slotlock 0.8.0 → 0.10.0

package/store.js

@@ -1,16 +1,21 @@
 // DB mechanics for the Slotlock core: explicit `postgres` client in, structured results out.
 import { SLOTLOCK_MAX_LOCATION_DEPTH, SLOTLOCK_MAX_LOCATIONS, SLOTLOCK_MAX_RESOURCE_GROUPS, SLOTLOCK_POOL_ORDERS, SLOTLOCK_RESOURCE_KINDS, isSlotlockResourceScope, parseSlotlockLocation, parseSlotlockResourceGroup, parseSlotlockResourceProfile, slotlockGroupingRef, } from './resource-profile.js';
 import { readSlotlockTenantUsage } from './usage.js';
+import { isSlotlockWorkspaceRole } from './workspace-roles.js';
 import { slotlockPlanReadRefusal } from './plans.js';
 import { SLOTLOCK_CHANGE_ORIGINS, SLOTLOCK_CHANGE_RETENTION_DAYS, isSlotlockChangeOrigin, slotlockEventFeedMethods, } from './event-feed.js';
-import { bookingBufferBeforeMs, bookingSearchBlocked, bookingSearchReach, parseBookingRuleDefaults, parseEffectiveBookingRules, bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
-import { createHash, randomUUID } from 'node:crypto';
+import { cancellationFeeDue, cutoffRuleBroken, bookingBufferBeforeMs, bookingSearchBlocked, bookingSearchReach, parseBookingRuleDefaults, parseEffectiveBookingRules, bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import ICAL from 'ical.js';
-import { SLOTLOCK_CORE_DDL, SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_RESOURCE_SCOPED_TABLES, SLOTLOCK_RESOURCE_SCOPE_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockCoverageChangeRenameSql, slotlockTenantLockKey, } from './ddl.js';
+import { SLOTLOCK_ASSISTANT_CHAT_ID, SLOTLOCK_ASSISTANT_MAX_CHATS, SLOTLOCK_CORE_DDL, SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_RESOURCE_SCOPED_TABLES, SLOTLOCK_RESOURCE_SCOPE_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockCoverageChangeRenameSql, slotlockTenantLockKey, } from './ddl.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
-import { SLOTLOCK_CALENDAR_HORIZON_DAYS, assertBoundedSearchWindow, expandRules, invalidWindowError, } from './rules.js';
+import { SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX, assertBoundedSearchWindow, expandRules, invalidWindowError, } from './rules.js';
 import { CalendarContractError, CalendarExpansionLimitError, expandCalendarEventSeries, normalizeCalendarEventContent, } from './sync.js';
+import { SLOTLOCK_SUBJECT_TABLES, SLOTLOCK_TENANT_EXPORT_TABLES, } from './types.js';
 import { parseAvailabilityRules } from './weekly-hours.js';
+import { applicableHours, exceptionQueryDays } from './hours.js';
+import { zonedDateTimeToUtc } from './timezone.js';
+import { createAvailabilityException, deleteHolidayCalendar, dueHolidayCalendars, importHolidayCalendar, listHolidayCalendars, noteHolidayCalendarFailure, deleteAvailabilityException, getAvailabilityDefaults, listAvailabilityExceptions, rankedExceptions, replaceImportedExceptions, setLocationAvailability, storeTenantAvailability, storedInheritedAvailability, } from './availability-store.js';
 import { APPROVAL_COLUMNS, approvalByRequestKey, approvalPoliciesFor, beginApprovalGrant, declineApproval, deleteApprovalPolicy, expireApprovals, finishApprovalGrant, getApproval, listApprovalPolicies, listApprovals, putApprovalPolicy, recordApprovalChange, toApproval, } from './approvals.js';
 const EXCLUSION_VIOLATION = '23P01';
 /** Holds one approval may own: a bundle's resources, or a move's new time in pieces. */
@@ -31,7 +36,30 @@ const MAX_HOLD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const MAX_BUFFER_AFTER_MS = 30 * 24 * 60 * 60 * 1000;
 /** A day, as bufferBeforeMinutes allows: a read by start can then still use the index. */
 const MAX_BUFFER_BEFORE_MS = 24 * 60 * 60 * 1000;
-export { SLOTLOCK_CALENDAR_HORIZON_DAYS };
+/** An audit action: `area.verb` (or `area.thing.verb`), lowercase. */
+const AUDIT_ACTION = /^[a-z][a-z_]{0,31}(\.[a-z][a-z_]{0,31}){1,2}$/;
+const AUDIT_TARGET_TYPE = /^[a-z][a-z_]{0,31}$/;
+const AUDIT_ACTOR_TYPES = new Set(['person', 'api_key', 'assistant', 'system']);
+/** Text cut to at most `max` UTF-8 bytes on a character boundary; null when absent or empty. */
+function cutBytes(value, max) {
+    if (value === undefined || value === '')
+        return null;
+    if (Buffer.byteLength(value, 'utf8') <= max)
+        return value;
+    let out = '';
+    for (const character of value) {
+        if (Buffer.byteLength(out + character, 'utf8') > max)
+            break;
+        out += character;
+    }
+    return out === '' ? null : out;
+}
+/** Audit metadata kept under the column's 4 KB: past it, the event says it was cut. */
+function boundAuditMetadata(metadata) {
+    const text = JSON.stringify(metadata);
+    return text !== undefined && Buffer.byteLength(text, 'utf8') <= 3_000 ? metadata : { truncated: true };
+}
+export { SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX };
 /**
  * Longest one-off event (ten years and some leap days); a recurring series is bounded by its
  * materialization window instead.
@@ -690,6 +718,9 @@ function validateExternalCommand(params) {
     if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.externalRef)) {
         return { ok: false, code: 'invalid_identity' };
     }
+    if (params.overrideReason !== undefined && !isValidOverrideReason(params.overrideReason)) {
+        return { ok: false, code: 'invalid_identity' };
+    }
     if (!Number.isSafeInteger(params.bufferAfterMs) ||
         params.bufferAfterMs < 0 ||
         params.bufferAfterMs > MAX_BUFFER_AFTER_MS) {
@@ -698,8 +729,91 @@ function validateExternalCommand(params) {
     if (!Number.isSafeInteger(params.revision) || params.revision <= 0) {
         return { ok: false, code: 'invalid_revision' };
     }
+    if (params.contactRef !== undefined && !isValidContactRef(params.contactRef)) {
+        return { ok: false, code: 'invalid_contact_ref' };
+    }
+    if (params.notify !== undefined && typeof params.notify !== 'boolean') {
+        return { ok: false, code: 'invalid_notify' };
+    }
+    if (params.reminderMinutes !== undefined &&
+        (!Array.isArray(params.reminderMinutes) ||
+            params.reminderMinutes.length > 5 ||
+            new Set(params.reminderMinutes).size !== params.reminderMinutes.length ||
+            params.reminderMinutes.some((minutes) => !Number.isSafeInteger(minutes) || minutes < 0 || minutes > 527_040))) {
+        return { ok: false, code: 'invalid_reminders' };
+    }
     return null;
 }
+/** A booking's reminders as stored: sorted, latest first; null for none. */
+function reminderColumn(minutes) {
+    return minutes && minutes.length > 0 ? [...minutes].sort((a, b) => b - a) : null;
+}
+/** A recipient's reference (RFC 0004 P3): what the contacts table and a booking name a person by. */
+const CONTACT_REF = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
+function isValidContactRef(value) {
+    return typeof value === 'string' && CONTACT_REF.test(value);
+}
+/** The most contacts a tenant keeps (RFC 0004 P3). */
+export const SLOTLOCK_MAX_CONTACTS_PER_TENANT = 100_000;
+const E164 = /^\+[1-9][0-9]{6,14}$/;
+const LOCALE = /^[a-z]{2,3}(-[A-Za-z0-9]{2,8})*$/;
+const CONTACT_COLUMNS = 'ref, name, email, phone, whatsapp, consent, consent_at, locale, created_at, updated_at';
+function toContact(row) {
+    const consent = {};
+    for (const channel of ['email', 'sms', 'whatsapp']) {
+        const answer = row.consent?.[channel];
+        if (typeof answer === 'boolean')
+            consent[channel] = answer;
+    }
+    const consentAt = {};
+    for (const channel of ['email', 'sms', 'whatsapp']) {
+        const at = row.consent_at?.[channel];
+        if (typeof at === 'string' && channel in consent)
+            consentAt[channel] = new Date(at);
+    }
+    return {
+        ref: row.ref,
+        name: row.name,
+        email: row.email,
+        phone: row.phone,
+        whatsapp: row.whatsapp,
+        consent,
+        consentAt,
+        locale: row.locale,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+/** A contact's fields as the table's CHECK takes them, or null when one is not. */
+function contactFields(params) {
+    const text = (value, valid) => {
+        if (value === undefined || value === null)
+            return null;
+        if (typeof value !== 'string' || !valid(value))
+            return undefined;
+        return value;
+    };
+    const name = text(params.name, (value) => value.length >= 1 && value.length <= 200 && !/[\u0000-\u001f\u007f]/.test(value));
+    const email = text(params.email, (value) => value.length >= 3 && value.length <= 320 && /^[^\s@]+@[^\s@]+$/.test(value));
+    const phone = text(params.phone, (value) => E164.test(value));
+    const whatsapp = text(params.whatsapp, (value) => E164.test(value));
+    const locale = text(params.locale, (value) => value.length <= 35 && LOCALE.test(value));
+    if (name === undefined || email === undefined || phone === undefined || whatsapp === undefined || locale === undefined) {
+        return null;
+    }
+    const consent = {};
+    if (params.consent !== undefined) {
+        if (typeof params.consent !== 'object' || params.consent === null || Array.isArray(params.consent))
+            return null;
+        for (const [channel, answer] of Object.entries(params.consent)) {
+            if ((channel !== 'email' && channel !== 'sms' && channel !== 'whatsapp') || typeof answer !== 'boolean') {
+                return null;
+            }
+            consent[channel] = answer;
+        }
+    }
+    return { name, email, phone, whatsapp, consent, locale };
+}
 function toReservation(row) {
     return {
         id: row.id,
@@ -711,8 +825,19 @@ function toReservation(row) {
         bufferAfterMs: Number(row.buffer_after_ms),
         revision: Number(row.revision),
         source: row.source,
+        ...(row.contact_ref ? { contactRef: row.contact_ref } : {}),
+        ...(row.notify === false ? { notify: false } : {}),
+        ...(row.reminder_minutes?.length ? { reminderMinutes: row.reminder_minutes.map(Number) } : {}),
     };
 }
+/** A hold's payment columns, as every read of one names them. */
+const HOLD_PAYMENT_COLUMNS = 'payment_required, payment_ref, paid_at, payment_amount_minor, payment_currency, paid_amount_minor, paid_currency';
+const HOLD_PAYMENT_COLUMNS_OF_HOLD = HOLD_PAYMENT_COLUMNS.split(', ')
+    .map((column) => `hold.${column}`)
+    .join(', ');
+function amountOf(minor, currency) {
+    return minor === null || minor === undefined || !currency ? null : { amountMinor: Number(minor), currency };
+}
 function toHold(row) {
     return {
         id: row.id,
@@ -723,8 +848,35 @@ function toHold(row) {
         expiresAt: row.expires_at,
         source: row.source,
         ...(row.hold_group_id ? { groupId: row.hold_group_id } : {}),
+        ...(row.payment_required
+            ? {
+                paymentRequired: true,
+                paymentRef: row.payment_ref ?? null,
+                paidAt: row.paid_at ?? null,
+                paymentAmount: amountOf(row.payment_amount_minor, row.payment_currency),
+                paidAmount: amountOf(row.paid_amount_minor, row.paid_currency),
+            }
+            : {}),
     };
 }
+/** The longest a hold that waits for payment may live (RFC 0004 C3): 30 minutes. */
+export const SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS = 30 * 60 * 1000;
+/** An amount in a currency's minor unit (cents), and its ISO 4217 code: what a hold's payment is. */
+function isValidAmount(value) {
+    const amount = value;
+    return (typeof amount === 'object' &&
+        amount !== null &&
+        Number.isSafeInteger(amount.amountMinor) &&
+        amount.amountMinor >= 0 &&
+        amount.amountMinor <= 1_000_000_000_000 &&
+        typeof amount.currency === 'string' &&
+        /^[A-Z]{3}$/.test(amount.currency));
+}
+/** A payment's reference as the integrator's processor names it: 1-255 printable bytes. */
+function isValidPaymentRef(value) {
+    return (typeof value === 'string' &&
+        /^[\x21-\x7e]{1,255}$/.test(value));
+}
 function pageCursor(after) {
     if (after !== undefined &&
         (!(after.start instanceof Date) ||
@@ -748,6 +900,169 @@ function pageLimit(limit) {
 function sandboxTestOnlyError() {
     return Object.assign(new Error('Slotlock does this only in a test environment (a tenant ending ~test)'), { code: 'sandbox_test_only' });
 }
+/** Columns an export leaves out of a table it holds: secrets, and leases only a server reads. */
+const TENANT_EXPORT_LEFT_OUT_COLUMNS = {
+    webhook_endpoints: ['secret', 'lease_token', 'lease_until'],
+    assistant_settings: ['sealed_key'],
+};
+/**
+ * Every table an export holds, as one statement (so one snapshot): each row as its table's name
+ * and a JSON line, without the tenant. `$1` is the tenant. A hold keeps no tenant of its own: its
+ * resource's is its. API keys come from slotlock.list_api_keys, which holds no digest.
