slotlock 0.6.3 → 0.8.0

package/store.js

@@ -1,14 +1,23 @@
 // DB mechanics for the Slotlock core: explicit `postgres` client in, structured results out.
+import { SLOTLOCK_MAX_LOCATION_DEPTH, SLOTLOCK_MAX_LOCATIONS, SLOTLOCK_MAX_RESOURCE_GROUPS, SLOTLOCK_POOL_ORDERS, SLOTLOCK_RESOURCE_KINDS, isSlotlockResourceScope, parseSlotlockLocation, parseSlotlockResourceGroup, parseSlotlockResourceProfile, slotlockGroupingRef, } from './resource-profile.js';
+import { readSlotlockTenantUsage } from './usage.js';
+import { slotlockPlanReadRefusal } from './plans.js';
 import { SLOTLOCK_CHANGE_ORIGINS, SLOTLOCK_CHANGE_RETENTION_DAYS, isSlotlockChangeOrigin, slotlockEventFeedMethods, } from './event-feed.js';
 import { bookingBufferBeforeMs, bookingSearchBlocked, bookingSearchReach, parseBookingRuleDefaults, parseEffectiveBookingRules, bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
 import { createHash, randomUUID } from 'node:crypto';
 import ICAL from 'ical.js';
-import { SLOTLOCK_CORE_DDL, SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockCoverageChangeRenameSql, slotlockTenantLockKey, } from './ddl.js';
+import { SLOTLOCK_CORE_DDL, SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_RESOURCE_SCOPED_TABLES, SLOTLOCK_RESOURCE_SCOPE_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockCoverageChangeRenameSql, slotlockTenantLockKey, } from './ddl.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
 import { SLOTLOCK_CALENDAR_HORIZON_DAYS, assertBoundedSearchWindow, expandRules, invalidWindowError, } from './rules.js';
 import { CalendarContractError, CalendarExpansionLimitError, expandCalendarEventSeries, normalizeCalendarEventContent, } from './sync.js';
 import { parseAvailabilityRules } from './weekly-hours.js';
+import { APPROVAL_COLUMNS, approvalByRequestKey, approvalPoliciesFor, beginApprovalGrant, declineApproval, deleteApprovalPolicy, expireApprovals, finishApprovalGrant, getApproval, listApprovalPolicies, listApprovals, putApprovalPolicy, recordApprovalChange, toApproval, } from './approvals.js';
 const EXCLUSION_VIOLATION = '23P01';
+/** Holds one approval may own: a bundle's resources, or a move's new time in pieces. */
+const SLOTLOCK_MAX_APPROVAL_HOLDS = 20;
+/** Approvals one requester, and one tenant, may have waiting at once. */
+const SLOTLOCK_MAX_PENDING_APPROVALS_PER_REQUESTER = 50;
+const SLOTLOCK_MAX_PENDING_APPROVALS = 500;
 /**
  * Concurrent inserts on the same EXCLUDE range can deadlock inside the constraint check itself
  * (intrinsic to Postgres EXCLUDE). The victim is fully rolled back, so one retry either wins or
@@ -561,8 +570,17 @@ async function tenantRlsUpToDate(tx, setting) {
     const [state] = await tx `
     SELECT pg_catalog.bool_and(
              rel.relrowsecurity AND rel.relforcerowsecurity
+             -- The tenant policy, and on a table a limited key is held to, the restrictive scope
+             -- policy, which can only narrow it; no other.
              AND (SELECT pg_catalog.count(*) FROM pg_catalog.pg_policy every
-                   WHERE every.polrelid = rel.oid) = 1
+                   WHERE every.polrelid = rel.oid
+                     AND (every.polname = 'tenant_isolation_v1'
+                          OR NOT (every.polname = 'resource_scope_v1' AND NOT every.polpermissive
+                                  AND wanted.name = ANY (${Object.keys(SLOTLOCK_RESOURCE_SCOPED_TABLES)}::text[])))) = 1
+             AND (SELECT pg_catalog.count(*) FROM pg_catalog.pg_policy scoped
+                   WHERE scoped.polrelid = rel.oid AND scoped.polname = 'resource_scope_v1'
+                     AND NOT scoped.polpermissive)
+                 = CASE WHEN wanted.name = ANY (${Object.keys(SLOTLOCK_RESOURCE_SCOPED_TABLES)}::text[]) THEN 1 ELSE 0 END
              AND pg_catalog.obj_description(pol.oid, 'pg_policy') = ${`slotlock:tenant-context:${setting}`}
              AND contract.tenant_context_setting = ${setting}
              AND contract.policy_fingerprint = pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(
@@ -727,6 +745,9 @@ function pageLimit(limit) {
     }
     return value;
 }
+function sandboxTestOnlyError() {
+    return Object.assign(new Error('Slotlock does this only in a test environment (a tenant ending ~test)'), { code: 'sandbox_test_only' });
+}
 function invalidIdentityError(message) {
     return Object.assign(new Error(message), { code: 'invalid_identity' });
 }
@@ -934,42 +955,56 @@ async function replaceCalendarEventOccurrences(tx, params) {
         WHERE event_id = ${params.eventId} AND reservation_id IS NOT NULL
      )`;
     await tx `DELETE FROM slotlock.calendar_event_occurrences WHERE event_id = ${params.eventId}`;
-    for (const occurrence of params.occurrences) {
-        let reservationId = null;
-        if ((params.event.transparency ?? 'opaque') === 'opaque') {
-            const occupied = occupiedTime({
-                ...occurrence,
-                bufferBeforeMs: params.bufferBeforeMs ?? 0,
-                bufferAfterMs: params.bufferAfterMs ?? 0,
-            });
-            await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
-            const derivedExternalRef = `calendar:${params.eventId}:${createHash('sha256')
-                .update(occurrence.recurrenceId)
-                .digest('hex')}`;
-            const reservations = await tx `
-        INSERT INTO slotlock.reservations (
-          resource_id, tenant_ref, external_ref, starts_at, ends_at,
-          buffer_after_ms, buffer_before_ms, revision, source, calendar_event_id
-        ) VALUES (
-          ${params.resourceId}, ${params.tenantRef}, ${derivedExternalRef},
-          ${occurrence.start}, ${occurrence.end}, ${params.bufferAfterMs ?? 0},
-          ${params.bufferBeforeMs ?? 0}, ${params.revision},
-          ${`calendar-event:${params.eventId}`}, ${params.eventId}
-        )
-        RETURNING id`;
-            reservationId = reservations[0]?.id ?? null;
-            if (!reservationId) {
+    if (params.occurrences.length === 0)
+        return;
+    // Three statements for the whole series, not three per occurrence: a series of 2,000 holds the
+    // tenant's locks for as long as its round trips take, and every write queued behind it waits.
+    const starts = params.occurrences.map((occurrence) => occurrence.start.toISOString());
+    const ends = params.occurrences.map((occurrence) => occurrence.end.toISOString());
+    const reservationIds = params.occurrences.map(() => '');
+    if ((params.event.transparency ?? 'opaque') === 'opaque') {
+        const occupied = params.occurrences.map((occurrence) => occupiedTime({
+            ...occurrence,
+            bufferBeforeMs: params.bufferBeforeMs ?? 0,
+            bufferAfterMs: params.bufferAfterMs ?? 0,
+        }));
+        await reapExpiredHoldsAcross(tx, params.resourceId, occupied);
+        const externalRefs = params.occurrences.map((occurrence) => `calendar:${params.eventId}:${createHash('sha256').update(occurrence.recurrenceId).digest('hex')}`);
+        const inserted = await tx `
+      INSERT INTO slotlock.reservations (
+        resource_id, tenant_ref, external_ref, starts_at, ends_at,
+        buffer_after_ms, buffer_before_ms, revision, source, calendar_event_id
+      )
+      SELECT ${params.resourceId}, ${params.tenantRef}, occurrence.external_ref,
+             occurrence.starts_at, occurrence.ends_at, ${params.bufferAfterMs ?? 0},
+             ${params.bufferBeforeMs ?? 0}, ${params.revision},
+             ${`calendar-event:${params.eventId}`}, ${params.eventId}
+        FROM ROWS FROM (pg_catalog.unnest(${externalRefs}::text[]),
+                        pg_catalog.unnest(${starts}::text[]::timestamptz[]),
+                        pg_catalog.unnest(${ends}::text[]::timestamptz[]))
+             WITH ORDINALITY AS occurrence(external_ref, starts_at, ends_at, ordinal)
+       ORDER BY occurrence.ordinal
+      RETURNING id, external_ref`;
+        const byRef = new Map(inserted.map((row) => [row.external_ref, row.id]));
+        externalRefs.forEach((externalRef, index) => {
+            const id = byRef.get(externalRef);
+            if (!id)
                 throw new Error('slotlock: calendar occurrence reservation insert returned no row');
-            }
-        }
-        await tx `
-      INSERT INTO slotlock.calendar_event_occurrences (
-        event_id, tenant_ref, recurrence_id, starts_at, ends_at, reservation_id
-      ) VALUES (
-        ${params.eventId}, ${params.tenantRef}, ${occurrence.recurrenceId},
-        ${occurrence.start}, ${occurrence.end}, ${reservationId}
-      )`;
+            reservationIds[index] = id;
+        });
     }
+    await tx `
+    INSERT INTO slotlock.calendar_event_occurrences (
+      event_id, tenant_ref, recurrence_id, starts_at, ends_at, reservation_id
+    )
+    SELECT ${params.eventId}, ${params.tenantRef}, occurrence.recurrence_id,
+           occurrence.starts_at, occurrence.ends_at, NULLIF(occurrence.reservation_id, '')::uuid
+      FROM ROWS FROM (pg_catalog.unnest(${params.occurrences.map((occurrence) => occurrence.recurrenceId)}::text[]),
+                      pg_catalog.unnest(${starts}::text[]::timestamptz[]),
+                      pg_catalog.unnest(${ends}::text[]::timestamptz[]),
+                      pg_catalog.unnest(${reservationIds}::text[]))
+           WITH ORDINALITY AS occurrence(recurrence_id, starts_at, ends_at, reservation_id, ordinal)
+     ORDER BY occurrence.ordinal`;
 }
 function seriesWindow(window) {
     if (!isFiniteWindow(window) ||
@@ -1232,18 +1267,50 @@ async function lockExternalIdentity(tx, tenantRef, externalRef) {
     await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([tenantRef, externalRef])}, 0))`;
 }
 /**
- * Whether the resource is the tenant's (`missing` when not), and whether it is archived.
- * Share-locked to the end of the transaction, so it is neither archived nor deleted meanwhile.
