slotlock 0.6.2 → 0.7.0

package/store.js

@@ -1,53 +1,52 @@
-// DB mechanics for the Slotlock core — explicit `postgres` client in, structured results out.
-// Domain policy (who may reserve, pricing, holds) belongs to future callers; this layer owns the
-// reliable how: idempotent schema apply, EXCLUDE-arbitrated inserts with a structured conflict.
+// DB mechanics for the Slotlock core: explicit `postgres` client in, structured results out.
+import { SLOTLOCK_MAX_LOCATION_DEPTH, SLOTLOCK_MAX_LOCATIONS, SLOTLOCK_MAX_RESOURCE_GROUPS, SLOTLOCK_POOL_ORDERS, SLOTLOCK_RESOURCE_KINDS, isSlotlockResourceScope, parseSlotlockLocation, parseSlotlockResourceGroup, parseSlotlockResourceProfile, slotlockGroupingRef, } from './resource-profile.js';
+import { readSlotlockTenantUsage } from './usage.js';
+import { slotlockPlanReadRefusal } from './plans.js';
 import { SLOTLOCK_CHANGE_ORIGINS, SLOTLOCK_CHANGE_RETENTION_DAYS, isSlotlockChangeOrigin, slotlockEventFeedMethods, } from './event-feed.js';
 import { bookingBufferBeforeMs, bookingSearchBlocked, bookingSearchReach, parseBookingRuleDefaults, parseEffectiveBookingRules, bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
 import { createHash, randomUUID } from 'node:crypto';
 import ICAL from 'ical.js';
-import { SLOTLOCK_CORE_DDL, SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockCoverageChangeRenameSql, slotlockTenantLockKey, } from './ddl.js';
+import { SLOTLOCK_CORE_DDL, SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_RESOURCE_SCOPED_TABLES, SLOTLOCK_RESOURCE_SCOPE_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockCoverageChangeRenameSql, slotlockTenantLockKey, } from './ddl.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
 import { SLOTLOCK_CALENDAR_HORIZON_DAYS, assertBoundedSearchWindow, expandRules, invalidWindowError, } from './rules.js';
 import { CalendarContractError, CalendarExpansionLimitError, expandCalendarEventSeries, normalizeCalendarEventContent, } from './sync.js';
 import { parseAvailabilityRules } from './weekly-hours.js';
-/** Postgres exclusion_violation — the EXCLUDE constraint fired. */
+import { APPROVAL_COLUMNS, approvalByRequestKey, approvalPoliciesFor, beginApprovalGrant, declineApproval, deleteApprovalPolicy, expireApprovals, finishApprovalGrant, getApproval, listApprovalPolicies, listApprovals, putApprovalPolicy, recordApprovalChange, toApproval, } from './approvals.js';
 const EXCLUSION_VIOLATION = '23P01';
+/** Holds one approval may own: a bundle's resources, or a move's new time in pieces. */
+const SLOTLOCK_MAX_APPROVAL_HOLDS = 20;
+/** Approvals one requester, and one tenant, may have waiting at once. */
+const SLOTLOCK_MAX_PENDING_APPROVALS_PER_REQUESTER = 50;
+const SLOTLOCK_MAX_PENDING_APPROVALS = 500;
 /**
- * Concurrent inserts checking the same EXCLUDE range can deadlock inside the constraint check
- * itself (probed at ~30-40% under two-way contention — intrinsic to Postgres EXCLUDE, present
- * for raw inserts too). A 40P01 victim's transaction is fully rolled back, so one retry either
- * wins cleanly or loses with a proper 23P01 — both structured. Never surfaced raw.
+ * Concurrent inserts on the same EXCLUDE range can deadlock inside the constraint check itself
+ * (intrinsic to Postgres EXCLUDE). The victim is fully rolled back, so one retry either wins or
+ * loses with a structured 23P01.
  */
 const DEADLOCK_DETECTED = '40P01';
 const SERIALIZATION_FAILURE = '40001';
-/** Holds are negotiation-scoped; a week is already generous. Beyond it is a caller bug. */
+/** Holds are negotiation-scoped; a week is already generous. */
 const MAX_HOLD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
-/** Turnaround cannot occupy a resource indefinitely because of a caller/unit error. */
+/** Guards against a caller unit error occupying a resource indefinitely. */
 const MAX_BUFFER_AFTER_MS = 30 * 24 * 60 * 60 * 1000;
-/**
- * The longest leading buffer a row keeps (a day, as bufferBeforeMinutes allows): a row's occupied
- * time starts at most this long before its start, so a read by start can still use the index.
- */
+/** A day, as bufferBeforeMinutes allows: a read by start can then still use the index. */
 const MAX_BUFFER_BEFORE_MS = 24 * 60 * 60 * 1000;
 export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
 /**
- * Longest one-off event the store accepts (ten years and some leap days): long enough for any lease
- * or long-term rental, short enough that a unit error cannot occupy a resource for ever. A recurring
- * series is bounded by its 367-day materialization window instead.
+ * Longest one-off event (ten years and some leap days); a recurring series is bounded by its
+ * materialization window instead.
  */
 export const SLOTLOCK_MAX_EVENT_DURATION_DAYS = 3_660;
 const DAY_MS = 24 * 60 * 60 * 1000;
 const MAX_CALENDAR_WINDOW_MS = SLOTLOCK_CALENDAR_HORIZON_DAYS * DAY_MS;
 /**
- * Longest window a recurring series is stored (materialized) for: the 367-day search window plus
- * two days. The rolling horizon starts a day before the current UTC day and must reach 367 days
- * past its end, so that a search of the full 367 days from any moment of the day is complete.
+ * The 367-day search window plus two days: the rolling horizon starts a day before the current UTC
+ * day and must reach 367 days past its end.
  */
 export const SLOTLOCK_MATERIALIZATION_WINDOW_DAYS = SLOTLOCK_CALENDAR_HORIZON_DAYS + 2;
 const MAX_MATERIALIZATION_WINDOW_MS = SLOTLOCK_MATERIALIZATION_WINDOW_DAYS * DAY_MS;
 const MAX_EVENT_DURATION_MS = SLOTLOCK_MAX_EVENT_DURATION_DAYS * DAY_MS;
 const MAX_RESOURCE_LIST_LIMIT = 1_000;
-/** Highest per-tenant resource cap `createResource` accepts. */
 const MAX_TENANT_RESOURCE_LIMIT = 100_000;
 const MAX_CALENDAR_LIST_LIMIT = 1_000;
 const MAX_FREE_BUSY_INTERVALS = 10_000;
@@ -66,7 +65,7 @@ const MAX_WAITLIST_WINDOW_MS = 31 * 24 * 60 * 60 * 1000;
 const DEFAULT_OFFER_TTL_MS = 15 * 60 * 1000;
 /** How long before its start a booking may be checked in. */
 export const SLOTLOCK_CHECK_IN_OPENS_MINUTES = 60;
-/** Free-looking resources one entry tries before the next entry: a race can take one first. */
+/** Free-looking resources one entry tries before the next: a race can take one first. */
 const OFFER_CANDIDATES = 3;
 /** Default hard ceiling for retained active + tombstoned identities per agent principal. */
 export const SLOTLOCK_AGENT_OWNER_EVENT_QUOTA = 1_000;
@@ -86,8 +85,8 @@ const AGENT_EVENT_OWNER_PATTERN = /^agent:[0-9a-f]{64}$/;
 /** Store-owned coverage source for bounded, locally materialized recurring events. */
 export const SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE = 'slotlock:local-recurrence-materialization';
 /**
- * Stable daily target shared by the event writer, maintenance worker, and readiness proof: from a
- * day before the current UTC day to 367 days past its end (SLOTLOCK_MATERIALIZATION_WINDOW_DAYS).
+ * From a day before the current UTC day to SLOTLOCK_MATERIALIZATION_WINDOW_DAYS past its end;
+ * shared by the writer, maintenance and readiness.
  */
 export function calendarEventRollingHorizon(now = new Date()) {
     if (!Number.isFinite(now.getTime()))
@@ -97,8 +96,8 @@ export function calendarEventRollingHorizon(now = new Date()) {
     return { start, end: new Date(start.getTime() + MAX_MATERIALIZATION_WINDOW_MS) };
 }
 /**
- * A stored series expanded from the cursor its last expansion left, or `null` when there is none it
- * can use or the expansion from it is refused: the write's own search from the start was refused.
+ * A stored series expanded from its last cursor, or `null` when there is no usable cursor or the
+ * expansion is refused.
  */
 function resumeStoredSeries(event, window, found) {
     if (!found?.recurrence_cursor)
@@ -116,15 +115,13 @@ function resumeStoredSeries(event, window, found) {
         throw error;
     }
 }
-/** A series cursor as the jsonb column takes it. */
 function seriesCursorJson(tx, cursor) {
     return cursor === null ? null : tx.json(cursor);
 }
 /**
- * The window a roll to `horizon` gives a series stored for `stored`: from the horizon's start to
- * the later of the two ends, so its end never moves back. `null` keeps the stored window: it covers
- * the horizon already, or it ends so far past it that no window from the horizon's start to its end
- * fits the 367-day cap (it rolls once the horizon is close enough).
+ * From the horizon's start to the later of the two ends, so the end never moves back. `null` keeps
+ * the stored window: it already covers the horizon, or no window from the horizon's start fits the
+ * 367-day cap yet.
  */
 function rolledWindow(stored, horizon) {
     if (stored.start <= horizon.start && stored.end >= horizon.end)
@@ -134,21 +131,18 @@ function rolledWindow(stored, horizon) {
     return { start: horizon.start, end: stored.end > horizon.end ? stored.end : horizon.end };
 }
 /**
- * How far past a rule's UNTIL, read as UTC, an occurrence can still end, beyond the series' own
- * length. UNTIL bounds an occurrence's start (RFC 5545 §3.3.10), but a floating or date-only UNTIL
- * is a wall time in a zone from UTC-12 to UTC+14, or a whole day; a start in an hour the clocks skip
- * moves forward; and an occurrence's wall-clock end can pass its exact length by a clock change, a
- * whole day where a zone moved across the date line. Three days covers them together.
+ * How far past a rule's UNTIL, read as UTC, an occurrence can still end. UNTIL bounds starts (RFC
+ * 5545 §3.3.10), but a floating or date-only UNTIL is a wall time in any zone (UTC-12 to UTC+14),
+ * skipped hours move starts forward, and clock changes stretch ends: three days covers them
+ * together.
  */
 const SERIES_UNTIL_SLACK_MS = 3 * DAY_MS;
 /** Stored-series windows a COUNT rule is followed through, from its start, to find its end. */
 const SERIES_COUNT_SEARCH_WINDOWS = 30;
 /**
- * A time by which every occurrence of a recurring series ends, moved ones included, or `null` when
- * it may go on: its rule has neither UNTIL nor COUNT as ical.js reads it (as the expansion does),
- * or its COUNT occurrences are not all found within SERIES_COUNT_SEARCH_WINDOWS windows from its
- * start, or that search is over its budget. A COUNT series ends a day after its last occurrence as
- * the expansion reads it today, so a later reading of its end may be longer.
+ * A time by which every occurrence of a series ends, or `null` when it may go on: no UNTIL or COUNT
+ * as ical.js reads it, or the COUNT occurrences are not all found within
+ * SERIES_COUNT_SEARCH_WINDOWS windows or the search budget.
  */
 function seriesEndsBy(event) {
     const recurrence = event.recurrence;
@@ -185,10 +179,8 @@ function seriesEndsBy(event) {
     return Number.isFinite(ends.getTime()) ? ends : null;
 }
 /**
- * The latest end among a COUNT series' occurrences, expanded window by window from its start with
- * exceptions left out (so a cancelled or moved one is still found in its own place), or `null` when
- * fewer than `count` turn up. ical.js yields at most COUNT occurrences, so once `count` are found
- * there are no more. An occurrence is counted in the window its start falls in.
+ * The latest end among a COUNT series' occurrences, expanded window by window with exceptions left
+ * out (so a moved one is found in its own place), or `null` when fewer than `count` turn up.
  */
 function lastCountedOccurrenceEnd(event, count) {
     const rrule = event.recurrence?.rrule;
@@ -225,16 +217,15 @@ function lastCountedOccurrenceEnd(event, count) {
     return null;
 }
 /**
- * The recurrence_ends_by column for an event, as text: NULL for a one-off, 'infinity' for no known
- * end. Bind it as text (`::text::timestamptz`): postgres.js serializes a timestamptz parameter
- * through Date, which cannot hold 'infinity'.
+ * recurrence_ends_by as text: NULL for a one-off, 'infinity' for no known end. Bind it as text
+ * (`::text::timestamptz`): postgres.js serializes timestamptz through Date, which cannot hold
+ * 'infinity'.
  */
 function recurrenceEndsByColumn(event) {
     if (!event.recurrence)
         return null;
     return seriesEndsBy(event)?.toISOString() ?? 'infinity';
 }
-/** The roll's `after`, checked, or `undefined` for a pass's first batch. */
 function rollCursor(after) {
     if (after === undefined)
         return undefined;
@@ -250,8 +241,8 @@ function rollCursor(after) {
     return after;
 }
 /**
- * Run `callback` in a transaction: a new one on a client (READ COMMITTED when asked, else the role's
- * default), or a savepoint inside the caller's, whose isolation cannot change.
+ * A new transaction on a client (READ COMMITTED when asked), or a savepoint inside the caller's,
+ * whose isolation cannot change.
  */
 async function inTransaction(executor, callback, isolation) {
     if ('begin' in executor) {
@@ -272,12 +263,9 @@ async function assertReadCommitted(tx) {
         throw invalidIsolationError();
 }
 /**
- * Run deployment SQL resolving names only in pg_catalog, then the session's temporary schema. The
- * deployment role owns every table, so a function or operator it found through a schema another
- * role can create objects in ("$user", public) would run with that ownership. The DDL strings pin
- * themselves as well; this covers the statements the store sends around them. Every name read
- * before the pin is schema-qualified. The caller's search_path is restored afterwards; a failure
- * aborts the transaction, which reverts the pin as well.
+ * Run deployment SQL with names resolved only in pg_catalog and pg_temp. The deployment role owns
+ * every table, so a function found in a schema another role can write to ("$user", public) would
+ * run with that ownership. The caller's search_path is restored afterwards.
  */
 async function withPinnedSearchPath(tx, operation) {
     const [caller] = await tx `
@@ -288,10 +276,8 @@ async function withPinnedSearchPath(tx, operation) {
     return result;
 }
 /**
- * The deployment DDL refuses a `slotlock` schema that another role controls with SQLSTATE 42501 and
- * its findings as a JSON array in DETAIL. Surface that as `unsafe_slotlock_schema` with `reasons`,
- * keeping the database's error (and its HINT) as `cause`. It refuses a schema a newer release
- * migrated with SQLSTATE 55000: surface that as `schema_newer`. Any other failure passes through.
+ * Map the DDL's refusals: SQLSTATE 42501 (another role controls the schema; findings as JSON in
+ * DETAIL) to `unsafe_slotlock_schema`, and 55000 to `schema_newer`. Anything else passes through.
  */
 function schemaControlRefusal(error) {
     const failure = error;
@@ -322,7 +308,6 @@ function schemaControlRefusal(error) {
         reasons,
     });
 }
-/** PostgreSQL lock_not_available: a lock wait passed lock_timeout. */
 const LOCK_NOT_AVAILABLE = '55P03';
 const DEFAULT_MIGRATION_LOCK_TIMEOUT_MS = 1_000;
 const DEFAULT_MIGRATION_STATEMENT_TIMEOUT_MS = 15 * 60 * 1000;
@@ -341,10 +326,10 @@ function migrationSettings(options) {
     return { lockTimeoutMs, statementTimeoutMs, attempts };
 }
 /**
- * Run one migration step: in a transaction (or a savepoint of the caller's), with names resolved
- * in pg_catalog only, serialized with every other migration of this database, and with the lock and
- * statement timeouts set. A step that waits past its lock timeout, or is ended as a deadlock's
- * victim, is rolled back and tried again after a pause, up to `attempts` times. The caller's own timeouts are put back afterwards.
+ * One migration step: in a transaction (or savepoint), names pinned to pg_catalog, serialized with
+ * every other migration, under the lock and statement timeouts. A lock timeout or deadlock is
+ * rolled back and retried up to `attempts` times. The caller's own timeouts are restored
+ * afterwards.
  */
 async function inMigration(executor, options, step) {
     const settings = migrationSettings(options);
@@ -367,9 +352,8 @@ async function inMigration(executor, options, step) {
             }));
         }
         catch (error) {
-            // A deadlock's victim (DEADLOCK_DETECTED: a caller's transaction took the outbox, then a
-            // coverage row, while a rename batch took them in the other order, say) lost its locks with
-            // it, so it is tried again like a step that timed out waiting.
+            // A deadlock victim (a writer took outbox then coverage, a rename batch the other order) lost
+            // its locks, so it retries like a lock timeout.
             const code = pgCode(error);
             if (code !== LOCK_NOT_AVAILABLE && code !== DEADLOCK_DETECTED)
                 throw error;
@@ -381,12 +365,10 @@ async function inMigration(executor, options, step) {
     }
 }
 /**
- * A digest of what the migration defines in the `slotlock` schema: its tables and columns,
- * constraints (and whether each is validated), indexes, triggers and functions, and whether PUBLIC
- * holds any right on them. Grants to other roles, ownership and row-level security are left out:
- * applyTenantRls and grantApplicationRole change those after applySchema has recorded the digest.
- * Objects of an extension are left out too. Deparsed definitions depend on search_path, so this runs
- * with it pinned, as the migration does.
+ * A digest of what the migration defines in the `slotlock` schema: tables, columns, constraints
+ * (and whether validated), indexes, triggers, functions and PUBLIC grants. Grants to other roles,
+ * ownership and RLS are left out: applyTenantRls and grantApplicationRole change those later. Runs
+ * with search_path pinned, as deparsed definitions depend on it.
  */
 async function slotlockCatalogDigest(tx) {
     const [row] = await tx `
@@ -446,10 +428,9 @@ async function slotlockCatalogDigest(tx) {
     return row?.digest ?? '';
 }
 /**
- * Whether the schema is exactly what this release's applySchema last left: the same version, DDL
- * and catalog digest, and no table left without FORCE by an interrupted migration. Reading needs
- * the right to (the deployment role owns the table); without it the full migration runs and refuses
- * what it must.
+ * Whether the schema is exactly what this release's applySchema last left: same version, DDL and
+ * catalog digest, and no table left unforced by an interrupted migration. Without the right to read
+ * it, the full migration runs instead.
  */
 async function slotlockSchemaUpToDate(tx) {
     const [present] = await tx `
@@ -476,29 +457,21 @@ async function slotlockSchemaUpToDate(tx) {
 }
 /**
  * Rename the coverage changes an earlier release wrote (ddl.ts, slotlockCoverageChangeRenameSql),
- * in batches of SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH outbox ids, each a transaction of its own,
- * from where the last pass stopped (`schema_version.coverage_changes_renamed_through`, saved with
- * each batch) up to the last change when this pass starts. The first pass is the 0.6 upgrade's; an
- * earlier release's server still running then can write more, so every later migration runs a pass
- * too, until one finds nothing to rename: that marks the rename done and no migration reads the
- * outbox for it again.
+ * in batches of SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH outbox ids, resuming from
+ * `schema_version.coverage_changes_renamed_through`. An older server still running can write more,
+ * so every migration runs a pass until one finds nothing.
  *
- * The head is read only once every transaction already writing to the outbox has ended, so no
- * change at or below it can commit after the pass has read past it. Forced RLS would hide every
- * tenant's rows from the deployment role, so a role it binds lifts FORCE from calendar_coverage and
- * outbox for each batch and puts it back before the batch commits: each batch holds ACCESS
- * EXCLUSIVE on both, taken in the order writers take them (a source, then its change), for one
- * primary-key range of the outbox. A table an operator left unforced stays so. A superuser or
- * BYPASSRLS role reads every row as it is: it holds SHARE ROW EXCLUSIVE on the outbox (which waits
- * for the writes in flight and holds off new ones, but no read) only for the short transaction that
- * reads the head. Changes an earlier release's server writes after the upgrade are put in shape as
- * they are inserted (ddl.ts, slotlock.outbox_coverage_in_shape); the passes are for those before.