+ */
+const TENANT_EXPORT_SQL = SLOTLOCK_TENANT_EXPORT_TABLES.map((table) => {
+    if (table === 'api_keys') {
+        return `SELECT 'api_keys'::text AS table_name, (pg_catalog.to_jsonb(kept) - 'key_tenant_ref')::text AS line
+  FROM slotlock.list_api_keys($1) kept`;
+    }
+    const dropped = ['tenant_ref', ...(TENANT_EXPORT_LEFT_OUT_COLUMNS[table] ?? [])].map((column) => ` - '${column}'`).join('');
+    const where = table === 'reservations'
+        ? `kept.tenant_ref = $1 OR (kept.tenant_ref IS NULL AND kept.resource_id IN (
+           SELECT owned.id FROM slotlock.resources owned WHERE owned.tenant_ref = $1))`
+        : 'kept.tenant_ref = $1';
+    return `SELECT '${table}'::text AS table_name, (pg_catalog.to_jsonb(kept)${dropped})::text AS line
+  FROM slotlock.${table} kept WHERE ${where}`;
+}).join('\nUNION ALL\n');
+/**
+ * Read everything the tenant keeps through one cursor (one snapshot), handing each part (one
+ * table's rows, up to SLOTLOCK_TENANT_EXPORT_PART_ROWS or about a megabyte) to `onPart`.
+ */
+async function readTenantExport(tx, tenantRef, onPart) {
+    const totals = { rows: 0, bytes: 0, tables: {} };
+    let current = null;
+    const flush = async () => {
+        if (current && current.lines.length > 0)
+            await onPart(current);
+        current = null;
+    };
+    await tx.unsafe(`DECLARE slotlock_tenant_export NO SCROLL CURSOR FOR\n${TENANT_EXPORT_SQL}`, [tenantRef]);
+    for (;;) {
+        const rows = await tx.unsafe('FETCH 1000 FROM slotlock_tenant_export');
+        if (rows.length === 0)
+            break;
+        for (const row of rows) {
+            const open = current;
+            if (open &&
+                (open.table !== row.table_name ||
+                    open.lines.length >= SLOTLOCK_TENANT_EXPORT_PART_ROWS ||
+                    open.bytes >= TENANT_EXPORT_PART_BYTES)) {
+                await flush();
+            }
+            current ??= { table: row.table_name, lines: [], bytes: 0 };
+            const bytes = Buffer.byteLength(row.line) + 1;
+            current.lines.push(row.line);
+            current.bytes += bytes;
+            totals.rows += 1;
+            totals.bytes += bytes;
+            totals.tables[row.table_name] = (totals.tables[row.table_name] ?? 0) + 1;
+        }
+    }
+    await flush();
+    await tx.unsafe('CLOSE slotlock_tenant_export');
+    return totals;
+}
+function toTenantExport(row) {
+    return {
+        id: row.id,
+        status: row.status,
+        requestedBy: row.requested_by,
+        createdAt: row.created_at,
+        finishedAt: row.finished_at,
+        expiresAt: row.expires_at,
+        parts: row.parts,
+        rows: Number(row.row_count),
+        bytes: Number(row.bytes),
+        tables: row.tables,
+        error: row.error,
+    };
+}
+function tenantExportRefusal(code) {
+    const message = {
+        export_in_progress: 'Slotlock builds one export of a tenant at a time: wait for the one asked for',
+        export_limit_reached: `Slotlock keeps at most ${SLOTLOCK_MAX_TENANT_EXPORTS} exports of a tenant: delete one first`,
+        export_too_large: `Slotlock exports at most ${SLOTLOCK_TENANT_EXPORT_MAX_BYTES / 1024 / 1024} MB through the API: its operator runs slotlock tenant export`,
+    }[code];
+    return Object.assign(new Error(message), { code });
+}
+/** A subject request's email: one address, compared without case. */
+const SUBJECT_EMAIL = /^[^\s@]+@[^\s@]+$/;
+/** Whom a subject request names, checked; null when it names none, more than one, or a bad one. */
+function subjectKey(subject) {
+    if (typeof subject !== 'object' || subject === null)
+        return null;
+    const named = Object.entries(subject).filter(([, value]) => value !== undefined);
+    if (named.length !== 1)
+        return null;
+    const [kind, raw] = named[0];
+    if (typeof raw !== 'string')
+        return null;
+    if (kind === 'email') {
+        const value = raw.trim().toLowerCase();
+        const bytes = Buffer.byteLength(value);
+        return bytes >= 3 && bytes <= 320 && SUBJECT_EMAIL.test(value) ? { kind, value } : null;
+    }
+    if (kind === 'contact')
+        return isValidContactRef(raw) ? { kind, value: raw } : null;
+    if (kind === 'holder' || kind === 'reference')
+        return isValidIdentity(raw) ? { kind, value: raw } : null;
+    return null;
+}
+function invalidSubjectError() {
+    return Object.assign(new Error('Slotlock names a person by exactly one of email, holder, contact or reference'), { code: 'invalid_subject' });
+}
+function emptySubjectCounts() {
+    return Object.fromEntries(SLOTLOCK_SUBJECT_TABLES.map((table) => [table, 0]));
+}
+/** The request fields an approval may keep a booking's or an event's reference in. */
+const SUBJECT_REFERENCE_KEYS = ['reference', 'reservation_ref', 'external_ref', 'event_ref'];
+/** The approvals whose request names the subject (SQL, on `approval`). */
+function subjectApprovalSql(tx, key, contactRefs) {
+    const value = key.value;
+    switch (key.kind) {
+        case 'email':
+            return tx `(lower(approval.request -> 'organizer' ->> 'email') = ${value}
+                 OR (jsonb_typeof(approval.request -> 'attendees') = 'array'
+                     AND EXISTS (SELECT 1 FROM jsonb_array_elements(approval.request -> 'attendees') AS attendee(value)
+                                  WHERE lower(attendee.value ->> 'email') = ${value}))
+                 OR approval.request ->> 'contact_ref' = ANY(${contactRefs}::text[]))`;
+        case 'holder':
+            return tx `approval.request ->> 'holder_ref' = ${value}`;
+        case 'contact':
+            return tx `approval.request ->> 'contact_ref' = ${value}`;
+        case 'reference':
+            return tx `EXISTS (SELECT 1 FROM unnest(${[...SUBJECT_REFERENCE_KEYS]}::text[]) AS field(name)
+                         WHERE approval.request ->> field.name = ${value})`;
+    }
+}
+/** An approval's request with the subject taken out (SQL, on `approval`). */
+function subjectScrubbedRequestSql(tx, key, contactRefs, replacement) {
+    const value = key.value;
+    switch (key.kind) {
+        case 'email':
+            return tx `(
+        SELECT CASE WHEN lower(kept.request -> 'organizer' ->> 'email') = ${value} THEN kept.request - 'organizer'
+                    ELSE kept.request END
+          FROM (SELECT CASE
+                         WHEN jsonb_typeof(scrubbed.request -> 'attendees') = 'array'
+                         THEN jsonb_set(scrubbed.request, '{attendees}', coalesce((
+                           SELECT jsonb_agg(attendee.value ORDER BY attendee.ordinality)
+                             FROM jsonb_array_elements(scrubbed.request -> 'attendees')
+                                  WITH ORDINALITY AS attendee(value, ordinality)
+                            WHERE lower(attendee.value ->> 'email') IS DISTINCT FROM ${value}), '[]'::jsonb))
+                         ELSE scrubbed.request END AS request
+                  FROM (SELECT CASE WHEN approval.request ->> 'contact_ref' = ANY(${contactRefs}::text[])
+                                    THEN approval.request - 'contact_ref' ELSE approval.request END AS request) scrubbed) kept)`;
+        case 'holder':
+            return tx `jsonb_set(approval.request, '{holder_ref}', to_jsonb(${replacement}::text))`;
+        case 'contact':
+            return tx `approval.request - 'contact_ref'`;
+        case 'reference':
+            return tx `(
+        SELECT approval.request || coalesce(jsonb_object_agg(field.name, to_jsonb(${replacement}::text)), '{}'::jsonb)
+          FROM unnest(${[...SUBJECT_REFERENCE_KEYS]}::text[]) AS field(name)
+         WHERE approval.request ->> field.name = ${value})`;
+    }
+}
 function invalidIdentityError(message) {
     return Object.assign(new Error(message), { code: 'invalid_identity' });
 }
@@ -1072,6 +1387,7 @@ function putCommandValue(params) {
         source: params.command.source ?? null,
         // Only when present, so a create without a hold keeps its hash.
         ...(params.command.fromHold ? { fromHold: params.command.fromHold.holdId } : {}),
+        ...(params.command.notify === false ? { notify: false } : {}),
         event: {
             ...params.event,
             start: params.event.start.toISOString(),
@@ -1191,8 +1507,255 @@ async function bookingRuling(tx, resourceId, interval, defaultHours) {
         rule: judge.broken(interval),
         turnaroundMs: judge.turnaroundMs,
         bufferBeforeMs: judge.bufferBeforeMs,
+        holdPrice: judge.holdPrice,
     };
 }
+/**
+ * The wall time a reservation says it starts at (RFC 0004 B9), when it names `start` in the
+ * resource's zone; `undefined` when none was given; null when it is not one or names another
+ * instant.
+ */
+async function localStartFor(tx, resourceId, localStart, start) {
+    if (localStart === undefined)
+        return undefined;
+    const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2}))?$/.exec(localStart);
+    if (!match)
+        return null;
+    const [row] = await tx `SELECT timezone FROM slotlock.resources WHERE id = ${resourceId}`;
+    if (!row)
+        return null;
+    try {
+        const [, year, month, day, hour, minute, second] = match.map((part) => (part === undefined ? 0 : Number(part)));
+        const named = zonedDateTimeToUtc({ year: year, month: month, day: day, hour: hour, minute: minute, second: second }, row.timezone);
+        return named.getTime() === start.getTime() ? `${localStart.length === 16 ? `${localStart}:00` : localStart}` : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether a source's reported busy time (RFC 0004 C1) meets [start, end) on the resource: read
+ * under the resource's write lock, which a source's replacement takes too.
