 @@ function toChange(row) {
         ...slotlockServedChange(row.type, row.subject, row.data),
         occurredAt: row.occurred_at,
         actor: row.actor,
-        // One a later release added, read by this one: unknown here, so unrecorded, not a failed page.
+        // An origin a later release added: unrecorded here, not a failed page.
         origin: isSlotlockChangeOrigin(row.origin) ? row.origin : null,
         keyId: row.key_id,
         position: encodePosition({ txid: row.txid, id: row.id, at: row.occurred_at.getTime() }),
@@ -202,8 +193,7 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
             const after = params.after === undefined ? null : decodePosition(params.after);
             if (params.after !== undefined && !after)
                 return { ok: false, code: 'invalid_cursor' };
-            // One statement, so the pruned position and the page are read from one snapshot: a prune
-            // that commits meanwhile is either wholly seen or not at all.
+            // One statement, so the pruned position and the page share a snapshot.
             const rows = await sql `
         SELECT mark.txid::text AS pruned_txid, mark.id::text AS pruned_id,
                pg_snapshot_xmin(pg_current_snapshot())::text AS horizon,
@@ -227,9 +217,8 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
             const head = rows[0];
             if (!head)
                 throw new Error('slotlock: change page returned no row');
-            // Whichever server pruned it, and however long it keeps changes: reading on could skip one.
-            // A 0.4 cursor also by its date, as 0.4 did: 0.4 pruned by age, not in feed order, so the
-            // mark its changes started at does not cover every one it took.
+            // Pruned by any server: reading on could skip a change. A 0.4 cursor also expires by date,
+            // since 0.4 pruned by age, not feed order.
             if (after &&
                 ((head.pruned_txid !== null &&
                     (BigInt(head.pruned_txid) > BigInt(after.txid) ||
@@ -241,8 +230,8 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
             }
             const changes = rows.flatMap((row) => (row.id === null ? [] : [toChange(row)]));
             const last = changes.at(-1);
-            // With nothing new the position stays, dated now: a reader that is up to date stays current.
-            // Before any change, every one still to come is after the oldest transaction still running.
+            // Nothing new: the position stays, dated now. Before any change, every one to come is after
+            // the oldest running transaction.
             const here = after ?? { txid: head.horizon, id: '0', at: 0 };
             return {
                 ok: true,
@@ -281,7 +270,6 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
             }
             const secret = `whsec_${randomBytes(32).toString('base64')}`;
             return inTransaction(sql, async (tx) => {
-                // One at a time per tenant, so racing creates stop at the limit.
                 await tx `SELECT pg_advisory_xact_lock(hashtextextended(${`slotlock:webhooks:${params.tenantRef}`}, 0))`;
                 const [count] = await tx `
           SELECT count(*)::int AS count FROM slotlock.webhook_endpoints
@@ -289,7 +277,7 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
                 if ((count?.count ?? 0) >= SLOTLOCK_MAX_WEBHOOK_ENDPOINTS) {
                     return { ok: false, code: 'webhook_limit_reached', limit: SLOTLOCK_MAX_WEBHOOK_ENDPOINTS };
                 }
-                // From now on: every transaction that has not ended yet is at or after this position.
+                // From now on: every transaction not yet ended is at or after this position.
                 const [row] = await tx `
           INSERT INTO slotlock.webhook_endpoints (tenant_ref, url, secret, event_types, cursor_txid)
           VALUES (${params.tenantRef}, ${params.url}, ${secret}, ${types}::text[],
@@ -323,7 +311,6 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
                 const [left] = await tx `
           SELECT count(*)::int AS count FROM slotlock.webhook_endpoints
            WHERE tenant_ref = ${params.tenantRef}`;
-                // The tenant's last endpoint takes it off the list servers deliver for.
                 if ((left?.count ?? 0) === 0) {
                     await tx `SELECT slotlock.unregister_webhook_tenant(${params.tenantRef}::text)`;
                 }
@@ -443,13 +430,12 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
              AND lease_token = ${params.leaseToken}::uuid
            RETURNING disabled_at IS NOT NULL AS disabled`;
                 if (settled?.disabled) {
-                    // The tenant hears of it on the feed, which every reader and other endpoint sees.
                     await tx `
             INSERT INTO slotlock.outbox (tenant_ref, type, subject, data)
             VALUES (${params.tenantRef}, 'webhook.disabled', ${params.endpointId},
                     ${tx.json({
-                        // The id alone: the feed goes to the tenant's other endpoints, and a URL can
-                        // carry a token.
+                        // The id alone: the feed reaches other endpoints, and a URL can carry a
+                        // token.
                         id: params.endpointId,
                         reason: failure?.gone === true ? 'gone' : 'failing',
                         last_status: failure?.status ?? null,
@@ -493,10 +479,9 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
         async pruneChanges(params) {
             if (!isIdentity(params.tenantRef))
                 throw identityError();
-            // Oldest first in feed order, and only up to the first change kept: a change still within the
-            // retention, one an enabled webhook has still to receive, or one of a transaction later than
-            // the oldest still running. So every change kept is after every change pruned (the trigger
-            // on the feed records how far), and a reader starting over reads on past the gap.
+            // Oldest first in feed order, and only up to the first change kept (within retention, still
+            // owed to an enabled webhook, or later than the oldest running transaction), so every kept
+            // change is after every pruned one and a reader starting over reads past the gap.
             const rows = await sql `
         WITH head AS MATERIALIZED (
           SELECT outbox.id, outbox.txid,