+ * The head is read once every transaction already writing to the outbox has ended, so nothing at or
+ * below it commits later. Forced RLS would hide other tenants' rows, so each batch lifts FORCE from
+ * calendar_coverage and outbox under ACCESS EXCLUSIVE (in writer lock order) and restores it before
+ * committing. A superuser or BYPASSRLS role instead holds SHARE ROW EXCLUSIVE on the outbox only
+ * while reading the head.
  */
 async function renameEarlierCoverageChanges(executor, options) {
     /**
-     * Run `work` able to read every tenant's outbox and coverage rows: as it is for a superuser or a
-     * BYPASSRLS role, else with FORCE lifted from the tables that have it, under ACCESS EXCLUSIVE
-     * (calendar_coverage, then outbox: the order every writer locks them in), and put back after.
+     * Run `work` able to read every tenant's rows: as is for a superuser or BYPASSRLS role, else with
+     * FORCE lifted under ACCESS EXCLUSIVE (calendar_coverage, then outbox: writer lock order) and put
+     * back after.
      */
     const everyTenant = async (tx, bypass, work) => {
         const forced = bypass
@@ -521,8 +494,8 @@ async function renameEarlierCoverageChanges(executor, options) {
             await tx.unsafe(`ALTER TABLE ${table} FORCE ROW LEVEL SECURITY`);
         return result;
     };
-    // The pass's head, in a short transaction of its own: once the writes in flight have ended (each
-    // holds ROW EXCLUSIVE from before it took its id), none at or below it can commit later.
+    // The head, in its own short transaction: writes in flight hold ROW EXCLUSIVE from before they
+    // took their id, so none at or below it commits later.
     const start = await inMigration(executor, options, async (tx) => {
         const [state] = await tx `
       SELECT version.coverage_changes_renamed AS renamed,
@@ -554,7 +527,6 @@ async function renameEarlierCoverageChanges(executor, options) {
             ]));
             const read = row?.last ?? null;
             renamedTotal += row?.renamed ?? 0;
-            // Saved with the batch, so a pass stopped part way goes on from here.
             await tx `
         UPDATE slotlock.schema_version
            SET coverage_changes_renamed_through = ${read ?? head}::bigint,
@@ -567,7 +539,6 @@ async function renameEarlierCoverageChanges(executor, options) {
         after = String(last);
     }
 }
-/** Whether the rename of coverage changes earlier releases wrote still has a pass to run. */
 async function coverageChangesRenamePending(tx) {
     const [row] = await tx `
     SELECT coverage_changes_renamed AS renamed FROM slotlock.schema_version WHERE singleton`;
@@ -586,8 +557,8 @@ async function slotlockConstraintUnvalidated(tx) {
     return row?.unvalidated === true;
 }
 /**
- * Whether every tenant table has forced RLS and only its tenant policy, bound to `setting`, whose
- * live fingerprint (computed as the RLS DDL computes it) matches the contract the DDL recorded.
+ * Whether every tenant table has forced RLS and only its tenant policy bound to `setting`, matching
+ * the fingerprint the DDL recorded.
  */
 async function tenantRlsUpToDate(tx, setting) {
     const [present] = await tx `
@@ -599,8 +570,17 @@ async function tenantRlsUpToDate(tx, setting) {
     const [state] = await tx `
     SELECT pg_catalog.bool_and(
              rel.relrowsecurity AND rel.relforcerowsecurity
+             -- The tenant policy, and on a table a limited key is held to, the restrictive scope
+             -- policy, which can only narrow it; no other.
              AND (SELECT pg_catalog.count(*) FROM pg_catalog.pg_policy every
-                   WHERE every.polrelid = rel.oid) = 1
+                   WHERE every.polrelid = rel.oid
+                     AND (every.polname = 'tenant_isolation_v1'
+                          OR NOT (every.polname = 'resource_scope_v1' AND NOT every.polpermissive
+                                  AND wanted.name = ANY (${Object.keys(SLOTLOCK_RESOURCE_SCOPED_TABLES)}::text[])))) = 1
+             AND (SELECT pg_catalog.count(*) FROM pg_catalog.pg_policy scoped
+                   WHERE scoped.polrelid = rel.oid AND scoped.polname = 'resource_scope_v1'
+                     AND NOT scoped.polpermissive)
+                 = CASE WHEN wanted.name = ANY (${Object.keys(SLOTLOCK_RESOURCE_SCOPED_TABLES)}::text[]) THEN 1 ELSE 0 END
              AND pg_catalog.obj_description(pol.oid, 'pg_policy') = ${`slotlock:tenant-context:${setting}`}
              AND contract.tenant_context_setting = ${setting}
              AND contract.policy_fingerprint = pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(
@@ -622,9 +602,8 @@ async function tenantRlsUpToDate(tx, setting) {
     return state?.current === true && state.matched === tables.length;
 }
 /**
- * The schema version recorded by the last migration, or `null` when there is none this role can
- * read: no schema, a schema from 0.2 or earlier, or a role not yet granted the function (run
- * `slotlock migrate`, which grants it).
+ * The recorded schema version, or `null` when this role cannot read one: no schema, 0.2 or earlier,
+ * or the function not yet granted (`slotlock migrate` grants it).
  */
 export async function readSlotlockSchemaVersion(sql) {
     const [readable] = await sql `
@@ -638,9 +617,8 @@ export async function readSlotlockSchemaVersion(sql) {
     return row?.version ?? null;
 }
 /**
- * Refuse to serve a schema another release migrated: `schema_outdated` when it is older than this
- * release (or unversioned), so `slotlock migrate` must run first; `schema_newer` when a newer release
- * migrated it, whose schema this release's code does not know. Both carry `installed` and `expected`.
+ * Refuse a schema another release migrated: `schema_outdated` (older or unversioned: run `slotlock
+ * migrate`) or `schema_newer`. Both carry `installed` and `expected`.
  */
 export async function assertSlotlockSchemaCurrent(sql) {
     const installed = await readSlotlockSchemaVersion(sql);
@@ -747,7 +725,6 @@ function toHold(row) {
         ...(row.hold_group_id ? { groupId: row.hold_group_id } : {}),
     };
 }
-/** A keyset cursor `{ start, id }` from the last row of a previous page, checked. */
 function pageCursor(after) {
     if (after !== undefined &&
         (!(after.start instanceof Date) ||
@@ -768,6 +745,9 @@ function pageLimit(limit) {
     }
     return value;
 }
+function sandboxTestOnlyError() {
+    return Object.assign(new Error('Slotlock does this only in a test environment (a tenant ending ~test)'), { code: 'sandbox_test_only' });
+}
 function invalidIdentityError(message) {
     return Object.assign(new Error(message), { code: 'invalid_identity' });
 }
@@ -975,44 +955,57 @@ async function replaceCalendarEventOccurrences(tx, params) {
         WHERE event_id = ${params.eventId} AND reservation_id IS NOT NULL
      )`;
     await tx `DELETE FROM slotlock.calendar_event_occurrences WHERE event_id = ${params.eventId}`;
-    for (const occurrence of params.occurrences) {
-        let reservationId = null;
-        if ((params.event.transparency ?? 'opaque') === 'opaque') {
-            const occupied = occupiedTime({
-                ...occurrence,
-                bufferBeforeMs: params.bufferBeforeMs ?? 0,
-                bufferAfterMs: params.bufferAfterMs ?? 0,
-            });
-            await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
-            const derivedExternalRef = `calendar:${params.eventId}:${createHash('sha256')
-                .update(occurrence.recurrenceId)
-                .digest('hex')}`;
-            const reservations = await tx `
-        INSERT INTO slotlock.reservations (
-          resource_id, tenant_ref, external_ref, starts_at, ends_at,
-          buffer_after_ms, buffer_before_ms, revision, source, calendar_event_id
-        ) VALUES (
-          ${params.resourceId}, ${params.tenantRef}, ${derivedExternalRef},
-          ${occurrence.start}, ${occurrence.end}, ${params.bufferAfterMs ?? 0},
-          ${params.bufferBeforeMs ?? 0}, ${params.revision},
-          ${`calendar-event:${params.eventId}`}, ${params.eventId}
-        )
-        RETURNING id`;
-            reservationId = reservations[0]?.id ?? null;
-            if (!reservationId) {
+    if (params.occurrences.length === 0)
+        return;
+    // Three statements for the whole series, not three per occurrence: a series of 2,000 holds the
+    // tenant's locks for as long as its round trips take, and every write queued behind it waits.
+    const starts = params.occurrences.map((occurrence) => occurrence.start.toISOString());
+    const ends = params.occurrences.map((occurrence) => occurrence.end.toISOString());
+    const reservationIds = params.occurrences.map(() => '');
+    if ((params.event.transparency ?? 'opaque') === 'opaque') {
+        const occupied = params.occurrences.map((occurrence) => occupiedTime({
+            ...occurrence,
+            bufferBeforeMs: params.bufferBeforeMs ?? 0,
+            bufferAfterMs: params.bufferAfterMs ?? 0,
+        }));
+        await reapExpiredHoldsAcross(tx, params.resourceId, occupied);
+        const externalRefs = params.occurrences.map((occurrence) => `calendar:${params.eventId}:${createHash('sha256').update(occurrence.recurrenceId).digest('hex')}`);
+        const inserted = await tx `
+      INSERT INTO slotlock.reservations (
+        resource_id, tenant_ref, external_ref, starts_at, ends_at,
+        buffer_after_ms, buffer_before_ms, revision, source, calendar_event_id
+      )
+      SELECT ${params.resourceId}, ${params.tenantRef}, occurrence.external_ref,
+             occurrence.starts_at, occurrence.ends_at, ${params.bufferAfterMs ?? 0},
+             ${params.bufferBeforeMs ?? 0}, ${params.revision},
+             ${`calendar-event:${params.eventId}`}, ${params.eventId}
+        FROM ROWS FROM (pg_catalog.unnest(${externalRefs}::text[]),
+                        pg_catalog.unnest(${starts}::text[]::timestamptz[]),
+                        pg_catalog.unnest(${ends}::text[]::timestamptz[]))
+             WITH ORDINALITY AS occurrence(external_ref, starts_at, ends_at, ordinal)
+       ORDER BY occurrence.ordinal
+      RETURNING id, external_ref`;
+        const byRef = new Map(inserted.map((row) => [row.external_ref, row.id]));
+        externalRefs.forEach((externalRef, index) => {
+            const id = byRef.get(externalRef);
+            if (!id)
                 throw new Error('slotlock: calendar occurrence reservation insert returned no row');
-            }
-        }
-        await tx `
-      INSERT INTO slotlock.calendar_event_occurrences (
-        event_id, tenant_ref, recurrence_id, starts_at, ends_at, reservation_id
-      ) VALUES (
-        ${params.eventId}, ${params.tenantRef}, ${occurrence.recurrenceId},
-        ${occurrence.start}, ${occurrence.end}, ${reservationId}
-      )`;
+            reservationIds[index] = id;
+        });
     }
+    await tx `
+    INSERT INTO slotlock.calendar_event_occurrences (
+      event_id, tenant_ref, recurrence_id, starts_at, ends_at, reservation_id
+    )
+    SELECT ${params.eventId}, ${params.tenantRef}, occurrence.recurrence_id,
+           occurrence.starts_at, occurrence.ends_at, NULLIF(occurrence.reservation_id, '')::uuid
+      FROM ROWS FROM (pg_catalog.unnest(${params.occurrences.map((occurrence) => occurrence.recurrenceId)}::text[]),
+                      pg_catalog.unnest(${starts}::text[]::timestamptz[]),
+                      pg_catalog.unnest(${ends}::text[]::timestamptz[]),
+                      pg_catalog.unnest(${reservationIds}::text[]))
+           WITH ORDINALITY AS occurrence(recurrence_id, starts_at, ends_at, reservation_id, ordinal)
+     ORDER BY occurrence.ordinal`;
 }
-/** A recurring series' materialization window: finite, forward, and at most 369 days. */
 function seriesWindow(window) {
     if (!isFiniteWindow(window) ||
         window.end.getTime() - window.start.getTime() > MAX_MATERIALIZATION_WINDOW_MS) {
@@ -1028,9 +1021,9 @@ function calendarWindow(window) {
     return { start: new Date(window.start), end: new Date(window.end) };
 }
 /**
- * A one-off event's materialization window must contain the event. It defaults to the event's own
- * interval and may exceed the 367-day recurrence cap only by being exactly that interval, which is
- * what the `slotlock_calendar_events_materialization_window_bounded` CHECK admits.
+ * A one-off event's window must contain the event. It may exceed the 367-day cap only by being
+ * exactly the event's interval, as the `slotlock_calendar_events_materialization_window_bounded`
+ * CHECK admits.
  */
 function oneOffEventWindow(event, requested) {
     const duration = event.end.getTime() - event.start.getTime();
@@ -1049,17 +1042,15 @@ function calendarCommandHash(value) {
     return createHash('sha256').update(JSON.stringify(value)).digest('hex');
 }
 /**
- * What makes a put the same request: its identity and the event it asks for. Not the window its
- * occurrences are stored over, which for a series is the rolling horizon from the current UTC
- * midnight: with it in the hash, a retry after midnight was refused as a different request.
+ * A put's identity and the event it asks for, not its storage window: a series' window moves with
+ * the UTC day, so a retry after midnight must still match.
  */
 function putCommandHash(params) {
     return calendarCommandHash(putCommandValue(params));
 }
 /**
- * The hash 0.3.0 and earlier stored, with the window in it, so a command stored before the upgrade
- * still replays: always for a one-off event, whose window is its own span, and on the same UTC day
- * for a series. Remove once no stored command can be that old (commands are pruned after 30 days).
+ * The hash 0.3.0 and earlier stored (window included), so an older stored command still replays.
+ * Remove once no stored command can be that old (pruned after 30 days).
  */
 export function legacyPutCommandHash(params) {
     return calendarCommandHash({
@@ -1079,7 +1070,7 @@ function putCommandValue(params) {
         expectedRevision: params.command.expectedRevision,
         resourceId: params.command.resourceId,
         source: params.command.source ?? null,
-        // Only when present, so a create without a hold keeps the hash it always had.
+        // Only when present, so a create without a hold keeps its hash.
         ...(params.command.fromHold ? { fromHold: params.command.fromHold.holdId } : {}),
         event: {
             ...params.event,
@@ -1138,8 +1129,7 @@ async function calendarOwnerCommandCount(tx, tenantRef, ownerRef) {
 }
 /**
  * The end of every event cancellation, under the event's identity and row locks: remove the event
- * (when there is one) and its occupation, leave the identity's tombstone at `revision`, and record
- * the command in `commandOwnerRef`'s namespace for replay.
+ * and its occupation, leave the tombstone at `revision`, and record the command for replay.
  */
 async function finishCalendarCancel(tx, params) {
     const eventId = params.eventId ?? randomUUID();
@@ -1179,8 +1169,8 @@ async function finishCalendarCancel(tx, params) {
     };
 }
 /**
- * The row an event write lost to. The write was rolled back, so the event's own rows from before
- * it are still there and are left out: they were to be replaced, and never block the event.
+ * The row an event write lost to. The write was rolled back, so the event's own previous rows are
+ * excluded: they were to be replaced.
  */
 async function findCalendarOverlap(sql, resourceId, occurrences, eventId, buffers = { bufferBeforeMs: 0, bufferAfterMs: 0 }) {
     for (const occurrence of occurrences) {
@@ -1191,10 +1181,9 @@ async function findCalendarOverlap(sql, resourceId, occurrences, eventId, buffer
     return { ok: false, code: 'overlap', conflictingReservationId: null };
 }
 /**
- * What the resource's booking rules (as they apply: its own over its pool's and tenant's defaults)
- * say about a booking of `interval` made now (by the database's clock, at this statement): the rule
- * it breaks, if any, and the buffers it must keep before and after it. A resource without its own
- * hours is judged against `defaultHours`.
+ * What the resource's effective booking rules say about booking `interval` now (database clock):
+ * the rule broken, if any, and the buffers to keep. A resource without its own hours is judged
+ * against `defaultHours`.
  */
 async function bookingRuling(tx, resourceId, interval, defaultHours) {
     const judge = await bookingJudge(tx, resourceId, defaultHours);
@@ -1207,8 +1196,8 @@ async function bookingRuling(tx, resourceId, interval, defaultHours) {
 /** How recently a sync must have read a resource whose booking rules require certainty. */
 const CERTAIN_COVERAGE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /**
- * The resource's booking rules as they apply, read once, as a check of any interval booked now (by
- * the database's clock at this statement) and the buffers a booking keeps.
+ * The resource's effective booking rules, read once, as a check of any interval booked now
+ * (database clock) and the buffers to keep.
  */
 async function bookingJudge(tx, resourceId, defaultHours) {
     const [row] = await tx `
@@ -1231,7 +1220,6 @@ async function bookingJudge(tx, resourceId, defaultHours) {
         effective_booking_rules: row.effective_booking_rules,
     });
     const hours = availabilityRules ?? defaultHours;
-    // Every sync covering the resource, and whether it was read within a day, by the same clock.
     const coverage = rules?.requireCertain === true
         ? await tx `
           SELECT starts_at, ends_at,
@@ -1241,12 +1229,11 @@ async function bookingJudge(tx, resourceId, defaultHours) {
         : [];
     const turnaroundMs = bookingBufferAfterMs(rules);
     const bufferBeforeMs = bookingBufferBeforeMs(rules);
-    // The booking and the buffers it keeps, as a search judges the slot.
     const uncertain = (interval) => coverage.some((source) => !source.fresh ||
         source.starts_at.getTime() > interval.start.getTime() - bufferBeforeMs ||
         source.ends_at.getTime() < interval.end.getTime() + turnaroundMs);
-    // A later occurrence of a series is judged on its step and hours only: notice and advance are
-    // about when the booking was made, which its first occurrence answers.
+    // Later occurrences are judged on step and hours only: notice and advance concern when the
+    // booking was made.
     const later = rules === undefined
         ? undefined
         : {
@@ -1271,29 +1258,59 @@ function sameExternalPayload(row, params, turnaroundMs = 0) {
     return (row.resource_id === params.resourceId &&
         row.starts_at.getTime() === params.start.getTime() &&
         row.ends_at.getTime() === params.end.getTime() &&
-        // As asked, or raised to the resource's turnaround when it was stored.
         (buffer === params.bufferAfterMs || buffer === Math.max(params.bufferAfterMs, turnaroundMs)) &&
         Number(row.revision) === params.revision &&
         row.source === (params.source ?? null));
 }
 async function lockExternalIdentity(tx, tenantRef, externalRef) {
-    // JSON encoding is unambiguous for this pair and contains no NUL byte (Postgres text rejects
-    // U+0000). The database hashes it to one transaction-scoped lock key.
+    // JSON is unambiguous for this pair and has no NUL byte (Postgres text rejects U+0000).
     await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([tenantRef, externalRef])}, 0))`;
 }
 /**
- * Whether the resource is the tenant's (`missing` when not), and whether it is archived. The row is
- * share-locked to the end of the transaction, so it is neither archived nor deleted meanwhile.
+ * Lock a resource a write is about to occupy time on, with its composite parent, in id order, to
+ * the end of the transaction (RFC 0004 A7): writes to one resource, or one composite's family,
+ * take turns. Without it, writers racing for the same time each insert, then wait at the
+ * exclusion constraint for one another, and PostgreSQL breaks each such deadlock only after its
+ * deadlock_timeout (a second), so a burst of agents for one slot could take many seconds. With
+ * it, each meets the winner's committed row and is refused at once. NO KEY UPDATE, so foreign
+ * keys to the resource are not blocked; an archive or delete waits for the write, as before. The
+ * resource's own row, or null when there is none (for the tenant, when one is given).
+ */
+async function lockResourceForWrite(tx, resourceId, tenantRef) {
+    const rows = await tx `
+    SELECT id, tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
+     WHERE (id = ${resourceId}
+            OR id = (SELECT parent_id FROM slotlock.resources WHERE id = ${resourceId}))
+       AND (${tenantRef}::text IS NULL OR tenant_ref = ${tenantRef})
+     ORDER BY id
+     FOR NO KEY UPDATE`;
+    const own = rows.find((row) => row.id === resourceId);
+    return own ? { tenant_ref: own.tenant_ref, archived: own.archived } : null;
+}
+/**
+ * Whether the resource is the tenant's (`missing` when not), and whether it is archived, locked
+ * for the write that follows (lockResourceForWrite).