+ */
+async function sourceBusyLoss(tx, resourceId, start, end) {
+    const [hit] = await tx `
+    SELECT 1 FROM slotlock.source_busy
+     WHERE resource_id IN (${compositeKin(tx, resourceId)}) AND starts_at < ${end} AND ends_at > ${start}
+     LIMIT 1`;
+    return hit !== undefined;
+}
+/**
+ * The resources whose busy time keeps this one busy (RFC 0003 G8, RFC 0004 C1), as a subquery: it,
+ * its composite if it is a part (the whole is in use), and its parts if it is a composite (a part
+ * in use takes the whole). Never its sibling parts, which are booked apart.
+ */
+function compositeKin(executor, resourceId) {
+    return executor `
+    SELECT ${resourceId}::uuid
+    UNION ALL
+    SELECT parent_id FROM slotlock.resources WHERE id = ${resourceId}::uuid AND parent_id IS NOT NULL
+    UNION ALL
+    SELECT id FROM slotlock.resources WHERE parent_id = ${resourceId}::uuid`;
+}
+/**
+ * A source's busy time as kept: each interval valid, clipped to the window, sorted and merged
+ * (touching ones too). Null when any is not an interval, or there are too many.
+ */
+function mergeSourceBusy(busy, window) {
+    if (!Array.isArray(busy) || busy.length > SLOTLOCK_SOURCE_BUSY_MAX)
+        return null;
+    const clipped = [];
+    for (const interval of busy) {
+        const start = interval?.start;
+        const end = interval?.end;
+        if (!(start instanceof Date) || !(end instanceof Date))
+            return null;
+        if (!Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || end <= start)
+            return null;
+        const from = Math.max(start.getTime(), window.start.getTime());
+        const to = Math.min(end.getTime(), window.end.getTime());
+        if (to > from)
+            clipped.push({ start: new Date(from), end: new Date(to) });
+    }
+    return mergeIntervals(clipped);
+}
+/** An entry's offer: the hold made for it, said on the entry and the feed. */
+async function recordWaitlistOffer(tx, tenantRef, entry, offer) {
+    await tx `
+    UPDATE slotlock.waitlist_entries
+       SET status = 'offered', hold_id = ${offer.holdId}, offered_resource_id = ${offer.resourceId},
+           offered_at = statement_timestamp()
+     WHERE id = ${entry.id}`;
+    await tx `
+    INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+    VALUES (${tenantRef}, ${offer.resourceId}, 'waitlist.offered', ${entry.id},
+            jsonb_strip_nulls(jsonb_build_object(
+              'id', ${entry.id}::uuid, 'hold_id', ${offer.holdId}::uuid,
+              'resource_id', ${offer.resourceId}::uuid, 'pool', ${entry.pool_ref}::text,
+              'start', ${offer.start}::timestamptz, 'end', ${offer.end}::timestamptz,
+              'expires_at', ${offer.expiresAt}::timestamptz,
+              'holder_ref', ${entry.holder_ref}::text)),
+            'slotlock:maintenance')`;
+}
+/**
+ * The earliest slot of the entry's length within its window, from now, on its resource or any
+ * member of its pool (by id), held for its holder: what is busy is read with each resource's
+ * buffers, and the hold itself still meets the booking rules and the constraint. Null when none.
+ */
+async function offerSlotOfLength(tx, inner, tenantRef, entry) {
+    const durationMs = Number(entry.duration_ms);
+    const candidates = await tx `
+    SELECT resources.id,
+           COALESCE(least(greatest((effective.effective_booking_rules->>'bufferBeforeMinutes')::numeric, 0), 1440)::int, 0) * 60000
+             AS before_ms,
+           COALESCE(least(greatest((effective.effective_booking_rules->>'turnaroundMinutes')::numeric, 0), 10080)::int, 0) * 60000
+             AS after_ms,
+           statement_timestamp() AS now
+      FROM slotlock.resources, LATERAL (SELECT ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}) effective
+     WHERE resources.tenant_ref = ${tenantRef} AND resources.archived_at IS NULL
+       AND (resources.id = ${entry.resource_id}::uuid
+            OR (${entry.resource_id}::uuid IS NULL AND resources.pool_ref = ${entry.pool_ref}))
+     ORDER BY resources.id
+     LIMIT ${OFFER_CANDIDATES}`;
+    for (const candidate of candidates) {
+        const from = new Date(Math.ceil(Math.max(entry.starts_at.getTime(), candidate.now.getTime()) / 60_000) * 60_000);
+        if (from.getTime() + durationMs > entry.ends_at.getTime())
+            continue;
+        const reach = {
+            start: new Date(from.getTime() - Number(candidate.before_ms) - 86_400_000),
+            end: new Date(entry.ends_at.getTime() + Number(candidate.after_ms) + 86_400_000),
+        };
+        // Bookings and holds, a composite's parent's or parts' claims, and calendars' busy time.
+        const busy = await tx `
+      SELECT occupied_starts_at AS start, occupied_ends_at AS end FROM (
+        SELECT COALESCE(occupied_starts_at, starts_at) AS occupied_starts_at,
+               COALESCE(occupied_ends_at, ends_at) AS occupied_ends_at
+          FROM slotlock.reservations
+         WHERE resource_id = ${candidate.id}
+           AND tstzrange(COALESCE(occupied_starts_at, starts_at), COALESCE(occupied_ends_at, ends_at), '[)')
+               && tstzrange(${reach.start}::timestamptz, ${reach.end}::timestamptz, '[)')
+           AND (status <> 'held' OR expires_at > statement_timestamp())
+        UNION ALL
+        ${compositeBusy(tx, candidate.id, reach)}
+        UNION ALL
+        ${sourceBusy(tx, candidate.id, reach)}
+      ) busy`;
+        // A slot [s, s + d) with its buffers occupies [s - before, s + d + after).
+        const blocked = busy.map((taken) => ({
+            start: new Date(taken.start.getTime() - Number(candidate.after_ms)),
+            end: new Date(taken.end.getTime() + Number(candidate.before_ms)),
+        }));
+        const slot = findNextAvailable({
+            busy: blocked,
+            windows: [{ start: from, end: entry.ends_at }],
+            durationMs,
+            align: (start) => new Date(Math.ceil(start.getTime() / 60_000) * 60_000),
+        });
+        if (!slot)
+            continue;
+        const hold = await inner.acquireHold({
+            resourceId: candidate.id,
+            start: slot.start,
+            end: slot.end,
+            ttlMs: Number(entry.offer_ttl_ms),
+            tenantRef,
+            holderRef: entry.holder_ref,
+            source: 'slotlock:waitlist',
+        });
+        if (!hold.ok)
+            continue;
+        return { resourceId: candidate.id, holdId: hold.hold.id, start: slot.start, end: slot.end, expiresAt: hold.hold.expiresAt };
+    }
+    return null;
+}
+/** An admin's reason for going past a cutoff (RFC 0004 B5): 1-500 characters, no control characters. */
+function isValidOverrideReason(value) {
+    return typeof value === 'string' && /^[^\u0000-\u001f\u007f]{1,500}$/u.test(value) && value.trim() !== '';
+}
+/**
+ * A resource's effective booking rules and the database clock: what a cancellation or a move is
+ * judged by (RFC 0004 B5). Rules that do not read refuse nothing here.
+ */
+async function rulesNow(tx, resourceId) {
+    const [row] = await tx `
+    SELECT ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}, statement_timestamp() AS now
+      FROM slotlock.resources WHERE id = ${resourceId}`;
+    if (!row)
+        return { rules: undefined, now: new Date() };
+    if (row.effective_booking_rules === null || row.effective_booking_rules === undefined)
+        return { rules: undefined, now: row.now };
+    return { rules: parseEffectiveBookingRules(row.effective_booking_rules).rules, now: row.now };
+}
+/**
+ * Mark what the next change of a booking records on the feed (RFC 0004 B5): a cancellation's fee
+ * and an admin's reason for going past a cutoff. Cleared with nulls.
+ */
+/**
+ * Whether a paid hold ended without a booking (RFC 0004 C3), so its payment was never applied:
+ * not booked (confirmed, or booked from), not still held, and not taken over by an approval that
+ * was granted or may still be.
+ */
+async function paidHoldEnded(tx, tenantRef, payment) {
+    if (payment.booked_at)
+        return false;
+    const [hold] = await tx `
+    SELECT status, expires_at > statement_timestamp() AS live FROM slotlock.reservations WHERE id = ${payment.id}`;
+    if (hold)
+        return hold.status === 'held' && !hold.live;
+    if (payment.approval_id) {
+        const [approval] = await tx `
+      SELECT status, expires_at > statement_timestamp() AS live FROM slotlock.approvals
+       WHERE id = ${payment.approval_id}::uuid AND tenant_ref = ${tenantRef}`;
+        if (approval?.status === 'granted')
+            return false;
+        if (approval?.status === 'pending' && approval.live)
+            return false;
+    }
+    return true;
+}
+/**
+ * Whether cancelling a booking that starts at `start` would be late now (RFC 0004 B5): past its
+ * cancel cutoff, or inside the window its cancellation fee is due in. A move made then keeps that
+ * start as the booking's cutoff anchor, so a move cannot take it out of what a cancellation owes.
+ */
+function cancellationLate(rules, start, now) {
+    return (cutoffRuleBroken(rules, 'cancel', start, now) !== null ||
+        (rules?.cancellationFee?.withinMinutes !== undefined && cancellationFeeDue(rules, start, now) !== null));
+}
+/** The start a cancellation is judged from: the cutoff anchor a late move kept, if earlier. */
+function cancellationStart(start, anchor) {
+    return anchor && anchor.getTime() < start.getTime() ? anchor : start;
+}
+async function noteEnding(tx, fee, overrideReason) {
+    await tx `
+    SELECT set_config('slotlock.cancellation_fee', ${fee ? JSON.stringify(fee) : ''}, true),
+           set_config('slotlock.override_reason', ${overrideReason ?? ''}, true)`;
+}
+/**
+ * Whether a one-off event may be cancelled now under its resource's cancel cutoff (RFC 0004 B5),
+ * and the fee a late cancellation records, marked for the feed. A series is not held to the cutoff:
+ * cancelling it cancels what is still to come.
+ */
+async function eventEnding(tx, event, enforce, overrideReason) {
+    if (event.recurring)
+        return { ok: true, fee: null };
+    const judged = await rulesNow(tx, event.resource_id);
+    // From the start it had when a late move kept it, if one did.