package/event-schema.js

@@ -1,22 +1,19 @@
-// A calendar event as the event tools return it, and as the application API returns any of a
-// tenant's events. Its own module because both the agent server and the application API describe
-// events with it, and the application API imports nothing from the agent server at runtime (the
-// agent server imports it, so the reverse would be a cycle).
+// A calendar event as the event tools and the application API return it. Its own module so the
+// application API need not import the agent server at runtime (that would be a cycle).
 import { z } from 'zod';
 const DATE_TIME = z.string().datetime({ offset: true });
 const RESOURCE_ID = z.string().trim().min(1).max(200);
 const EVENT_ID = z.string().trim().min(1).max(500);
 const REVISION = z.number().int().positive();
-// Output bounds mirror the trusted store's byte ceilings. A value admitted by a UTF-8 byte
-// ceiling can never exceed that many UTF-16 code units, so every valid stored/provider event is
-// serializable without truncating recurrence semantics or calendar identities.
+// Output bounds mirror the store's UTF-8 byte ceilings, which never exceed as many UTF-16 code
+// units, so every stored event serializes untruncated.
 const TRUSTED_SUMMARY_OUTPUT_MAX = 4_096;
 const TRUSTED_TEXT_OUTPUT_MAX = 16_384;
 const TRUSTED_PERSON_NAME_OUTPUT_MAX = 1_024;
 const TRUSTED_RECURRENCE_EXCEPTION_OUTPUT_MAX = 1_000;
 const TRUSTED_REMINDER_MINUTES_OUTPUT_MAX = 366 * 24 * 60;
-// The grammar the store keeps an address in (normalizeEmail in sync.ts), so every stored one can be
-// returned: an address from an imported feed need not be one z.email() takes (ops@localhost).
+// The grammar the store keeps an address in (sync.ts normalizeEmail): an imported address need not
+// pass z.email() (ops@localhost).
 const STORED_ADDRESS = z
     .string()
     .min(3)

package/hooks.d.ts

@@ -1,7 +1,5 @@
 /**
- * Let a hook's promise fail unseen. `onEvent` and `onError` are typed as returning nothing, but an
- * async one returns a promise, and its rejection, left alone, is an unhandled rejection: Node ends
- * the process on one by default. A hook that throws is caught where it is called; this is the same
- * for one that rejects.
+ * Let a hook's promise fail unseen: an async `onEvent` or `onError` returns a promise whose
+ * rejection would be unhandled, which ends a Node process by default.
  */
 export declare function ignoreRejection(result: unknown): void;