  */
 async function tenantResourceState(tx, resourceId, tenantRef) {
-    const [row] = await tx `
-    SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
-     WHERE id = ${resourceId} AND tenant_ref = ${tenantRef}
-     FOR SHARE`;
+    const row = await readResourceForWrite(tx, resourceId, tenantRef);
     if (!row)
         return 'missing';
     return row.archived ? 'archived' : 'active';
 }
+/**
+ * A resource a write is about to check its booking against, key-share locked so it is not deleted
+ * meanwhile. It does not make writers wait for each other: lockResourceForWrite does, later, right
+ * before the occupation is written, and checks again that the resource is there and not archived.
+ * (KEY SHARE never conflicts with the NO KEY UPDATE that follows, so two writers cannot deadlock
+ * upgrading.)
+ */
+async function readResourceForWrite(tx, resourceId, tenantRef) {
+    const [row] = await tx `
+    SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
+     WHERE id = ${resourceId} AND (${tenantRef}::text IS NULL OR tenant_ref = ${tenantRef})
+     FOR KEY SHARE`;
+    return row ?? null;
+}
 function pgCode(err) {
     let cur = err;
     while (cur && typeof cur === 'object') {
@@ -1332,10 +1349,19 @@ function invalidPoolError() {
         code: 'invalid_pool',
     });
 }
+/** A resource's own columns, as toResource reads them. */
+const RESOURCE_COLUMNS = `id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
+  visibility, archived_at, name, description, kind, capacity, labels, attributes, location_ref,
+  parent_id, part_index,
+  (SELECT place.name FROM slotlock.locations place
+    WHERE place.tenant_ref = resources.tenant_ref AND place.ref = resources.location_ref) AS location_name,
+  ARRAY(SELECT member.group_ref FROM slotlock.resource_group_members member
+         WHERE member.tenant_ref = resources.tenant_ref AND member.resource_id = resources.id
+         ORDER BY member.group_ref) AS group_refs`;
 /**
- * A resource row's booking rules as they apply (jsonb; NULL for none): the tenant's defaults,
- * overlaid by its pool's, overlaid by its own, field by field, so one set at a narrower level wins.
- * Read from a row of slotlock.resources named `resources` (no alias).
+ * A resource row's effective booking rules (jsonb; NULL for none): tenant defaults, overlaid by its
+ * pool's, overlaid by its own, field by field. Reads from a row of slotlock.resources named
+ * `resources` (no alias).
  */
 const EFFECTIVE_BOOKING_RULES = `NULLIF(
   COALESCE((SELECT defaults.rules FROM slotlock.booking_rule_defaults defaults
@@ -1347,7 +1373,7 @@ const EFFECTIVE_BOOKING_RULES = `NULLIF(
   '{}'::jsonb) AS effective_booking_rules`;
 /** What rules Slotlock did not write read as: no booking passes them. */
 const REFUSE_EVERY_BOOKING = Object.freeze({ maxAdvanceDays: 1, minNoticeMinutes: 525_600 });
-/** Rules read back from storage: written validated, so anything else refuses every booking. */
+/** Rules written validated, so anything else read back refuses every booking. */
 function storedBookingRules(value) {
     try {
         return parseBookingRules(value);
@@ -1368,8 +1394,37 @@ function toResource(row) {
         resource.archivedAt = row.archived_at;
     if (row.pool_ref !== null && row.pool_ref !== undefined)
         resource.pool = row.pool_ref;
+    // The profile, each part only when it says something.
+    if (typeof row.name === 'string')
+        resource.name = row.name;
+    if (typeof row.description === 'string')
+        resource.description = row.description;
+    if (row.kind !== undefined && row.kind !== 'other' && SLOTLOCK_RESOURCE_KINDS.includes(row.kind)) {
+        resource.kind = row.kind;
+    }
+    if (typeof row.capacity === 'number')
+        resource.capacity = row.capacity;
+    if (Array.isArray(row.labels) && row.labels.length > 0)
+        resource.labels = [...row.labels];
+    if (row.attributes !== null &&
+        typeof row.attributes === 'object' &&
+        !Array.isArray(row.attributes) &&
+        Object.keys(row.attributes).length > 0) {
+        resource.attributes = { ...row.attributes };
+    }
+    if (typeof row.location_ref === 'string') {
+        resource.location = row.location_ref;
+        if (typeof row.location_name === 'string')
+            resource.locationName = row.location_name;
+    }
+    if (Array.isArray(row.group_refs) && row.group_refs.length > 0)
+        resource.groups = [...row.group_refs];
+    if (typeof row.parent_id === 'string' && typeof row.part_index === 'number') {
+        resource.parentId = row.parent_id;
+        resource.partIndex = row.part_index;
+    }
     if (row.availability_rules !== null && row.availability_rules !== undefined) {
-        // Written through setResourceAvailability, which validates; anything else reads as closed.
+        // Written validated; anything else reads as closed.
         try {
             resource.availabilityRules = parseAvailabilityRules(row.availability_rules);
         }
@@ -1378,14 +1433,12 @@ function toResource(row) {
         }
     }
     if (row.booking_rules !== null && row.booking_rules !== undefined) {
-        // Written through setResourceBookingRules, which validates; anything else reads as refusing
-        // every booking, never as no rule.
+        // Written validated; anything else refuses every booking, never as no rule.
         resource.bookingRules = storedBookingRules(row.booking_rules);
     }
     if (row.effective_booking_rules !== null && row.effective_booking_rules !== undefined) {
-        // Merged from levels each validated alone, so only their combination can disagree (an offset
-        // from one level over a shorter step from another): that one is read modulo the step. A field
-        // invalid in itself was not written by Slotlock, and refuses every booking, as stored rules do.
+        // Levels are validated alone, so only their combination can disagree (an offset over a shorter
+        // step): that one is read modulo the step. A field invalid in itself refuses every booking.
         const { rules, dropped } = parseEffectiveBookingRules(row.effective_booking_rules);
         if (dropped.length > 0) {
             console.warn(JSON.stringify({ message: 'slotlock refused invalid booking rules', resource: row.id, dropped }));
@@ -1397,7 +1450,6 @@ function toResource(row) {
     }
     return resource;
 }
-/** Validated rules as a jsonb parameter, or null for "use the default". */
 function availabilityParameter(sql, rules) {
     // sql.json, not JSON.stringify: a string bound to jsonb is stored as a JSON string.
     if (rules === null)
@@ -1408,23 +1460,137 @@ function availabilityParameter(sql, rules) {
         durationMinutes,
     })));
 }
+/** What the location and group guards (ddl.ts) refuse with, by their HINT. */
+const GROUPING_REFUSALS = new Set([
+    'pool_order_limit_reached',
+    'composite_too_deep',
+    'composite_parts_limit',
+    'composite_busy',
+    'location_too_deep',
+    'location_cycle',
+    'location_limit_reached',
+    'group_limit_reached',
+    'resource_group_limit_reached',
+]);
+/**
+ * A location or group write PostgreSQL refused, as the store's code: a guard's HINT, or the code
+ * `foreignKeys` gives a foreign key that failed. Anything else as it was.
+ */
+function groupingRefusal(error, foreignKeys = {}) {
+    const failure = error;
+    const coded = (code) => Object.assign(new Error(typeof failure?.message === 'string' ? failure.message : code, { cause: error }), { code });
+    if (failure?.code === '23514' && typeof failure.hint === 'string' && GROUPING_REFUSALS.has(failure.hint)) {
+        return coded(failure.hint);
+    }
+    if (failure?.code === '23503' && typeof failure.constraint_name === 'string') {
+        const code = foreignKeys[failure.constraint_name];
+        if (code !== undefined)
+            return coded(code);
+    }
+    return error;
+}
+/**
+ * Run a location or group write in a savepoint of its own (a transaction when there is none), and
+ * map what PostgreSQL refuses (groupingRefusal). A failed statement leaves the caller's transaction
+ * usable, and postgres.js reports the mapped error rather than the statement's.
+ */
+async function guardedWrite(executor, write, foreignKeys = {}) {
+    try {
+        return await inTransaction(executor, write);
+    }
+    catch (error) {
+        throw groupingRefusal(error, foreignKeys);
+    }
+}
+/** A resource's location that the tenant does not have. */
+const RESOURCE_LOCATION_MISSING = Object.freeze({ slotlock_resources_location_fkey: 'location_not_found' });
+/** The nearest time zone a location, or one above it, has; null when none has one. */
+async function locationTimezone(executor, tenantRef, location) {
+    const [row] = await executor `
+    WITH RECURSIVE up(ref, parent_ref, timezone, steps) AS (
+      SELECT place.ref, place.parent_ref, place.timezone, 1 FROM slotlock.locations place
+       WHERE place.tenant_ref = ${tenantRef} AND place.ref = ${location}
+      UNION ALL
+      SELECT place.ref, place.parent_ref, place.timezone, up.steps + 1
+        FROM slotlock.locations place JOIN up ON place.tenant_ref = ${tenantRef} AND place.ref = up.parent_ref
+       WHERE up.timezone IS NULL AND up.steps <= ${SLOTLOCK_MAX_LOCATION_DEPTH}
+    )
+    SELECT timezone FROM up WHERE timezone IS NOT NULL ORDER BY steps LIMIT 1`;
+    return row?.timezone ?? null;
+}
+const toLocation = (row) => ({
+    ref: row.ref,
+    name: row.name,
+    parentRef: row.parent_ref,
+    timezone: row.timezone,
+    resources: Number(row.resources),
+});
+const toGroup = (row) => ({
+    ref: row.ref,
+    name: row.name,
+    description: row.description,
+    members: Number(row.members),
+});
+/**
+ * A checked profile change as statement parameters: each field's value (null when not given or
+ * cleared) and whether it was given. Labels travel as one comma-joined string, which a label never
+ * contains: postgres.js binds an array as text[] only once the pool knows the server's types.
+ */
+function profileParameters(change) {
+    return {
+        name: change.name ?? null,
+        setName: change.name !== undefined,
+        description: change.description ?? null,
+        setDescription: change.description !== undefined,
+        kind: change.kind ?? null,
+        setKind: change.kind !== undefined,
+        capacity: change.capacity ?? null,
+        setCapacity: change.capacity !== undefined,
+        labels: change.labels === undefined ? null : change.labels.join(','),
+        setLabels: change.labels !== undefined,
+        attributes: change.attributes === undefined ? null : JSON.stringify(change.attributes),
+        setAttributes: change.attributes !== undefined,
+    };
+}
 async function upsertResource(executor, params) {
     const visibility = params.visibility ?? 'shared';
     const asked = params.visibility ?? null;
+    const profile = profileParameters(params.profile ?? {});
     let rows;
-    // An existing identity keeps the visibility it has: creating it again with none named returns it
-    // as it is, and with another one is refused, so a private one is never made shared that way.
+    // An existing identity keeps its visibility: re-creating with another is refused, so a private
+    // one is never made shared. Its profile takes the fields given, and keeps the rest.
     if (params.tenantRef !== undefined && params.externalRef !== undefined) {
         rows = await executor `
-      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
-      VALUES (${params.externalRef}, ${params.tenantRef}, ${params.timezone ?? 'UTC'}, ${visibility})
+      INSERT INTO slotlock.resources (
+        external_ref, tenant_ref, timezone, visibility, name, description, kind, capacity, labels, attributes,
+        location_ref
+      )
+      VALUES (
+        ${params.externalRef}, ${params.tenantRef}, ${params.timezone ?? 'UTC'}, ${visibility},
+        ${profile.name}::text, ${profile.description}::text, COALESCE(${profile.kind}::text, 'other'),
+        ${profile.capacity}::integer,
+        COALESCE(pg_catalog.string_to_array(${profile.labels}::text, ','), '{}'::text[]),
+        COALESCE(${profile.attributes}::text::jsonb, '{}'::jsonb),
+        ${params.location ?? null}::text
+      )
       ON CONFLICT (tenant_ref, external_ref)
         WHERE tenant_ref IS NOT NULL AND external_ref IS NOT NULL
-      DO UPDATE SET timezone = EXCLUDED.timezone
+      DO UPDATE SET timezone = EXCLUDED.timezone,
+        name = CASE WHEN ${profile.setName}::boolean THEN EXCLUDED.name ELSE slotlock.resources.name END,
+        description = CASE WHEN ${profile.setDescription}::boolean THEN EXCLUDED.description
+                           ELSE slotlock.resources.description END,
+        kind = CASE WHEN ${profile.setKind}::boolean THEN EXCLUDED.kind ELSE slotlock.resources.kind END,
+        capacity = CASE WHEN ${profile.setCapacity}::boolean THEN EXCLUDED.capacity ELSE slotlock.resources.capacity END,
+        labels = CASE WHEN ${profile.setLabels}::boolean THEN EXCLUDED.labels ELSE slotlock.resources.labels END,
+        attributes = CASE WHEN ${profile.setAttributes}::boolean THEN EXCLUDED.attributes
+                          ELSE slotlock.resources.attributes END,
+        location_ref = CASE WHEN ${params.location !== undefined}::boolean THEN EXCLUDED.location_ref
+                            ELSE slotlock.resources.location_ref END
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+      RETURNING ${executor.unsafe(RESOURCE_COLUMNS)}, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     else if (params.externalRef !== undefined) {
+        // A legacy resource (no tenant) has no profile.
         rows = await executor `
       INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
       VALUES (${params.externalRef}, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
@@ -1432,13 +1598,13 @@ async function upsertResource(executor, params) {
         WHERE tenant_ref IS NULL AND external_ref IS NOT NULL
       DO UPDATE SET external_ref = EXCLUDED.external_ref
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+      RETURNING ${executor.unsafe(RESOURCE_COLUMNS)}, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     else {
         rows = await executor `
       INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
       VALUES (NULL, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+      RETURNING ${executor.unsafe(RESOURCE_COLUMNS)}, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     const row = rows[0];
     if (!row) {
@@ -1449,11 +1615,9 @@ async function upsertResource(executor, params) {
     return toResource(row);
 }
 /**
- * Rematerialize one stored recurring master over the window a roll to `horizon` gives it
- * (rolledWindow): from where its last expansion stopped when that can be trusted, else its start.
- * False when there is no such master or nothing to roll. A collision throws the database's 23P01,
- * and a rule over the expansion budget CalendarExpansionLimitError; run it in a savepoint, which
- * either rolls back whole.
+ * Rematerialize one stored recurring master over rolledWindow: from its last expansion's cursor
+ * when trustworthy, else its start. False when there is nothing to roll. A collision throws 23P01
+ * and an over-budget rule CalendarExpansionLimitError; run it in a savepoint.
  */
 async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
     const [row] = await tx `
@@ -1499,8 +1663,8 @@ async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
     return true;
 }
 /**
- * Work out and store when a series stored before 0.3 ends (recurrence_ends_by), as its next roll
- * would; its stored occurrences are left as they are.
+ * Work out and store when a series stored before 0.3 ends, as its next roll would; its occurrences
+ * are left as they are.
  */
 async function learnSeriesEnd(tx, tenantRef, eventId) {
     const [row] = await tx `
@@ -1522,7 +1686,6 @@ async function learnSeriesEnd(tx, tenantRef, eventId) {
        SET recurrence_ends_by = ${recurrenceEndsByColumn(event)}::text::timestamptz
      WHERE id = ${row.id} AND tenant_ref = ${tenantRef} AND recurrence_ends_by IS NULL`;
 }
-/** Put a master the roll could not extend behind the others for an hour. */
 async function deferRoll(executor, tenantRef, eventId) {
     await executor `
     UPDATE slotlock.calendar_events
@@ -1531,24 +1694,19 @@ async function deferRoll(executor, tenantRef, eventId) {
 }
 /**
  * Whether every opaque recurring series on the resource (but `exceptEventId`) is stored over the
- * part of [start, end) that a roll can ever reach: from the later of `start` and the rolling
- * horizon's start. A write there must not land where such a series is not stored, or the series'
- * next roll would collide with it and stop. A series known to end before that part
- * (recurrence_ends_by) cannot meet the write and is left out, as is one stored through its end. A
- * series behind is first rolled to the horizon, in a savepoint of the write's transaction, so the
- * write meets its occurrences under the exclusion arbiter; false when one cannot be (it goes on
- * past the horizon and so does the write, it collides, or its rule is over the budget). Series are
- * rolled in id order; an event's update holds its own row while it rolls the others, so it and a
- * write rolling the same series in that order can deadlock, which the database breaks (the writer
- * retries once, then answers an overlap).
+ * part of [start, end) a roll can reach. A write must not land where a series is not stored yet, or
+ * the series' next roll would collide with it. A series behind is first rolled to the horizon in a
+ * savepoint, so the write meets its occurrences under the exclusion arbiter; false when one cannot
+ * be. Series roll in id order; a deadlock with a concurrent writer is broken by the database
+ * (retried once, then an overlap).
  */
 async function recurrenceCoversWrite(tx, params) {
     const horizon = calendarEventRollingHorizon();
     if (params.end <= horizon.start)
         return true;
     const from = params.start > horizon.start ? params.start : horizon.start;
-    // LEAST and GREATEST ignore a NULL argument (PostgreSQL 16, Conditional Expressions): a series
-    // with no known end is behind wherever it is stored short of the write's end.
+    // LEAST and GREATEST ignore NULL arguments (PostgreSQL 16): a series with no known end is behind
+    // wherever it is stored short of the write's end.
     const behind = () => tx `
     SELECT event.id, event.recurrence_ends_by IS NULL AS ends_by_unknown,
            COALESCE(event.recurrence_ends_by <= ${horizon.end}::timestamptz, false)
@@ -1578,8 +1736,8 @@ async function recurrenceCoversWrite(tx, params) {
     if (due.length === 0)
         return true;
     if (params.end > horizon.end) {
-        // A series stored before 0.3 has not worked out when it ends; it does so now, and is left out
-        // if it ends before the write or is stored through its end.
+        // A series stored before 0.3 works out its end now, and is left out if it ends before the write
+        // or is stored through its end.
         if (due.some((row) => row.ends_by_unknown)) {
             for (const { id, ends_by_unknown } of due) {
                 if (ends_by_unknown)
@@ -1589,7 +1747,6 @@ async function recurrenceCoversWrite(tx, params) {
             if (due.length === 0)
                 return true;
         }
-        // No roll stores a series past the horizon: one going on past it stays behind such a write.
         if (due.some((row) => !row.ends_in_horizon))
             return false;
     }
@@ -1607,9 +1764,8 @@ async function recurrenceCoversWrite(tx, params) {
     return (await behind()).length === 0;
 }
 /**
- * Whether an event already occupies, on the resource, all the time `occurrences` would: such a
- * write (a rename, a new description) takes no time a series could later need, so it is not held
- * to where the series on the resource are stored.
+ * Whether an event already occupies all the time `occurrences` would: such a write (a rename) takes
+ * no time a series could later need.
  */
 async function holdsEveryOccurrence(tx, eventId, resourceId, occurrences) {
     const held = await tx `
@@ -1620,7 +1776,6 @@ async function holdsEveryOccurrence(tx, eventId, resourceId, occurrences) {
        AND reservation.resource_id = ${resourceId}`;
     return occurrences.every((occurrence) => held.some(({ start, end }) => start <= occurrence.start && occurrence.end <= end));
 }
-/** From the earliest start to the latest end of an event's occurrences, or null for none. */
 function occurrenceSpan(occurrences) {
     const [first] = occurrences;
     if (!first)
@@ -1636,10 +1791,9 @@ function occurrenceSpan(occurrences) {
     return { start, end };
 }
 /**
- * After a write lost to the exclusion arbiter: roll, in a transaction of its own, the series on the
- * resource the write's transaction rolled with it (and lost), so they stay extended and the loss
- * can name the occurrence that blocked it. A resource with no tenant has no series. Upkeep only: if
- * it fails, the series are left to maintenance and the write is still answered as a loss.
+ * After a write lost to the exclusion arbiter: roll, in a transaction of its own, the series the
+ * write's transaction rolled and lost, so the loss can name the blocking occurrence. Upkeep only:
+ * on failure, maintenance rolls them later.
  */
 async function rollSeriesBehind(executor, resourceId, start, end, exceptEventId) {
     try {
@@ -1677,35 +1831,30 @@ function tenantLimitsOption(limits) {
     return valid;
 }
 /**
- * Serialize one tenant's writes that add rows of one limited kind, so each counts what every
- * earlier one committed. Taken before any row lock, after the write's identity locks.
+ * Serialize a tenant's writes adding rows of one limited kind, so each counts what earlier ones
+ * committed. Taken after the identity locks, before any row lock.