+    const start = cancellationStart(event.starts_at, event.cutoff_anchor);
+    let note = null;
+    if (enforce && cutoffRuleBroken(judged.rules, 'cancel', start, judged.now)) {
+        if (overrideReason === undefined) {
+            return { ok: false, refusal: { ok: false, code: 'booking_rule_violated', rule: 'cancel_cutoff' } };
+        }
+        note = overrideReason;
+    }
+    const due = cancellationFeeDue(judged.rules, start, judged.now);
+    const fee = due ? { amountMinor: due.amountMinor, currency: due.currency } : null;
+    await noteEnding(tx, fee ? { amount_minor: fee.amountMinor, currency: fee.currency } : null, note);
+    return { ok: true, fee };
+}
+/** How long busy time a calendar reported is kept after it ended: the feed's retention. */
+const SOURCE_BUSY_RETENTION_DAYS = 30;
 /** How recently a sync must have read a resource whose booking rules require certainty. */
 const CERTAIN_COVERAGE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /**
@@ -1201,25 +1764,35 @@ const CERTAIN_COVERAGE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
  */
 async function bookingJudge(tx, resourceId, defaultHours) {
     const [row] = await tx `
-    SELECT ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}, availability_rules, timezone,
-           statement_timestamp() AS now
+    SELECT ${tx.unsafe(EFFECTIVE_BOOKING_RULES)}, availability_rules,
+           CASE WHEN resources.availability_rules IS NULL
+                THEN slotlock.inherited_availability(resources.tenant_ref, resources.location_ref) END
+             AS inherited_availability,
+           timezone, statement_timestamp() AS now,
+           to_char((statement_timestamp() AT TIME ZONE 'UTC')::date - 2, 'YYYY-MM-DD') AS today
       FROM slotlock.resources WHERE id = ${resourceId}`;
     if (!row || row.effective_booking_rules === null || row.effective_booking_rules === undefined) {
-        return { broken: () => null, turnaroundMs: 0, bufferBeforeMs: 0 };
+        return { broken: () => null, turnaroundMs: 0, bufferBeforeMs: 0, holdPrice: undefined };
     }
-    const { effectiveBookingRules: rules, availabilityRules } = toResource({
+    const resource = toResource({
         id: resourceId,
         external_ref: null,
         tenant_ref: null,
         timezone: row.timezone,
         availability_rules: row.availability_rules,
+        inherited_availability: row.inherited_availability,
         booking_rules: null,
         pool_ref: null,
         visibility: 'shared',
         archived_at: null,
         effective_booking_rules: row.effective_booking_rules,
     });
-    const hours = availabilityRules ?? defaultHours;
+    const rules = resource.effectiveBookingRules;
+    const hours = applicableHours(resource, defaultHours).rules;
+    // Enforced hours read the exceptions from two days back (a zone is at most fourteen hours from UTC).
+    const exceptions = rules?.enforceHours === true
+        ? ((await rankedExceptions(tx, [resourceId], { from: row.today })).get(resourceId) ?? [])
+        : [];
     const coverage = rules?.requireCertain === true
         ? await tx `
           SELECT starts_at, ends_at,
@@ -1246,11 +1819,13 @@ async function bookingJudge(tx, resourceId, defaultHours) {
             rules: checks.first ? rules : later,
             timezone: row.timezone,
             hours,
+            exceptions,
             interval,
             now: row.now,
         }) ?? (uncertain(interval) ? 'uncertain' : null),
         turnaroundMs,
         bufferBeforeMs,
+        holdPrice: rules?.holdPrice,
     };
 }
 function sameExternalPayload(row, params, turnaroundMs = 0) {
@@ -1262,6 +1837,29 @@ function sameExternalPayload(row, params, turnaroundMs = 0) {
         Number(row.revision) === params.revision &&
         row.source === (params.source ?? null));
 }
+/**
+ * What a holder holds in the tenant, live: its own holds, and those of approvals it asked for that
+ * a person has yet to decide (RFC 0004 A4), which hold time for it just the same. Counted for its
+ * caps under the holder's lock. `except` leaves out a hold about to give way to an approval.
+ */
+async function holderHeld(tx, tenantRef, holderRef, except) {
+    const [held] = await tx `
+    SELECT count(*)::int AS count,
+           COALESCE(sum(extract(epoch FROM
+             ends_at + (buffer_after_ms + buffer_before_ms) * interval '1 millisecond'
+               - starts_at)), 0)::float8
+             AS seconds
+      FROM slotlock.reservations
+     WHERE tenant_ref IS NULL AND status = 'held'
+       AND expires_at > statement_timestamp()
+       AND resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef})
+       AND (${except ?? null}::uuid IS NULL OR id <> ${except ?? null}::uuid)
+       AND (holder_ref = ${holderRef}
+            OR holder_ref IN (SELECT 'approval:' || approval.id FROM slotlock.approvals approval
+                               WHERE approval.tenant_ref = ${tenantRef} AND approval.status = 'pending'
+                                 AND approval.requester ->> 'holder_ref' = ${holderRef}))`;
+    return { count: held?.count ?? 0, seconds: held?.seconds ?? 0 };
+}
 async function lockExternalIdentity(tx, tenantRef, externalRef) {
     // JSON is unambiguous for this pair and has no NUL byte (Postgres text rejects U+0000).
     await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([tenantRef, externalRef])}, 0))`;
@@ -1324,7 +1922,7 @@ function pgCode(err) {
 export const SLOTLOCK_MAX_POOL_MEMBERS = 100;
 /** The most pools of one tenant that may have default booking rules (`setBookingRuleDefaults`). */
 export const SLOTLOCK_MAX_POOL_RULE_DEFAULTS = 1_000;
-const WAITLIST_COLUMNS = 'id, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms, status, hold_id, offered_resource_id, offered_at, created_at';
+const WAITLIST_COLUMNS = 'id, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms, status, hold_id, offered_resource_id, offered_at, created_at, duration_ms, decided_at';
 function toWaitlistEntry(row) {
     return {
         id: row.id,
@@ -1339,6 +1937,8 @@ function toWaitlistEntry(row) {
         offeredResourceId: row.offered_resource_id,
         offeredAt: row.offered_at,
         createdAt: row.created_at,
+        durationMs: row.duration_ms === null ? null : Number(row.duration_ms),
+        decidedAt: row.decided_at,
     };
 }
 export function isPoolName(value) {
@@ -1353,6 +1953,9 @@ function invalidPoolError() {
 const RESOURCE_COLUMNS = `id, external_ref, tenant_ref, timezone, availability_rules, booking_rules, pool_ref,
   visibility, archived_at, name, description, kind, capacity, labels, attributes, location_ref,
   parent_id, part_index,
+  CASE WHEN resources.availability_rules IS NULL
+       THEN slotlock.inherited_availability(resources.tenant_ref, resources.location_ref) END
+    AS inherited_availability,
   (SELECT place.name FROM slotlock.locations place
     WHERE place.tenant_ref = resources.tenant_ref AND place.ref = resources.location_ref) AS location_name,
   ARRAY(SELECT member.group_ref FROM slotlock.resource_group_members member
@@ -1432,6 +2035,11 @@ function toResource(row) {
             resource.availabilityRules = [];
         }
     }
+    if (resource.availabilityRules === undefined) {
+        const inherited = storedInheritedAvailability(row.inherited_availability);
+        if (inherited)
+            resource.inheritedAvailability = inherited;
+    }
     if (row.booking_rules !== null && row.booking_rules !== undefined) {
         // Written validated; anything else refuses every booking, never as no rule.
         resource.bookingRules = storedBookingRules(row.booking_rules);
@@ -1640,6 +2248,24 @@ async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
         cursor: row.recurrence_cursor ?? null,
         stored: true,
     });
+    // Busy time a calendar reported (RFC 0004 C1) is refused to a rolled occurrence as an overlap is:
+    // nothing is written, the series is put off, and the roll counts it a conflict.
+    if ((event.transparency ?? 'opaque') === 'opaque' && occurrences.length > 0) {
+        const beforeMs = Number(row.buffer_before_ms ?? 0);
+        const afterMs = Number(row.buffer_after_ms ?? 0);
+        const [met] = await tx `
+      SELECT 1
+        FROM slotlock.source_busy busy
+        JOIN ROWS FROM (
+               pg_catalog.unnest(${occurrences.map((each) => new Date(each.start.getTime() - beforeMs).toISOString())}::text[]::timestamptz[]),
+               pg_catalog.unnest(${occurrences.map((each) => new Date(each.end.getTime() + afterMs).toISOString())}::text[]::timestamptz[]))
+             AS occurrence(starts_at, ends_at)
+          ON busy.starts_at < occurrence.ends_at AND busy.ends_at > occurrence.starts_at
+       WHERE busy.resource_id IN (${compositeKin(tx, row.resource_id)})
+       LIMIT 1`;
+        if (met)
+            throw Object.assign(new Error('slotlock: a rolled occurrence meets reported busy time'), { code: EXCLUSION_VIOLATION });
+    }
     await replaceCalendarEventOccurrences(tx, {
         tenantRef,
         eventId: row.id,
@@ -1815,6 +2441,35 @@ async function rollSeriesBehind(executor, resourceId, start, end, exceptEventId)
         // Rolled back whole (its own transaction, or a savepoint of the caller's).
     }
 }
+/** An audit event as the API and `slotlock audit export` give it: snake_case, nulls kept. */
+export function slotlockAuditEventRecord(event) {
+    return {
+        id: event.id,
+        occurred_at: event.occurredAt.toISOString(),
+        action: event.action,
+        actor_type: event.actorType,
+        actor_ref: event.actorRef,
+        actor_role: event.actorRole ?? null,
+        target_type: event.targetType ?? null,
+        target_ref: event.targetRef ?? null,
+        outcome: event.outcome,
+        reason: event.reason ?? null,
+        ip_address: event.ipAddress ?? null,
+        user_agent: event.userAgent ?? null,
+        metadata: event.metadata,
+        chain_index: event.chainIndex,
+        hash: event.hash,
+    };
+}
+/** Hours a tenant export is kept once ready, or since it was asked for if it never is. */
+export const SLOTLOCK_TENANT_EXPORT_HOURS = 24;
+/** The most a tenant export holds: past it, the export fails (`export_too_large`). */
+export const SLOTLOCK_TENANT_EXPORT_MAX_BYTES = 512 * 1024 * 1024;
+/** The most exports a tenant keeps at once. */
+export const SLOTLOCK_MAX_TENANT_EXPORTS = 5;
+/** A part of an export: one table's rows, at most this many, or about this many bytes. */
+export const SLOTLOCK_TENANT_EXPORT_PART_ROWS = 5_000;
+const TENANT_EXPORT_PART_BYTES = 1024 * 1024;
 const MAX_TENANT_LIMIT = 10_000_000;
 function tenantLimitsOption(limits) {
     const valid = {};
@@ -2097,6 +2752,18 @@ function compositeBusy(executor, resourceId, window) {
        AND claim.during && tstzrange(${window.start}, ${window.end}, '[)')
        AND (claim.status <> 'held' OR claim.expires_at > statement_timestamp())`;
 }
+/**
+ * Busy time calendars reported without their events (RFC 0004 C1) that meets `window`, as
+ * (occupied_starts_at, occupied_ends_at): every read of a resource's busy time unions it in, as
+ * every write refuses it (sourceBusyLoss), so a time offered is a time the write accepts.
+ */
+function sourceBusy(executor, resourceId, window) {
+    return executor `
+    SELECT busy.starts_at AS occupied_starts_at, busy.ends_at AS occupied_ends_at
+      FROM slotlock.source_busy busy
+     WHERE busy.resource_id IN (${compositeKin(executor, resourceId)})
+       AND busy.starts_at < ${window.end} AND busy.ends_at > ${window.start}`;
+}
 /**
  * Structured answer after losing to the EXCLUDE arbiter: name the live winner.
  * conflictingReservationId is null in one narrow race (the blocker expired between the constraint
@@ -2206,6 +2873,24 @@ export function createTenantSlots(max) {
 function lockTimeoutError(cause) {
     return Object.assign(new Error('Slotlock tenant transaction waited too long for a lock: retry later', { cause }), { code: 'lock_timeout' });
 }
+/**
+ * Build a pending tenant export (RFC 0004 D3) in its own tenant transaction, and mark it failed if
+ * that fails (`export_too_large`, else `export_failed`). Null when it was not pending, or another
+ * server is building it. Never throws: a server builds it after answering, and maintenance builds
+ * one left pending.