+ * Lock a resource a write is about to occupy time on, with its composite parent, in id order, to
+ * the end of the transaction (RFC 0004 A7): writes to one resource, or one composite's family,
+ * take turns. Without it, writers racing for the same time each insert, then wait at the
+ * exclusion constraint for one another, and PostgreSQL breaks each such deadlock only after its
+ * deadlock_timeout (a second), so a burst of agents for one slot could take many seconds. With
+ * it, each meets the winner's committed row and is refused at once. NO KEY UPDATE, so foreign
+ * keys to the resource are not blocked; an archive or delete waits for the write, as before. The
+ * resource's own row, or null when there is none (for the tenant, when one is given).
+ */
+async function lockResourceForWrite(tx, resourceId, tenantRef) {
+    const rows = await tx `
+    SELECT id, tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
+     WHERE (id = ${resourceId}
+            OR id = (SELECT parent_id FROM slotlock.resources WHERE id = ${resourceId}))
+       AND (${tenantRef}::text IS NULL OR tenant_ref = ${tenantRef})
+     ORDER BY id
+     FOR NO KEY UPDATE`;
+    const own = rows.find((row) => row.id === resourceId);
+    return own ? { tenant_ref: own.tenant_ref, archived: own.archived } : null;
+}
+/**
+ * Whether the resource is the tenant's (`missing` when not), and whether it is archived, locked
+ * for the write that follows (lockResourceForWrite).
  */
 async function tenantResourceState(tx, resourceId, tenantRef) {
-    const [row] = await tx `
-    SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
-     WHERE id = ${resourceId} AND tenant_ref = ${tenantRef}
-     FOR SHARE`;
+    const row = await readResourceForWrite(tx, resourceId, tenantRef);
     if (!row)
         return 'missing';
     return row.archived ? 'archived' : 'active';
 }
+/**
+ * A resource a write is about to check its booking against, key-share locked so it is not deleted
+ * meanwhile. It does not make writers wait for each other: lockResourceForWrite does, later, right
+ * before the occupation is written, and checks again that the resource is there and not archived.
+ * (KEY SHARE never conflicts with the NO KEY UPDATE that follows, so two writers cannot deadlock
+ * upgrading.)
+ */
+async function readResourceForWrite(tx, resourceId, tenantRef) {
+    const [row] = await tx `
+    SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
+     WHERE id = ${resourceId} AND (${tenantRef}::text IS NULL OR tenant_ref = ${tenantRef})
+     FOR KEY SHARE`;
+    return row ?? null;
+}
 function pgCode(err) {
     let cur = err;
     while (cur && typeof cur === 'object') {
@@ -1282,6 +1349,15 @@ function invalidPoolError() {
         code: 'invalid_pool',
     });
 }
+/** A resource's own columns, as toResource reads them. */
+const RESOURCE_COLUMNS = `id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
+  visibility, archived_at, name, description, kind, capacity, labels, attributes, location_ref,
+  parent_id, part_index,
+  (SELECT place.name FROM slotlock.locations place
+    WHERE place.tenant_ref = resources.tenant_ref AND place.ref = resources.location_ref) AS location_name,
+  ARRAY(SELECT member.group_ref FROM slotlock.resource_group_members member
+         WHERE member.tenant_ref = resources.tenant_ref AND member.resource_id = resources.id
+         ORDER BY member.group_ref) AS group_refs`;
 /**
  * A resource row's effective booking rules (jsonb; NULL for none): tenant defaults, overlaid by its
  * pool's, overlaid by its own, field by field. Reads from a row of slotlock.resources named
@@ -1318,6 +1394,35 @@ function toResource(row) {
         resource.archivedAt = row.archived_at;
     if (row.pool_ref !== null && row.pool_ref !== undefined)
         resource.pool = row.pool_ref;
+    // The profile, each part only when it says something.
+    if (typeof row.name === 'string')
+        resource.name = row.name;
+    if (typeof row.description === 'string')
+        resource.description = row.description;
+    if (row.kind !== undefined && row.kind !== 'other' && SLOTLOCK_RESOURCE_KINDS.includes(row.kind)) {
+        resource.kind = row.kind;
+    }
+    if (typeof row.capacity === 'number')
+        resource.capacity = row.capacity;
+    if (Array.isArray(row.labels) && row.labels.length > 0)
+        resource.labels = [...row.labels];
+    if (row.attributes !== null &&
+        typeof row.attributes === 'object' &&
+        !Array.isArray(row.attributes) &&
+        Object.keys(row.attributes).length > 0) {
+        resource.attributes = { ...row.attributes };
+    }
+    if (typeof row.location_ref === 'string') {
+        resource.location = row.location_ref;
+        if (typeof row.location_name === 'string')
+            resource.locationName = row.location_name;
+    }
+    if (Array.isArray(row.group_refs) && row.group_refs.length > 0)
+        resource.groups = [...row.group_refs];
+    if (typeof row.parent_id === 'string' && typeof row.part_index === 'number') {
+        resource.parentId = row.parent_id;
+        resource.partIndex = row.part_index;
+    }
     if (row.availability_rules !== null && row.availability_rules !== undefined) {
         // Written validated; anything else reads as closed.
         try {
@@ -1355,23 +1460,137 @@ function availabilityParameter(sql, rules) {
         durationMinutes,
     })));
 }
+/** What the location and group guards (ddl.ts) refuse with, by their HINT. */
+const GROUPING_REFUSALS = new Set([
+    'pool_order_limit_reached',
+    'composite_too_deep',
+    'composite_parts_limit',
+    'composite_busy',
+    'location_too_deep',
+    'location_cycle',
+    'location_limit_reached',
+    'group_limit_reached',
+    'resource_group_limit_reached',
+]);
+/**
+ * A location or group write PostgreSQL refused, as the store's code: a guard's HINT, or the code
+ * `foreignKeys` gives a foreign key that failed. Anything else as it was.
+ */
+function groupingRefusal(error, foreignKeys = {}) {
+    const failure = error;
+    const coded = (code) => Object.assign(new Error(typeof failure?.message === 'string' ? failure.message : code, { cause: error }), { code });
+    if (failure?.code === '23514' && typeof failure.hint === 'string' && GROUPING_REFUSALS.has(failure.hint)) {
+        return coded(failure.hint);
+    }
+    if (failure?.code === '23503' && typeof failure.constraint_name === 'string') {
+        const code = foreignKeys[failure.constraint_name];
+        if (code !== undefined)
+            return coded(code);
+    }
+    return error;
+}
+/**
+ * Run a location or group write in a savepoint of its own (a transaction when there is none), and
+ * map what PostgreSQL refuses (groupingRefusal). A failed statement leaves the caller's transaction
+ * usable, and postgres.js reports the mapped error rather than the statement's.
+ */
+async function guardedWrite(executor, write, foreignKeys = {}) {
+    try {
+        return await inTransaction(executor, write);
+    }
+    catch (error) {
+        throw groupingRefusal(error, foreignKeys);
+    }
+}
+/** A resource's location that the tenant does not have. */
+const RESOURCE_LOCATION_MISSING = Object.freeze({ slotlock_resources_location_fkey: 'location_not_found' });
+/** The nearest time zone a location, or one above it, has; null when none has one. */
+async function locationTimezone(executor, tenantRef, location) {
+    const [row] = await executor `
+    WITH RECURSIVE up(ref, parent_ref, timezone, steps) AS (
+      SELECT place.ref, place.parent_ref, place.timezone, 1 FROM slotlock.locations place
+       WHERE place.tenant_ref = ${tenantRef} AND place.ref = ${location}
+      UNION ALL
+      SELECT place.ref, place.parent_ref, place.timezone, up.steps + 1
+        FROM slotlock.locations place JOIN up ON place.tenant_ref = ${tenantRef} AND place.ref = up.parent_ref
+       WHERE up.timezone IS NULL AND up.steps <= ${SLOTLOCK_MAX_LOCATION_DEPTH}
+    )
+    SELECT timezone FROM up WHERE timezone IS NOT NULL ORDER BY steps LIMIT 1`;
+    return row?.timezone ?? null;
+}
+const toLocation = (row) => ({
+    ref: row.ref,
+    name: row.name,
+    parentRef: row.parent_ref,
+    timezone: row.timezone,
+    resources: Number(row.resources),
+});
+const toGroup = (row) => ({
+    ref: row.ref,
+    name: row.name,
+    description: row.description,
+    members: Number(row.members),
+});
+/**
+ * A checked profile change as statement parameters: each field's value (null when not given or
+ * cleared) and whether it was given. Labels travel as one comma-joined string, which a label never
+ * contains: postgres.js binds an array as text[] only once the pool knows the server's types.
+ */
+function profileParameters(change) {
+    return {
+        name: change.name ?? null,
+        setName: change.name !== undefined,
+        description: change.description ?? null,
+        setDescription: change.description !== undefined,
+        kind: change.kind ?? null,
+        setKind: change.kind !== undefined,
+        capacity: change.capacity ?? null,
+        setCapacity: change.capacity !== undefined,
+        labels: change.labels === undefined ? null : change.labels.join(','),
+        setLabels: change.labels !== undefined,
+        attributes: change.attributes === undefined ? null : JSON.stringify(change.attributes),
+        setAttributes: change.attributes !== undefined,
+    };
+}
 async function upsertResource(executor, params) {
     const visibility = params.visibility ?? 'shared';
     const asked = params.visibility ?? null;
+    const profile = profileParameters(params.profile ?? {});
     let rows;
     // An existing identity keeps its visibility: re-creating with another is refused, so a private
-    // one is never made shared.