  */
 async function lockTenantLimit(tx, tenantRef, kind) {
     // An object, so the key never equals a [tenantRef, externalRef] identity lock's.
     await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify({ tenantLimit: kind, tenantRef })}, 0))`;
 }
 /**
- * Rows a tenant added within this many days count against its limits whatever time they hold, so
- * bookings and events dated in the past, and cancellations, add at most the limit in any such
- * window. Ended history is not pruned: over a longer time it can still grow. Maintenance keeps
- * event idempotency records and stray retirements at least as long (the store's `retentionDays`).
+ * Rows added within this many days count whatever time they hold, so back-dated bookings and
+ * cancellations add at most the limit per window. Maintenance keeps idempotency records and stray
+ * retirements at least this long.
  */
 const TENANT_LIMIT_RECENT_DAYS = SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS;
 /**
- * The rows a tenant has that its limit of `kind` counts: what is still to come, and what it added
- * in the last TENANT_LIMIT_RECENT_DAYS days; what ended before then is history and does not count.
- * Each part stops at `limit` rows, read through an index, so a count costs no more than the limit
- * however much history the tenant keeps; the total is at least `limit` exactly when the tenant is
- * at it.
+ * The rows a tenant's `kind` limit counts: what is still to come plus what it added in the last
+ * TENANT_LIMIT_RECENT_DAYS days. Each part stops at `limit` rows read through an index, so a count
+ * costs at most the limit.
  */
 async function tenantLimitCount(tx, tenantRef, kind, limit) {
     let rows;
     switch (kind) {
         case 'holds':
-            // Every held row, expired or not, until it is deleted: an expired hold no rival writes over
-            // stays stored until maintenance or a hold at the limit deletes it. And the answer kept for
-            // each keyed hold no longer held (released or confirmed, or its expired row deleted) until it
-            // is forgotten. An answer whose hold is still a held row is left out: that row counts.
+            // Every held row until deleted (expired ones too), plus each keyed hold's kept answer once
+            // its row is gone.
             rows = await tx `
         SELECT (
           (SELECT count(*) FROM (
@@ -1725,9 +1874,8 @@ async function tenantLimitCount(tx, tenantRef, kind, limit) {
         )::int AS count`;
             break;
         case 'reservations':
-            // Bookings still to come; bookings that have ended and cancellations, made recently; and
-            // references retired with no booking, until maintenance prunes them. A cancelled booking's
-            // tombstone is kept for good, and stops counting once it is no longer recent.
+            // Bookings still to come; ended bookings and cancellations made recently; and stray
+            // retirements until pruned.
             rows = await tx `
         WITH recent AS (
           SELECT now() - ${TENANT_LIMIT_RECENT_DAYS}::int * interval '1 day' AS since
@@ -1755,9 +1903,9 @@ async function tenantLimitCount(tx, tenantRef, kind, limit) {
         )::int AS count`;
             break;
         case 'events':
-            // One-off events still to come and series not known to have ended; events that have ended
-            // and cancellations of any owner, made recently; and agent cancellations until maintenance
-            // prunes them. The owner identity CHECK makes every owner but 'internal' an 'agent:' one.
+            // One-off events still to come and series not known to have ended; recent ended events and
+            // cancellations; and agent cancellations until pruned. The owner CHECK makes every owner but
+            // 'internal' an 'agent:' one.
             rows = await tx `
         WITH recent AS (
           SELECT now() - ${TENANT_LIMIT_RECENT_DAYS}::int * interval '1 day' AS since
@@ -1802,9 +1950,8 @@ async function tenantLimitCount(tx, tenantRef, kind, limit) {
     return count;
 }
 /**
- * Delete up to `limit` of a tenant's holds that have expired, oldest first; the number deleted. A
- * writer reaping or confirming a hold locks it: such a row is skipped, and the delete repeats the
- * predicate on the row as it now is.
+ * Delete up to `limit` of a tenant's expired holds, oldest first. Rows a reaper or confirmer has
+ * locked are skipped, and the delete rechecks the predicate.
  */
 async function deleteExpiredHolds(tx, tenantRef, limit) {
     const [row] = await tx `
@@ -1828,8 +1975,8 @@ async function deleteExpiredHolds(tx, tenantRef, limit) {
     return Number(row?.deleted ?? 0);
 }
 /**
- * Delete up to `limit` of a tenant's keyed hold answers whose hold has expired, so a retry with one
- * of their keys makes a new hold; answers another transaction holds are skipped. The number deleted.
+ * Delete up to `limit` keyed hold answers whose hold has expired, so a retry makes a new hold;
+ * locked answers are skipped.
  */
 async function forgetExpiredHoldAnswers(tx, tenantRef, limit) {
     const [row] = await tx `
@@ -1852,8 +1999,8 @@ async function forgetExpiredHoldAnswers(tx, tenantRef, limit) {
     return Number(row?.deleted ?? 0);
 }
 /**
- * The time a booking of [start, end) keeping these buffers occupies, as the exclusion constraint
- * reads it: from its start less its leading buffer to its end plus its trailing one.
+ * A booking's occupied time as the exclusion constraint reads it: start less its leading buffer to
+ * end plus its trailing one.
  */
 function occupiedTime(params) {
     return {
@@ -1862,8 +2009,8 @@ function occupiedTime(params) {
     };
 }
 /**
- * A row's occupied time starts before `end`: a condition on its occupied start that still reads the
- * (resource_id, starts_at, ends_at) index, since no row starts more than a day after it.
+ * Occupied start before `end`, written so the (resource_id, starts_at, ends_at) index still
+ * applies: no row starts more than a day after its occupied start.
  */
 function occupiedStartsBefore(executor, end, alias) {
     const column = (name) => executor.unsafe(alias === undefined ? name : `${alias}.${name}`);
@@ -1871,19 +2018,21 @@ function occupiedStartsBefore(executor, end, alias) {
                    AND COALESCE(${column('occupied_starts_at')}, ${column('starts_at')}) < ${end})`;
 }
 /**
- * Delete expired held rows whose occupied time (buffers included, as the EXCLUDE constraint reads
- * it) overlaps the requested window, whose `start` and `end` are its own occupied start and end
- * (`occupiedTime`), in deterministic id
- * order under FOR UPDATE — two concurrent reapers lock the same rows in the same order (no
- * deadlock), the loser simply finds them gone. Runs inside the caller's transaction, immediately
- * before its INSERT, so the EXCLUDE arbiter only ever sees LIVE occupation.
+ * Delete expired held rows whose occupied time overlaps the window, in id order under FOR UPDATE:
+ * concurrent reapers lock in the same order (no deadlock) and the loser finds them gone. Runs right
+ * before the caller's INSERT, so the EXCLUDE arbiter only sees live occupation.
  */
 async function reapExpiredHolds(tx, resourceId, start, end) {
+    // A composite's parent and parts too (RFC 0003 G8): their expired holds' claims are in the way.
     await tx `
     DELETE FROM slotlock.reservations
      WHERE id IN (
        SELECT id FROM slotlock.reservations
-        WHERE resource_id = ${resourceId}
+        WHERE resource_id IN (
+                SELECT ${resourceId}::uuid
+                UNION ALL SELECT family.parent_id FROM slotlock.resources family
+                           WHERE family.id = ${resourceId} AND family.parent_id IS NOT NULL
+                UNION ALL SELECT family.id FROM slotlock.resources family WHERE family.parent_id = ${resourceId})
           AND status = 'held'
           AND expires_at <= statement_timestamp()
           AND ${occupiedStartsBefore(tx, end)}
@@ -1893,10 +2042,65 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
      )`;
 }
 /**
- * Structured answer after losing to the EXCLUDE arbiter: name the (live) winner.
- * conflictingReservationId can be null in one narrow race: the blocker expired between the
- * loser's transaction start (constraint saw it) and this lookup (live filter hides it) — an
- * immediate retry reaps it and wins.
+ * reapExpiredHolds for many windows on one resource in one statement (a series' occurrences): the
+ * same rows, in the same id order under FOR UPDATE, as one call per window would delete. The
+ * envelope of the windows bounds the scan so the index applies; each row must still overlap one.
+ */
+async function reapExpiredHoldsAcross(tx, resourceId, windows) {
+    if (windows.length === 0)
+        return;
+    let first = Number.POSITIVE_INFINITY;
+    let last = Number.NEGATIVE_INFINITY;
+    for (const window of windows) {
+        first = Math.min(first, window.start.getTime());
+        last = Math.max(last, window.end.getTime());
+    }
+    await tx `
+    DELETE FROM slotlock.reservations
+     WHERE id IN (
+       SELECT held.id FROM slotlock.reservations held
+        WHERE held.resource_id IN (
+                SELECT ${resourceId}::uuid
+                UNION ALL SELECT family.parent_id FROM slotlock.resources family
+                           WHERE family.id = ${resourceId} AND family.parent_id IS NOT NULL
+                UNION ALL SELECT family.id FROM slotlock.resources family WHERE family.parent_id = ${resourceId})
+          AND held.status = 'held'
+          AND held.expires_at <= statement_timestamp()
+          AND ${occupiedStartsBefore(tx, new Date(last), 'held')}
+          AND COALESCE(held.occupied_ends_at, held.ends_at) > ${new Date(first)}
+          AND EXISTS (
+                SELECT 1
+                  FROM ROWS FROM (pg_catalog.unnest(${windows.map((window) => window.start.toISOString())}::text[]::timestamptz[]),
+                                  pg_catalog.unnest(${windows.map((window) => window.end.toISOString())}::text[]::timestamptz[]))
+                       AS occupied(starts_at, ends_at)
+                 WHERE COALESCE(held.occupied_starts_at, held.starts_at) < occupied.ends_at
+                   AND COALESCE(held.occupied_ends_at, held.ends_at) > occupied.starts_at)
+        ORDER BY held.id
+        FOR UPDATE
+     )`;
+}
+/**
+ * What else keeps a resource busy as part of a composite (RFC 0003 G8), as rows of
+ * (occupied_starts_at, occupied_ends_at): a part, the bookings of its parent as a whole; a parent,
+ * the bookings of any of its parts. Its own bookings are read with its own rows. Nothing for a
+ * resource that is neither.
+ */
+function compositeBusy(executor, resourceId, window) {
+    return executor `
+    SELECT lower(claim.during) AS occupied_starts_at, upper(claim.during) AS occupied_ends_at
+      FROM slotlock.resources me
+      JOIN slotlock.composite_claims claim
+        ON claim.resource_id = COALESCE(me.parent_id, me.id)
+       AND claim.booked_resource_id <> me.id
+       AND (me.parent_id IS NULL OR claim.span @> me.part_index)
+     WHERE me.id = ${resourceId}
+       AND claim.during && tstzrange(${window.start}, ${window.end}, '[)')
+       AND (claim.status <> 'held' OR claim.expires_at > statement_timestamp())`;
+}
+/**
+ * Structured answer after losing to the EXCLUDE arbiter: name the live winner.
+ * conflictingReservationId is null in one narrow race (the blocker expired between the constraint
+ * check and this lookup); an immediate retry reaps it and wins.
  */
 async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, excludeReservationId, excludeCalendarEventId, bufferBeforeMs = 0) {
     const winners = await sql `
@@ -1917,7 +2121,27 @@ async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, exclu
        AND (status <> 'held' OR expires_at > statement_timestamp())
      ORDER BY starts_at
      LIMIT 1`;
-    return { ok: false, code: 'overlap', conflictingReservationId: winners[0]?.id ?? null };
+    if (winners[0])
+        return { ok: false, code: 'overlap', conflictingReservationId: winners[0].id };
+    // Lost to a composite's claim (RFC 0003 G8): the booking on the whole, or on a part, in the way.
+    const claimed = await sql `
+    SELECT claim.reservation_id::text AS id
+      FROM slotlock.resources me
+      JOIN slotlock.composite_claims claim
+        ON claim.resource_id = COALESCE(me.parent_id, me.id)
+       AND claim.booked_resource_id <> me.id
+       AND (me.parent_id IS NULL OR claim.span @> me.part_index)
+     WHERE me.id = ${resourceId}
+       AND (${excludeReservationId ?? null}::uuid IS NULL OR claim.reservation_id <> ${excludeReservationId ?? null}::uuid)
+       AND claim.during && tstzrange(
+             ${start}::timestamptz - ${bufferBeforeMs} * interval '1 millisecond',
+             ${end}::timestamptz + ${bufferAfterMs} * interval '1 millisecond',
+             '[)'
+           )
+       AND (claim.status <> 'held' OR claim.expires_at > statement_timestamp())
+     ORDER BY lower(claim.during)
+     LIMIT 1`;
+    return { ok: false, code: 'overlap', conflictingReservationId: claimed[0]?.id ?? null };
 }
 /** The tenant a hold call is limited to, or null for none; an invalid one is refused. */
 function holdTenantRef(options) {
@@ -1967,7 +2191,7 @@ export function createTenantSlots(max) {
             if (released)
                 return;
             released = true;
-            // Handed straight to the next in line, so the count stays as it is.
+            // Handed straight to the next in line, so the count is unchanged.
             const next = slots.waiting.shift();
             if (next) {
                 next();
@@ -1991,6 +2215,14 @@ export function createSlotlockStore(sql, options = {}) {
  */
 export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'createResource',
+    'updateResourceProfile',
+    'putLocation',
+    'updateLocation',
+    'deleteLocation',
+    'putGroup',
+    'deleteGroup',
+    'addGroupMember',
+    'removeGroupMember',
     'archiveResource',
     'restoreResource',
     'deleteResource',
@@ -1998,6 +2230,17 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'setResourceBookingRules',
     'setBookingRuleDefaults',
     'setResourcePool',
+    'setResourceParent',
+    'setPoolOrder',
+    'notePoolBooking',
+    'putApprovalPolicy',
+    'deleteApprovalPolicy',
+    'requestApproval',
+    'beginApprovalGrant',
+    'finishApprovalGrant',
+    'declineApproval',
+    'resetTestTenant',
+    'fastForwardTestTenant',
     'setTenantAvailability',
     'createReservation',
     'createExternalReservation',
@@ -2020,6 +2263,7 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'leaveWaitlist',
     'putAssistantSettings',
     'deleteAssistantSettings',
+    'resealAssistantKey',
     'putAssistantConversation',
     'settleAssistantAction',
     'deleteAssistantConversation',
@@ -2033,9 +2277,8 @@ function staleSuspensionCheckError() {
     return Object.assign(new Error('Slotlock writes for a tenant only in a READ COMMITTED transaction, whose suspension check sees every suspension committed before the tenant lock'), { code: 'invalid_transaction_isolation' });
 }
 /**
- * Reading a tenant's suspension needs EXECUTE on slotlock.tenant_suspended(text), which PUBLIC does
- * not hold (SQLSTATE 42501 without it), and a schema this release migrated (42883 before then).
- * Name the remedy for each; any other failure passes through.
+ * Reading a suspension needs EXECUTE on slotlock.tenant_suspended(text) (42501 without it) and a
+ * schema this release migrated (42883 before). Name the remedy for each.
  */
 function suspensionCheckRefusal(error) {
     const code = pgCode(error);
@@ -2048,8 +2291,8 @@ function suspensionCheckRefusal(error) {
     return error;
 }
 /**
- * A store on `sql`. With `refusal`, every method in SLOTLOCK_TENANT_WRITE_METHODS throws what it
- * returns before any query (a suspended tenant, or a suspension check that could be stale).
+ * A store on `sql`. With `refusal`, every SLOTLOCK_TENANT_WRITE_METHODS method throws it before any
+ * query.
  */
 function buildSlotlockStore(sql, options, refusal) {
     const configuredTenantSetting = options.tenantContextSetting ?? SLOTLOCK_TENANT_CONTEXT_SETTING;
@@ -2096,7 +2339,7 @@ function buildSlotlockStore(sql, options, refusal) {
         ? createTenantSlots(maxTenantTransactions)
         : undefined;
     const lockTimeout = ownTransactions && tenantLockTimeoutMs !== undefined ? `${tenantLockTimeoutMs}ms` : undefined;
-    createSlotlockTenantRlsDdl(configuredTenantSetting); // Validate once before any scoped query.
+    createSlotlockTenantRlsDdl(configuredTenantSetting);
     const storeOptions = {
         tenantContextSetting: configuredTenantSetting,
         agentOwnerEventQuota: configuredAgentOwnerEventQuota,
@@ -2107,9 +2350,8 @@ function buildSlotlockStore(sql, options, refusal) {
         ...(maxHeldHoursPerHolder !== undefined ? { maxHeldHoursPerHolder } : {}),
     };
     /**
-     * Under the tenant's lock for `kind`: the limit when the tenant is at it, else null. No limit for
-     * `kind`, or no tenant, takes no lock. Writes that only lower the count take no lock, so a count
-     * read early stays an upper bound for the rest of the transaction.
+     * Under the tenant's lock for `kind`: the limit when the tenant is at it, else null. Writes that
+     * only lower the count take no lock, so an early count stays an upper bound.
      */
     async function tenantLimitReached(tx, tenantRef, kind) {
         const limit = configuredTenantLimits[kind];
@@ -2119,10 +2361,8 @@ function buildSlotlockStore(sql, options, refusal) {
         await lockTenantLimit(tx, tenantRef, kind);
         if ((await tenantLimitCount(tx, tenantRef, kind, limit)) < limit)
             return null;
-        // A hold, and a keyed hold's answer, keep their place only until the hold expires; at the
-        // limit, the expired holds and their answers are deleted, as maintenance would, and the count
-        // is read again. Counting expired rows until then keeps what a tenant stores within the limit
-        // between maintenance passes, however short its holds.
+        // At the limit, expired holds and their answers are deleted, as maintenance would, and the
+        // count is read again.
         if (kind !== 'holds' ||
             (await deleteExpiredHolds(tx, tenantRef, limit)) +
                 (await forgetExpiredHoldAnswers(tx, tenantRef, limit)) ===
@@ -2133,7 +2373,7 @@ function buildSlotlockStore(sql, options, refusal) {
     }
     /**
      * The tenant whose limit a write on the resource counts against: the caller's, else the
-     * resource's (a resource never changes tenant, so it is read before any lock). Null with no limit.
+     * resource's (never changes, so read before any lock). Null with no limit.
      */
     async function limitTenant(tx, kind, resourceId, tenantRef) {
         if (configuredTenantLimits[kind] === undefined)
@@ -2147,12 +2387,9 @@ function buildSlotlockStore(sql, options, refusal) {
     const store = {
         ...slotlockEventFeedMethods(sql, retentionDays),
         async applySchema(migrationOptions) {
-            // PostgreSQL's IF NOT EXISTS DDL is idempotent after commit but not race-free: two fresh
-            // application instances can still collide on pg_namespace/pg_extension unique indexes.
-            // inMigration serializes bootstrap per database and the transaction releases the lock on
-            // crashes. A schema this release already left as it is changes nothing and locks no table,
-            // unless old rows kept one of its constraints NOT VALID (then only the validation runs again)
-            // or the rename of earlier coverage changes is not done (then only a pass of it runs).
+            // IF NOT EXISTS DDL is idempotent but not race-free: two fresh instances can collide on
+            // pg_namespace/pg_extension indexes, so inMigration serializes bootstrap. An unchanged schema
+            // locks no table unless a constraint is still NOT VALID or the coverage rename is unfinished.
             const next = await inMigration(sql, migrationOptions, async (tx) => {
                 await tx.unsafe(SLOTLOCK_DEPLOYMENT_CHECKS).catch((error) => {
                     throw schemaControlRefusal(error);
@@ -2168,18 +2405,15 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
                 return { validate: true, rename: await coverageChangesRenamePending(tx) };
             });
-            // Changes an earlier release wrote are renamed in short batches once the structure commits,
-            // never under its locks, by this migration and the next ones until a pass finds none
-            // (renameEarlierCoverageChanges); the feed serves any not renamed yet redacted (event-feed.ts,
-            // slotlockServedChange).
+            // Renamed in short batches after the structure commits, never under its locks; the feed
+            // redacts any not yet renamed (event-feed.ts, slotlockServedChange).
             if (next.rename)
                 await renameEarlierCoverageChanges(sql, migrationOptions);
             if (!next.validate)
                 return;
-            // Once the DDL has committed, its ACCESS EXCLUSIVE locks are gone: validating holds none that
-            // a serving query waits for (ddl.ts, DEPLOYMENT_VALIDATE_CONSTRAINTS). Inside a caller's
-            // transaction both steps share it, and its locks, until it ends. The digests go last, so a
-            // migration stopped before them runs whole again.