package/hooks.js

@@ -1,8 +1,6 @@
 /**
- * Let a hook's promise fail unseen. `onEvent` and `onError` are typed as returning nothing, but an
- * async one returns a promise, and its rejection, left alone, is an unhandled rejection: Node ends
- * the process on one by default. A hook that throws is caught where it is called; this is the same
- * for one that rejects.
+ * Let a hook's promise fail unseen: an async `onEvent` or `onError` returns a promise whose
+ * rejection would be unhandled, which ends a Node process by default.
  */
 export function ignoreRejection(result) {
     if ((typeof result === 'object' || typeof result === 'function') &&

package/ical-worker-thread.js

@@ -1,5 +1,5 @@
-// One worker of createICalendarWorkerPool: reads the feeds it is sent with the ordinary parsers and
-// posts back what they return, or the code of the CalendarContractError they throw.
+// One worker of createICalendarWorkerPool: runs the ordinary parsers and posts back their result or
+// CalendarContractError code.
 import { parentPort } from 'node:worker_threads';
 import { CalendarContractError, CalendarExpansionLimitError, parseICalendarChanges, parseICalendarFeed, parseTrustedICalendarEvents, } from './sync.js';
 const port = parentPort;
@@ -16,8 +16,7 @@ port.on('message', (request) => {
         reply = { id: request.id, ok: true, value };
     }
     catch (error) {
-        // The parsers turn every failure into a CalendarContractError; anything else is a fault, and
-        // ends this worker so the pool reports it.
+        // Anything but a CalendarContractError is a fault: end this worker so the pool reports it.
         if (!(error instanceof CalendarContractError))
             throw error;
         reply = {

package/ical-worker.d.ts

@@ -28,9 +28,9 @@ export interface ICalendarWorkerPoolOptions {
     /** Workers that may run at once, 1-64. Defaults to 2. */
     size?: number;
     /**
-     * How long one parse may run on its worker, in ms, before the worker is stopped and the feed
-     * refused (CalendarExpansionLimitError), 100-60,000. Defaults to 3,000: several times what the
-     * parser's step budget takes, with room for a new worker to start.
+     * How long one parse may run, in ms (100-60,000), before its worker is stopped and the feed
+     * refused (CalendarExpansionLimitError). Defaults to 3,000: several times the parser's step
+     * budget, with room for a worker to start.
      */
     deadlineMs?: number;
     /** Parses that may wait for a worker, 0-10,000; more are refused at once. Defaults to 64. */
@@ -38,8 +38,8 @@ export interface ICalendarWorkerPoolOptions {
     /** The heap one worker may use, in MB, 16-4,096. Defaults to 128. */
     maxHeapMb?: number;
     /**
-     * The module each worker runs. Defaults to `ical-worker-thread.js` beside this module, which the
-     * built package ships; Slotlock's own TypeScript sources cannot start it (tests pass a stand-in).
+     * The module each worker runs. Defaults to the built `ical-worker-thread.js` beside this module;
+     * Slotlock's TypeScript sources cannot start it (tests pass a stand-in).
      */
     entry?: URL;
 }
@@ -64,11 +64,9 @@ export declare class ICalendarWorkerPoolClosedError extends Error {
     constructor();
 }
 /**
- * A pool of worker threads that read untrusted iCalendar for the calling thread. Results and
- * errors are those of `parseICalendarChanges`, `parseICalendarFeed` and
- * `parseTrustedICalendarEvents` (the same
- * `CalendarContractError` codes), plus CalendarExpansionLimitError when a worker passes its
- * deadline or its heap, ICalendarWorkerBusyError when the queue is full, and
+ * A pool of worker threads reading untrusted iCalendar for the calling thread. Results and errors
+ * are the parsers' (same `CalendarContractError` codes), plus CalendarExpansionLimitError past a
+ * worker's deadline or heap, ICalendarWorkerBusyError when the queue is full, and
  * ICalendarWorkerPoolClosedError after `close()`. Idle workers do not keep the process alive.
  */
 export declare function createICalendarWorkerPool(options?: ICalendarWorkerPoolOptions): ICalendarWorkerPool;