+    // one is never made shared. Its profile takes the fields given, and keeps the rest.
     if (params.tenantRef !== undefined && params.externalRef !== undefined) {
         rows = await executor `
-      INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
-      VALUES (${params.externalRef}, ${params.tenantRef}, ${params.timezone ?? 'UTC'}, ${visibility})
+      INSERT INTO slotlock.resources (
+        external_ref, tenant_ref, timezone, visibility, name, description, kind, capacity, labels, attributes,
+        location_ref
+      )
+      VALUES (
+        ${params.externalRef}, ${params.tenantRef}, ${params.timezone ?? 'UTC'}, ${visibility},
+        ${profile.name}::text, ${profile.description}::text, COALESCE(${profile.kind}::text, 'other'),
+        ${profile.capacity}::integer,
+        COALESCE(pg_catalog.string_to_array(${profile.labels}::text, ','), '{}'::text[]),
+        COALESCE(${profile.attributes}::text::jsonb, '{}'::jsonb),
+        ${params.location ?? null}::text
+      )
       ON CONFLICT (tenant_ref, external_ref)
         WHERE tenant_ref IS NOT NULL AND external_ref IS NOT NULL
-      DO UPDATE SET timezone = EXCLUDED.timezone
+      DO UPDATE SET timezone = EXCLUDED.timezone,
+        name = CASE WHEN ${profile.setName}::boolean THEN EXCLUDED.name ELSE slotlock.resources.name END,
+        description = CASE WHEN ${profile.setDescription}::boolean THEN EXCLUDED.description
+                           ELSE slotlock.resources.description END,
+        kind = CASE WHEN ${profile.setKind}::boolean THEN EXCLUDED.kind ELSE slotlock.resources.kind END,
+        capacity = CASE WHEN ${profile.setCapacity}::boolean THEN EXCLUDED.capacity ELSE slotlock.resources.capacity END,
+        labels = CASE WHEN ${profile.setLabels}::boolean THEN EXCLUDED.labels ELSE slotlock.resources.labels END,
+        attributes = CASE WHEN ${profile.setAttributes}::boolean THEN EXCLUDED.attributes
+                          ELSE slotlock.resources.attributes END,
+        location_ref = CASE WHEN ${params.location !== undefined}::boolean THEN EXCLUDED.location_ref
+                            ELSE slotlock.resources.location_ref END
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+      RETURNING ${executor.unsafe(RESOURCE_COLUMNS)}, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     else if (params.externalRef !== undefined) {
+        // A legacy resource (no tenant) has no profile.
         rows = await executor `
       INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
       VALUES (${params.externalRef}, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
@@ -1379,13 +1598,13 @@ async function upsertResource(executor, params) {
         WHERE tenant_ref IS NULL AND external_ref IS NOT NULL
       DO UPDATE SET external_ref = EXCLUDED.external_ref
       WHERE ${asked}::text IS NULL OR slotlock.resources.visibility = ${asked}::text
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+      RETURNING ${executor.unsafe(RESOURCE_COLUMNS)}, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     else {
         rows = await executor `
       INSERT INTO slotlock.resources (external_ref, tenant_ref, timezone, visibility)
       VALUES (NULL, NULL, ${params.timezone ?? 'UTC'}, ${visibility})
-      RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+      RETURNING ${executor.unsafe(RESOURCE_COLUMNS)}, ${executor.unsafe(EFFECTIVE_BOOKING_RULES)}`;
     }
     const row = rows[0];
     if (!row) {
@@ -1804,11 +2023,16 @@ function occupiedStartsBefore(executor, end, alias) {
  * before the caller's INSERT, so the EXCLUDE arbiter only sees live occupation.
  */
 async function reapExpiredHolds(tx, resourceId, start, end) {
+    // A composite's parent and parts too (RFC 0003 G8): their expired holds' claims are in the way.
     await tx `
     DELETE FROM slotlock.reservations
      WHERE id IN (
        SELECT id FROM slotlock.reservations
-        WHERE resource_id = ${resourceId}
+        WHERE resource_id IN (
+                SELECT ${resourceId}::uuid
+                UNION ALL SELECT family.parent_id FROM slotlock.resources family
+                           WHERE family.id = ${resourceId} AND family.parent_id IS NOT NULL
+                UNION ALL SELECT family.id FROM slotlock.resources family WHERE family.parent_id = ${resourceId})
           AND status = 'held'
           AND expires_at <= statement_timestamp()
           AND ${occupiedStartsBefore(tx, end)}
@@ -1817,6 +2041,62 @@ async function reapExpiredHolds(tx, resourceId, start, end) {
         FOR UPDATE
      )`;
 }
+/**
+ * reapExpiredHolds for many windows on one resource in one statement (a series' occurrences): the
+ * same rows, in the same id order under FOR UPDATE, as one call per window would delete. The
+ * envelope of the windows bounds the scan so the index applies; each row must still overlap one.
+ */
+async function reapExpiredHoldsAcross(tx, resourceId, windows) {
+    if (windows.length === 0)
+        return;
+    let first = Number.POSITIVE_INFINITY;
+    let last = Number.NEGATIVE_INFINITY;
+    for (const window of windows) {
+        first = Math.min(first, window.start.getTime());
+        last = Math.max(last, window.end.getTime());
+    }
+    await tx `
+    DELETE FROM slotlock.reservations
+     WHERE id IN (
+       SELECT held.id FROM slotlock.reservations held
+        WHERE held.resource_id IN (
+                SELECT ${resourceId}::uuid
+                UNION ALL SELECT family.parent_id FROM slotlock.resources family
+                           WHERE family.id = ${resourceId} AND family.parent_id IS NOT NULL
+                UNION ALL SELECT family.id FROM slotlock.resources family WHERE family.parent_id = ${resourceId})
+          AND held.status = 'held'
+          AND held.expires_at <= statement_timestamp()
+          AND ${occupiedStartsBefore(tx, new Date(last), 'held')}
+          AND COALESCE(held.occupied_ends_at, held.ends_at) > ${new Date(first)}
+          AND EXISTS (
+                SELECT 1
+                  FROM ROWS FROM (pg_catalog.unnest(${windows.map((window) => window.start.toISOString())}::text[]::timestamptz[]),
+                                  pg_catalog.unnest(${windows.map((window) => window.end.toISOString())}::text[]::timestamptz[]))
+                       AS occupied(starts_at, ends_at)
+                 WHERE COALESCE(held.occupied_starts_at, held.starts_at) < occupied.ends_at
+                   AND COALESCE(held.occupied_ends_at, held.ends_at) > occupied.starts_at)
+        ORDER BY held.id
+        FOR UPDATE
+     )`;
+}
+/**
+ * What else keeps a resource busy as part of a composite (RFC 0003 G8), as rows of
+ * (occupied_starts_at, occupied_ends_at): a part, the bookings of its parent as a whole; a parent,
+ * the bookings of any of its parts. Its own bookings are read with its own rows. Nothing for a
+ * resource that is neither.
+ */
+function compositeBusy(executor, resourceId, window) {
+    return executor `
+    SELECT lower(claim.during) AS occupied_starts_at, upper(claim.during) AS occupied_ends_at
+      FROM slotlock.resources me
+      JOIN slotlock.composite_claims claim
+        ON claim.resource_id = COALESCE(me.parent_id, me.id)
+       AND claim.booked_resource_id <> me.id
+       AND (me.parent_id IS NULL OR claim.span @> me.part_index)
+     WHERE me.id = ${resourceId}
+       AND claim.during && tstzrange(${window.start}, ${window.end}, '[)')
+       AND (claim.status <> 'held' OR claim.expires_at > statement_timestamp())`;
+}
 /**
  * Structured answer after losing to the EXCLUDE arbiter: name the live winner.
  * conflictingReservationId is null in one narrow race (the blocker expired between the constraint
@@ -1841,7 +2121,27 @@ async function overlapLoss(sql, resourceId, start, end, bufferAfterMs = 0, exclu
        AND (status <> 'held' OR expires_at > statement_timestamp())
      ORDER BY starts_at
      LIMIT 1`;
-    return { ok: false, code: 'overlap', conflictingReservationId: winners[0]?.id ?? null };
+    if (winners[0])
+        return { ok: false, code: 'overlap', conflictingReservationId: winners[0].id };
+    // Lost to a composite's claim (RFC 0003 G8): the booking on the whole, or on a part, in the way.
+    const claimed = await sql `
+    SELECT claim.reservation_id::text AS id
+      FROM slotlock.resources me
+      JOIN slotlock.composite_claims claim
+        ON claim.resource_id = COALESCE(me.parent_id, me.id)
+       AND claim.booked_resource_id <> me.id
+       AND (me.parent_id IS NULL OR claim.span @> me.part_index)
+     WHERE me.id = ${resourceId}
+       AND (${excludeReservationId ?? null}::uuid IS NULL OR claim.reservation_id <> ${excludeReservationId ?? null}::uuid)
+       AND claim.during && tstzrange(
+             ${start}::timestamptz - ${bufferBeforeMs} * interval '1 millisecond',
+             ${end}::timestamptz + ${bufferAfterMs} * interval '1 millisecond',
+             '[)'
+           )
+       AND (claim.status <> 'held' OR claim.expires_at > statement_timestamp())
+     ORDER BY lower(claim.during)
+     LIMIT 1`;
+    return { ok: false, code: 'overlap', conflictingReservationId: claimed[0]?.id ?? null };
 }
 /** The tenant a hold call is limited to, or null for none; an invalid one is refused. */
 function holdTenantRef(options) {
@@ -1915,6 +2215,14 @@ export function createSlotlockStore(sql, options = {}) {
  */
 export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'createResource',
+    'updateResourceProfile',
+    'putLocation',
+    'updateLocation',
+    'deleteLocation',
+    'putGroup',
+    'deleteGroup',
+    'addGroupMember',
+    'removeGroupMember',
     'archiveResource',
     'restoreResource',
     'deleteResource',
@@ -1922,6 +2230,17 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'setResourceBookingRules',
     'setBookingRuleDefaults',
     'setResourcePool',
+    'setResourceParent',
+    'setPoolOrder',
+    'notePoolBooking',
+    'putApprovalPolicy',
+    'deleteApprovalPolicy',
+    'requestApproval',
+    'beginApprovalGrant',
+    'finishApprovalGrant',
+    'declineApproval',
+    'resetTestTenant',
+    'fastForwardTestTenant',
     'setTenantAvailability',
     'createReservation',
     'createExternalReservation',
@@ -1944,6 +2263,7 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'leaveWaitlist',
     'putAssistantSettings',
     'deleteAssistantSettings',
+    'resealAssistantKey',
     'putAssistantConversation',
     'settleAssistantAction',
     'deleteAssistantConversation',
@@ -2262,6 +2582,12 @@ function buildSlotlockStore(sql, options, refusal) {
             if (keyId !== undefined && !isValidResourceId(keyId)) {
                 throw Object.assign(new Error('Slotlock key id must be a UUID'), { code: 'invalid_identity' });
             }
+            const scope = options?.resourceScope;
+            if (scope !== undefined && !isSlotlockResourceScope(scope)) {
+                throw Object.assign(new Error('Slotlock resource scope must name locations or groups by reference'), {
+                    code: 'invalid_identity',
+                });
+            }
             const release = await tenantSlots?.(tenantRef, options?.signal);
             // A lock timeout leaves the transaction unusable, so the reset below would fail with another
             // error: noted here.
@@ -2289,9 +2615,27 @@ function buildSlotlockStore(sql, options, refusal) {
                    set_config('slotlock.origin', COALESCE(${origin ?? null}::text,
                      NULLIF(current_setting('slotlock.origin', true), ''), 'library'), true) AS origin,
                    set_config('slotlock.key_id', ${keyId ?? ''}, true) AS key,
+                   current_setting(${SLOTLOCK_RESOURCE_SCOPE_SETTING}, true) AS scope,
                    slotlock.tenant_suspended(${tenantRef}) AS suspended`.catch((error) => {
                     throw suspensionCheckRefusal(error);
                 });
+                // A limited key's resources, read in the tenant's context (and within an enclosing
+                // scope, if one is set), then held for the rest of the transaction.