+ */
+export async function buildSlotlockTenantExport(store, tenantRef, exportId) {
+    try {
+        return await store.withTenant(tenantRef, (tenant) => tenant.buildTenantExport({ tenantRef, exportId }));
+    }
+    catch (error) {
+        const reason = error?.code === 'export_too_large' ? 'export_too_large' : 'export_failed';
+        await store
+            .withTenant(tenantRef, (tenant) => tenant.failTenantExport({ tenantRef, exportId, error: reason }))
+            .catch(() => undefined);
+        return null;
+    }
+}
 export function createSlotlockStore(sql, options = {}) {
     return buildSlotlockStore(sql, options, null);
 }
@@ -2241,18 +2926,31 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'declineApproval',
     'resetTestTenant',
     'fastForwardTestTenant',
+    'storeTenantAvailability',
     'setTenantAvailability',
+    'setLocationAvailability',
+    'createAvailabilityException',
+    'deleteAvailabilityException',
+    'replaceImportedExceptions',
+    'importHolidayCalendar',
+    'deleteHolidayCalendar',
+    'noteHolidayCalendarFailure',
     'createReservation',
     'createExternalReservation',
     'rescheduleExternalReservation',
     'cancelExternalReservation',
     'acquireHold',
+    'markHoldPaid',
+    'putContact',
+    'deleteContact',
     'confirmHold',
     'releaseHold',
     'putCalendarEvent',
     'cancelCalendarEvent',
     'cancelCalendarEventById',
     'recordCalendarCoverage',
+    'replaceSourceBusy',
+    'reportCoverageConflict',
     'createWebhookEndpoint',
     'deleteWebhookEndpoint',
     'enableWebhookEndpoint',
@@ -2261,12 +2959,14 @@ export const SLOTLOCK_TENANT_WRITE_METHODS = Object.freeze([
     'checkInReservation',
     'joinWaitlist',
     'leaveWaitlist',
+    'declineWaitlistOffer',
     'putAssistantSettings',
     'deleteAssistantSettings',
     'resealAssistantKey',
-    'putAssistantConversation',
+    'putAssistantChat',
+    'renameAssistantChat',
     'settleAssistantAction',
-    'deleteAssistantConversation',
+    'deleteAssistantChat',
 ]);
 function tenantSuspendedError() {
     return Object.assign(new Error('Slotlock tenant is suspended: it may read, and write nothing'), {
@@ -2348,6 +3048,9 @@ function buildSlotlockStore(sql, options, refusal) {
         retentionDays,
         maxHoldsPerHolder,
         ...(maxHeldHoursPerHolder !== undefined ? { maxHeldHoursPerHolder } : {}),
+        // The server's hours judge a tenant's writes too: without them, enforced hours would refuse
+        // every booking on a resource that inherits nothing.
+        ...(options.defaultAvailabilityRules !== undefined ? { defaultAvailabilityRules: options.defaultAvailabilityRules } : {}),
     };
     /**
      * Under the tenant's lock for `kind`: the limit when the tenant is at it, else null. Writes that
@@ -3185,18 +3888,75 @@ function buildSlotlockStore(sql, options, refusal) {
          WHERE tenant_ref = ${params.tenantRef} AND pool_ref = ${params.pool}
            AND member_order = 'round_robin'`;
         },
+        async storeTenantAvailability(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
+                    code: 'invalid_identity',
+                });
+            }
+            // What `matching` compares with is read in the same transaction as what replaces it.
+            return inTransaction(sql, (tx) => storeTenantAvailability(tx, params), 'read committed');
+        },
         async setTenantAvailability(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
                     code: 'invalid_identity',
                 });
             }
-            const rules = availabilityParameter(sql, params.rules);
-            const updated = await sql `
-        UPDATE slotlock.resources
-           SET availability_rules = ${rules}::jsonb
-         WHERE tenant_ref = ${params.tenantRef}`;
-            return updated.count;
+            const stored = await inTransaction(sql, (tx) => storeTenantAvailability(tx, { tenantRef: params.tenantRef, rules: params.rules, overrideResources: 'all' }), 'read committed');
+            return stored.inheriting;
+        },
+        async setLocationAvailability(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
+                    code: 'invalid_identity',
+                });
+            }
+            return setLocationAvailability(sql, params);
+        },
+        async getAvailabilityDefaults(params) {
+            return getAvailabilityDefaults(sql, params);
+        },
+        async createAvailabilityException(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
+                    code: 'invalid_identity',
+                });
+            }
+            return createAvailabilityException(sql, params);
+        },
+        async listAvailabilityExceptions(params) {
+            return listAvailabilityExceptions(sql, params);
+        },
+        async deleteAvailabilityException(params) {
+            return deleteAvailabilityException(sql, params);
+        },
+        async replaceImportedExceptions(params) {
+            return replaceImportedExceptions(sql, params);
+        },
+        async importHolidayCalendar(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw Object.assign(new Error('Slotlock tenant reference must be 1-500 UTF-8 bytes'), {
+                    code: 'invalid_identity',
+                });
+            }
+            // The calendar, its holidays and what it dropped, all or none.
+            return inTransaction(sql, (tx) => importHolidayCalendar(tx, params), 'read committed');
+        },
+        async listHolidayCalendars(params) {
+            return listHolidayCalendars(sql, params);
+        },
+        async deleteHolidayCalendar(params) {
+            return inTransaction(sql, (tx) => deleteHolidayCalendar(tx, params), 'read committed');
+        },
+        async dueHolidayCalendars(params) {
+            return dueHolidayCalendars(sql, params);
+        },
+        async noteHolidayCalendarFailure(params) {
+            return noteHolidayCalendarFailure(sql, params);
+        },
+        async availabilityExceptionsFor(params) {
+            return rankedExceptions(sql, params.resourceIds, exceptionQueryDays(params.window));
         },
         async listResources(params) {
             if (!isValidIdentity(params.tenantRef)) {
@@ -3388,6 +4148,9 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'resource_not_found' };
                         if (locked.archived)
                             return { ok: false, code: 'resource_archived' };
+                        // Busy time a calendar reported without its events (RFC 0004 C1) is refused as a booking's is.
+                        if (await sourceBusyLoss(tx, params.resourceId, occupied.start, occupied.end))
+                            return { ok: false, code: 'overlap', conflictingReservationId: null };
                         await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
@@ -3400,7 +4163,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 ${params.source ?? null}
               )
               RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
-                        buffer_after_ms, revision, source`;
+                        buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes`;
                         if (!row)
                             throw new Error('slotlock: reservation insert returned no row');
                         return { ok: true, reservation: toReservation(row) };
@@ -3446,7 +4209,7 @@ function buildSlotlockStore(sql, options, refusal) {
                         // holds.
                         const existing = await tx `
               SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
-                     buffer_after_ms, revision, source
+                     buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes
                 FROM slotlock.reservations
                WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
                  AND calendar_event_id IS NULL
@@ -3485,24 +4248,31 @@ function buildSlotlockStore(sql, options, refusal) {
                         }))) {
                             return { ok: false, code: 'recurrence_not_materialized' };
                         }
+                        const wall = await localStartFor(tx, params.resourceId, params.localStart, params.start);
+                        if (wall === null)
+                            return { ok: false, code: 'invalid_local_start' };
                         // Writers to this resource take turns from here to the insert (lockResourceForWrite).
                         const locked = await lockResourceForWrite(tx, params.resourceId, params.tenantRef);
                         if (!locked)
                             return { ok: false, code: 'resource_tenant_mismatch' };
                         if (locked.archived)
                             return { ok: false, code: 'resource_archived' };
+                        // Busy time a calendar reported without its events (RFC 0004 C1) is refused as a booking's is.
+                        if (await sourceBusyLoss(tx, params.resourceId, occupied.start, occupied.end))
+                            return { ok: false, code: 'overlap', conflictingReservationId: null };
                         await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               INSERT INTO slotlock.reservations (
                 resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
-                buffer_before_ms, revision, source
+                buffer_before_ms, revision, source, wall_starts_at, contact_ref, notify, reminder_minutes
               ) VALUES (
                 ${params.resourceId}, ${params.tenantRef}, ${params.externalRef}, ${params.start},
                 ${params.end}, ${bufferAfterMs}, ${writtenBefore}, ${params.revision},
-                ${params.source ?? null}
+                ${params.source ?? null}, ${wall ?? null}::timestamp, ${params.contactRef ?? null},
+                ${params.notify ?? true}, ${reminderColumn(params.reminderMinutes)}::integer[]
               )
               RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
-                        buffer_after_ms, revision, source`;
+                        buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes`;
                         const row = rows[0];
                         if (!row)
                             throw new Error('slotlock: external reservation insert returned no row');
@@ -3538,7 +4308,7 @@ function buildSlotlockStore(sql, options, refusal) {
                         await lockExternalIdentity(tx, params.tenantRef, params.externalRef);
                         const existing = await tx `
               SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
-                     buffer_after_ms, revision, source
+                     buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes, cutoff_anchor
                 FROM slotlock.reservations
                WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
                  AND calendar_event_id IS NULL
@@ -3566,6 +4336,26 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (params.revision !== currentRevision + 1) {
                             return { ok: false, code: 'revision_conflict' };
                         }
+                        // A move in time or to another resource, past the booking's reschedule cutoff (RFC 0004
+                        // B5), only with an admin's reason.
+                        const moved = found.starts_at.getTime() !== params.start.getTime() ||
+                            found.ends_at.getTime() !== params.end.getTime() ||
+                            found.resource_id !== params.resourceId;
+                        let overrideNote = null;
+                        let cutoffAnchor = found.cutoff_anchor;
+                        if (moved) {
+                            const judged = await rulesNow(tx, found.resource_id);
+                            if (cutoffRuleBroken(judged.rules, 'reschedule', found.starts_at, judged.now)) {
+                                if (params.overrideReason === undefined) {
+                                    return { ok: false, code: 'booking_rule_violated', rule: 'reschedule_cutoff' };
+                                }
+                                overrideNote = params.overrideReason;
+                            }
+                            // Moved when cancelling would already be late: it stays as late as it was.
+                            const from = cancellationStart(found.starts_at, cutoffAnchor);
+                            if (cancellationLate(judged.rules, from, judged.now))
+                                cutoffAnchor = from;
+                        }
                         const resourceState = await tenantResourceState(tx, params.resourceId, params.tenantRef);
                         if (resourceState === 'missing')
                             return { ok: false, code: 'resource_tenant_mismatch' };
@@ -3573,6 +4363,11 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'resource_archived' };
                         if (ruling.rule)
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
+                        if (overrideNote !== null)
+                            await noteEnding(tx, null, overrideNote);
+                        const wall = await localStartFor(tx, params.resourceId, params.localStart, params.start);
+                        if (wall === null)
+                            return { ok: false, code: 'invalid_local_start' };
                         bufferAfterMs = Math.max(params.bufferAfterMs, ruling.turnaroundMs);
                         bufferBeforeMs = ruling.bufferBeforeMs;
                         const occupied = occupiedTime({ ...params, bufferBeforeMs, bufferAfterMs });
@@ -3589,6 +4384,9 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'resource_tenant_mismatch' };
                         if (locked.archived)
                             return { ok: false, code: 'resource_archived' };
+                        // Busy time a calendar reported without its events (RFC 0004 C1) is refused as a booking's is.