+            // After the DDL commits its ACCESS EXCLUSIVE locks are gone, so validation blocks no serving
+            // query (ddl.ts, DEPLOYMENT_VALIDATE_CONSTRAINTS). Digests go last, so a migration stopped
+            // earlier runs whole again.
             await inMigration(sql, migrationOptions, async (tx) => {
                 await tx.unsafe(SLOTLOCK_VALIDATION_DDL);
                 await tx `
@@ -2348,9 +2582,15 @@ function buildSlotlockStore(sql, options, refusal) {
             if (keyId !== undefined && !isValidResourceId(keyId)) {
                 throw Object.assign(new Error('Slotlock key id must be a UUID'), { code: 'invalid_identity' });
             }
+            const scope = options?.resourceScope;
+            if (scope !== undefined && !isSlotlockResourceScope(scope)) {
+                throw Object.assign(new Error('Slotlock resource scope must name locations or groups by reference'), {
+                    code: 'invalid_identity',
+                });
+            }
             const release = await tenantSlots?.(tenantRef, options?.signal);
-            // A lock wait that timed out leaves the transaction unusable, so the reset below fails with
-            // another error in its place: noted here as it happens.
+            // A lock timeout leaves the transaction unusable, so the reset below would fail with another
+            // error: noted here.
             let timedOut = false;
             return inTransaction(sql, async (tx) => {
                 if (lockTimeout !== undefined) {
@@ -2358,9 +2598,8 @@ function buildSlotlockStore(sql, options, refusal) {
                 }
                 if (isolation !== undefined)
                     await assertReadCommitted(tx);
-                // Held shared until the transaction ends: suspension and erasure, which take it
-                // exclusively, wait for this transaction, and one that starts after them reads them below
-                // (READ COMMITTED: a statement after the lock sees what committed before it was granted).
+                // Held shared until the transaction ends: suspension and erasure take it exclusively, so
+                // they wait for this transaction, and one starting after them sees them (READ COMMITTED).
                 const previous = await tx `
             SELECT current_setting(${configuredTenantSetting}, true) AS value,
                    current_setting('slotlock.actor', true) AS actor,
@@ -2376,12 +2615,29 @@ function buildSlotlockStore(sql, options, refusal) {
                    set_config('slotlock.origin', COALESCE(${origin ?? null}::text,
                      NULLIF(current_setting('slotlock.origin', true), ''), 'library'), true) AS origin,
                    set_config('slotlock.key_id', ${keyId ?? ''}, true) AS key,
+                   current_setting(${SLOTLOCK_RESOURCE_SCOPE_SETTING}, true) AS scope,
                    slotlock.tenant_suspended(${tenantRef}) AS suspended`.catch((error) => {
                     throw suspensionCheckRefusal(error);
                 });
-                // A caller's REPEATABLE READ or SERIALIZABLE snapshot was taken before the lock was
-                // granted, so it may not show a suspension that committed while this transaction waited:
-                // its writes are refused, and it may read.
+                // A limited key's resources, read in the tenant's context (and within an enclosing
+                // scope, if one is set), then held for the rest of the transaction.
+                if (scope !== undefined) {
+                    await tx `
+              SELECT set_config(${SLOTLOCK_RESOURCE_SCOPE_SETTING}, '{' || COALESCE((
+                       SELECT string_agg(held.id::text, ',' ORDER BY held.id)
+                         FROM slotlock.resources held
+                        WHERE held.tenant_ref = ${tenantRef}
+                          AND ((held.location_ref IS NOT NULL
+                                AND slotlock.location_path(held.tenant_ref, held.location_ref)
+                                    && pg_catalog.string_to_array(${scope.locations.join(',')}::text, ','))
+                               OR EXISTS (
+                                 SELECT 1 FROM slotlock.resource_group_members member
+                                  WHERE member.tenant_ref = held.tenant_ref AND member.resource_id = held.id
+                                    AND member.group_ref = ANY (pg_catalog.string_to_array(${scope.groups.join(',')}::text, ','))))
+                     ), '') || '}', true)`;
+                }
+                // A caller's REPEATABLE READ or SERIALIZABLE snapshot predates the lock, so it may miss a
+                // suspension: its writes are refused, reads allowed.
                 const refusal = context?.suspended === true
                     ? tenantSuspendedError
                     : previous[0]?.isolation !== 'read committed'
@@ -2399,7 +2655,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     await tx `SELECT set_config(${configuredTenantSetting}, ${previous[0]?.value ?? ''}, true),
                             set_config('slotlock.actor', ${previous[0]?.actor ?? ''}, true),
                             set_config('slotlock.origin', ${previous[0]?.origin ?? ''}, true),
-                            set_config('slotlock.key_id', ${previous[0]?.key ?? ''}, true)`;
+                            set_config('slotlock.key_id', ${previous[0]?.key ?? ''}, true),
+                            set_config(${SLOTLOCK_RESOURCE_SCOPE_SETTING}, ${context?.scope ?? ''}, true)`;
                 }
             }, 'read committed')
                 .catch((error) => {
@@ -2412,10 +2669,51 @@ function buildSlotlockStore(sql, options, refusal) {
         },
         async createResource(params) {
             assertValidResourceInput(params);
+            if (params.profile !== undefined && params.tenantRef === undefined) {
+                throw Object.assign(new Error('Slotlock gives a profile only to a resource with a tenant'), {
+                    code: 'invalid_resource_profile',
+                });
+            }
+            const { profile: given, maxTenantResources: _limit, location, ...identity } = params;
+            if (location !== undefined) {
+                if (params.tenantRef === undefined) {
+                    throw Object.assign(new Error('Slotlock gives a location only to a resource with a tenant'), {
+                        code: 'invalid_location',
+                        field: 'location',
+                    });
+                }
+                slotlockGroupingRef('invalid_location', location);
+                // Without a time zone of its own, it takes its location's.
+                if (identity.timezone === undefined) {
+                    const zone = await locationTimezone(sql, params.tenantRef, location);
+                    if (zone !== null)
+                        identity.timezone = zone;
+                }
+            }
+            const upsert = {
+                ...identity,
+                ...(given !== undefined ? { profile: parseSlotlockResourceProfile(given) } : {}),
+                ...(location !== undefined ? { location } : {}),
+            };
             const requested = params.maxTenantResources;
-            const configured = params.tenantRef === undefined ? undefined : configuredTenantLimits.resources;
-            if (requested === undefined && configured === undefined)
-                return upsertResource(sql, params);
+            // The lower of the store's own limit and the tenant's plan (plans.ts), when it has one.
+            const planned = params.tenantRef === undefined
+                ? undefined
+                : (await sql `
+                SELECT max_resources FROM slotlock.tenant_plan(${params.tenantRef}::text)`.catch((error) => {
+                    throw slotlockPlanReadRefusal(error);
+                }))[0]?.max_resources;
+            const storeLimit = params.tenantRef === undefined ? undefined : configuredTenantLimits.resources;
+            const configured = planned === undefined
+                ? storeLimit
+                : storeLimit === undefined
+                    ? planned
+                    : Math.min(planned, storeLimit);
+            if (requested === undefined && configured === undefined) {
+                if (location === undefined)
+                    return upsertResource(sql, upsert);
+                return guardedWrite(sql, (tx) => upsertResource(tx, upsert), RESOURCE_LOCATION_MISSING);
+            }
             if (requested !== undefined &&
                 (!Number.isSafeInteger(requested) ||
                     requested < 1 ||
@@ -2436,7 +2734,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 // An object, so the key never equals a [tenantRef, externalRef] identity lock's.
                 await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify({ resourceCount: tenantRef })}, 0))`;
                 // READ COMMITTED: each statement below sees every create committed before the lock.
-                // Re-creating a resource the tenant has (by its reference) adds none.
+                // Re-creating a known reference adds none.
                 const known = externalRef === null
                     ? []
                     : await tx `
@@ -2449,7 +2747,9 @@ function buildSlotlockStore(sql, options, refusal) {
                         throw Object.assign(new Error(`Slotlock tenant already has ${max} resources, the most allowed here`), { code: 'resource_limit_reached', limit: max });
                     }
                 }
-                return upsertResource(tx, params);
+                if (location === undefined)
+                    return upsertResource(tx, upsert);
+                return guardedWrite(tx, (inner) => upsertResource(inner, upsert), RESOURCE_LOCATION_MISSING);
             }, 'read committed');
         },
         async getResource(params) {
@@ -2460,13 +2760,193 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
+        SELECT ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
+        async updateResourceProfile(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw Object.assign(new Error('Slotlock resource identity is invalid'), {
+                    code: 'invalid_identity',
+                });
+            }
+            const profile = profileParameters(parseSlotlockResourceProfile(params.profile));
+            const location = params.location === undefined || params.location === null
+                ? null
+                : slotlockGroupingRef('invalid_location', params.location);
+            const rows = await guardedWrite(sql, (tx) => tx `
+        UPDATE slotlock.resources
+           SET name = CASE WHEN ${profile.setName}::boolean THEN ${profile.name}::text ELSE name END,
+               description = CASE WHEN ${profile.setDescription}::boolean
+                                  THEN ${profile.description}::text ELSE description END,
+               kind = CASE WHEN ${profile.setKind}::boolean THEN ${profile.kind}::text ELSE kind END,
+               capacity = CASE WHEN ${profile.setCapacity}::boolean
+                               THEN ${profile.capacity}::integer ELSE capacity END,
+               labels = CASE WHEN ${profile.setLabels}::boolean
+                             THEN pg_catalog.string_to_array(${profile.labels}::text, ',') ELSE labels END,
+               attributes = CASE WHEN ${profile.setAttributes}::boolean
+                                 THEN ${profile.attributes}::text::jsonb ELSE attributes END,
+               location_ref = CASE WHEN ${params.location !== undefined}::boolean
+                                   THEN ${location}::text ELSE location_ref END
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING ${tx.unsafe(RESOURCE_COLUMNS)}, ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}`, RESOURCE_LOCATION_MISSING);
+            const row = rows[0];
+            return row ? toResource(row) : null;
+        },
+        async listLocations(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const rows = await sql `
+        WITH RECURSIVE tree(ref, name, parent_ref, timezone, path) AS (
+          SELECT place.ref, place.name, place.parent_ref, place.timezone, ARRAY[place.ref]
+            FROM slotlock.locations place
+           WHERE place.tenant_ref = ${params.tenantRef} AND place.parent_ref IS NULL
+          UNION ALL
+          SELECT place.ref, place.name, place.parent_ref, place.timezone, tree.path || place.ref
+            FROM slotlock.locations place
+            JOIN tree ON place.tenant_ref = ${params.tenantRef} AND place.parent_ref = tree.ref
+           WHERE cardinality(tree.path) <= ${SLOTLOCK_MAX_LOCATION_DEPTH}
+        )
+        SELECT tree.ref, tree.name, tree.parent_ref, tree.timezone,
+               (SELECT count(*) FROM slotlock.resources held
+                 WHERE held.tenant_ref = ${params.tenantRef} AND held.location_ref = tree.ref)::int AS resources
+          FROM tree
+         ORDER BY tree.path
+         LIMIT ${SLOTLOCK_MAX_LOCATIONS}`;
+            return rows.map(toLocation);
+        },
+        async putLocation(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const location = parseSlotlockLocation(params);
+            const [row] = await guardedWrite(sql, (tx) => tx `
+        INSERT INTO slotlock.locations AS kept (tenant_ref, ref, name, parent_ref, timezone)
+        VALUES (${params.tenantRef}, ${location.ref}, ${location.name ?? ''}, ${location.parentRef ?? null},
+                ${location.timezone ?? null})
+        ON CONFLICT (tenant_ref, ref) DO UPDATE
+        SET name = EXCLUDED.name,
+            parent_ref = CASE WHEN ${location.parentRef !== undefined}::boolean
+                              THEN EXCLUDED.parent_ref ELSE kept.parent_ref END,
+            timezone = CASE WHEN ${location.timezone !== undefined}::boolean
+                            THEN EXCLUDED.timezone ELSE kept.timezone END
+        RETURNING kept.ref, kept.name, kept.parent_ref, kept.timezone,
+                  (SELECT count(*) FROM slotlock.resources held
+                    WHERE held.tenant_ref = kept.tenant_ref AND held.location_ref = kept.ref)::int AS resources`, { slotlock_locations_parent_fkey: 'location_not_found' });
+            return toLocation(row);
+        },
+        async updateLocation(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const location = parseSlotlockLocation(params);
+            const [row] = await guardedWrite(sql, (tx) => tx `
+        UPDATE slotlock.locations AS kept
+           SET name = COALESCE(${location.name ?? null}::text, kept.name),
+               parent_ref = CASE WHEN ${location.parentRef !== undefined}::boolean
+                                 THEN ${location.parentRef ?? null}::text ELSE kept.parent_ref END,
+               timezone = CASE WHEN ${location.timezone !== undefined}::boolean
+                               THEN ${location.timezone ?? null}::text ELSE kept.timezone END
+         WHERE kept.tenant_ref = ${params.tenantRef} AND kept.ref = ${location.ref}
+        RETURNING kept.ref, kept.name, kept.parent_ref, kept.timezone,
+                  (SELECT count(*) FROM slotlock.resources held
+                    WHERE held.tenant_ref = kept.tenant_ref AND held.location_ref = kept.ref)::int AS resources`, { slotlock_locations_parent_fkey: 'location_not_found' });
+            return row ? toLocation(row) : null;
+        },
+        async deleteLocation(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const ref = slotlockGroupingRef('invalid_location', params.ref);
+            const rows = await guardedWrite(sql, (tx) => tx `
+          DELETE FROM slotlock.locations
+           WHERE tenant_ref = ${params.tenantRef} AND ref = ${ref}
+          RETURNING ref`, {
+                slotlock_locations_parent_fkey: 'location_in_use',
+                slotlock_resources_location_fkey: 'location_in_use',
+            });
+            return rows.length > 0;
+        },
+        async listGroups(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const rows = await sql `
+        SELECT kept.ref, kept.name, kept.description,
+               (SELECT count(*) FROM slotlock.resource_group_members member
+                 WHERE member.tenant_ref = kept.tenant_ref AND member.group_ref = kept.ref)::int AS members
+          FROM slotlock.resource_groups kept
+         WHERE kept.tenant_ref = ${params.tenantRef}
+         ORDER BY kept.ref
+         LIMIT ${SLOTLOCK_MAX_RESOURCE_GROUPS}`;
+            return rows.map(toGroup);
+        },
+        async putGroup(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const group = parseSlotlockResourceGroup(params);
+            const [row] = await guardedWrite(sql, (tx) => tx `
+        INSERT INTO slotlock.resource_groups AS kept (tenant_ref, ref, name, description)
+        VALUES (${params.tenantRef}, ${group.ref}, ${group.name}, ${group.description})
+        ON CONFLICT (tenant_ref, ref) DO UPDATE
+        SET name = EXCLUDED.name,
+            description = CASE WHEN ${params.description !== undefined}::boolean
+                               THEN EXCLUDED.description ELSE kept.description END
+        RETURNING kept.ref, kept.name, kept.description,
+                  (SELECT count(*) FROM slotlock.resource_group_members member
+                    WHERE member.tenant_ref = kept.tenant_ref AND member.group_ref = kept.ref)::int AS members`);
+            return toGroup(row);
+        },
+        async deleteGroup(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const ref = slotlockGroupingRef('invalid_group', params.ref);
+            const rows = await sql `
+        DELETE FROM slotlock.resource_groups
+         WHERE tenant_ref = ${params.tenantRef} AND ref = ${ref}
+        RETURNING ref`;
+            return rows.length > 0;
+        },
+        async addGroupMember(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const group = slotlockGroupingRef('invalid_group', params.group);
+            if (!isValidResourceId(params.resourceId)) {
+                throw Object.assign(new Error('Slotlock resource not found in this tenant'), {
+                    code: 'resource_not_found',
+                });
+            }
+            const rows = await guardedWrite(sql, (tx) => tx `
+          INSERT INTO slotlock.resource_group_members (tenant_ref, group_ref, resource_id)
+          VALUES (${params.tenantRef}, ${group}, ${params.resourceId}::uuid)
+          ON CONFLICT DO NOTHING
+          RETURNING true AS added`, {
+                slotlock_resource_group_members_group_fkey: 'group_not_found',
+                slotlock_resource_group_members_resource_fkey: 'resource_not_found',
+            });
+            return rows.length > 0;
+        },
+        async removeGroupMember(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const group = slotlockGroupingRef('invalid_group', params.group);
+            if (!isValidResourceId(params.resourceId))
+                return false;
+            const rows = await sql `
+        DELETE FROM slotlock.resource_group_members
+         WHERE tenant_ref = ${params.tenantRef} AND group_ref = ${group}
+           AND resource_id = ${params.resourceId}::uuid
+        RETURNING group_ref`;
+            return rows.length > 0;
+        },
         async setResourceAvailability(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
                 throw Object.assign(new Error('Slotlock resource identity is invalid'), {
@@ -2478,7 +2958,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET availability_rules = ${rules}::jsonb
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2509,8 +2989,7 @@ function buildSlotlockStore(sql, options, refusal) {
                  ELSE statement_timestamp()
                END
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-                  visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2539,8 +3018,8 @@ function buildSlotlockStore(sql, options, refusal) {
             const tenantRef = params.tenantRef;
             return inTransaction(sql, async (tx) => {
                 if (pool !== '') {
-                    // Counted under the tenant's lock, so racing writes stop at the cap.
-                    // The count after the lock sees every committed row only under READ COMMITTED.
+                    // Counted under the tenant's lock, which only READ COMMITTED makes see every committed
+                    // row.
                     await assertReadCommitted(tx);
                     await tx `SELECT pg_advisory_xact_lock(hashtextextended(${`slotlock:rule-defaults:${tenantRef}`}, 0))`;
                     const [counted] = await tx `
@@ -2589,8 +3068,25 @@ function buildSlotlockStore(sql, options, refusal) {
             const rows = await sql `
         UPDATE slotlock.resources SET pool_ref = ${params.pool}
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-                  visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+            const row = rows[0];
+            return row ? toResource(row) : null;
+        },
+        async setResourceParent(params) {
+            if (!isValidIdentity(params.tenantRef) ||
+                !isValidResourceId(params.id) ||
+                (params.parentId !== null && !isValidResourceId(params.parentId))) {
+                throw Object.assign(new Error('Slotlock resource identity is invalid'), {
+                    code: 'invalid_identity',
+                });
+            }
+            if (params.parentId === params.id) {
+                throw Object.assign(new Error('Slotlock resource cannot be a part of itself'), { code: 'composite_too_deep' });
+            }
+            const rows = await guardedWrite(sql, (tx) => tx `
+          UPDATE slotlock.resources SET parent_id = ${params.parentId}::uuid
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+          RETURNING ${tx.unsafe(RESOURCE_COLUMNS)}, ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}`, { slotlock_resources_parent_fkey: 'parent_not_found' });
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2600,28 +3096,94 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!isPoolName(params.pool))
                 throw invalidPoolError();
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-               visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
+        SELECT ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
            AND archived_at IS NULL
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
          ORDER BY id
          LIMIT ${SLOTLOCK_MAX_POOL_MEMBERS}`;
-            return rows.map(toResource);
+            const members = rows.map(toResource);
+            if (params.ordered !== true || members.length < 2)
+                return members;
+            let [settings] = await sql `
+        SELECT member_order, last_member::text FROM slotlock.pool_settings
+         WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}`;
+            if (settings?.member_order === 'round_robin' && params.forBooking === true) {
+                // Read again under the row's lock, held until the booking commits with the place it noted.
+                [settings] = await sql `
+          SELECT member_order, last_member::text FROM slotlock.pool_settings
+           WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
+           FOR UPDATE`;
+            }
+            if (settings?.member_order === 'round_robin') {
+                // From the first member after the one booked last, by id, round to the start.
+                const after = settings.last_member;
+                const next = after === null ? 0 : members.findIndex((member) => member.id > after);
+                const start = next < 0 ? 0 : next;
+                return [...members.slice(start), ...members.slice(0, start)];
+            }
+            if (settings?.member_order === 'least_booked') {
+                // Bookings made on each in the last 30 days, holds and cancelled ones not counted.