+                if (scope !== undefined) {
+                    await tx `
+              SELECT set_config(${SLOTLOCK_RESOURCE_SCOPE_SETTING}, '{' || COALESCE((
+                       SELECT string_agg(held.id::text, ',' ORDER BY held.id)
+                         FROM slotlock.resources held
+                        WHERE held.tenant_ref = ${tenantRef}
+                          AND ((held.location_ref IS NOT NULL
+                                AND slotlock.location_path(held.tenant_ref, held.location_ref)
+                                    && pg_catalog.string_to_array(${scope.locations.join(',')}::text, ','))
+                               OR EXISTS (
+                                 SELECT 1 FROM slotlock.resource_group_members member
+                                  WHERE member.tenant_ref = held.tenant_ref AND member.resource_id = held.id
+                                    AND member.group_ref = ANY (pg_catalog.string_to_array(${scope.groups.join(',')}::text, ','))))
+                     ), '') || '}', true)`;
+                }
                 // A caller's REPEATABLE READ or SERIALIZABLE snapshot predates the lock, so it may miss a
                 // suspension: its writes are refused, reads allowed.
                 const refusal = context?.suspended === true
@@ -2311,7 +2655,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     await tx `SELECT set_config(${configuredTenantSetting}, ${previous[0]?.value ?? ''}, true),
                             set_config('slotlock.actor', ${previous[0]?.actor ?? ''}, true),
                             set_config('slotlock.origin', ${previous[0]?.origin ?? ''}, true),
-                            set_config('slotlock.key_id', ${previous[0]?.key ?? ''}, true)`;
+                            set_config('slotlock.key_id', ${previous[0]?.key ?? ''}, true),
+                            set_config(${SLOTLOCK_RESOURCE_SCOPE_SETTING}, ${context?.scope ?? ''}, true)`;
                 }
             }, 'read committed')
                 .catch((error) => {
@@ -2324,10 +2669,51 @@ function buildSlotlockStore(sql, options, refusal) {
         },
         async createResource(params) {
             assertValidResourceInput(params);
+            if (params.profile !== undefined && params.tenantRef === undefined) {
+                throw Object.assign(new Error('Slotlock gives a profile only to a resource with a tenant'), {
+                    code: 'invalid_resource_profile',
+                });
+            }
+            const { profile: given, maxTenantResources: _limit, location, ...identity } = params;
+            if (location !== undefined) {
+                if (params.tenantRef === undefined) {
+                    throw Object.assign(new Error('Slotlock gives a location only to a resource with a tenant'), {
+                        code: 'invalid_location',
+                        field: 'location',
+                    });
+                }
+                slotlockGroupingRef('invalid_location', location);
+                // Without a time zone of its own, it takes its location's.
+                if (identity.timezone === undefined) {
+                    const zone = await locationTimezone(sql, params.tenantRef, location);
+                    if (zone !== null)
+                        identity.timezone = zone;
+                }
+            }
+            const upsert = {
+                ...identity,
+                ...(given !== undefined ? { profile: parseSlotlockResourceProfile(given) } : {}),
+                ...(location !== undefined ? { location } : {}),
+            };
             const requested = params.maxTenantResources;
-            const configured = params.tenantRef === undefined ? undefined : configuredTenantLimits.resources;
-            if (requested === undefined && configured === undefined)
-                return upsertResource(sql, params);
+            // The lower of the store's own limit and the tenant's plan (plans.ts), when it has one.
+            const planned = params.tenantRef === undefined
+                ? undefined
+                : (await sql `
+                SELECT max_resources FROM slotlock.tenant_plan(${params.tenantRef}::text)`.catch((error) => {
+                    throw slotlockPlanReadRefusal(error);
+                }))[0]?.max_resources;
+            const storeLimit = params.tenantRef === undefined ? undefined : configuredTenantLimits.resources;
+            const configured = planned === undefined
+                ? storeLimit
+                : storeLimit === undefined
+                    ? planned
+                    : Math.min(planned, storeLimit);
+            if (requested === undefined && configured === undefined) {
+                if (location === undefined)
+                    return upsertResource(sql, upsert);
+                return guardedWrite(sql, (tx) => upsertResource(tx, upsert), RESOURCE_LOCATION_MISSING);
+            }
             if (requested !== undefined &&
                 (!Number.isSafeInteger(requested) ||
                     requested < 1 ||
@@ -2361,7 +2747,9 @@ function buildSlotlockStore(sql, options, refusal) {
                         throw Object.assign(new Error(`Slotlock tenant already has ${max} resources, the most allowed here`), { code: 'resource_limit_reached', limit: max });
                     }
                 }
-                return upsertResource(tx, params);
+                if (location === undefined)
+                    return upsertResource(tx, upsert);
+                return guardedWrite(tx, (inner) => upsertResource(inner, upsert), RESOURCE_LOCATION_MISSING);
             }, 'read committed');
         },
         async getResource(params) {
@@ -2372,13 +2760,193 @@ function buildSlotlockStore(sql, options, refusal) {
                 });
             }
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
+        SELECT ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
+        async updateResourceProfile(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
+                throw Object.assign(new Error('Slotlock resource identity is invalid'), {
+                    code: 'invalid_identity',
+                });
+            }
+            const profile = profileParameters(parseSlotlockResourceProfile(params.profile));
+            const location = params.location === undefined || params.location === null
+                ? null
+                : slotlockGroupingRef('invalid_location', params.location);
+            const rows = await guardedWrite(sql, (tx) => tx `
+        UPDATE slotlock.resources
+           SET name = CASE WHEN ${profile.setName}::boolean THEN ${profile.name}::text ELSE name END,
+               description = CASE WHEN ${profile.setDescription}::boolean
+                                  THEN ${profile.description}::text ELSE description END,
+               kind = CASE WHEN ${profile.setKind}::boolean THEN ${profile.kind}::text ELSE kind END,
+               capacity = CASE WHEN ${profile.setCapacity}::boolean
+                               THEN ${profile.capacity}::integer ELSE capacity END,
+               labels = CASE WHEN ${profile.setLabels}::boolean
+                             THEN pg_catalog.string_to_array(${profile.labels}::text, ',') ELSE labels END,
+               attributes = CASE WHEN ${profile.setAttributes}::boolean
+                                 THEN ${profile.attributes}::text::jsonb ELSE attributes END,
+               location_ref = CASE WHEN ${params.location !== undefined}::boolean
+                                   THEN ${location}::text ELSE location_ref END
+         WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+        RETURNING ${tx.unsafe(RESOURCE_COLUMNS)}, ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}`, RESOURCE_LOCATION_MISSING);
+            const row = rows[0];
+            return row ? toResource(row) : null;
+        },
+        async listLocations(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const rows = await sql `
+        WITH RECURSIVE tree(ref, name, parent_ref, timezone, path) AS (
+          SELECT place.ref, place.name, place.parent_ref, place.timezone, ARRAY[place.ref]
+            FROM slotlock.locations place
+           WHERE place.tenant_ref = ${params.tenantRef} AND place.parent_ref IS NULL
+          UNION ALL
+          SELECT place.ref, place.name, place.parent_ref, place.timezone, tree.path || place.ref
+            FROM slotlock.locations place
+            JOIN tree ON place.tenant_ref = ${params.tenantRef} AND place.parent_ref = tree.ref
+           WHERE cardinality(tree.path) <= ${SLOTLOCK_MAX_LOCATION_DEPTH}
+        )
+        SELECT tree.ref, tree.name, tree.parent_ref, tree.timezone,
+               (SELECT count(*) FROM slotlock.resources held
+                 WHERE held.tenant_ref = ${params.tenantRef} AND held.location_ref = tree.ref)::int AS resources
+          FROM tree
+         ORDER BY tree.path
+         LIMIT ${SLOTLOCK_MAX_LOCATIONS}`;
+            return rows.map(toLocation);
+        },
+        async putLocation(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const location = parseSlotlockLocation(params);
+            const [row] = await guardedWrite(sql, (tx) => tx `
+        INSERT INTO slotlock.locations AS kept (tenant_ref, ref, name, parent_ref, timezone)
+        VALUES (${params.tenantRef}, ${location.ref}, ${location.name ?? ''}, ${location.parentRef ?? null},
+                ${location.timezone ?? null})
+        ON CONFLICT (tenant_ref, ref) DO UPDATE
+        SET name = EXCLUDED.name,
+            parent_ref = CASE WHEN ${location.parentRef !== undefined}::boolean
+                              THEN EXCLUDED.parent_ref ELSE kept.parent_ref END,
+            timezone = CASE WHEN ${location.timezone !== undefined}::boolean
+                            THEN EXCLUDED.timezone ELSE kept.timezone END
+        RETURNING kept.ref, kept.name, kept.parent_ref, kept.timezone,
+                  (SELECT count(*) FROM slotlock.resources held
+                    WHERE held.tenant_ref = kept.tenant_ref AND held.location_ref = kept.ref)::int AS resources`, { slotlock_locations_parent_fkey: 'location_not_found' });
+            return toLocation(row);
+        },
+        async updateLocation(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const location = parseSlotlockLocation(params);
+            const [row] = await guardedWrite(sql, (tx) => tx `
+        UPDATE slotlock.locations AS kept
+           SET name = COALESCE(${location.name ?? null}::text, kept.name),
+               parent_ref = CASE WHEN ${location.parentRef !== undefined}::boolean
+                                 THEN ${location.parentRef ?? null}::text ELSE kept.parent_ref END,
+               timezone = CASE WHEN ${location.timezone !== undefined}::boolean
+                               THEN ${location.timezone ?? null}::text ELSE kept.timezone END
+         WHERE kept.tenant_ref = ${params.tenantRef} AND kept.ref = ${location.ref}
+        RETURNING kept.ref, kept.name, kept.parent_ref, kept.timezone,
+                  (SELECT count(*) FROM slotlock.resources held
+                    WHERE held.tenant_ref = kept.tenant_ref AND held.location_ref = kept.ref)::int AS resources`, { slotlock_locations_parent_fkey: 'location_not_found' });
+            return row ? toLocation(row) : null;
+        },
+        async deleteLocation(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const ref = slotlockGroupingRef('invalid_location', params.ref);