package/ical-worker.js

@@ -30,11 +30,9 @@ function workerFailure(error) {
     return new Error('slotlock: an iCalendar worker failed', { cause: error });
 }
 /**
- * A pool of worker threads that read untrusted iCalendar for the calling thread. Results and
- * errors are those of `parseICalendarChanges`, `parseICalendarFeed` and
- * `parseTrustedICalendarEvents` (the same
- * `CalendarContractError` codes), plus CalendarExpansionLimitError when a worker passes its
- * deadline or its heap, ICalendarWorkerBusyError when the queue is full, and
+ * A pool of worker threads reading untrusted iCalendar for the calling thread. Results and errors
+ * are the parsers' (same `CalendarContractError` codes), plus CalendarExpansionLimitError past a
+ * worker's deadline or heap, ICalendarWorkerBusyError when the queue is full, and
  * ICalendarWorkerPoolClosedError after `close()`. Idle workers do not keep the process alive.
  */
 export function createICalendarWorkerPool(options = {}) {
@@ -100,8 +98,8 @@ export function createICalendarWorkerPool(options = {}) {
         nextId += 1;
         slot.id = nextId;
         slot.worker.ref();
-        // Past its deadline the feed is refused and its worker stopped: whatever ical.js is doing,
-        // terminate() ends it, and the next parse gets a new worker.
+        // Past its deadline the feed is refused and terminate() ends the worker, whatever ical.js is
+        // doing.
         slot.timer = setTimeout(() => retire(slot, new CalendarExpansionLimitError()), deadlineMs);
         slot.worker.postMessage({ ...job.request, id: slot.id });
     }
@@ -144,8 +142,8 @@ export function createICalendarWorkerPool(options = {}) {
         WorkerClass ??= (await threads).Worker;
         if (closed)
             throw new ICalendarWorkerPoolClosedError();
-        // After the await: parses that arrived together resume in order, each seeing the queue as the
-        // ones before it left it.
+        // After the await, parses that arrived together resume in order, each seeing the queue as the
+        // ones before left it.
         if (queue.length >= maxQueue && !hasIdleCapacity())
             throw new ICalendarWorkerBusyError();
         return new Promise((resolve, reject) => {

package/interop.js

@@ -4,7 +4,7 @@
 // directly.
 import ICAL from 'ical.js';
 import { zonedDateTimeFields } from './timezone.js';
-import { parseAvailabilityRules } from './weekly-hours.js';
+import { invalidAvailability, parseAvailabilityRules } from './weekly-hours.js';
 /** The longest VAVAILABILITY text `parseVAvailability` reads. */
 export const SLOTLOCK_MAX_VAVAILABILITY_CHARACTERS = 65_536;
 const PRODID = '-//Pylota//Slotlock//EN';
@@ -13,9 +13,6 @@ const DAYS = ['SU', 'MO', 'TU', 'WE', 'TH', 'FR', 'SA'];
 /** 2024-01-07 is a Sunday: the reference week runs Sunday 7 to Saturday 13 January. */
 const REFERENCE_SUNDAY = Date.UTC(2024, 0, 7);
 const VAVAILABILITY_DTSTAMP = '20240101T000000Z';
-function invalidAvailability(message) {
-    return Object.assign(new Error(message), { code: 'invalid_availability' });
-}
 const pad = (value, width = 2) => String(value).padStart(width, '0');
 /** RFC 5545 §3.1: lines of at most 75 octets, continued with a leading space. */
 function fold(line) {