+                const counts = await sql `
+          SELECT booked.resource_id::text, count(*)::int AS booked
+            FROM slotlock.reservations booked
+           WHERE booked.tenant_ref = ${params.tenantRef}
+             AND booked.resource_id = ANY (${members.map((member) => member.id)}::uuid[])
+             AND booked.status = 'confirmed'
+             AND booked.created_at > statement_timestamp() - interval '30 days'
+           GROUP BY booked.resource_id`;
+                const booked = new Map(counts.map((row) => [row.resource_id, Number(row.booked)]));
+                // Stable among equals: by id, as the database orders them.
+                return [...members].sort((a, b) => (booked.get(a.id) ?? 0) - (booked.get(b.id) ?? 0) || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+            }
+            return members;
         },
         async listPools(params) {
             if (!isValidIdentity(params.tenantRef))
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             const rows = await sql `
-        SELECT pool_ref AS pool, count(*)::int AS capacity
+        SELECT pool_ref AS pool, count(*)::int AS capacity,
+               COALESCE((SELECT settings.member_order FROM slotlock.pool_settings settings
+                          WHERE settings.tenant_ref = ${params.tenantRef}
+                            AND settings.pool_ref = resources.pool_ref), 'stable') AS member_order
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND pool_ref IS NOT NULL AND archived_at IS NULL
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
          GROUP BY pool_ref
          ORDER BY pool_ref
          LIMIT 1000`;
-            return rows;
+            return rows.map((row) => ({ pool: row.pool, capacity: row.capacity, order: row.member_order }));
+        },
+        async setPoolOrder(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            if (!isPoolName(params.pool))
+                throw invalidPoolError();
+            if (!SLOTLOCK_POOL_ORDERS.includes(params.order)) {
+                throw Object.assign(new Error(`Slotlock pool order must be one of ${SLOTLOCK_POOL_ORDERS.join(', ')}`), {
+                    code: 'invalid_pool_order',
+                });
+            }
+            // At most SLOTLOCK_MAX_POOL_SETTINGS pools a tenant (pool_settings_guard).
+            await guardedWrite(sql, (tx) => tx `
+        INSERT INTO slotlock.pool_settings (tenant_ref, pool_ref, member_order)
+        VALUES (${params.tenantRef}, ${params.pool}, ${params.order})
+        ON CONFLICT (tenant_ref, pool_ref)
+        DO UPDATE SET member_order = EXCLUDED.member_order, updated_at = statement_timestamp()`);
+            return params.order;
+        },
+        async notePoolBooking(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            if (!isPoolName(params.pool) || !isValidResourceId(params.resourceId))
+                return;
+            // Only a pool that goes round keeps its place; another has nothing to note.
+            await sql `
+        UPDATE slotlock.pool_settings
+           SET last_member = ${params.resourceId}::uuid, updated_at = statement_timestamp()
+         WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
+           AND member_order = 'round_robin'`;
         },
         async setTenantAvailability(params) {
             if (!isValidIdentity(params.tenantRef)) {
@@ -2653,28 +3215,87 @@ function buildSlotlockStore(sql, options, refusal) {
                     code: 'invalid_cursor',
                 });
             }
+            // The filters are checked as a profile is, so a bad one is refused rather than matching none.
+            const place = params.location === undefined ? null : slotlockGroupingRef('invalid_location', params.location);
+            const group = params.group === undefined ? null : slotlockGroupingRef('invalid_group', params.group);
+            if (params.pool !== undefined && !isPoolName(params.pool))
+                throw invalidPoolError();
+            const pool = params.pool ?? null;
+            const filter = parseSlotlockResourceProfile({
+                ...(params.kind !== undefined ? { kind: params.kind } : {}),
+                ...(params.labels !== undefined ? { labels: params.labels } : {}),
+            });
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
+        SELECT ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
            AND (${params.includeArchived === true} OR archived_at IS NULL)
            AND (${params.after ?? null}::uuid IS NULL OR id > ${params.after ?? null}::uuid)
+           AND (${filter.kind ?? null}::text IS NULL OR kind = ${filter.kind ?? null}::text)
+           AND (${filter.labels === undefined || filter.labels.length === 0 ? null : filter.labels.join(',')}::text IS NULL
+                OR labels @> pg_catalog.string_to_array(${filter.labels?.join(',') ?? ''}::text, ','))
+           AND (${place}::text IS NULL OR location_ref IN (
+                 WITH RECURSIVE below(ref, steps) AS (
+                   SELECT place.ref, 1 FROM slotlock.locations place
+                    WHERE place.tenant_ref = ${params.tenantRef} AND place.ref = ${place}::text
+                   UNION ALL
+                   SELECT place.ref, below.steps + 1
+                     FROM slotlock.locations place
+                     JOIN below ON place.tenant_ref = ${params.tenantRef} AND place.parent_ref = below.ref
+                    WHERE below.steps <= ${SLOTLOCK_MAX_LOCATION_DEPTH}
+                 )
+                 SELECT ref FROM below))
+           AND (${group}::text IS NULL OR EXISTS (
+                 SELECT 1 FROM slotlock.resource_group_members member
+                  WHERE member.tenant_ref = resources.tenant_ref AND member.resource_id = resources.id
+                    AND member.group_ref = ${group}::text))
+           AND (${pool}::text IS NULL OR pool_ref = ${pool}::text)
          ORDER BY id
          LIMIT ${limit}`;
             return rows.map(toResource);
         },
+        async readUsage(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return readSlotlockTenantUsage(sql, params.tenantRef, params.from, params.to);
+        },
+        async rollUpUsage(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 5_000;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100_000) {
+                throw Object.assign(new Error('Slotlock usage roll-up limit must be 1-100,000'), {
+                    code: 'invalid_limit',
+                });
+            }
+            const [result] = await sql `
+        SELECT slotlock.roll_up_usage(${params.tenantRef}::text, ${limit}::integer) AS read`;
+            return result?.read ?? 0;
+        },
+        async countResources(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
+                    code: 'invalid_identity',
+                });
+            }
+            const [counted] = await sql `
+        SELECT count(*) AS count FROM slotlock.resources WHERE tenant_ref = ${params.tenantRef}`;
+            return Number(counted?.count ?? 0);
+        },
         async archiveResource(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
                 throw invalidIdentityError('Slotlock resource identity is invalid');
             }
-            // Its clock time, not the transaction's start: a booking that committed holding the row's
-            // share lock went in before this.
+            // Clock time, not transaction start: a booking that committed holding the row's share lock
+            // went in before this.
             const [row] = await sql `
         UPDATE slotlock.resources
            SET archived_at = COALESCE(archived_at, clock_timestamp())
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             return row ? toResource(row) : null;
         },
         async restoreResource(params) {
@@ -2685,7 +3306,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET archived_at = NULL
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             return row ? toResource(row) : null;
         },
         async deleteResource(params) {
@@ -2715,8 +3336,8 @@ function buildSlotlockStore(sql, options, refusal) {
                  ) AS live`;
                 if (live?.live)
                     return { ok: false, code: 'resource_in_use' };
-                // Its rows go with it: reservations, events and their children, coverage and hold answers
-                // all cascade from the resource.
+                // Reservations, events and their children, coverage and hold answers all cascade from the
+                // resource.
                 await tx `DELETE FROM slotlock.resources WHERE id = ${params.id}`;
                 return { ok: true, deleted: true };
             });
@@ -2730,22 +3351,16 @@ function buildSlotlockStore(sql, options, refusal) {
             if (params.tenantRef !== undefined && !isValidIdentity(params.tenantRef)) {
                 return { ok: false, code: 'resource_not_found' };
             }
-            // A booking on a tenant's resource takes the tenant and its own id as reference, so it can be
-            // cancelled and moved like any other; one on a resource with no tenant stays tenantless.
+            // A booking on a tenant's resource takes the tenant and its own id as reference; one on a
+            // tenantless resource stays tenantless.
             const id = randomUUID();
-            // The buffers written, for the overlap answer if the write loses.
             let bufferBeforeMs = 0;
             let bufferAfterMs = 0;
             for (let attempt = 1;; attempt++) {
                 try {
                     return await inTransaction(sql, async (tx) => {
                         const bookingLimit = await tenantLimitReached(tx, await limitTenant(tx, 'reservations', params.resourceId, params.tenantRef), 'reservations');
-                        const [resource] = await tx `
-              SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
-               WHERE id = ${params.resourceId}
-                 AND (${params.tenantRef ?? null}::text IS NULL
-                      OR tenant_ref = ${params.tenantRef ?? null})
-               FOR SHARE`;
+                        const resource = await readResourceForWrite(tx, params.resourceId, params.tenantRef ?? null);
                         if (!resource)
                             return { ok: false, code: 'resource_not_found' };
                         if (resource.archived)
@@ -2767,6 +3382,12 @@ function buildSlotlockStore(sql, options, refusal) {
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
+                        // Writers to this resource take turns from here to the insert (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, params.tenantRef ?? null);
+                        if (!locked)
+                            return { ok: false, code: 'resource_not_found' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
@@ -2788,15 +3409,15 @@ function buildSlotlockStore(sql, options, refusal) {
                 catch (err) {
                     const code = pgCode(err);
                     if ((code === DEADLOCK_DETECTED || code === SERIALIZATION_FAILURE) && attempt === 1) {
-                        continue; // fully rolled back — one retry wins cleanly or loses with a clean 23P01
+                        continue; // fully rolled back: one retry wins or loses with a clean 23P01
                     }
                     if (code !== EXCLUSION_VIOLATION &&
                         code !== DEADLOCK_DETECTED &&
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    // A SECOND contention abort is treated as a loss too (structured, possibly with a null
-                    // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
+                    // A second contention abort is a structured loss too (possibly with a null winner), never
+                    // a raw throw.
                     const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
                     await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
                     return overlapLoss(sql, params.resourceId, params.start, params.end, bufferAfterMs, undefined, undefined, bufferBeforeMs);
@@ -2821,8 +3442,8 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (cancelled[0])
                             return { ok: false, code: 'reservation_cancelled' };
                         // A calendar event's occupation carries a reference in this namespace too, but it is
-                        // not a booking: create, reschedule and cancel never read, replay, move or free it,
-                        // and answer as for a reference no booking holds. Bookings have their own unique index.
+                        // not a booking: create, reschedule and cancel treat it as a reference no booking
+                        // holds.
                         const existing = await tx `
               SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                      buffer_after_ms, revision, source
@@ -2833,7 +3454,7 @@ function buildSlotlockStore(sql, options, refusal) {
                         const found = existing[0];
                         const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
                         if (found) {
-                            // The booking has moved on since: a delayed create is stale, as a delayed move is.
+                            // Moved on since: a delayed create is stale, as a delayed move is.
                             if (params.revision < Number(found.revision)) {
                                 return { ok: false, code: 'stale_revision' };
                             }
@@ -2864,6 +3485,12 @@ function buildSlotlockStore(sql, options, refusal) {
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
+                        // Writers to this resource take turns from here to the insert (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, params.tenantRef);
+                        if (!locked)
+                            return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               INSERT INTO slotlock.reservations (
@@ -2956,6 +3583,12 @@ function buildSlotlockStore(sql, options, refusal) {
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
+                        // Writers to this resource take turns from here to the insert (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, params.tenantRef);
+                        if (!locked)
+                            return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               UPDATE slotlock.reservations
@@ -3034,8 +3667,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     }
                 }
                 if (!found) {
-                    // A calendar event's occupation row carries this reference: it is the event's, not a
-                    // booking's. Nothing is cancelled, and nothing retired: a tombstone would only grow.
+                    // This reference is a calendar event's occupation, not a booking: nothing to cancel or
+                    // retire.
                     const [occupation] = await tx `
             SELECT id FROM slotlock.reservations
              WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
@@ -3049,7 +3682,7 @@ function buildSlotlockStore(sql, options, refusal) {
                         return { ok: false, code: 'reservation_limit_reached', limit };
                 }
                 // A reference no booking holds yet is retired too, so a create delivered after its cancel
-                // cannot bring the booking back. Only such a stray retirement is pruned past retention.
+                // cannot bring it back.
                 await tx `
           INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray)
           VALUES (${params.tenantRef}, ${params.externalRef}, ${params.revision}, ${!found})`;
@@ -3064,9 +3697,8 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!isFiniteWindow({ start: params.start, end: params.end })) {
                 return { ok: false, code: 'invalid_window' };
             }
-            // Finiteness + cap: NaN/Infinity would raise raw 22008 in make_interval, and an absurd
-            // ttl mints an effectively-eternal hold whose expiry can even exceed the JS Date range
-            // (Invalid Date back to the caller). All refused pre-table.
+            // NaN/Infinity would raise a raw 22008 in make_interval, and a huge ttl could exceed the JS
+            // Date range.
             if (!Number.isFinite(params.ttlMs) || params.ttlMs <= 0 || params.ttlMs > MAX_HOLD_TTL_MS) {
                 return { ok: false, code: 'invalid_ttl' };
             }
@@ -3106,8 +3738,17 @@ function buildSlotlockStore(sql, options, refusal) {
                 ...(holderRef !== undefined ? { holderRef } : {}),
             });
             const ttlSeconds = params.ttlMs / 1000;
-            // The buffers written: the one asked for, raised to the resource's turnaround, and its rule's
-            // leading buffer.
+            // The holder's caps: the store's, lowered by its key's own (RFC 0004 A5), never raised.
+            const asked = params.holderCaps;
+            const holdCap = Math.min(maxHoldsPerHolder, asked?.maxHolds ?? Number.POSITIVE_INFINITY);
+            const heldHoursCap = asked?.maxHeldHours !== undefined
+                ? Math.min(maxHeldHoursPerHolder ?? Number.POSITIVE_INFINITY, asked.maxHeldHours)
+                : maxHeldHoursPerHolder;
+            if ((asked?.maxHolds !== undefined && !(Number.isSafeInteger(asked.maxHolds) && asked.maxHolds >= 1)) ||
+                (asked?.maxHeldHours !== undefined && !(Number.isSafeInteger(asked.maxHeldHours) && asked.maxHeldHours >= 1))) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            // The buffer asked for, raised to the resource's turnaround, and its rule's leading buffer.
             let written = bufferAfterMs;
             let writtenBefore = 0;
             for (let attempt = 1;; attempt++) {
@@ -3134,22 +3775,17 @@ function buildSlotlockStore(sql, options, refusal) {
                             }
                         }
                         const holdLimit = await tenantLimitReached(tx, await limitTenant(tx, 'holds', params.resourceId, tenantRef), 'holds');
-                        const [resource] = await tx `
-              SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
-               WHERE id = ${params.resourceId}
-                 AND (${tenantRef ?? null}::text IS NULL OR tenant_ref = ${tenantRef ?? null})
-               FOR SHARE`;
+                        const resource = await readResourceForWrite(tx, params.resourceId, tenantRef ?? null);
                         if (!resource)
                             return { ok: false, code: 'resource_not_found' };
                         if (resource.archived)
                             return { ok: false, code: 'resource_archived' };
                         if (holdLimit !== null)
                             return { ok: false, code: 'hold_limit_reached', limit: holdLimit };
-                        // Seconds the holder already holds, turnaround included, when its time is capped.
                         let heldSeconds = null;
                         if (holderRef !== undefined) {
-                            // One holder's live holds, counted under a lock on the holder so racing holds stop
-                            // at the cap: an agent cannot hold a resource's whole week.
+                            // Counted under a lock on the holder, so racing holds stop at the cap: an agent
+                            // cannot hold a resource's whole week.
                             await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([
                                 'slotlock-holder',
                                 tenantRef,
@@ -3165,10 +3801,10 @@ function buildSlotlockStore(sql, options, refusal) {
                  WHERE holder_ref = ${holderRef} AND tenant_ref IS NULL AND status = 'held'
                    AND expires_at > statement_timestamp()
                    AND resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef ?? null})`;
-                            if ((held?.count ?? 0) >= maxHoldsPerHolder) {
-                                return { ok: false, code: 'hold_limit_reached', limit: maxHoldsPerHolder };
+                            if ((held?.count ?? 0) >= holdCap) {
+                                return { ok: false, code: 'hold_limit_reached', limit: holdCap };
                             }
-                            if (maxHeldHoursPerHolder !== undefined)
+                            if (heldHoursCap !== undefined)
                                 heldSeconds = held?.seconds ?? 0;
                         }
                         const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
@@ -3178,10 +3814,10 @@ function buildSlotlockStore(sql, options, refusal) {
                         writtenBefore = ruling.bufferBeforeMs;
                         const reach = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs: written });
                         if (heldSeconds !== null &&
-                            maxHeldHoursPerHolder !== undefined &&
+                            heldHoursCap !== undefined &&
                             heldSeconds + (reach.end.getTime() - reach.start.getTime()) / 1000 >
-                                maxHeldHoursPerHolder * 3_600) {
-                            return { ok: false, code: 'held_time_limit_reached', limit: maxHeldHoursPerHolder };
+                                heldHoursCap * 3_600) {
+                            return { ok: false, code: 'held_time_limit_reached', limit: heldHoursCap };
                         }
                         if (resource.tenant_ref !== null &&
                             !(await recurrenceCoversWrite(tx, {
@@ -3191,6 +3827,12 @@ function buildSlotlockStore(sql, options, refusal) {
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
+                        // Writers to this resource take turns from here to the insert (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, tenantRef ?? null);
+                        if (!locked)
+                            return { ok: false, code: 'resource_not_found' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await reapExpiredHolds(tx, params.resourceId, reach.start, reach.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
@@ -3229,8 +3871,8 @@ function buildSlotlockStore(sql, options, refusal) {
                         code !== SERIALIZATION_FAILURE) {
                         throw err;
                     }
-                    // A SECOND contention abort is treated as a loss too (structured, possibly with a null
-                    // winner if both rivals rolled back) — symmetric with 40P01, never a raw throw.
+                    // A second contention abort is a structured loss too (possibly with a null winner), never
+                    // a raw throw.
                     const occupied = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs: written });
                     await rollSeriesBehind(sql, params.resourceId, occupied.start, occupied.end);
                     return overlapLoss(sql, params.resourceId, params.start, params.end, written, undefined, undefined, writtenBefore);
@@ -3252,6 +3894,21 @@ function buildSlotlockStore(sql, options, refusal) {
            AND hold.status = 'held' AND hold.expires_at > statement_timestamp()`;
             return row ? toHold(row) : null;
         },
+        async getHolderHold(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.holderRef)) {
+                throw invalidIdentityError('Slotlock tenant and holder must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.holdId))
+                return null;
+            const [row] = await sql `
+        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+               hold.expires_at, hold.source, hold.expires_at > statement_timestamp() AS live
+          FROM slotlock.reservations hold
+          JOIN slotlock.resources resource ON resource.id = hold.resource_id
+         WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
+           AND hold.status = 'held' AND hold.holder_ref = ${params.holderRef}`;
+            return row ? { hold: toHold(row), live: row.live } : null;
+        },
         async listHolds(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
@@ -3306,6 +3963,276 @@ function buildSlotlockStore(sql, options, refusal) {
                 source: row.source,
             }));
         },
+        async describeBooking(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.id))
+                return null;
+            const [row] = await sql `
+        SELECT booking.resource_id, booking.status, booking.holder_ref,
+               COALESCE(booking.occupied_starts_at, booking.starts_at) AS occupied_start,
+               COALESCE(booking.occupied_ends_at, booking.ends_at) AS occupied_end,
+               event.id AS event_id, event.external_ref AS event_ref, event.owner_ref AS event_owner_ref
+          FROM slotlock.reservations booking
+          JOIN slotlock.resources resource ON resource.id = booking.resource_id
+          LEFT JOIN slotlock.calendar_events event
+            ON event.id = booking.calendar_event_id AND event.tenant_ref = ${params.tenantRef}
+         WHERE booking.id = ${params.id} AND resource.tenant_ref = ${params.tenantRef}`;
+            if (!row)
+                return null;
+            return {
+                id: params.id,
+                resourceId: row.resource_id,
+                status: row.status,
+                holderRef: row.holder_ref,
+                eventId: row.event_id,
+                eventRef: row.event_ref,
+                eventOwnerRef: row.event_owner_ref,
+                start: row.occupied_start,
+                end: row.occupied_end,
+            };
+        },
+        async eventOccupancy(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.ownerRef)) {
+                throw invalidIdentityError('Slotlock tenant and owner must be 1-500 UTF-8 bytes');
+            }
+            const refs = params.externalRefs.filter((ref) => isValidIdentity(ref));
+            if (refs.length === 0)
+                return [];
+            const rows = await sql `
+        SELECT booking.resource_id,
+               COALESCE(booking.occupied_starts_at, booking.starts_at) AS start,
+               COALESCE(booking.occupied_ends_at, booking.ends_at) AS "end",
+               event.recurrence_rule IS NOT NULL AS recurring
+          FROM slotlock.calendar_events event
+          JOIN slotlock.reservations booking ON booking.calendar_event_id = event.id
+         WHERE event.tenant_ref = ${params.tenantRef} AND event.owner_ref = ${params.ownerRef}
+           AND event.external_ref = ANY (${refs}::text[])
+         ORDER BY booking.resource_id, 2, booking.id`;
+            return rows.map((row) => ({ resourceId: row.resource_id, start: row.start, end: row.end, recurring: row.recurring }));
+        },
+        async putApprovalPolicy(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return putApprovalPolicy(sql, params);
+        },
+        async listApprovalPolicies(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return listApprovalPolicies(sql, params.tenantRef);
+        },
+        async deleteApprovalPolicy(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return { deleted: await deleteApprovalPolicy(sql, params.tenantRef, params.ref) };
+        },
+        async approvalPoliciesFor(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return approvalPoliciesFor(sql, params.tenantRef, params.resourceIds);
+        },
+        async requestApproval(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.requesterRef)) {
+                throw invalidIdentityError('Slotlock tenant and requester must be 1-500 UTF-8 bytes');
+            }
+            if (!/^[0-9a-f]{64}$/.test(params.requestKey)) {
+                throw invalidIdentityError('Slotlock approval request key must be 64 hex characters');
+            }
+            if (params.holds.length < 1 ||
+                params.holds.length > SLOTLOCK_MAX_APPROVAL_HOLDS ||
+                params.holds.some((hold) => !isValidResourceId(hold.resourceId) || !(hold.end > hold.start))) {
+                throw invalidIdentityError(`Slotlock approval holds must be 1-${SLOTLOCK_MAX_APPROVAL_HOLDS} intervals on resources`);
+            }
+            const { tenantRef } = params;
+            try {
+                return await inTransaction(sql, async (tx) => {
+                    // Retries of one request wait for each other, so the second answers the first's approval.