+            const rows = await guardedWrite(sql, (tx) => tx `
+          DELETE FROM slotlock.locations
+           WHERE tenant_ref = ${params.tenantRef} AND ref = ${ref}
+          RETURNING ref`, {
+                slotlock_locations_parent_fkey: 'location_in_use',
+                slotlock_resources_location_fkey: 'location_in_use',
+            });
+            return rows.length > 0;
+        },
+        async listGroups(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const rows = await sql `
+        SELECT kept.ref, kept.name, kept.description,
+               (SELECT count(*) FROM slotlock.resource_group_members member
+                 WHERE member.tenant_ref = kept.tenant_ref AND member.group_ref = kept.ref)::int AS members
+          FROM slotlock.resource_groups kept
+         WHERE kept.tenant_ref = ${params.tenantRef}
+         ORDER BY kept.ref
+         LIMIT ${SLOTLOCK_MAX_RESOURCE_GROUPS}`;
+            return rows.map(toGroup);
+        },
+        async putGroup(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const group = parseSlotlockResourceGroup(params);
+            const [row] = await guardedWrite(sql, (tx) => tx `
+        INSERT INTO slotlock.resource_groups AS kept (tenant_ref, ref, name, description)
+        VALUES (${params.tenantRef}, ${group.ref}, ${group.name}, ${group.description})
+        ON CONFLICT (tenant_ref, ref) DO UPDATE
+        SET name = EXCLUDED.name,
+            description = CASE WHEN ${params.description !== undefined}::boolean
+                               THEN EXCLUDED.description ELSE kept.description END
+        RETURNING kept.ref, kept.name, kept.description,
+                  (SELECT count(*) FROM slotlock.resource_group_members member
+                    WHERE member.tenant_ref = kept.tenant_ref AND member.group_ref = kept.ref)::int AS members`);
+            return toGroup(row);
+        },
+        async deleteGroup(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const ref = slotlockGroupingRef('invalid_group', params.ref);
+            const rows = await sql `
+        DELETE FROM slotlock.resource_groups
+         WHERE tenant_ref = ${params.tenantRef} AND ref = ${ref}
+        RETURNING ref`;
+            return rows.length > 0;
+        },
+        async addGroupMember(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const group = slotlockGroupingRef('invalid_group', params.group);
+            if (!isValidResourceId(params.resourceId)) {
+                throw Object.assign(new Error('Slotlock resource not found in this tenant'), {
+                    code: 'resource_not_found',
+                });
+            }
+            const rows = await guardedWrite(sql, (tx) => tx `
+          INSERT INTO slotlock.resource_group_members (tenant_ref, group_ref, resource_id)
+          VALUES (${params.tenantRef}, ${group}, ${params.resourceId}::uuid)
+          ON CONFLICT DO NOTHING
+          RETURNING true AS added`, {
+                slotlock_resource_group_members_group_fkey: 'group_not_found',
+                slotlock_resource_group_members_resource_fkey: 'resource_not_found',
+            });
+            return rows.length > 0;
+        },
+        async removeGroupMember(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const group = slotlockGroupingRef('invalid_group', params.group);
+            if (!isValidResourceId(params.resourceId))
+                return false;
+            const rows = await sql `
+        DELETE FROM slotlock.resource_group_members
+         WHERE tenant_ref = ${params.tenantRef} AND group_ref = ${group}
+           AND resource_id = ${params.resourceId}::uuid
+        RETURNING group_ref`;
+            return rows.length > 0;
+        },
         async setResourceAvailability(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
                 throw Object.assign(new Error('Slotlock resource identity is invalid'), {
@@ -2390,7 +2958,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET availability_rules = ${rules}::jsonb
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2421,8 +2989,7 @@ function buildSlotlockStore(sql, options, refusal) {
                  ELSE statement_timestamp()
                END
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-                  visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2501,8 +3068,25 @@ function buildSlotlockStore(sql, options, refusal) {
             const rows = await sql `
         UPDATE slotlock.resources SET pool_ref = ${params.pool}
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-                  visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+            const row = rows[0];
+            return row ? toResource(row) : null;
+        },
+        async setResourceParent(params) {
+            if (!isValidIdentity(params.tenantRef) ||
+                !isValidResourceId(params.id) ||
+                (params.parentId !== null && !isValidResourceId(params.parentId))) {
+                throw Object.assign(new Error('Slotlock resource identity is invalid'), {
+                    code: 'invalid_identity',
+                });
+            }
+            if (params.parentId === params.id) {
+                throw Object.assign(new Error('Slotlock resource cannot be a part of itself'), { code: 'composite_too_deep' });
+            }
+            const rows = await guardedWrite(sql, (tx) => tx `
+          UPDATE slotlock.resources SET parent_id = ${params.parentId}::uuid
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
+          RETURNING ${tx.unsafe(RESOURCE_COLUMNS)}, ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}`, { slotlock_resources_parent_fkey: 'parent_not_found' });
             const row = rows[0];
             return row ? toResource(row) : null;
         },
@@ -2512,28 +3096,94 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!isPoolName(params.pool))
                 throw invalidPoolError();
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
-               visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
+        SELECT ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
            AND archived_at IS NULL
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
          ORDER BY id
          LIMIT ${SLOTLOCK_MAX_POOL_MEMBERS}`;
-            return rows.map(toResource);
+            const members = rows.map(toResource);
+            if (params.ordered !== true || members.length < 2)
+                return members;
+            let [settings] = await sql `
+        SELECT member_order, last_member::text FROM slotlock.pool_settings
+         WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}`;
+            if (settings?.member_order === 'round_robin' && params.forBooking === true) {
+                // Read again under the row's lock, held until the booking commits with the place it noted.
+                [settings] = await sql `
+          SELECT member_order, last_member::text FROM slotlock.pool_settings
+           WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
+           FOR UPDATE`;
+            }
+            if (settings?.member_order === 'round_robin') {
+                // From the first member after the one booked last, by id, round to the start.
+                const after = settings.last_member;
+                const next = after === null ? 0 : members.findIndex((member) => member.id > after);
+                const start = next < 0 ? 0 : next;
+                return [...members.slice(start), ...members.slice(0, start)];
+            }
+            if (settings?.member_order === 'least_booked') {
+                // Bookings made on each in the last 30 days, holds and cancelled ones not counted.
+                const counts = await sql `
+          SELECT booked.resource_id::text, count(*)::int AS booked
+            FROM slotlock.reservations booked
+           WHERE booked.tenant_ref = ${params.tenantRef}
+             AND booked.resource_id = ANY (${members.map((member) => member.id)}::uuid[])
+             AND booked.status = 'confirmed'
+             AND booked.created_at > statement_timestamp() - interval '30 days'
+           GROUP BY booked.resource_id`;
+                const booked = new Map(counts.map((row) => [row.resource_id, Number(row.booked)]));
+                // Stable among equals: by id, as the database orders them.
+                return [...members].sort((a, b) => (booked.get(a.id) ?? 0) - (booked.get(b.id) ?? 0) || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+            }
+            return members;
         },
         async listPools(params) {
             if (!isValidIdentity(params.tenantRef))
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             const rows = await sql `
-        SELECT pool_ref AS pool, count(*)::int AS capacity
+        SELECT pool_ref AS pool, count(*)::int AS capacity,
+               COALESCE((SELECT settings.member_order FROM slotlock.pool_settings settings
+                          WHERE settings.tenant_ref = ${params.tenantRef}
+                            AND settings.pool_ref = resources.pool_ref), 'stable') AS member_order
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef} AND pool_ref IS NOT NULL AND archived_at IS NULL
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
          GROUP BY pool_ref
          ORDER BY pool_ref
          LIMIT 1000`;
-            return rows;
+            return rows.map((row) => ({ pool: row.pool, capacity: row.capacity, order: row.member_order }));
+        },
+        async setPoolOrder(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            if (!isPoolName(params.pool))
+                throw invalidPoolError();
+            if (!SLOTLOCK_POOL_ORDERS.includes(params.order)) {
+                throw Object.assign(new Error(`Slotlock pool order must be one of ${SLOTLOCK_POOL_ORDERS.join(', ')}`), {
+                    code: 'invalid_pool_order',
+                });
+            }
+            // At most SLOTLOCK_MAX_POOL_SETTINGS pools a tenant (pool_settings_guard).
+            await guardedWrite(sql, (tx) => tx `
+        INSERT INTO slotlock.pool_settings (tenant_ref, pool_ref, member_order)
+        VALUES (${params.tenantRef}, ${params.pool}, ${params.order})
+        ON CONFLICT (tenant_ref, pool_ref)
+        DO UPDATE SET member_order = EXCLUDED.member_order, updated_at = statement_timestamp()`);
+            return params.order;
+        },
+        async notePoolBooking(params) {
+            if (!isValidIdentity(params.tenantRef))
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            if (!isPoolName(params.pool) || !isValidResourceId(params.resourceId))
+                return;
+            // Only a pool that goes round keeps its place; another has nothing to note.
+            await sql `
+        UPDATE slotlock.pool_settings
+           SET last_member = ${params.resourceId}::uuid, updated_at = statement_timestamp()
+         WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
+           AND member_order = 'round_robin'`;
         },
         async setTenantAvailability(params) {
             if (!isValidIdentity(params.tenantRef)) {
@@ -2565,17 +3215,76 @@ function buildSlotlockStore(sql, options, refusal) {
                     code: 'invalid_cursor',
                 });
             }
+            // The filters are checked as a profile is, so a bad one is refused rather than matching none.