package/maintenance.d.ts

@@ -8,10 +8,9 @@ export interface SlotlockMaintenanceResult {
     /** Series over the expansion budget, or whose roll failed otherwise; they keep their old coverage. */
     refused: number;
     /**
-     * Expired holds and the answers kept for keyed ones, and past the retention window event
-     * idempotency answers, agents' event cancellations, booking references retired with no
-     * booking and feed changes, deleted, and dashboard assistant conversations past their expiry.
-     * A cancelled booking's tombstone stays.
+     * Rows deleted: expired holds and their keyed answers; past retention, event idempotency answers,
+     * agent event cancellations, stray booking retirements and feed changes; and expired assistant
+     * conversations. A cancelled booking's tombstone stays.
      */
     pruned: number;
     /**
@@ -28,16 +27,15 @@ export interface SlotlockMaintenanceResult {
     /** More was left than one pass does: run another. */
     capped: boolean;
     /**
-     * The roll stopped before the series it had put back: series it has not tried since may still
-     * extend, so another pass should follow at once.
+     * The roll stopped before the series it had deferred: others may still extend, so run another
+     * pass at once.
      */
     rollPending: boolean;
 }
 /**
- * One maintenance pass for a tenant: roll its recurring events to the rolling horizon, then purge
- * its expired holds with their answers and prune its events' and bookings' bookkeeping past the
- * retention window, each in at most `batches` batches (1-100, default 10), every batch its own
- * transaction. Aborting `signal` stops it between batches with the signal's reason.
+ * One maintenance pass for a tenant: roll its recurring events to the horizon, then purge expired
+ * holds and prune bookkeeping past retention, each in at most `batches` batches (1-100, default
+ * 10), each its own transaction. Aborting `signal` stops it between batches.
  */
 export declare function maintainSlotlockTenant(store: SlotlockStore, tenantRef: string, options?: {
     batches?: number;
@@ -63,6 +61,12 @@ export interface SlotlockMaintenanceSchedulerOptions {
     sql: Sql;
     /** Tenants maintained from the start, whether or not a key of theirs calls. */
     tenants: readonly string[];
+    /**
+     * Every tenant with data (slotlock.maintenance_tenants), read at the start and once an interval;
+     * each not maintained within the interval is queued, so a tenant whose keys never call is
+     * maintained too. What it throws goes to onError.
+     */
+    discover?: () => Promise<readonly string[]>;
     /** How often each tenant is maintained, at most a day. */
     intervalMs: number;
     /** Tenants remembered; the one served longest ago is forgotten first. Default 10,000. */