+                        if (await sourceBusyLoss(tx, params.resourceId, occupied.start, occupied.end))
+                            return { ok: false, code: 'overlap', conflictingReservationId: null };
                         await reapExpiredHolds(tx, params.resourceId, occupied.start, occupied.end);
                         const rows = await tx `
               UPDATE slotlock.reservations
@@ -3599,14 +4397,22 @@ function buildSlotlockStore(sql, options, refusal) {
                      buffer_before_ms = ${bufferBeforeMs},
                      revision = ${params.revision},
                      source = ${params.source ?? null},
+                     -- Whom to tell, and whether (RFC 0004 P3): as sent, like the rest.
+                     contact_ref = ${params.contactRef ?? null},
+                     notify = ${params.notify ?? true},
+                     reminder_minutes = ${reminderColumn(params.reminderMinutes)}::integer[],
+                     -- The wall time it now says it starts at, if any (RFC 0004 B9).
+                     wall_starts_at = ${wall ?? null}::timestamp,
+                     zone_shift_reported_at = NULL,
                      -- A check-in is for the time it was made for: a move to another start clears it.
                      checked_in_at = CASE
                        WHEN starts_at = ${params.start} AND resource_id = ${params.resourceId}
                        THEN checked_in_at
-                     END
+                     END,
+                     cutoff_anchor = ${cutoffAnchor ?? null}::timestamptz
                WHERE id = ${found.id}
                RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
-                         buffer_after_ms, revision, source`;
+                         buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes`;
                         const row = rows[0];
                         if (!row)
                             throw new Error('slotlock: external reservation update returned no row');
@@ -3633,6 +4439,9 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.externalRef)) {
                 return { ok: false, code: 'invalid_identity' };
             }
+            if (params.overrideReason !== undefined && !isValidOverrideReason(params.overrideReason)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
             if (!Number.isSafeInteger(params.revision) || params.revision <= 0) {
                 return { ok: false, code: 'invalid_revision' };
             }
@@ -3653,11 +4462,15 @@ function buildSlotlockStore(sql, options, refusal) {
                         : { ok: false, code: 'reservation_cancelled' };
                 }
                 const existing = await tx `
-          SELECT id, revision FROM slotlock.reservations
+          SELECT id, revision, resource_id, starts_at, cutoff_anchor FROM slotlock.reservations
            WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
              AND calendar_event_id IS NULL
            FOR UPDATE`;
                 const found = existing[0];
+                // Past its cancel cutoff a booking is cancelled only with an admin's reason, and a late
+                // cancellation records its fee (RFC 0004 B5).
+                let fee = null;
+                let overrideNote = null;
                 if (found) {
                     const currentRevision = Number(found.revision);
                     if (params.revision <= currentRevision)
@@ -3665,6 +4478,16 @@ function buildSlotlockStore(sql, options, refusal) {
                     if (params.revision !== currentRevision + 1) {
                         return { ok: false, code: 'revision_conflict' };
                     }
+                    const judged = await rulesNow(tx, found.resource_id);
+                    // From the start it had when a late move kept it, if one did.
+                    const start = cancellationStart(found.starts_at, found.cutoff_anchor);
+                    if (cutoffRuleBroken(judged.rules, 'cancel', start, judged.now)) {
+                        if (params.overrideReason === undefined) {
+                            return { ok: false, code: 'booking_rule_violated', rule: 'cancel_cutoff' };
+                        }
+                        overrideNote = params.overrideReason;
+                    }
+                    fee = cancellationFeeDue(judged.rules, start, judged.now);
                 }
                 if (!found) {
                     // This reference is a calendar event's occupation, not a booking: nothing to cancel or
@@ -3683,14 +4506,25 @@ function buildSlotlockStore(sql, options, refusal) {
                 }
                 // A reference no booking holds yet is retired too, so a create delivered after its cancel
                 // cannot bring it back.
+                const recorded = fee ? { amount_minor: fee.amountMinor, currency: fee.currency } : null;
                 await tx `
-          INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray)
-          VALUES (${params.tenantRef}, ${params.externalRef}, ${params.revision}, ${!found})`;
+          INSERT INTO slotlock.reservation_tombstones (
+            tenant_ref, external_ref, revision, stray, end_reason, cancellation_fee, override_reason
+          )
+          VALUES (${params.tenantRef}, ${params.externalRef}, ${params.revision}, ${!found}, 'cancelled',
+                  ${recorded ? tx.json(recorded) : null}::jsonb, ${overrideNote})`;
                 if (!found)
                     return { ok: true, cancelled: false, revision: params.revision };
+                await noteEnding(tx, recorded, overrideNote);
                 const deleted = await tx `
           DELETE FROM slotlock.reservations WHERE id = ${found.id} RETURNING id`;
-                return { ok: true, cancelled: deleted.length === 1, revision: params.revision };
+                await noteEnding(tx, null, null);
+                return {
+                    ok: true,
+                    cancelled: deleted.length === 1,
+                    revision: params.revision,
+                    ...(fee ? { cancellationFee: { amountMinor: fee.amountMinor, currency: fee.currency } } : {}),
+                };
             });
         },
         async acquireHold(params) {
@@ -3702,6 +4536,16 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!Number.isFinite(params.ttlMs) || params.ttlMs <= 0 || params.ttlMs > MAX_HOLD_TTL_MS) {
                 return { ok: false, code: 'invalid_ttl' };
             }
+            const paymentRequired = params.paymentRequired === true;
+            if (params.paymentRequired !== undefined && typeof params.paymentRequired !== 'boolean') {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            if (paymentRequired && params.ttlMs > SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS) {
+                return { ok: false, code: 'invalid_ttl' };
+            }
+            if (params.payment !== undefined && (!paymentRequired || !isValidAmount(params.payment))) {
+                return { ok: false, code: 'invalid_payment' };
+            }
             const bufferAfterMs = params.bufferAfterMs ?? 0;
             if (!Number.isSafeInteger(bufferAfterMs) ||
                 bufferAfterMs < 0 ||
@@ -3736,6 +4580,8 @@ function buildSlotlockStore(sql, options, refusal) {
                 source: params.source ?? null,
                 ...(params.groupId !== undefined ? { groupId: params.groupId } : {}),
                 ...(holderRef !== undefined ? { holderRef } : {}),
+                ...(paymentRequired ? { paymentRequired } : {}),
+                ...(params.payment ? { payment: params.payment } : {}),
             });
             const ttlSeconds = params.ttlMs / 1000;
             // The holder's caps: the store's, lowered by its key's own (RFC 0004 A5), never raised.
@@ -3764,7 +4610,14 @@ function buildSlotlockStore(sql, options, refusal) {
                             const [prior] = await tx `
                 SELECT hold_id AS id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at,
                        source, payload_hash,
-                       (SELECT hold_group_id FROM slotlock.reservations WHERE id = hold_id) AS hold_group_id
+                       (SELECT hold_group_id FROM slotlock.reservations WHERE id = hold_id) AS hold_group_id,
+                       (SELECT payment_required FROM slotlock.reservations WHERE id = hold_id) AS payment_required,
+                       (SELECT payment_ref FROM slotlock.reservations WHERE id = hold_id) AS payment_ref,
+                       (SELECT paid_at FROM slotlock.reservations WHERE id = hold_id) AS paid_at,
+                       (SELECT payment_amount_minor FROM slotlock.reservations WHERE id = hold_id) AS payment_amount_minor,
+                       (SELECT payment_currency FROM slotlock.reservations WHERE id = hold_id) AS payment_currency,
+                       (SELECT paid_amount_minor FROM slotlock.reservations WHERE id = hold_id) AS paid_amount_minor,
+                       (SELECT paid_currency FROM slotlock.reservations WHERE id = hold_id) AS paid_currency
                   FROM slotlock.hold_commands
                  WHERE tenant_ref = ${tenantRef ?? null} AND principal_ref = ${principalRef ?? null}
                    AND idempotency_key = ${idempotencyKey ?? null}`;
@@ -3782,6 +4635,24 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'resource_archived' };
                         if (holdLimit !== null)
                             return { ok: false, code: 'hold_limit_reached', limit: holdLimit };
+                        // An agent's hold takes the tenant's price, never its own (RFC 0004 C3).
+                        let holdPaymentRequired = paymentRequired;
+                        let holdPayment = params.payment;
+                        let holdTtlSeconds = ttlSeconds;
+                        // The resource's rules, read once: its price here, the rest judged below.
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
+                        if (params.priceFromRules === true) {
+                            const price = ruling.holdPrice;
+                            if (params.payment !== undefined &&
+                                (!price || price.amountMinor !== params.payment.amountMinor || price.currency !== params.payment.currency)) {
+                                return { ok: false, code: 'payment_price_mismatch' };
+                            }
+                            if (price) {
+                                holdPaymentRequired = true;
+                                holdPayment = { amountMinor: price.amountMinor, currency: price.currency };
+                                holdTtlSeconds = Math.min(ttlSeconds, SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS / 1000);
+                            }
+                        }
                         let heldSeconds = null;
                         if (holderRef !== undefined) {
                             // Counted under a lock on the holder, so racing holds stop at the cap: an agent
@@ -3791,23 +4662,13 @@ function buildSlotlockStore(sql, options, refusal) {
                                 tenantRef,
                                 holderRef,
                             ])}, 0))`;
-                            const [held] = await tx `
-                SELECT count(*)::int AS count,
-                       COALESCE(sum(extract(epoch FROM
-                         ends_at + (buffer_after_ms + buffer_before_ms) * interval '1 millisecond'
-                           - starts_at)), 0)::float8
-                         AS seconds
-                  FROM slotlock.reservations
-                 WHERE holder_ref = ${holderRef} AND tenant_ref IS NULL AND status = 'held'
-                   AND expires_at > statement_timestamp()
-                   AND resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef ?? null})`;
-                            if ((held?.count ?? 0) >= holdCap) {
+                            const held = await holderHeld(tx, tenantRef ?? null, holderRef);
+                            if (held.count >= holdCap) {
                                 return { ok: false, code: 'hold_limit_reached', limit: holdCap };
                             }
                             if (heldHoursCap !== undefined)
-                                heldSeconds = held?.seconds ?? 0;
+                                heldSeconds = held.seconds;
                         }
-                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
                         if (ruling.rule)
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
                         written = Math.max(bufferAfterMs, ruling.turnaroundMs);
@@ -3833,18 +4694,23 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'resource_not_found' };
                         if (locked.archived)
                             return { ok: false, code: 'resource_archived' };
+                        // Busy time a calendar reported without its events (RFC 0004 C1) is refused as a booking's is.