+            const place = params.location === undefined ? null : slotlockGroupingRef('invalid_location', params.location);
+            const group = params.group === undefined ? null : slotlockGroupingRef('invalid_group', params.group);
+            if (params.pool !== undefined && !isPoolName(params.pool))
+                throw invalidPoolError();
+            const pool = params.pool ?? null;
+            const filter = parseSlotlockResourceProfile({
+                ...(params.kind !== undefined ? { kind: params.kind } : {}),
+                ...(params.labels !== undefined ? { labels: params.labels } : {}),
+            });
             const rows = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
+        SELECT ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}
           FROM slotlock.resources
          WHERE tenant_ref = ${params.tenantRef}
            AND (${params.visibility ?? null}::text IS NULL OR visibility = ${params.visibility ?? null})
            AND (${params.includeArchived === true} OR archived_at IS NULL)
            AND (${params.after ?? null}::uuid IS NULL OR id > ${params.after ?? null}::uuid)
+           AND (${filter.kind ?? null}::text IS NULL OR kind = ${filter.kind ?? null}::text)
+           AND (${filter.labels === undefined || filter.labels.length === 0 ? null : filter.labels.join(',')}::text IS NULL
+                OR labels @> pg_catalog.string_to_array(${filter.labels?.join(',') ?? ''}::text, ','))
+           AND (${place}::text IS NULL OR location_ref IN (
+                 WITH RECURSIVE below(ref, steps) AS (
+                   SELECT place.ref, 1 FROM slotlock.locations place
+                    WHERE place.tenant_ref = ${params.tenantRef} AND place.ref = ${place}::text
+                   UNION ALL
+                   SELECT place.ref, below.steps + 1
+                     FROM slotlock.locations place
+                     JOIN below ON place.tenant_ref = ${params.tenantRef} AND place.parent_ref = below.ref
+                    WHERE below.steps <= ${SLOTLOCK_MAX_LOCATION_DEPTH}
+                 )
+                 SELECT ref FROM below))
+           AND (${group}::text IS NULL OR EXISTS (
+                 SELECT 1 FROM slotlock.resource_group_members member
+                  WHERE member.tenant_ref = resources.tenant_ref AND member.resource_id = resources.id
+                    AND member.group_ref = ${group}::text))
+           AND (${pool}::text IS NULL OR pool_ref = ${pool}::text)
          ORDER BY id
          LIMIT ${limit}`;
             return rows.map(toResource);
         },
+        async readUsage(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return readSlotlockTenantUsage(sql, params.tenantRef, params.from, params.to);
+        },
+        async rollUpUsage(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 5_000;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100_000) {
+                throw Object.assign(new Error('Slotlock usage roll-up limit must be 1-100,000'), {
+                    code: 'invalid_limit',
+                });
+            }
+            const [result] = await sql `
+        SELECT slotlock.roll_up_usage(${params.tenantRef}::text, ${limit}::integer) AS read`;
+            return result?.read ?? 0;
+        },
+        async countResources(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
+                    code: 'invalid_identity',
+                });
+            }
+            const [counted] = await sql `
+        SELECT count(*) AS count FROM slotlock.resources WHERE tenant_ref = ${params.tenantRef}`;
+            return Number(counted?.count ?? 0);
+        },
         async archiveResource(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id)) {
                 throw invalidIdentityError('Slotlock resource identity is invalid');
@@ -2586,7 +3295,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET archived_at = COALESCE(archived_at, clock_timestamp())
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             return row ? toResource(row) : null;
         },
         async restoreResource(params) {
@@ -2597,7 +3306,7 @@ function buildSlotlockStore(sql, options, refusal) {
         UPDATE slotlock.resources
            SET archived_at = NULL
          WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
-        RETURNING id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility, archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
+        RETURNING ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}`;
             return row ? toResource(row) : null;
         },
         async deleteResource(params) {
@@ -2651,12 +3360,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 try {
                     return await inTransaction(sql, async (tx) => {
                         const bookingLimit = await tenantLimitReached(tx, await limitTenant(tx, 'reservations', params.resourceId, params.tenantRef), 'reservations');
-                        const [resource] = await tx `
-              SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
-               WHERE id = ${params.resourceId}
-                 AND (${params.tenantRef ?? null}::text IS NULL
-                      OR tenant_ref = ${params.tenantRef ?? null})
-               FOR SHARE`;
+                        const resource = await readResourceForWrite(tx, params.resourceId, params.tenantRef ?? null);
                         if (!resource)
                             return { ok: false, code: 'resource_not_found' };
                         if (resource.archived)
@@ -2678,6 +3382,12 @@ function buildSlotlockStore(sql, options, refusal) {
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
+                        // Writers to this resource take turns from here to the insert (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, params.tenantRef ?? null);
+                        if (!locked)
+                            return { ok: false, code: 'resource_not_found' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
@@ -2775,6 +3485,12 @@ function buildSlotlockStore(sql, options, refusal) {
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
+                        // Writers to this resource take turns from here to the insert (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, params.tenantRef);
+                        if (!locked)
+                            return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               INSERT INTO slotlock.reservations (
@@ -2867,6 +3583,12 @@ function buildSlotlockStore(sql, options, refusal) {
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
+                        // Writers to this resource take turns from here to the insert (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, params.tenantRef);
+                        if (!locked)
+                            return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               UPDATE slotlock.reservations
@@ -3016,6 +3738,16 @@ function buildSlotlockStore(sql, options, refusal) {
                 ...(holderRef !== undefined ? { holderRef } : {}),
             });
             const ttlSeconds = params.ttlMs / 1000;
+            // The holder's caps: the store's, lowered by its key's own (RFC 0004 A5), never raised.
+            const asked = params.holderCaps;
+            const holdCap = Math.min(maxHoldsPerHolder, asked?.maxHolds ?? Number.POSITIVE_INFINITY);
+            const heldHoursCap = asked?.maxHeldHours !== undefined
+                ? Math.min(maxHeldHoursPerHolder ?? Number.POSITIVE_INFINITY, asked.maxHeldHours)
+                : maxHeldHoursPerHolder;
+            if ((asked?.maxHolds !== undefined && !(Number.isSafeInteger(asked.maxHolds) && asked.maxHolds >= 1)) ||
+                (asked?.maxHeldHours !== undefined && !(Number.isSafeInteger(asked.maxHeldHours) && asked.maxHeldHours >= 1))) {
+                return { ok: false, code: 'invalid_identity' };
+            }
             // The buffer asked for, raised to the resource's turnaround, and its rule's leading buffer.
             let written = bufferAfterMs;
             let writtenBefore = 0;
@@ -3043,11 +3775,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             }
                         }
                         const holdLimit = await tenantLimitReached(tx, await limitTenant(tx, 'holds', params.resourceId, tenantRef), 'holds');
-                        const [resource] = await tx `
-              SELECT tenant_ref, archived_at IS NOT NULL AS archived FROM slotlock.resources
-               WHERE id = ${params.resourceId}
-                 AND (${tenantRef ?? null}::text IS NULL OR tenant_ref = ${tenantRef ?? null})
-               FOR SHARE`;
+                        const resource = await readResourceForWrite(tx, params.resourceId, tenantRef ?? null);
                         if (!resource)
                             return { ok: false, code: 'resource_not_found' };
                         if (resource.archived)
@@ -3073,10 +3801,10 @@ function buildSlotlockStore(sql, options, refusal) {
                  WHERE holder_ref = ${holderRef} AND tenant_ref IS NULL AND status = 'held'
                    AND expires_at > statement_timestamp()
                    AND resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef ?? null})`;
-                            if ((held?.count ?? 0) >= maxHoldsPerHolder) {
-                                return { ok: false, code: 'hold_limit_reached', limit: maxHoldsPerHolder };
+                            if ((held?.count ?? 0) >= holdCap) {
+                                return { ok: false, code: 'hold_limit_reached', limit: holdCap };
                             }
-                            if (maxHeldHoursPerHolder !== undefined)
+                            if (heldHoursCap !== undefined)
                                 heldSeconds = held?.seconds ?? 0;
                         }
                         const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
@@ -3086,10 +3814,10 @@ function buildSlotlockStore(sql, options, refusal) {
                         writtenBefore = ruling.bufferBeforeMs;
                         const reach = occupiedTime({ ...params, bufferBeforeMs: writtenBefore, bufferAfterMs: written });
                         if (heldSeconds !== null &&
-                            maxHeldHoursPerHolder !== undefined &&
+                            heldHoursCap !== undefined &&
                             heldSeconds + (reach.end.getTime() - reach.start.getTime()) / 1000 >
-                                maxHeldHoursPerHolder * 3_600) {
-                            return { ok: false, code: 'held_time_limit_reached', limit: maxHeldHoursPerHolder };
+                                heldHoursCap * 3_600) {
+                            return { ok: false, code: 'held_time_limit_reached', limit: heldHoursCap };
                         }
                         if (resource.tenant_ref !== null &&
                             !(await recurrenceCoversWrite(tx, {
@@ -3099,6 +3827,12 @@ function buildSlotlockStore(sql, options, refusal) {
                             }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
+                        // Writers to this resource take turns from here to the insert (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, tenantRef ?? null);
+                        if (!locked)
+                            return { ok: false, code: 'resource_not_found' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await reapExpiredHolds(tx, params.resourceId, reach.start, reach.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
@@ -3160,6 +3894,21 @@ function buildSlotlockStore(sql, options, refusal) {
            AND hold.status = 'held' AND hold.expires_at > statement_timestamp()`;
             return row ? toHold(row) : null;
         },
+        async getHolderHold(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.holderRef)) {
+                throw invalidIdentityError('Slotlock tenant and holder must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.holdId))
+                return null;
+            const [row] = await sql `
+        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+               hold.expires_at, hold.source, hold.expires_at > statement_timestamp() AS live
+          FROM slotlock.reservations hold
+          JOIN slotlock.resources resource ON resource.id = hold.resource_id
+         WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
+           AND hold.status = 'held' AND hold.holder_ref = ${params.holderRef}`;
+            return row ? { hold: toHold(row), live: row.live } : null;
+        },
         async listHolds(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
@@ -3214,6 +3963,276 @@ function buildSlotlockStore(sql, options, refusal) {
                 source: row.source,
             }));
         },
+        async describeBooking(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.id))
+                return null;
+            const [row] = await sql `
+        SELECT booking.resource_id, booking.status, booking.holder_ref,
+               COALESCE(booking.occupied_starts_at, booking.starts_at) AS occupied_start,
+               COALESCE(booking.occupied_ends_at, booking.ends_at) AS occupied_end,
+               event.id AS event_id, event.external_ref AS event_ref, event.owner_ref AS event_owner_ref
+          FROM slotlock.reservations booking
+          JOIN slotlock.resources resource ON resource.id = booking.resource_id
+          LEFT JOIN slotlock.calendar_events event
+            ON event.id = booking.calendar_event_id AND event.tenant_ref = ${params.tenantRef}
+         WHERE booking.id = ${params.id} AND resource.tenant_ref = ${params.tenantRef}`;
+            if (!row)
+                return null;
+            return {
+                id: params.id,
+                resourceId: row.resource_id,
+                status: row.status,
+                holderRef: row.holder_ref,
+                eventId: row.event_id,
+                eventRef: row.event_ref,
+                eventOwnerRef: row.event_owner_ref,
+                start: row.occupied_start,
+                end: row.occupied_end,
+            };
+        },
+        async eventOccupancy(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.ownerRef)) {
+                throw invalidIdentityError('Slotlock tenant and owner must be 1-500 UTF-8 bytes');
+            }
+            const refs = params.externalRefs.filter((ref) => isValidIdentity(ref));
+            if (refs.length === 0)
+                return [];
+            const rows = await sql `
+        SELECT booking.resource_id,
+               COALESCE(booking.occupied_starts_at, booking.starts_at) AS start,
+               COALESCE(booking.occupied_ends_at, booking.ends_at) AS "end",
+               event.recurrence_rule IS NOT NULL AS recurring
+          FROM slotlock.calendar_events event
+          JOIN slotlock.reservations booking ON booking.calendar_event_id = event.id
+         WHERE event.tenant_ref = ${params.tenantRef} AND event.owner_ref = ${params.ownerRef}
+           AND event.external_ref = ANY (${refs}::text[])
+         ORDER BY booking.resource_id, 2, booking.id`;
+            return rows.map((row) => ({ resourceId: row.resource_id, start: row.start, end: row.end, recurring: row.recurring }));
+        },
+        async putApprovalPolicy(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return putApprovalPolicy(sql, params);
+        },
+        async listApprovalPolicies(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return listApprovalPolicies(sql, params.tenantRef);
+        },
+        async deleteApprovalPolicy(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return { deleted: await deleteApprovalPolicy(sql, params.tenantRef, params.ref) };
+        },
+        async approvalPoliciesFor(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return approvalPoliciesFor(sql, params.tenantRef, params.resourceIds);
+        },
+        async requestApproval(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.requesterRef)) {
+                throw invalidIdentityError('Slotlock tenant and requester must be 1-500 UTF-8 bytes');
+            }
+            if (!/^[0-9a-f]{64}$/.test(params.requestKey)) {
+                throw invalidIdentityError('Slotlock approval request key must be 64 hex characters');
+            }
+            if (params.holds.length < 1 ||
+                params.holds.length > SLOTLOCK_MAX_APPROVAL_HOLDS ||
+                params.holds.some((hold) => !isValidResourceId(hold.resourceId) || !(hold.end > hold.start))) {
+                throw invalidIdentityError(`Slotlock approval holds must be 1-${SLOTLOCK_MAX_APPROVAL_HOLDS} intervals on resources`);
+            }
+            const { tenantRef } = params;
+            try {
+                return await inTransaction(sql, async (tx) => {
+                    // Retries of one request wait for each other, so the second answers the first's approval.