+                    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([
+                        'slotlock-approval',
+                        tenantRef,
+                        params.requestKey,
+                    ])}, 0))`;
+                    const prior = await approvalByRequestKey(tx, tenantRef, params.requestKey);
+                    if (prior) {
+                        const [same] = await tx `
+              SELECT request = ${tx.json(params.request)}::jsonb AS same
+                FROM slotlock.approvals WHERE id = ${prior.id}`;
+                        return same?.same
+                            ? { ok: true, approval: prior, replayed: true }
+                            : { ok: false, code: 'idempotency_conflict' };
+                    }
+                    // Counted under a lock on the tenant's approvals, so racing requests stop at the caps.
+                    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-approvals', tenantRef])}, 0))`;
+                    const [pending] = await tx `
+            SELECT count(*)::int AS tenant,
+                   (count(*) FILTER (WHERE requester ->> 'subject' = ${params.requesterRef}))::int AS requester
+              FROM slotlock.approvals
+             WHERE tenant_ref = ${tenantRef} AND status = 'pending' AND expires_at > statement_timestamp()`;
+                    if ((pending?.requester ?? 0) >= SLOTLOCK_MAX_PENDING_APPROVALS_PER_REQUESTER) {
+                        return { ok: false, code: 'approval_limit_reached', limit: SLOTLOCK_MAX_PENDING_APPROVALS_PER_REQUESTER };
+                    }
+                    if ((pending?.tenant ?? 0) >= SLOTLOCK_MAX_PENDING_APPROVALS) {
+                        return { ok: false, code: 'approval_limit_reached', limit: SLOTLOCK_MAX_PENDING_APPROVALS };
+                    }
+                    const id = randomUUID();
+                    // The requester's own hold of the time gives way to the approval's.
+                    if (params.consumeHold && isValidResourceId(params.consumeHold.holdId)) {
+                        await tx `
+              DELETE FROM slotlock.reservations
+               WHERE id = ${params.consumeHold.holdId} AND status = 'held'
+                 AND holder_ref = ${params.consumeHold.holderRef}`;
+                    }
+                    const holds = [...params.holds].sort((left, right) => left.resourceId.localeCompare(right.resourceId) || left.start.getTime() - right.start.getTime());
+                    // Locked as any booking write locks them, in id order, so a racing booking takes turns.
+                    for (const resourceId of [...new Set(holds.map((hold) => hold.resourceId))].sort()) {
+                        await lockResourceForWrite(tx, resourceId, tenantRef);
+                    }
+                    for (const hold of holds)
+                        await reapExpiredHolds(tx, hold.resourceId, hold.start, hold.end);
+                    const held = await tx `
+            INSERT INTO slotlock.reservations (
+              resource_id, starts_at, ends_at, buffer_after_ms, buffer_before_ms, status, expires_at,
+              source, holder_ref, hold_group_id
+            )
+            SELECT wanted.resource_id, wanted.starts_at, wanted.ends_at, 0, 0, 'held', ${params.expiresAt},
+                   'slotlock:approval', ${`approval:${id}`}, ${id}::uuid
+              FROM ROWS FROM (pg_catalog.unnest(${holds.map((hold) => hold.resourceId)}::uuid[]),
+                              pg_catalog.unnest(${holds.map((hold) => hold.start.toISOString())}::text[]::timestamptz[]),
+                              pg_catalog.unnest(${holds.map((hold) => hold.end.toISOString())}::text[]::timestamptz[]))
+                   AS wanted(resource_id, starts_at, ends_at)
+            RETURNING id`;
+                    const [row] = await tx `
+            INSERT INTO slotlock.approvals (
+              id, tenant_ref, policy_ref, operation, request, requester, hold_ids, resource_ids,
+              starts_at, ends_at, request_key, expires_at
+            ) VALUES (
+              ${id}, ${tenantRef}, ${params.policyRef}, ${params.operation}, ${tx.json(params.request)},
+              ${tx.json(params.requester)}, ${held.map((hold) => hold.id)}::uuid[],
+              ${[...new Set(holds.map((hold) => hold.resourceId))]}::uuid[], ${params.start}, ${params.end},
+              ${params.requestKey}, ${params.expiresAt}
+            )
+            RETURNING ${tx.unsafe(APPROVAL_COLUMNS)}`;
+                    if (!row)
+                        throw new Error('slotlock: approval insert returned no row');
+                    const approval = toApproval(row);
+                    await recordApprovalChange(tx, tenantRef, 'approval.requested', approval);
+                    return { ok: true, approval, replayed: false };
+                }, 'read committed');
+            }
+            catch (err) {
+                if (pgCode(err) === EXCLUSION_VIOLATION)
+                    return { ok: false, code: 'overlap' };
+                throw err;
+            }
+        },
+        async findApproval(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!/^[0-9a-f]{64}$/.test(params.requestKey))
+                return null;
+            return approvalByRequestKey(sql, params.tenantRef, params.requestKey);
+        },
+        async getApproval(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return getApproval(sql, params.tenantRef, params.id);
+        },
+        async listApprovals(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 50;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) {
+                throw invalidIdentityError('Slotlock approval list limit must be 1-200');
+            }
+            return listApprovals(sql, {
+                tenantRef: params.tenantRef,
+                limit,
+                ...(params.status !== undefined ? { status: params.status } : {}),
+            });
+        },
+        async beginApprovalGrant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return beginApprovalGrant(sql, params.tenantRef, params.id);
+        },
+        async finishApprovalGrant(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.decidedBy)) {
+                throw invalidIdentityError('Slotlock tenant and decider must be 1-500 UTF-8 bytes');
+            }
+            return finishApprovalGrant(sql, params.tenantRef, params.id, params.decidedBy);
+        },
+        async declineApproval(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.decidedBy)) {
+                throw invalidIdentityError('Slotlock tenant and decider must be 1-500 UTF-8 bytes');
+            }
+            if (params.reason !== undefined && params.reason.length > 500) {
+                throw invalidIdentityError('Slotlock approval reason must be at most 500 characters');
+            }
+            return declineApproval(sql, params);
+        },
+        async resetTestTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!params.tenantRef.endsWith('~test'))
+                throw sandboxTestOnlyError();
+            const rows = await sql `
+        SELECT * FROM slotlock.reset_test_tenant(${params.tenantRef}::text)`.catch((error) => {
+                if (error.hint === 'sandbox_test_only')
+                    throw sandboxTestOnlyError();
+                throw error;
+            });
+            return Object.fromEntries(rows.map((row) => [row.reset_table, Number(row.reset_rows)]));
+        },
+        async fastForwardTestTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!params.tenantRef.endsWith('~test'))
+                throw sandboxTestOnlyError();
+            if (!Number.isSafeInteger(params.minutes) || params.minutes < 1 || params.minutes > 525_600) {
+                throw invalidIdentityError('Slotlock fast-forward is 1 to 525,600 minutes');
+            }
+            const [counted] = await sql `
+        WITH lapsed_holds AS (
+          UPDATE slotlock.reservations hold
+             SET expires_at = statement_timestamp() - interval '1 millisecond'
+           WHERE hold.status = 'held'
+             AND hold.expires_at > statement_timestamp()
+             AND hold.expires_at <= statement_timestamp() + make_interval(mins => ${params.minutes})
+             AND hold.resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${params.tenantRef})
+          RETURNING 1
+        ), lapsed_approvals AS (
+          UPDATE slotlock.approvals
+             SET expires_at = statement_timestamp() - interval '1 millisecond'
+           WHERE tenant_ref = ${params.tenantRef} AND status = 'pending'
+             AND expires_at > statement_timestamp()
+             AND expires_at <= statement_timestamp() + make_interval(mins => ${params.minutes})
+          RETURNING 1
+        )
+        SELECT (SELECT count(*) FROM lapsed_holds)::int AS holds,
+               (SELECT count(*) FROM lapsed_approvals)::int AS approvals`;
+            return { holds: counted?.holds ?? 0, approvals: counted?.approvals ?? 0 };
+        },
+        async expireApprovals(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 100;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) {
+                throw invalidIdentityError('Slotlock approval expiry limit must be 1-1000');
+            }
+            return { expired: await expireApprovals(sql, params.tenantRef, limit) };
+        },
         async getReservation(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.externalRef)) {
                 throw invalidIdentityError('Slotlock booking identity must be 1-500 UTF-8 bytes');
@@ -3344,13 +4271,12 @@ function buildSlotlockStore(sql, options, refusal) {
         },
         async confirmHold(holdId, options = {}) {
             const tenantRef = holdTenantRef(options);
-            // Not an id the store issues: it names no hold (and would be a raw 22P02 in the query).
+            // Not an id the store issues (and a raw 22P02 in the query).
             if (!isValidResourceId(holdId))
                 return { ok: false, code: 'hold_not_found' };
             return inTransaction(sql, async (tx) => {
-                // The tenant whose booking the hold becomes is its resource's; a hold never changes
-                // resource, so it is read before the identity lock, which is taken before the row lock as
-                // every booking write takes them.
+                // A hold never changes resource, so the owner is read before the identity lock, taken
+                // before the row lock as every booking write does.
                 const [owner] = await tx `
           SELECT hold.resource_id, resource.tenant_ref AS resource_tenant
             FROM slotlock.reservations hold
@@ -3363,29 +4289,24 @@ function buildSlotlockStore(sql, options, refusal) {
                 if (bookingTenant !== null)
                     await lockExternalIdentity(tx, bookingTenant, holdId);
                 const bookingLimit = await tenantLimitReached(tx, bookingTenant, 'reservations');
-                // The resource's share lock, as every booking write takes it: an archive waits for this
-                // confirmation, and one that committed first is read here.
-                const [resource] = await tx `
-          SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
-           WHERE id = ${owner.resource_id}
-           FOR SHARE`;
+                // The resource's lock, as every booking write takes it: an archive waits for this
+                // confirmation.
+                const resource = await lockResourceForWrite(tx, owner.resource_id, null);
                 const [row] = await tx `
           SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
-                 revision, source, status, (status = 'held' AND expires_at > statement_timestamp()) AS live
+                 revision, source, status, (status = 'held' AND expires_at > statement_timestamp()) AS live,
+                 hold_group_id, holder_ref
             FROM slotlock.reservations
            WHERE id = ${holdId}
            FOR UPDATE`;
                 if (!row) {
-                    // NOTE: a hold reaped mid-flight by a rival (expired while this confirm waited on the
-                    // reaper's lock) reads as hold_not_found: the row is gone and the space was legitimately
-                    // taken; both refusal codes are terminal for the caller.
+                    // A hold reaped by a rival while this confirm waited reads as hold_not_found; both
+                    // refusals are terminal for the caller.
                     return { ok: false, code: 'hold_not_found' };
                 }
                 if (row.status === 'confirmed') {
-                    // Idempotent confirm: a retried confirm (network replay) of an already-confirmed hold is
-                    // SUCCESS, the booking as it now is; reporting failure would make callers double-book
-                    // elsewhere. A confirmed hold's reference is its own id (none without a tenant); a
-                    // booking with another reference was never this hold.
+                    // A retried confirm of an already-confirmed hold is success: reporting failure would make
+                    // callers double-book elsewhere. A booking with another reference was never this hold.
                     if (row.external_ref !== null && row.external_ref !== row.id) {
                         return { ok: false, code: 'hold_not_found' };
                     }
@@ -3393,7 +4314,6 @@ function buildSlotlockStore(sql, options, refusal) {
                 }
                 if (!row.live)
                     return { ok: false, code: 'hold_expired' };
-                // Archived since the hold was taken: a confirmation would be a new booking on it.
                 if (resource?.archived !== false)
                     return { ok: false, code: 'resource_archived' };
                 if (bookingTenant !== null) {
@@ -3412,8 +4332,8 @@ function buildSlotlockStore(sql, options, refusal) {
                 if (bookingLimit !== null) {
                     return { ok: false, code: 'reservation_limit_reached', limit: bookingLimit };
                 }
-                // The occupied end is already the end plus the hold's buffer (the trigger set it); the
-                // tenant and reference make the hold a booking that cancel and reschedule reach.
+                // The trigger already set the occupied end; the tenant and reference make the hold a
+                // booking cancel and reschedule reach.
                 const [confirmed] = await tx `
           UPDATE slotlock.reservations
              SET status = 'confirmed', expires_at = NULL,
@@ -3423,6 +4343,14 @@ function buildSlotlockStore(sql, options, refusal) {
                     buffer_after_ms, revision, source`;
                 if (!confirmed)
                     throw new Error('slotlock: hold confirmation returned no row');
+                // Its linked alternatives (one group, one holder) are released with it, as booking one
+                // from an agent releases the rest.
+                if (row.hold_group_id !== null && row.holder_ref !== null) {
+                    await tx `
+            DELETE FROM slotlock.reservations
+             WHERE status = 'held' AND hold_group_id = ${row.hold_group_id}::uuid
+               AND holder_ref = ${row.holder_ref} AND id <> ${holdId}`;
+                }
                 return { ok: true, reservation: toReservation(confirmed) };
             });
         },
@@ -3482,17 +4410,21 @@ function buildSlotlockStore(sql, options, refusal) {
                     });
                 }
             }
-            // Expired holds are dead occupation: excluded here so findNextAvailable can offer their
-            // space (the acquiring transaction reaps the row itself when it takes the window).
+            // Expired holds are excluded so findNextAvailable can offer their space; the acquiring
+            // transaction reaps the row itself.
             const rows = await sql `
-        SELECT COALESCE(occupied_starts_at, starts_at) AS occupied_starts_at,
-               COALESCE(occupied_ends_at, ends_at) AS occupied_ends_at
-          FROM slotlock.reservations
-         WHERE resource_id = ${resourceId}
-           AND ${occupiedStartsBefore(sql, window.end)}
-           AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
-           AND (status <> 'held' OR expires_at > statement_timestamp())
-         ORDER BY COALESCE(occupied_starts_at, starts_at)
+        SELECT occupied_starts_at, occupied_ends_at FROM (
+          SELECT COALESCE(occupied_starts_at, starts_at) AS occupied_starts_at,
+                 COALESCE(occupied_ends_at, ends_at) AS occupied_ends_at
+            FROM slotlock.reservations
+           WHERE resource_id = ${resourceId}
+             AND ${occupiedStartsBefore(sql, window.end)}
+             AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
+             AND (status <> 'held' OR expires_at > statement_timestamp())
+          UNION ALL
+          ${compositeBusy(sql, resourceId, window)}
+        ) busy
+         ORDER BY occupied_starts_at
          LIMIT ${options.limit ?? null}`;
             return rows.map((r) => ({ start: r.occupied_starts_at, end: r.occupied_ends_at }));
         },
@@ -3532,8 +4464,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     });
                 }
                 catch (error) {
-                    // A long-running series can take more than a write searches from its start. If it is
-                    // stored, it is expanded again below from where its last expansion stopped.
+                    // A long-running series can outgrow the write's search budget from its start; a stored
+                    // one is expanded below from its last cursor.
                     if (!(error instanceof CalendarExpansionLimitError) || !event.recurrence)
                         throw error;
                 }
@@ -3552,7 +4484,6 @@ function buildSlotlockStore(sql, options, refusal) {
             });
             const recurrenceEndsBy = recurrenceEndsByColumn(event);
             let attempted = expanded?.occurrences ?? [];
-            // The buffers the attempt kept, for the overlap answer if it loses.
             let attemptedBuffers = { bufferBeforeMs: 0, bufferAfterMs: 0 };
             let storedEventId;
             for (let attempt = 1;; attempt++) {
@@ -3580,8 +4511,8 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (ownerRef !== SLOTLOCK_INTERNAL_EVENT_OWNER_REF) {
                             await lockCalendarOwnerQuota(tx, params.tenantRef, ownerRef);
                             const commandCount = await calendarOwnerCommandCount(tx, params.tenantRef, ownerRef);
-                            // Preserve one guaranteed cancellation slot for every possible live identity. This
-                            // prevents update churn from making a principal unable to release calendar space.
+                            // Reserve one cancellation slot for every possible live identity, so update churn
+                            // cannot leave a principal unable to release calendar space.
                             const putCommandLimit = configuredAgentOwnerCommandQuota - configuredAgentOwnerEventQuota;
                             if (commandCount >= putCommandLimit) {
                                 return {
@@ -3668,12 +4599,17 @@ function buildSlotlockStore(sql, options, refusal) {
                                 return { ok: false, code: 'hold_not_found' };
                             }
                             const [hold] = await tx `
-                SELECT resource_id, starts_at, ends_at, hold_group_id FROM slotlock.reservations
+                SELECT resource_id, starts_at, ends_at, hold_group_id,
+                       expires_at > statement_timestamp() AS live
+                  FROM slotlock.reservations
                  WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${holderRef}
-                   AND expires_at > statement_timestamp()
                  FOR UPDATE`;
                             if (!hold)
                                 return { ok: false, code: 'hold_not_found' };
+                            // The holder's own hold that lapsed and is not yet reaped: named as the application
+                            // API's confirm names it. Another holder's stays not found.
+                            if (!hold.live)
+                                return { ok: false, code: 'hold_expired' };
                             const [only] = occurrences;
                             if (hold.resource_id !== params.resourceId ||
                                 occurrences.length !== 1 ||
@@ -3682,7 +4618,6 @@ function buildSlotlockStore(sql, options, refusal) {
                                 only.end > hold.ends_at) {
                                 return { ok: false, code: 'hold_mismatch' };
                             }
-                            // The hold and its alternatives give way to the event in this transaction.
                             await tx `
                 DELETE FROM slotlock.reservations
                  WHERE status = 'held' AND holder_ref = ${holderRef}
@@ -3773,9 +4708,15 @@ function buildSlotlockStore(sql, options, refusal) {
                   ${revision}, ${params.source ?? null}, ${turnaroundMs}, ${bufferBeforeMs}
                 )`;
                         }
-                        // The normalized children are the queryable/canonical representation. The JSON
-                        // columns above remain a migration-compatibility mirror until older readers retire.
+                        // The normalized children are canonical; the JSON columns above are a compatibility
+                        // mirror until older readers retire.
                         await replaceCalendarEventChildren(tx, params.tenantRef, eventId, event);
+                        // Writers to this resource take turns from here to its occupations (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, params.tenantRef);
+                        if (!locked)
+                            return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await replaceCalendarEventOccurrences(tx, {
                             tenantRef: params.tenantRef,
                             eventId,
@@ -3945,11 +4886,8 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const after = rollCursor(params.after);
-            // Due: the masters rolledWindow rolls, which do not cover the window and end within the cap
-            // of its start. Those it has never put back come first, then those it has, longest waiting
-            // first: however many it cannot extend, they never stand in front of one it has not tried,
-            // so every pass that is not capped by such new ones reaches the healthy series, and the ones
-            // put back take turns.