+                        if (await sourceBusyLoss(tx, params.resourceId, reach.start, reach.end))
+                            return { ok: false, code: 'overlap', conflictingReservationId: null };
                         await reapExpiredHolds(tx, params.resourceId, reach.start, reach.end);
                         const [row] = await tx `
               INSERT INTO slotlock.reservations (
                 resource_id, starts_at, ends_at, buffer_after_ms, buffer_before_ms, status,
-                expires_at, source, holder_ref, hold_group_id
+                expires_at, source, holder_ref, hold_group_id, payment_required,
+                payment_amount_minor, payment_currency
               ) VALUES (
                 ${params.resourceId}, ${params.start}, ${params.end}, ${written}, ${writtenBefore}, 'held',
-                statement_timestamp() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null},
-                ${holderRef ?? null}, ${params.groupId ?? null}
+                statement_timestamp() + make_interval(secs => ${holdTtlSeconds}), ${params.source ?? null},
+                ${holderRef ?? null}, ${params.groupId ?? null}, ${holdPaymentRequired},
+                ${holdPayment?.amountMinor ?? null}, ${holdPayment?.currency ?? null}
               )
               RETURNING id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at, source,
-                        hold_group_id`;
+                        hold_group_id, ${tx.unsafe(HOLD_PAYMENT_COLUMNS)}`;
                         if (!row)
                             throw new Error('slotlock: hold insert returned no row');
                         if (keyed) {
@@ -3879,50 +4745,620 @@ function buildSlotlockStore(sql, options, refusal) {
                 }
             }
         },
-        async getHold(params) {
+        async putContact(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             }
-            if (!isValidResourceId(params.holdId))
-                return null;
-            const [row] = await sql `
-        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
-               hold.expires_at, hold.source
-          FROM slotlock.reservations hold
-          JOIN slotlock.resources resource ON resource.id = hold.resource_id
-         WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
-           AND hold.status = 'held' AND hold.expires_at > statement_timestamp()`;
-            return row ? toHold(row) : null;
+            if (!isValidContactRef(params.ref))
+                return { ok: false, code: 'invalid_contact_ref' };
+            const fields = contactFields(params);
+            if (!fields)
+                return { ok: false, code: 'invalid_contact' };
+            return inTransaction(sql, async (tx) => {
+                await lockExternalIdentity(tx, params.tenantRef, `contact:${params.ref}`);
+                const [existing] = await tx `
+          SELECT ref FROM slotlock.contacts WHERE tenant_ref = ${params.tenantRef} AND ref = ${params.ref}`;
+                if (!existing) {
+                    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-contacts', params.tenantRef])}, 0))`;
+                    const [kept] = await tx `
+            SELECT count(*)::int AS count FROM (
+              SELECT 1 FROM slotlock.contacts WHERE tenant_ref = ${params.tenantRef}
+               LIMIT ${SLOTLOCK_MAX_CONTACTS_PER_TENANT}) kept`;
+                    if ((kept?.count ?? 0) >= SLOTLOCK_MAX_CONTACTS_PER_TENANT) {
+                        return { ok: false, code: 'contact_limit_reached', limit: SLOTLOCK_MAX_CONTACTS_PER_TENANT };
+                    }
+                }
+                // When each channel's answer was given, kept while it stands: the proof of consent.
+                const [before] = await tx `
+          SELECT consent, consent_at FROM slotlock.contacts
+           WHERE tenant_ref = ${params.tenantRef} AND ref = ${params.ref}`;
+                const stamp = new Date().toISOString();
+                const consentAt = {};
+                for (const channel of ['email', 'sms', 'whatsapp']) {
+                    const answer = fields.consent[channel];
+                    if (answer === undefined)
+                        continue;
+                    const kept = before?.consent?.[channel] === answer ? before.consent_at?.[channel] : undefined;
+                    consentAt[channel] = kept ?? stamp;
+                }
+                const [row] = await tx `
+          INSERT INTO slotlock.contacts (tenant_ref, ref, name, email, phone, whatsapp, consent, consent_at, locale)
+          VALUES (${params.tenantRef}, ${params.ref}, ${fields.name}, ${fields.email}, ${fields.phone},
+                  ${fields.whatsapp}, ${tx.json(fields.consent)}, ${tx.json(consentAt)}, ${fields.locale})
+          ON CONFLICT (tenant_ref, ref) DO UPDATE
+             SET name = EXCLUDED.name, email = EXCLUDED.email, phone = EXCLUDED.phone,
+                 whatsapp = EXCLUDED.whatsapp, consent = EXCLUDED.consent, consent_at = EXCLUDED.consent_at,
+                 locale = EXCLUDED.locale, updated_at = statement_timestamp()
+          RETURNING ${tx.unsafe(CONTACT_COLUMNS)}`;
+                if (!row)
+                    throw new Error('slotlock: contact upsert returned no row');
+                return { ok: true, contact: toContact(row), created: !existing };
+            }, 'read committed');
         },
-        async getHolderHold(params) {
-            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.holderRef)) {
-                throw invalidIdentityError('Slotlock tenant and holder must be 1-500 UTF-8 bytes');
+        async getContact(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             }
-            if (!isValidResourceId(params.holdId))
+            if (!isValidContactRef(params.ref))
                 return null;
             const [row] = await sql `
-        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
-               hold.expires_at, hold.source, hold.expires_at > statement_timestamp() AS live
-          FROM slotlock.reservations hold
-          JOIN slotlock.resources resource ON resource.id = hold.resource_id
-         WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
-           AND hold.status = 'held' AND hold.holder_ref = ${params.holderRef}`;
-            return row ? { hold: toHold(row), live: row.live } : null;
+        SELECT ${sql.unsafe(CONTACT_COLUMNS)}
+          FROM slotlock.contacts WHERE tenant_ref = ${params.tenantRef} AND ref = ${params.ref}`;
+            return row ? toContact(row) : null;
         },
-        async listHolds(params) {
+        async listContacts(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
             }
-            if (!isValidResourceId(params.resourceId)) {
-                throw invalidIdentityError('Slotlock resource id must be a UUID');
-            }
             const limit = pageLimit(params.limit);
-            const after = pageCursor(params.after);
+            if (params.after !== undefined && !isValidContactRef(params.after))
+                return [];
             const rows = await sql `
-        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
-               hold.expires_at, hold.source
-          FROM slotlock.reservations hold
-          JOIN slotlock.resources resource ON resource.id = hold.resource_id
+        SELECT ${sql.unsafe(CONTACT_COLUMNS)} FROM slotlock.contacts
+         WHERE tenant_ref = ${params.tenantRef}
+           AND (${params.after ?? null}::text IS NULL OR ref > ${params.after ?? null})
+         ORDER BY ref
+         LIMIT ${limit}`;
+            return rows.map(toContact);
+        },
+        async deleteContact(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidContactRef(params.ref))
+                return { deleted: false, bookings: 0 };
+            return inTransaction(sql, async (tx) => {
+                await lockExternalIdentity(tx, params.tenantRef, `contact:${params.ref}`);
+                const deleted = await tx `
+          DELETE FROM slotlock.contacts WHERE tenant_ref = ${params.tenantRef} AND ref = ${params.ref}
+          RETURNING ref`;
+                // Its reference leaves the bookings too; the feed keeps no row of the person (the change
+                // trigger ignores a write that moves no time).
+                const bookings = await tx `
+          UPDATE slotlock.reservations SET contact_ref = NULL
+           WHERE tenant_ref = ${params.tenantRef} AND contact_ref = ${params.ref}
+           RETURNING id`;
+                return { deleted: deleted.length > 0, bookings: bookings.length };
+            }, 'read committed');
+        },
+        async exportSubject(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const key = subjectKey(params.subject);
+            if (!key)
+                throw invalidSubjectError();
+            const limit = params.limit ?? 1_000;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 10_000) {
+                throw Object.assign(new RangeError('Slotlock subject export limit must be 1-10000'), { code: 'invalid_limit' });
+            }
+            const tenantRef = params.tenantRef;
+            const value = key.value;
+            const take = limit + 1;
+            return inTransaction(sql, async (tx) => {
+                // The contacts an email or a contact reference names; the bookings, changes and approvals
+                // that name those contacts are theirs too.
+                const contactRefs = key.kind === 'email'
+                    ? (await tx `
+                SELECT ref FROM slotlock.contacts WHERE tenant_ref = ${tenantRef} AND lower(email) = ${value}`).map((row) => row.ref)
+                    : key.kind === 'contact'
+                        ? [value]
+                        : [];
+                const records = Object.fromEntries(SLOTLOCK_SUBJECT_TABLES.map((table) => [table, []]));
+                const read = async (table, rows) => {
+                    records[table] = (await rows).map((entry) => entry.row);
+                };
+                if (contactRefs.length > 0) {
+                    await read('contacts', tx `
+            SELECT to_jsonb(contact) - 'tenant_ref' AS row FROM slotlock.contacts contact
+             WHERE contact.tenant_ref = ${tenantRef} AND contact.ref = ANY(${contactRefs}::text[])
+             ORDER BY contact.ref LIMIT ${take}`);
+                    await read('reservations', tx `
+            SELECT to_jsonb(booking) - 'tenant_ref' AS row FROM slotlock.reservations booking
+             WHERE booking.tenant_ref = ${tenantRef} AND booking.contact_ref = ANY(${contactRefs}::text[])
+             ORDER BY booking.created_at, booking.id LIMIT ${take}`);
+                    await read('outbox', tx `
+            SELECT jsonb_build_object('id', change.id::text, 'type', change.type, 'subject', change.subject,
+                                      'data', change.data, 'occurred_at', change.occurred_at) AS row
+              FROM slotlock.outbox change
+             WHERE change.tenant_ref = ${tenantRef} AND change.data ->> 'contact_ref' = ANY(${contactRefs}::text[])
+             ORDER BY change.id LIMIT ${take}`);
+                }
+                if (key.kind === 'email') {
+                    await read('calendar_event_attendees', tx `
+            SELECT to_jsonb(attendee) - 'tenant_ref' AS row FROM slotlock.calendar_event_attendees attendee
+             WHERE attendee.tenant_ref = ${tenantRef} AND lower(attendee.email) = ${value}
+             ORDER BY attendee.event_id, attendee.ordinal LIMIT ${take}`);
+                }
+                if (key.kind === 'email' || key.kind === 'reference') {
+                    // An event's time and title, and its organizer only when that is them: never the others
+                    // it names.
+                    await read('calendar_events', tx `
+            SELECT jsonb_strip_nulls(jsonb_build_object(
+                     'id', event.id, 'external_ref', event.external_ref, 'resource_id', event.resource_id,
+                     'starts_at', event.starts_at, 'ends_at', event.ends_at, 'timezone', event.timezone,
+                     'summary', event.summary, 'status', event.status,
+                     'recurring', event.recurrence_rule IS NOT NULL, 'created_at', event.created_at,
+                     'organizer', CASE WHEN lower(event.organizer ->> 'email') = ${value} THEN event.organizer END)) AS row
+              FROM slotlock.calendar_events event
+             WHERE event.tenant_ref = ${tenantRef}
+               AND ${key.kind === 'email'
+                        ? tx `(lower(event.organizer ->> 'email') = ${value}
+                         OR EXISTS (SELECT 1 FROM jsonb_array_elements(event.attendees) AS attendee(value)
+                                     WHERE lower(attendee.value ->> 'email') = ${value}))`
+                        : tx `event.external_ref = ${value}`}
+             ORDER BY event.created_at, event.id LIMIT ${take}`);
+                }
+                if (key.kind === 'holder') {
+                    // A hold may keep no tenant of its own: its resource's is its.
+                    await read('reservations', tx `
+            SELECT to_jsonb(booking) - 'tenant_ref' AS row FROM slotlock.reservations booking
+             WHERE booking.holder_ref = ${value}
+               AND (booking.tenant_ref = ${tenantRef}
+                    OR (booking.tenant_ref IS NULL AND booking.resource_id IN (
+                      SELECT resource.id FROM slotlock.resources resource WHERE resource.tenant_ref = ${tenantRef})))
+             ORDER BY booking.created_at, booking.id LIMIT ${take}`);
+                    await read('waitlist_entries', tx `
+            SELECT to_jsonb(entry) - 'tenant_ref' AS row FROM slotlock.waitlist_entries entry
+             WHERE entry.tenant_ref = ${tenantRef} AND entry.holder_ref = ${value}
+             ORDER BY entry.created_at, entry.id LIMIT ${take}`);
+                    await read('outbox', tx `
+            SELECT jsonb_build_object('id', change.id::text, 'type', change.type, 'subject', change.subject,
+                                      'data', change.data, 'occurred_at', change.occurred_at) AS row
+              FROM slotlock.outbox change
+             WHERE change.tenant_ref = ${tenantRef} AND change.data ->> 'holder_ref' = ${value}
+             ORDER BY change.id LIMIT ${take}`);
+                }
+                if (key.kind === 'reference') {
+                    await read('reservations', tx `
+            SELECT to_jsonb(booking) - 'tenant_ref' AS row FROM slotlock.reservations booking
+             WHERE booking.tenant_ref = ${tenantRef} AND booking.external_ref = ${value}
+               AND booking.calendar_event_id IS NULL
+             ORDER BY booking.created_at, booking.id LIMIT ${take}`);
+                    for (const table of [
+                        'reservation_tombstones',
+                        'reservation_conflict_archive',
+                        'calendar_event_tombstones',
+                        'calendar_event_commands',
+                    ]) {
+                        await read(table, tx `
+              SELECT to_jsonb(kept) - 'tenant_ref' AS row FROM ${tx(`slotlock.${table}`)} kept
+               WHERE kept.tenant_ref = ${tenantRef} AND kept.external_ref = ${value}
+               LIMIT ${take}`);
+                    }
+                    await read('outbox', tx `
+            SELECT jsonb_build_object('id', change.id::text, 'type', change.type, 'subject', change.subject,
+                                      'data', change.data, 'occurred_at', change.occurred_at) AS row
+              FROM slotlock.outbox change
+             WHERE change.tenant_ref = ${tenantRef} AND change.data ->> 'reference' = ${value}
+             ORDER BY change.id LIMIT ${take}`);
+                }
+                // An approval's decision, never its request: that may name others.