+                    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([
+                        'slotlock-approval',
+                        tenantRef,
+                        params.requestKey,
+                    ])}, 0))`;
+                    const prior = await approvalByRequestKey(tx, tenantRef, params.requestKey);
+                    if (prior) {
+                        const [same] = await tx `
+              SELECT request = ${tx.json(params.request)}::jsonb AS same
+                FROM slotlock.approvals WHERE id = ${prior.id}`;
+                        return same?.same
+                            ? { ok: true, approval: prior, replayed: true }
+                            : { ok: false, code: 'idempotency_conflict' };
+                    }
+                    // Counted under a lock on the tenant's approvals, so racing requests stop at the caps.
+                    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-approvals', tenantRef])}, 0))`;
+                    const [pending] = await tx `
+            SELECT count(*)::int AS tenant,
+                   (count(*) FILTER (WHERE requester ->> 'subject' = ${params.requesterRef}))::int AS requester
+              FROM slotlock.approvals
+             WHERE tenant_ref = ${tenantRef} AND status = 'pending' AND expires_at > statement_timestamp()`;
+                    if ((pending?.requester ?? 0) >= SLOTLOCK_MAX_PENDING_APPROVALS_PER_REQUESTER) {
+                        return { ok: false, code: 'approval_limit_reached', limit: SLOTLOCK_MAX_PENDING_APPROVALS_PER_REQUESTER };
+                    }
+                    if ((pending?.tenant ?? 0) >= SLOTLOCK_MAX_PENDING_APPROVALS) {
+                        return { ok: false, code: 'approval_limit_reached', limit: SLOTLOCK_MAX_PENDING_APPROVALS };
+                    }
+                    const id = randomUUID();
+                    // The requester's own hold of the time gives way to the approval's.
+                    if (params.consumeHold && isValidResourceId(params.consumeHold.holdId)) {
+                        await tx `
+              DELETE FROM slotlock.reservations
+               WHERE id = ${params.consumeHold.holdId} AND status = 'held'
+                 AND holder_ref = ${params.consumeHold.holderRef}`;
+                    }
+                    const holds = [...params.holds].sort((left, right) => left.resourceId.localeCompare(right.resourceId) || left.start.getTime() - right.start.getTime());
+                    // Locked as any booking write locks them, in id order, so a racing booking takes turns.
+                    for (const resourceId of [...new Set(holds.map((hold) => hold.resourceId))].sort()) {
+                        await lockResourceForWrite(tx, resourceId, tenantRef);
+                    }
+                    for (const hold of holds)
+                        await reapExpiredHolds(tx, hold.resourceId, hold.start, hold.end);
+                    const held = await tx `
+            INSERT INTO slotlock.reservations (
+              resource_id, starts_at, ends_at, buffer_after_ms, buffer_before_ms, status, expires_at,
+              source, holder_ref, hold_group_id
+            )
+            SELECT wanted.resource_id, wanted.starts_at, wanted.ends_at, 0, 0, 'held', ${params.expiresAt},
+                   'slotlock:approval', ${`approval:${id}`}, ${id}::uuid
+              FROM ROWS FROM (pg_catalog.unnest(${holds.map((hold) => hold.resourceId)}::uuid[]),
+                              pg_catalog.unnest(${holds.map((hold) => hold.start.toISOString())}::text[]::timestamptz[]),
+                              pg_catalog.unnest(${holds.map((hold) => hold.end.toISOString())}::text[]::timestamptz[]))
+                   AS wanted(resource_id, starts_at, ends_at)
+            RETURNING id`;
+                    const [row] = await tx `
+            INSERT INTO slotlock.approvals (
+              id, tenant_ref, policy_ref, operation, request, requester, hold_ids, resource_ids,
+              starts_at, ends_at, request_key, expires_at
+            ) VALUES (
+              ${id}, ${tenantRef}, ${params.policyRef}, ${params.operation}, ${tx.json(params.request)},
+              ${tx.json(params.requester)}, ${held.map((hold) => hold.id)}::uuid[],
+              ${[...new Set(holds.map((hold) => hold.resourceId))]}::uuid[], ${params.start}, ${params.end},
+              ${params.requestKey}, ${params.expiresAt}
+            )
+            RETURNING ${tx.unsafe(APPROVAL_COLUMNS)}`;
+                    if (!row)
+                        throw new Error('slotlock: approval insert returned no row');
+                    const approval = toApproval(row);
+                    await recordApprovalChange(tx, tenantRef, 'approval.requested', approval);
+                    return { ok: true, approval, replayed: false };
+                }, 'read committed');
+            }
+            catch (err) {
+                if (pgCode(err) === EXCLUSION_VIOLATION)
+                    return { ok: false, code: 'overlap' };
+                throw err;
+            }
+        },
+        async findApproval(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!/^[0-9a-f]{64}$/.test(params.requestKey))
+                return null;
+            return approvalByRequestKey(sql, params.tenantRef, params.requestKey);
+        },
+        async getApproval(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return getApproval(sql, params.tenantRef, params.id);
+        },
+        async listApprovals(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 50;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) {
+                throw invalidIdentityError('Slotlock approval list limit must be 1-200');
+            }
+            return listApprovals(sql, {
+                tenantRef: params.tenantRef,
+                limit,
+                ...(params.status !== undefined ? { status: params.status } : {}),
+            });
+        },
+        async beginApprovalGrant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return beginApprovalGrant(sql, params.tenantRef, params.id);
+        },
+        async finishApprovalGrant(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.decidedBy)) {
+                throw invalidIdentityError('Slotlock tenant and decider must be 1-500 UTF-8 bytes');
+            }
+            return finishApprovalGrant(sql, params.tenantRef, params.id, params.decidedBy);
+        },
+        async declineApproval(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.decidedBy)) {
+                throw invalidIdentityError('Slotlock tenant and decider must be 1-500 UTF-8 bytes');
+            }
+            if (params.reason !== undefined && params.reason.length > 500) {
+                throw invalidIdentityError('Slotlock approval reason must be at most 500 characters');
+            }
+            return declineApproval(sql, params);
+        },
+        async resetTestTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!params.tenantRef.endsWith('~test'))
+                throw sandboxTestOnlyError();
+            const rows = await sql `
+        SELECT * FROM slotlock.reset_test_tenant(${params.tenantRef}::text)`.catch((error) => {
+                if (error.hint === 'sandbox_test_only')
+                    throw sandboxTestOnlyError();
+                throw error;
+            });
+            return Object.fromEntries(rows.map((row) => [row.reset_table, Number(row.reset_rows)]));
+        },
+        async fastForwardTestTenant(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!params.tenantRef.endsWith('~test'))
+                throw sandboxTestOnlyError();
+            if (!Number.isSafeInteger(params.minutes) || params.minutes < 1 || params.minutes > 525_600) {
+                throw invalidIdentityError('Slotlock fast-forward is 1 to 525,600 minutes');
+            }
+            const [counted] = await sql `
+        WITH lapsed_holds AS (
+          UPDATE slotlock.reservations hold
+             SET expires_at = statement_timestamp() - interval '1 millisecond'
+           WHERE hold.status = 'held'
+             AND hold.expires_at > statement_timestamp()
+             AND hold.expires_at <= statement_timestamp() + make_interval(mins => ${params.minutes})
+             AND hold.resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${params.tenantRef})
+          RETURNING 1
+        ), lapsed_approvals AS (
+          UPDATE slotlock.approvals
+             SET expires_at = statement_timestamp() - interval '1 millisecond'
+           WHERE tenant_ref = ${params.tenantRef} AND status = 'pending'
+             AND expires_at > statement_timestamp()
+             AND expires_at <= statement_timestamp() + make_interval(mins => ${params.minutes})
+          RETURNING 1
+        )
+        SELECT (SELECT count(*) FROM lapsed_holds)::int AS holds,
+               (SELECT count(*) FROM lapsed_approvals)::int AS approvals`;
+            return { holds: counted?.holds ?? 0, approvals: counted?.approvals ?? 0 };
+        },
+        async expireApprovals(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 100;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) {
+                throw invalidIdentityError('Slotlock approval expiry limit must be 1-1000');
+            }
+            return { expired: await expireApprovals(sql, params.tenantRef, limit) };
+        },
         async getReservation(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.externalRef)) {
                 throw invalidIdentityError('Slotlock booking identity must be 1-500 UTF-8 bytes');
@@ -3270,15 +4289,13 @@ function buildSlotlockStore(sql, options, refusal) {
                 if (bookingTenant !== null)
                     await lockExternalIdentity(tx, bookingTenant, holdId);
                 const bookingLimit = await tenantLimitReached(tx, bookingTenant, 'reservations');
-                // The resource's share lock, as every booking write takes it: an archive waits for this
+                // The resource's lock, as every booking write takes it: an archive waits for this
                 // confirmation.
-                const [resource] = await tx `
-          SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
-           WHERE id = ${owner.resource_id}
-           FOR SHARE`;
+                const resource = await lockResourceForWrite(tx, owner.resource_id, null);
                 const [row] = await tx `
           SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
-                 revision, source, status, (status = 'held' AND expires_at > statement_timestamp()) AS live
+                 revision, source, status, (status = 'held' AND expires_at > statement_timestamp()) AS live,
+                 hold_group_id, holder_ref
             FROM slotlock.reservations
            WHERE id = ${holdId}
            FOR UPDATE`;
@@ -3326,6 +4343,14 @@ function buildSlotlockStore(sql, options, refusal) {
                     buffer_after_ms, revision, source`;
                 if (!confirmed)
                     throw new Error('slotlock: hold confirmation returned no row');
+                // Its linked alternatives (one group, one holder) are released with it, as booking one
+                // from an agent releases the rest.