+            // Due masters, never-deferred ones first, then deferred ones longest-waiting first: masters
+            // it cannot extend never starve healthy ones, and deferred ones take turns.
             const candidates = await sql `
         SELECT id, materialized_ends_at, roll_retry_at
           FROM slotlock.calendar_events
@@ -3986,10 +4924,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     }
                     catch (error) {
                         if (error instanceof CalendarExpansionLimitError) {
-                            // It takes more than Slotlock expands: a rule that never occurs again, one with no
-                            // cursor to resume from whose search from its start has outgrown the budget, or one an
-                            // earlier Slotlock stored that this one refuses. Nothing was written; its old coverage
-                            // stays, and the masters after it still roll.
+                            // Over the expansion budget (or a rule this release refuses): nothing written, old
+                            // coverage kept, later masters still roll.
                             refused += 1;
                             refusedEventIds.push(candidate.id);
                             await deferRoll(sql, params.tenantRef, candidate.id);
@@ -4002,16 +4938,15 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (code === EXCLUSION_VIOLATION ||
                             code === DEADLOCK_DETECTED ||
                             code === SERIALIZATION_FAILURE) {
-                            // The savepoint rolled every delete/insert back, so the previous materialized
-                            // coverage remains truthful and callers will fail closed beyond it.
+                            // The savepoint rolled everything back, so old coverage stays truthful and callers
+                            // fail closed beyond it.
                             conflicts += 1;
                             conflictEventIds.push(candidate.id);
                             await deferRoll(sql, params.tenantRef, candidate.id);
                             break;
                         }
-                        // Anything else this one series meets (a row no Slotlock would write, a constraint it
-                        // trips) was rolled back with its savepoint too: it is put back like one over the
-                        // budget, so no single row stops the tenant's roll.
+                        // Any other failure was rolled back with its savepoint too: defer it like an
+                        // over-budget one, so no single row stops the tenant's roll.
                         refused += 1;
                         refusedEventIds.push(candidate.id);
                         await deferRoll(sql, params.tenantRef, candidate.id);
@@ -4178,8 +5113,8 @@ function buildSlotlockStore(sql, options, refusal) {
                         idempotent: true,
                     };
                 }
-                // An event's owner and reference never change, so they are read before its identity lock,
-                // which is taken before its row lock as every event write takes them.
+                // Owner and reference never change, so they are read before the identity lock, taken before
+                // the row lock as every event write does.
                 const [identity] = await tx `
           SELECT owner_ref, external_ref FROM slotlock.calendar_events
            WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}`;
@@ -4190,7 +5125,6 @@ function buildSlotlockStore(sql, options, refusal) {
           SELECT id, resource_id, revision FROM slotlock.calendar_events
            WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}
            FOR UPDATE`;
-                // Cancelled while this waited on its lock.
                 if (!found)
                     return { ok: false, code: 'event_not_found' };
                 if (params.expectedResourceId !== undefined &&
@@ -4290,7 +5224,6 @@ function buildSlotlockStore(sql, options, refusal) {
                 catch (error) {
                     if (pgCode(error) !== EXCLUSION_VIOLATION)
                         throw error;
-                    // It stays where it was; whoever owns it decides.
                     await report(event, 'event.timezone_conflict');
                     conflicts++;
                 }
@@ -4307,8 +5240,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     code: 'invalid_limit',
                 });
             }
-            // Never under the default: a shorter retention trims the feed, not how long a retried write
-            // is answered as the first was.
+            // Never under the default: a shorter retention trims the feed, not how long a retry is
+            // answered as the first was.
             const keepDays = params.retentionDays ?? Math.max(retentionDays, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS);
             if (!Number.isSafeInteger(keepDays) ||
                 keepDays < 1 ||
@@ -4318,11 +5251,10 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             return inTransaction(sql, async (tx) => {
-                // A 0.2 server still serving after the migration wrote its confirmed holds (and
-                // createReservation bookings) on the tenant's resources without the tenant or a reference,
-                // so no cancel or move reaches them; the migration gives those it finds the tenant and
-                // their own id, and this gives later ones the same. Each takes its reference's identity lock
-                // first, as every booking write does; a tombstone of its id retired nothing and goes.
+                // A 0.2 server still running after the migration wrote confirmed holds and
+                // createReservation bookings without the tenant or a reference; give them both, as the
+                // migration does. Each takes its reference's identity lock first, and a tombstone of its id
+                // goes.
                 const legacy = await tx `
           SELECT booking.id
             FROM slotlock.reservations booking
@@ -4402,8 +5334,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     code: 'invalid_limit',
                 });
             }
-            // Never under the default: a shorter retention trims the feed, not how long a retried write
-            // is answered as the first was.
+            // Never under the default: a shorter retention trims the feed, not how long a retry is
+            // answered as the first was.
             const keepDays = params.retentionDays ?? Math.max(retentionDays, SLOTLOCK_EVENT_COMMAND_RETENTION_DAYS);
             if (!Number.isSafeInteger(keepDays) ||
                 keepDays < 1 ||
@@ -4413,8 +5345,8 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             return inTransaction(sql, async (tx) => {
-                // Commands are exact-replay evidence, never resurrection authority: after the window every
-                // owner's are eligible, and the active event or tombstone stays canonical where present.
+                // Commands are replay evidence, never resurrection authority: after the window every
+                // owner's go.
                 const commands = await tx `
           WITH candidates AS MATERIALIZED (
             SELECT command.owner_ref, command.idempotency_key
@@ -4434,9 +5366,8 @@ function buildSlotlockStore(sql, options, refusal) {
             RETURNING 1
           )
           SELECT count(*)::int AS deleted FROM deleted`;
-                // Once every command of an agent-owned cancelled identity is gone its tombstone may follow;
-                // internal tombstones are provider/sync authority and stay. Event writers lock the tombstone
-                // row, so a row they hold is skipped and the delete repeats the selection predicate.
+                // An agent-owned tombstone may follow once all its commands are gone; internal ones are
+                // provider/sync authority and stay. Locked rows are skipped and the predicate rechecked.
                 const tombstones = await tx `
           WITH candidates AS MATERIALIZED (
             SELECT tombstone.owner_ref, tombstone.external_ref
@@ -4532,7 +5463,6 @@ function buildSlotlockStore(sql, options, refusal) {
                     if (params.revision !== currentRevision + 1) {
                         return { ok: false, code: 'revision_conflict' };
                     }
-                    // A fresh read ends a staleness: the next one is reported again.
                     await tx `
             UPDATE slotlock.calendar_coverage
                SET starts_at = ${window.start}, ends_at = ${window.end},
@@ -4686,7 +5616,7 @@ function buildSlotlockStore(sql, options, refusal) {
             if (refusal)
                 return 0;
             const tenantRef = params.tenantRef;
-            // The same test twice: to find them, then under each reference's lock, as a cancel takes it.
+            // The same test twice: to find them, then under each reference's lock.
             const due = (tx, externalRef) => tx `
         SELECT reservation.id, reservation.external_ref, reservation.revision, reservation.resource_id,
                (resource.booking_rules->>'checkInMinutes')::int AS minutes
@@ -4717,14 +5647,15 @@ function buildSlotlockStore(sql, options, refusal) {
                     await tx `
             INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray)
             VALUES (${tenantRef}, ${row.external_ref}, ${revision}, false)`;
+                    // The deletion is the change: the feed's trigger names it reservation.no_show (one change,
+                    // not a cancellation too), by maintenance, with the check-in window it missed.
+                    await tx `
+            SELECT set_config('slotlock.ending', 'no_show', true),
+                   set_config('slotlock.ending_detail', ${String(row.minutes)}, true),
+                   set_config('slotlock.actor', 'slotlock:maintenance', true)`;
                     await tx `DELETE FROM slotlock.reservations WHERE id = ${row.id}`;
                     await tx `
-            INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
-            VALUES (${tenantRef}, ${row.resource_id}, 'reservation.no_show', ${row.external_ref},
-                    jsonb_build_object('id', ${row.id}::uuid, 'reference', ${row.external_ref}::text,
-                                       'resource_id', ${row.resource_id}::uuid, 'revision', ${revision}::bigint,
-                                       'check_in_minutes', ${row.minutes}::int),
-                    'slotlock:maintenance')`;
+            SELECT set_config('slotlock.ending', '', true), set_config('slotlock.ending_detail', '', true)`;
                     return true;
                 });
                 if (done)
@@ -4753,7 +5684,35 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!Number.isSafeInteger(offerTtlMs) || offerTtlMs < 60_000 || offerTtlMs > 86_400_000) {
                 return { ok: false, code: 'invalid_ttl' };
             }
+            const key = params.idempotencyKey;
+            if (key !== undefined && !isValidIdentity(key))
+                return { ok: false, code: 'invalid_identity' };
+            const payloadHash = key === undefined
+                ? null
+                : createHash('sha256')
+                    .update(JSON.stringify([
+                    params.resourceId ?? null,
+                    params.pool ?? null,
+                    window.start.toISOString(),
+                    window.end.toISOString(),
+                    holderRef,
+                    offerTtlMs,
+                ]))
+                    .digest('hex');
             return inTransaction(sql, async (tx) => {
+                // The tenant's waitlist lock first, which offers and every join take: a retry racing its
+                // first finds the entry the first made.
+                await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-waitlist', tenantRef])}, 0))`;
+                if (key !== undefined) {
+                    const [earlier] = await tx `
+            SELECT ${tx.unsafe(WAITLIST_COLUMNS)}, payload_hash FROM slotlock.waitlist_entries
+             WHERE tenant_ref = ${tenantRef} AND idempotency_key = ${key}`;
+                    if (earlier) {
+                        if (earlier.payload_hash !== payloadHash)
+                            return { ok: false, code: 'idempotency_conflict' };
+                        return { ok: true, entry: toWaitlistEntry(earlier), replayed: true };
+                    }
+                }
                 if (params.resourceId !== undefined) {
                     const [resource] = await tx `
             SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
@@ -4771,8 +5730,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     if (!member)
                         return { ok: false, code: 'pool_not_found' };
                 }
-                // Counted under the tenant's waitlist lock, which offers take too, so racing joins stop at the cap.
-                await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-waitlist', tenantRef])}, 0))`;
+                // Counted under the tenant's waitlist lock (taken above), which offers take too, so racing
+                // joins stop at the cap.
                 const [counts] = await tx `
           SELECT count(*)::int AS tenant, count(*) FILTER (WHERE holder_ref = ${holderRef})::int AS holder
             FROM slotlock.waitlist_entries WHERE tenant_ref = ${tenantRef} AND status = 'waiting'`;
@@ -4782,11 +5741,12 @@ function buildSlotlockStore(sql, options, refusal) {
                 }
                 const [row] = await tx `
           INSERT INTO slotlock.waitlist_entries
-            (tenant_ref, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms)
+            (tenant_ref, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms,
+             idempotency_key, payload_hash)
           VALUES (${tenantRef}, ${params.resourceId ?? null}, ${params.pool ?? null}, ${window.start},
-                  ${window.end}, ${holderRef}, ${offerTtlMs})
+                  ${window.end}, ${holderRef}, ${offerTtlMs}, ${key ?? null}, ${payloadHash})
           RETURNING ${tx.unsafe(WAITLIST_COLUMNS)}`;
-                return { ok: true, entry: toWaitlistEntry(row) };
+                return { ok: true, entry: toWaitlistEntry(row), replayed: false };
             });
         },
         async listWaitlist(params) {
@@ -4812,7 +5772,6 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id))
                 return false;
             return inTransaction(sql, async (tx) => {
-                // Waits for an offer pass that has this entry locked, so it leaves what that pass decided.
                 const [left] = await tx `
           DELETE FROM slotlock.waitlist_entries
            WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
@@ -4820,8 +5779,7 @@ function buildSlotlockStore(sql, options, refusal) {
           RETURNING hold_id`;
                 if (!left)
                     return false;
-                // An offer not yet taken goes too, freeing the time for the next who waits; a confirmed
-                // one is a booking now and stays.
+                // An untaken offer's hold goes too; a confirmed one is a booking now and stays.
                 if (left.hold_id) {
                     await buildSlotlockStore(tx, options, null).releaseHold(left.hold_id, { tenantRef: params.tenantRef });
                 }
@@ -4878,6 +5836,17 @@ function buildSlotlockStore(sql, options, refusal) {
         DELETE FROM slotlock.assistant_settings WHERE tenant_ref = ${params.tenantRef} RETURNING 1`;
             return rows.length > 0;
         },
+        async resealAssistantKey(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return false;
+            if (params.to.length === 0 || params.to === params.from)
+                return false;
+            const rows = await sql `
+        UPDATE slotlock.assistant_settings SET sealed_key = ${params.to}
+         WHERE tenant_ref = ${params.tenantRef} AND sealed_key = ${params.from}
+        RETURNING 1`;
+            return rows.length > 0;
+        },
         async getAssistantConversation(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef))
                 return null;
@@ -5020,7 +5989,6 @@ function buildSlotlockStore(sql, options, refusal) {
              WHERE tenant_ref = ${tenantRef} AND status <> 'waiting'
                AND ends_at < statement_timestamp() - make_interval(days => ${retentionDays})`;
                 }
-                // One page in join order; the caller passes `next` back for the rest.
                 const waiting = await tx `
           SELECT ${tx.unsafe(WAITLIST_COLUMNS)} FROM slotlock.waitlist_entries
            WHERE tenant_ref = ${tenantRef} AND status = 'waiting'
@@ -5028,19 +5996,16 @@ function buildSlotlockStore(sql, options, refusal) {
                   OR (created_at, id) > (${after?.createdAt ?? null}::timestamptz, ${after?.id ?? null}::uuid))
            ORDER BY created_at, id
            LIMIT ${limit}`;
-                // Holds made through a store on this transaction, each in a savepoint of its own.
                 const inner = buildSlotlockStore(tx, options, null);
                 let offered = 0;
                 for (const entry of waiting) {
-                    // Locked so a leave waits for this offer, and skipped if it left first.
                     const [still] = await tx `
             SELECT 1 FROM slotlock.waitlist_entries
              WHERE id = ${entry.id} AND status = 'waiting' FOR UPDATE`;
                     if (!still)
                         continue;
-                    // Only resources whose window looks free are tried: a hold refused keeps its locks
-                    // until the transaction ends, so trying every member of a full pool would pile them up.
-                    // A hold there keeps the resource's buffers (its rules as they apply), so they must be free too.
+                    // Only resources that look free (buffers included) are tried: a refused hold keeps its
+                    // locks until the transaction ends.
                     const candidates = await tx `
             SELECT resources.id
               FROM slotlock.resources,
@@ -5136,7 +6101,6 @@ function buildSlotlockStore(sql, options, refusal) {
                     code: 'resource_tenant_mismatch',
                 });
             }
-            // Each row's occupied time: its buffers are as busy as the booking.
             const busyRows = await sql `
         SELECT COALESCE(reservation.occupied_starts_at, reservation.starts_at) AS starts_at,
                COALESCE(reservation.occupied_ends_at, reservation.ends_at) AS occupied_ends_at
@@ -5145,6 +6109,8 @@ function buildSlotlockStore(sql, options, refusal) {
            AND ${occupiedStartsBefore(sql, window.end, 'reservation')}
            AND COALESCE(reservation.occupied_ends_at, reservation.ends_at) > ${window.start}
            AND (reservation.status <> 'held' OR reservation.expires_at > statement_timestamp())
+        UNION ALL
+        ${compositeBusy(sql, params.resourceId, window)}
          ORDER BY 1
          LIMIT ${MAX_FREE_BUSY_INTERVALS + 1}`;
             if (busyRows.length > MAX_FREE_BUSY_INTERVALS) {
@@ -5187,8 +6153,8 @@ function buildSlotlockStore(sql, options, refusal) {
           FROM recurring_sources
          WHERE earliest_possible_at < ${window.end}`;
             const localRecurrenceRequired = Number(localRecurrenceCoverage?.source_count ?? 0) > 0;
-            // A resource that requires certainty requires every sync recording coverage of it, as its
-            // writes do (bookingJudge), and judges them by the same day.
+            // Requiring certainty means every sync covering the resource, judged by the same day, as
+            // writes do (bookingJudge).
             const requireCertain = owner[0].require_certain;
             const recordedSources = requireCertain
                 ? (await sql `
@@ -5223,8 +6189,8 @@ function buildSlotlockStore(sql, options, refusal) {
             let hasFreshOverlap = coverageRows.some((coverage) => coverage.fresh && coverage.starts_at < window.end && coverage.ends_at > window.start);
             if (localRecurrenceRequired) {
                 if (localRecurrenceCoverage?.complete !== true) {
-                    // Put the intrinsic source first: it is the boundary the caller can repair by rolling
-                    // the event horizon, independently of any provider snapshot repair.
+                    // The intrinsic source first: the caller can repair it by rolling the horizon,
+                    // independent of providers.
                     missingSources.unshift(SLOTLOCK_LOCAL_RECURRENCE_COVERAGE_SOURCE);
                 }
                 hasFreshOverlap ||= localRecurrenceCoverage?.overlaps === true;
@@ -5263,8 +6229,7 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!isValidResourceId(params.resourceId))
                 throw notFound();
             const [row] = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility,
-               archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}, statement_timestamp() AS now
+        SELECT ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}, statement_timestamp() AS now
           FROM slotlock.resources
          WHERE id = ${params.resourceId} AND tenant_ref IS NOT DISTINCT FROM ${tenantRef}`;
             if (!row)
@@ -5273,8 +6238,6 @@ function buildSlotlockStore(sql, options, refusal) {
                 return null;
             const resource = toResource(row);
             const rules = params.rules ?? resource.availabilityRules ?? [];
-            // Only what a booking made now may take: the resource's booking rules (as they apply) bound
-            // the search.
             const search = bookingSearch({
                 rules: resource.effectiveBookingRules,
                 timezone: resource.timezone,
@@ -5285,11 +6248,11 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!search)
                 return null;
             const { window } = search;
-            // A slot's buffers may run past the window: the time they can reach must be proven free too.
+            // A slot's buffers may run past the window: that reach must be proven free too.
             const reach = bookingSearchReach(search);
             let busy;
             if (tenantRef === null) {
-                // No event, coverage or series can belong to a resource with no tenant: only its rows.
+                // A tenantless resource has no events, coverage or series: only its rows.
                 busy = await this.listBusy(params.resourceId, reach);
             }
             else {
@@ -5311,7 +6274,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             ? { coverageMaxAgeMs: params.coverageMaxAgeMs }
                             : {}),
                     });
-                    // Absence is never treated as free time: what cannot be proven gives no slot.
+                    // Absence is never free time.
                     if (freeBusy.coverage.state !== 'complete')
                         return null;
                     busy.push(...freeBusy.busy);
@@ -5376,7 +6339,9 @@ function buildSlotlockStore(sql, options, refusal) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             }
             const erased = await sql `
-        SELECT erased_table, erased_rows FROM slotlock.erase_tenant(${params.tenantRef}::text)`;
+        SELECT erased_table, erased_rows FROM slotlock.erase_tenant(${params.tenantRef}::text)`.catch((error) => {
+                throw billingActiveRefusal(error);
+            });
             const rows = {};
             let total = 0;
             for (const row of erased) {
@@ -5394,7 +6359,18 @@ function buildSlotlockStore(sql, options, refusal) {
     };
     return Object.assign(store, Object.fromEntries(SLOTLOCK_TENANT_WRITE_METHODS.map((name) => [name, refuse])));
 }
-/** The deployment role alone may suspend: another role is refused EXECUTE on the functions. */
+/**
+ * erase_tenant refuses a tenant whose plan names a live subscription (`billing_active`): it is
+ * cancelled first, so it does not renew for an erased account.
+ */
+function billingActiveRefusal(error) {
+    if (pgCode(error) !== '55006' || error.hint !== 'billing_active')
+        return error;
+    return Object.assign(new Error('Slotlock tenant has a live subscription: cancel it before erasing the tenant', {
+        cause: error,
+    }), { code: 'billing_active' });
+}
+/** The deployment role alone may suspend: others are refused EXECUTE on the functions. */
 function suspensionRefusal(error) {
     if (pgCode(error) !== '42501')
         return error;