package/maintenance.js

@@ -1,17 +1,15 @@
 import { ignoreRejection } from './hooks.js';
 import { SLOTLOCK_MAX_WAITLIST_PER_TENANT, calendarEventRollingHorizon, } from './store.js';
 /**
- * One maintenance pass for a tenant: roll its recurring events to the rolling horizon, then purge
- * its expired holds with their answers and prune its events' and bookings' bookkeeping past the
- * retention window, each in at most `batches` batches (1-100, default 10), every batch its own
- * transaction. Aborting `signal` stops it between batches with the signal's reason.
+ * One maintenance pass for a tenant: roll its recurring events to the horizon, then purge expired
+ * holds and prune bookkeeping past retention, each in at most `batches` batches (1-100, default
+ * 10), each its own transaction. Aborting `signal` stops it between batches.
  */
 export async function maintainSlotlockTenant(store, tenantRef, options = {}) {
     const batches = options.batches ?? 10;
     if (!(Number.isSafeInteger(batches) && batches >= 1 && batches <= 100)) {
         throw new RangeError('batches must be a whole number from 1 to 100');
     }
-    // What a pass changes (a no-show released, a waitlist offer) is recorded as maintenance's.
     const withTenant = (callback) => store.withTenant(tenantRef, callback, { origin: 'maintenance' });
     const window = calendarEventRollingHorizon();
     let extended = 0;
@@ -19,8 +17,7 @@ export async function maintainSlotlockTenant(store, tenantRef, options = {}) {
     let refused = 0;
     let rollCapped = true;
     let after = null;
-    // A roll that fails does not stop the pruning: expired holds are purged all the same, and the
-    // roll's error is thrown after.
+    // A failed roll does not stop the pruning; its error is thrown after.
     let rollFailure = null;
     try {
         for (let batch = 0; batch < batches; batch++) {
@@ -65,15 +62,14 @@ export async function maintainSlotlockTenant(store, tenantRef, options = {}) {
         }
     }
     options.signal?.throwIfAborted();
-    // Conversations last 2 hours after their last message (dashboard.ts): an expired one is
-    // unreadable already, and deleted here.
+    // Conversations expire 2 hours after their last message (dashboard.ts).
     pruned += await withTenant((tenant) => tenant.pruneAssistantConversations({ tenantRef }));
     const zones = await withTenant((tenant) => tenant.followZoneRules({ tenantRef, move: options.followZoneRules === true }));
     const staleSources = await withTenant((tenant) => tenant.reportStaleCoverage({ tenantRef }));
     // No-shows first: the time they free is offered to the waitlist in the same pass.
     const noShows = await withTenant((tenant) => tenant.releaseNoShows({ tenantRef }));
-    // The whole waitlist, in join order, a page at a time and each page its own transaction, so a
-    // later entry whose window is free is offered however many wait before it.
+    // The whole waitlist in join order, a page per transaction, so a later free entry is offered
+    // however many wait before it.
     let waitlistOffers = 0;
     let page = null;
     for (let pages = 0; pages < WAITLIST_PAGES; pages++) {
@@ -183,12 +179,10 @@ export function startSlotlockMaintenance(options) {
                         catch {
                             // Reporting must never stop maintenance, or make a pass that ran look failed.
                         }
-                        // A capped pass that got somewhere goes round again at once, as does one whose roll
-                        // stopped before the series it had put back: each series it could not extend is now
-                        // behind every one it has not tried (the store puts it there), so the next pass meets
-                        // new ones, and however many are stuck, each is met once before a healthy one is
-                        // reached. A pass that reached the series put back waits for the next interval: they
-                        // take turns there, and the next pass reaches anything new before them.
+                        // A capped pass that progressed, or whose roll stopped before its deferred series, goes
+                        // again at once: deferred series sit behind untried ones, so each stuck one is met once
+                        // before a healthy one is reached. A pass that reached the deferred series waits for
+                        // the next interval.
                         const progressed = result.extended + result.pruned > 0;
                         again = result.capped && (progressed || result.rollPending);
                     }
@@ -215,20 +209,42 @@ export function startSlotlockMaintenance(options) {
             working = null;
         }
     };
-    // Expired assistant conversations of every tenant, the ones whose keys never call included (a
-    // tenant only the dashboard serves): one bounded sweep at most every quarter hour.
+    const report = (error) => {
+        try {
+            ignoreRejection(options.onError?.(error));
+        }
+        catch {
+            // Reporting must never stop maintenance.
+        }
+    };
+    // Expired conversations of every tenant, including those no key calls (dashboard-only): one
+    // bounded sweep at most every quarter hour.
     let lastSweep = 0;
     const sweep = () => {
         if (controller.signal.aborted || Date.now() - lastSweep < Math.min(intervalMs, SWEEP_INTERVAL_MS))
             return;
         lastSweep = Date.now();
-        options.store.sweepAssistantConversations().catch((error) => {
-            try {
-                ignoreRejection(options.onError?.(error));
-            }
-            catch {
-                // Reporting must never stop maintenance.
-            }
+        options.store.sweepAssistantConversations().catch(report);
+    };
+    // Every tenant with data, once an interval: those no key has called since the server started too.
+    let lastDiscovery = Number.NEGATIVE_INFINITY;
+    let discovering = false;
+    const discover = () => {
+        const list = options.discover;
+        if (!list || discovering || controller.signal.aborted)
+            return;
+        if (Date.now() - lastDiscovery < intervalMs)
+            return;
+        lastDiscovery = Date.now();
+        discovering = true;
+        (async () => list())()
+            .then((tenants) => {
+            for (const tenantRef of tenants)
+                if (due(tenantRef))
+                    enqueue(tenantRef);
+        }, report)
+            .finally(() => {
+            discovering = false;
         });
     };
     const tick = () => {
@@ -236,6 +252,7 @@ export function startSlotlockMaintenance(options) {
             if (due(tenantRef))
                 enqueue(tenantRef);
         }
+        discover();
         sweep();
     };
     const timer = setInterval(tick, Math.min(intervalMs, 60_000));