+                if (row.hold_group_id !== null && row.holder_ref !== null) {
+                    await tx `
+            DELETE FROM slotlock.reservations
+             WHERE status = 'held' AND hold_group_id = ${row.hold_group_id}::uuid
+               AND holder_ref = ${row.holder_ref} AND id <> ${holdId}`;
+                }
                 return { ok: true, reservation: toReservation(confirmed) };
             });
         },
@@ -3388,14 +4413,18 @@ function buildSlotlockStore(sql, options, refusal) {
             // Expired holds are excluded so findNextAvailable can offer their space; the acquiring
             // transaction reaps the row itself.
             const rows = await sql `
-        SELECT COALESCE(occupied_starts_at, starts_at) AS occupied_starts_at,
-               COALESCE(occupied_ends_at, ends_at) AS occupied_ends_at
-          FROM slotlock.reservations
-         WHERE resource_id = ${resourceId}
-           AND ${occupiedStartsBefore(sql, window.end)}
-           AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
-           AND (status <> 'held' OR expires_at > statement_timestamp())
-         ORDER BY COALESCE(occupied_starts_at, starts_at)
+        SELECT occupied_starts_at, occupied_ends_at FROM (
+          SELECT COALESCE(occupied_starts_at, starts_at) AS occupied_starts_at,
+                 COALESCE(occupied_ends_at, ends_at) AS occupied_ends_at
+            FROM slotlock.reservations
+           WHERE resource_id = ${resourceId}
+             AND ${occupiedStartsBefore(sql, window.end)}
+             AND COALESCE(occupied_ends_at, ends_at) > ${window.start}
+             AND (status <> 'held' OR expires_at > statement_timestamp())
+          UNION ALL
+          ${compositeBusy(sql, resourceId, window)}
+        ) busy
+         ORDER BY occupied_starts_at
          LIMIT ${options.limit ?? null}`;
             return rows.map((r) => ({ start: r.occupied_starts_at, end: r.occupied_ends_at }));
         },
@@ -3570,12 +4599,17 @@ function buildSlotlockStore(sql, options, refusal) {
                                 return { ok: false, code: 'hold_not_found' };
                             }
                             const [hold] = await tx `
-                SELECT resource_id, starts_at, ends_at, hold_group_id FROM slotlock.reservations
+                SELECT resource_id, starts_at, ends_at, hold_group_id,
+                       expires_at > statement_timestamp() AS live
+                  FROM slotlock.reservations
                  WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${holderRef}
-                   AND expires_at > statement_timestamp()
                  FOR UPDATE`;
                             if (!hold)
                                 return { ok: false, code: 'hold_not_found' };
+                            // The holder's own hold that lapsed and is not yet reaped: named as the application
+                            // API's confirm names it. Another holder's stays not found.
+                            if (!hold.live)
+                                return { ok: false, code: 'hold_expired' };
                             const [only] = occurrences;
                             if (hold.resource_id !== params.resourceId ||
                                 occurrences.length !== 1 ||
@@ -3677,6 +4711,12 @@ function buildSlotlockStore(sql, options, refusal) {
                         // The normalized children are canonical; the JSON columns above are a compatibility
                         // mirror until older readers retire.
                         await replaceCalendarEventChildren(tx, params.tenantRef, eventId, event);
+                        // Writers to this resource take turns from here to its occupations (lockResourceForWrite).
+                        const locked = await lockResourceForWrite(tx, params.resourceId, params.tenantRef);
+                        if (!locked)
+                            return { ok: false, code: 'resource_tenant_mismatch' };
+                        if (locked.archived)
+                            return { ok: false, code: 'resource_archived' };
                         await replaceCalendarEventOccurrences(tx, {
                             tenantRef: params.tenantRef,
                             eventId,
@@ -4607,14 +5647,15 @@ function buildSlotlockStore(sql, options, refusal) {
                     await tx `
             INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray)
             VALUES (${tenantRef}, ${row.external_ref}, ${revision}, false)`;
+                    // The deletion is the change: the feed's trigger names it reservation.no_show (one change,
+                    // not a cancellation too), by maintenance, with the check-in window it missed.
+                    await tx `
+            SELECT set_config('slotlock.ending', 'no_show', true),
+                   set_config('slotlock.ending_detail', ${String(row.minutes)}, true),
+                   set_config('slotlock.actor', 'slotlock:maintenance', true)`;
                     await tx `DELETE FROM slotlock.reservations WHERE id = ${row.id}`;
                     await tx `
-            INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
-            VALUES (${tenantRef}, ${row.resource_id}, 'reservation.no_show', ${row.external_ref},
-                    jsonb_build_object('id', ${row.id}::uuid, 'reference', ${row.external_ref}::text,
-                                       'resource_id', ${row.resource_id}::uuid, 'revision', ${revision}::bigint,
-                                       'check_in_minutes', ${row.minutes}::int),
-                    'slotlock:maintenance')`;
+            SELECT set_config('slotlock.ending', '', true), set_config('slotlock.ending_detail', '', true)`;
                     return true;
                 });
                 if (done)
@@ -4643,7 +5684,35 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!Number.isSafeInteger(offerTtlMs) || offerTtlMs < 60_000 || offerTtlMs > 86_400_000) {
                 return { ok: false, code: 'invalid_ttl' };
             }
+            const key = params.idempotencyKey;
+            if (key !== undefined && !isValidIdentity(key))
+                return { ok: false, code: 'invalid_identity' };
+            const payloadHash = key === undefined
+                ? null
+                : createHash('sha256')
+                    .update(JSON.stringify([
+                    params.resourceId ?? null,
+                    params.pool ?? null,
+                    window.start.toISOString(),
+                    window.end.toISOString(),
+                    holderRef,
+                    offerTtlMs,
+                ]))
+                    .digest('hex');
             return inTransaction(sql, async (tx) => {
+                // The tenant's waitlist lock first, which offers and every join take: a retry racing its
+                // first finds the entry the first made.
+                await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-waitlist', tenantRef])}, 0))`;
+                if (key !== undefined) {
+                    const [earlier] = await tx `
+            SELECT ${tx.unsafe(WAITLIST_COLUMNS)}, payload_hash FROM slotlock.waitlist_entries
+             WHERE tenant_ref = ${tenantRef} AND idempotency_key = ${key}`;
+                    if (earlier) {
+                        if (earlier.payload_hash !== payloadHash)
+                            return { ok: false, code: 'idempotency_conflict' };
+                        return { ok: true, entry: toWaitlistEntry(earlier), replayed: true };
+                    }
+                }
                 if (params.resourceId !== undefined) {
                     const [resource] = await tx `
             SELECT archived_at IS NOT NULL AS archived FROM slotlock.resources
@@ -4661,9 +5730,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     if (!member)
                         return { ok: false, code: 'pool_not_found' };
                 }
-                // Counted under the tenant's waitlist lock, which offers take too, so racing joins stop at
-                // the cap.
-                await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-waitlist', tenantRef])}, 0))`;
+                // Counted under the tenant's waitlist lock (taken above), which offers take too, so racing
+                // joins stop at the cap.
                 const [counts] = await tx `
           SELECT count(*)::int AS tenant, count(*) FILTER (WHERE holder_ref = ${holderRef})::int AS holder
             FROM slotlock.waitlist_entries WHERE tenant_ref = ${tenantRef} AND status = 'waiting'`;
@@ -4673,11 +5741,12 @@ function buildSlotlockStore(sql, options, refusal) {
                 }
                 const [row] = await tx `
           INSERT INTO slotlock.waitlist_entries
-            (tenant_ref, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms)
+            (tenant_ref, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms,
+             idempotency_key, payload_hash)
           VALUES (${tenantRef}, ${params.resourceId ?? null}, ${params.pool ?? null}, ${window.start},
-                  ${window.end}, ${holderRef}, ${offerTtlMs})
+                  ${window.end}, ${holderRef}, ${offerTtlMs}, ${key ?? null}, ${payloadHash})
           RETURNING ${tx.unsafe(WAITLIST_COLUMNS)}`;
-                return { ok: true, entry: toWaitlistEntry(row) };
+                return { ok: true, entry: toWaitlistEntry(row), replayed: false };
             });
         },
         async listWaitlist(params) {
@@ -4767,6 +5836,17 @@ function buildSlotlockStore(sql, options, refusal) {
         DELETE FROM slotlock.assistant_settings WHERE tenant_ref = ${params.tenantRef} RETURNING 1`;
             return rows.length > 0;
         },
+        async resealAssistantKey(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return false;
+            if (params.to.length === 0 || params.to === params.from)
+                return false;
+            const rows = await sql `
+        UPDATE slotlock.assistant_settings SET sealed_key = ${params.to}
+         WHERE tenant_ref = ${params.tenantRef} AND sealed_key = ${params.from}
+        RETURNING 1`;
+            return rows.length > 0;
+        },
         async getAssistantConversation(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef))
                 return null;
@@ -5029,6 +6109,8 @@ function buildSlotlockStore(sql, options, refusal) {
            AND ${occupiedStartsBefore(sql, window.end, 'reservation')}
            AND COALESCE(reservation.occupied_ends_at, reservation.ends_at) > ${window.start}
            AND (reservation.status <> 'held' OR reservation.expires_at > statement_timestamp())
+        UNION ALL
+        ${compositeBusy(sql, params.resourceId, window)}
          ORDER BY 1
          LIMIT ${MAX_FREE_BUSY_INTERVALS + 1}`;
             if (busyRows.length > MAX_FREE_BUSY_INTERVALS) {
@@ -5147,8 +6229,7 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!isValidResourceId(params.resourceId))
                 throw notFound();
             const [row] = await sql `
-        SELECT id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref, visibility,
-               archived_at, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}, statement_timestamp() AS now
+        SELECT ${sql.unsafe(RESOURCE_COLUMNS)}, ${sql.unsafe(EFFECTIVE_BOOKING_RULES)}, statement_timestamp() AS now
           FROM slotlock.resources
          WHERE id = ${params.resourceId} AND tenant_ref IS NOT DISTINCT FROM ${tenantRef}`;
             if (!row)
@@ -5258,7 +6339,9 @@ function buildSlotlockStore(sql, options, refusal) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             }
             const erased = await sql `
-        SELECT erased_table, erased_rows FROM slotlock.erase_tenant(${params.tenantRef}::text)`;
+        SELECT erased_table, erased_rows FROM slotlock.erase_tenant(${params.tenantRef}::text)`.catch((error) => {
+                throw billingActiveRefusal(error);
+            });
             const rows = {};
             let total = 0;
             for (const row of erased) {
@@ -5276,6 +6359,17 @@ function buildSlotlockStore(sql, options, refusal) {
     };
     return Object.assign(store, Object.fromEntries(SLOTLOCK_TENANT_WRITE_METHODS.map((name) => [name, refuse])));
 }
+/**
+ * erase_tenant refuses a tenant whose plan names a live subscription (`billing_active`): it is
+ * cancelled first, so it does not renew for an erased account.
+ */
+function billingActiveRefusal(error) {
+    if (pgCode(error) !== '55006' || error.hint !== 'billing_active')
+        return error;
+    return Object.assign(new Error('Slotlock tenant has a live subscription: cancel it before erasing the tenant', {
+        cause: error,
+    }), { code: 'billing_active' });
+}
 /** The deployment role alone may suspend: others are refused EXECUTE on the functions. */
 function suspensionRefusal(error) {
     if (pgCode(error) !== '42501')