+                await read('approvals', tx `
+          SELECT jsonb_strip_nulls(jsonb_build_object(
+                   'id', approval.id, 'policy_ref', approval.policy_ref, 'status', approval.status,
+                   'operation', approval.operation, 'starts_at', approval.starts_at,
+                   'ends_at', approval.ends_at, 'expires_at', approval.expires_at,
+                   'decided_at', approval.decided_at, 'created_at', approval.created_at)) AS row
+            FROM slotlock.approvals approval
+           WHERE approval.tenant_ref = ${tenantRef} AND ${subjectApprovalSql(tx, key, contactRefs)}
+           ORDER BY approval.created_at, approval.id LIMIT ${take}`);
+                let truncated = false;
+                for (const table of SLOTLOCK_SUBJECT_TABLES) {
+                    if (records[table].length > limit) {
+                        records[table] = records[table].slice(0, limit);
+                        truncated = true;
+                    }
+                }
+                return { records, truncated };
+            }, 'read committed');
+        },
+        async eraseSubject(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const key = subjectKey(params.subject);
+            if (!key)
+                throw invalidSubjectError();
+            const tenantRef = params.tenantRef;
+            const value = key.value;
+            // One name for what the erasure reached, so what was one holder or booking still reads as one.
+            const replacement = `erased-${randomBytes(16).toString('hex')}`;
+            return inTransaction(sql, async (tx) => {
+                const erased = emptySubjectCounts();
+                const count = async (table, rows) => {
+                    erased[table] += (await rows).length;
+                };
+                const changes = async (kind, name) => {
+                    const [row] = await tx `
+            SELECT slotlock.erase_subject_changes(${tenantRef}::text, ${kind}::text, ${name}::text,
+                                                  ${kind === 'contact' ? null : replacement}::text) AS changed`;
+                    erased.outbox += Number(row?.changed ?? 0);
+                };
+                const contactRefs = key.kind === 'email'
+                    ? (await tx `
+                SELECT ref FROM slotlock.contacts WHERE tenant_ref = ${tenantRef} AND lower(email) = ${value}
+                 ORDER BY ref`).map((row) => row.ref)
+                    : key.kind === 'contact'
+                        ? [value]
+                        : [];
+                // As deleteContact: a contact written meanwhile waits, then finds itself gone or kept.
+                for (const ref of contactRefs)
+                    await lockExternalIdentity(tx, tenantRef, `contact:${ref}`);
+                if (key.kind === 'reference')
+                    await lockExternalIdentity(tx, tenantRef, value);
+                // Approvals first, while their requests still match what is being erased.
+                await count('approvals', tx `
+          UPDATE slotlock.approvals approval
+             SET request = ${subjectScrubbedRequestSql(tx, key, contactRefs, replacement)}
+           WHERE approval.tenant_ref = ${tenantRef} AND ${subjectApprovalSql(tx, key, contactRefs)}
+          RETURNING 1`);
+                if (contactRefs.length > 0) {
+                    await count('contacts', tx `
+            DELETE FROM slotlock.contacts
+             WHERE tenant_ref = ${tenantRef} AND ref = ANY(${contactRefs}::text[])
+            RETURNING 1`);
+                    // The bookings stay; they no longer name whom to tell.
+                    await count('reservations', tx `
+            UPDATE slotlock.reservations SET contact_ref = NULL
+             WHERE tenant_ref = ${tenantRef} AND contact_ref = ANY(${contactRefs}::text[])
+            RETURNING 1`);
+                    for (const ref of contactRefs)
+                        await changes('contact', ref);
+                }
+                if (key.kind === 'email') {
+                    await count('calendar_event_attendees', tx `
+            DELETE FROM slotlock.calendar_event_attendees
+             WHERE tenant_ref = ${tenantRef} AND lower(email) = ${value}
+            RETURNING 1`);
+                    // The event keeps its revision: nothing it books changed, and no one is told of it again.
+                    await count('calendar_events', tx `
+            UPDATE slotlock.calendar_events event
+               SET attendees = coalesce((
+                     SELECT jsonb_agg(attendee.value ORDER BY attendee.ordinality)
+                       FROM jsonb_array_elements(event.attendees) WITH ORDINALITY AS attendee(value, ordinality)
+                      WHERE lower(attendee.value ->> 'email') IS DISTINCT FROM ${value}), '[]'::jsonb),
+                   organizer = CASE WHEN lower(event.organizer ->> 'email') = ${value} THEN NULL ELSE event.organizer END
+             WHERE event.tenant_ref = ${tenantRef}
+               AND (lower(event.organizer ->> 'email') = ${value}
+                    OR EXISTS (SELECT 1 FROM jsonb_array_elements(event.attendees) AS attendee(value)
+                                WHERE lower(attendee.value ->> 'email') = ${value}))
+            RETURNING 1`);
+                }
+                if (key.kind === 'holder') {
+                    await count('waitlist_entries', tx `
+            DELETE FROM slotlock.waitlist_entries
+             WHERE tenant_ref = ${tenantRef} AND holder_ref = ${value}
+            RETURNING 1`);
+                    // Holds and bookings stay as time taken, held by a name that is no one's.
+                    await count('reservations', tx `
+            UPDATE slotlock.reservations booking SET holder_ref = ${replacement}
+             WHERE booking.holder_ref = ${value}
+               AND (booking.tenant_ref = ${tenantRef}
+                    OR (booking.tenant_ref IS NULL AND booking.resource_id IN (
+                      SELECT resource.id FROM slotlock.resources resource WHERE resource.tenant_ref = ${tenantRef})))
+            RETURNING 1`);
+                    await changes('holder', value);
+                }
+                if (key.kind === 'reference') {
+                    // A booking keeps its time under a name that is no one's; so do its ended bookings and
+                    // events. The reference is free to book again.
+                    await count('reservations', tx `
+            UPDATE slotlock.reservations SET external_ref = ${replacement}
+             WHERE tenant_ref = ${tenantRef} AND external_ref = ${value} AND calendar_event_id IS NULL
+            RETURNING 1`);
+                    for (const table of [
+                        'reservation_tombstones',
+                        'reservation_conflict_archive',
+                        'calendar_events',
+                        'calendar_event_tombstones',
+                        'calendar_event_commands',
+                    ]) {
+                        await count(table, tx `
+              UPDATE ${tx(`slotlock.${table}`)} SET external_ref = ${replacement}
+               WHERE tenant_ref = ${tenantRef} AND external_ref = ${value}
+              RETURNING 1`);
+                    }
+                    await changes('reference', value);
+                }
+                return { erased };
+            }, 'read committed');
+        },
+        async createTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const tenantRef = params.tenantRef;
+            return inTransaction(sql, async (tx) => {
+                await lockExternalIdentity(tx, tenantRef, 'tenant-export');
+                const [kept] = await tx `
+          SELECT count(*) FILTER (WHERE status = 'pending')::int AS pending, count(*)::int AS kept
+            FROM slotlock.tenant_exports
+           WHERE tenant_ref = ${tenantRef} AND expires_at > statement_timestamp()`;
+                if ((kept?.pending ?? 0) > 0)
+                    throw tenantExportRefusal('export_in_progress');
+                if ((kept?.kept ?? 0) >= SLOTLOCK_MAX_TENANT_EXPORTS)
+                    throw tenantExportRefusal('export_limit_reached');
+                const requestedBy = params.requestedBy === undefined ? null : cutBytes(params.requestedBy, 200) ?? null;
+                const [row] = await tx `
+          INSERT INTO slotlock.tenant_exports (tenant_ref, requested_by, expires_at)
+          VALUES (${tenantRef}, ${requestedBy},
+                  statement_timestamp() + make_interval(hours => ${SLOTLOCK_TENANT_EXPORT_HOURS}))
+          RETURNING *, row_count::text AS row_count, bytes::text AS bytes`;
+                if (!row)
+                    throw new Error('slotlock: tenant export insert returned no row');
+                return toTenantExport(row);
+            }, 'read committed');
+        },
+        async buildTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId))
+                return null;
+            const tenantRef = params.tenantRef;
+            const exportId = params.exportId;
+            return inTransaction(sql, async (tx) => {
+                // Held to the end: another server building it skips it rather than waiting.
+                const [claimed] = await tx `
+          SELECT id FROM slotlock.tenant_exports
+           WHERE id = ${exportId} AND tenant_ref = ${tenantRef} AND status = 'pending'
+           FOR UPDATE SKIP LOCKED`;
+                if (!claimed)
+                    return null;
+                let part = 0;
+                let written = 0;
+                const totals = await readTenantExport(tx, tenantRef, async (read) => {
+                    // Refused as soon as it is too large, so nothing past the limit is read or kept.
+                    written += read.bytes;
+                    if (written > SLOTLOCK_TENANT_EXPORT_MAX_BYTES)
+                        throw tenantExportRefusal('export_too_large');
+                    part += 1;
+                    await tx `
+            INSERT INTO slotlock.tenant_export_parts (export_id, tenant_ref, part, table_name, row_count, content)
+            VALUES (${exportId}, ${tenantRef}, ${part}, ${read.table}, ${read.lines.length}, ${read.lines.join('\n')})`;
+                });
+                const [row] = await tx `
+          UPDATE slotlock.tenant_exports
+             SET status = 'ready', finished_at = statement_timestamp(),
+                 expires_at = statement_timestamp() + make_interval(hours => ${SLOTLOCK_TENANT_EXPORT_HOURS}),
+                 parts = ${part}, row_count = ${totals.rows}, bytes = ${totals.bytes},
+                 tables = ${tx.json(totals.tables)}
+           WHERE id = ${exportId} AND tenant_ref = ${tenantRef}
+          RETURNING *, row_count::text AS row_count, bytes::text AS bytes`;
+                return row ? toTenantExport(row) : null;
+            }, 'read committed');
+        },
+        async failTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId))
+                return;
+            await sql `
+        UPDATE slotlock.tenant_exports
+           SET status = 'failed', finished_at = statement_timestamp(), error = ${cutBytes(params.error, 200) ?? 'export_failed'}
+         WHERE id = ${params.exportId} AND tenant_ref = ${params.tenantRef} AND status = 'pending'`;
+        },
+        async getTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId))
+                return null;
+            const [row] = await sql `
+        SELECT *, row_count::text AS row_count, bytes::text AS bytes FROM slotlock.tenant_exports
+         WHERE id = ${params.exportId} AND tenant_ref = ${params.tenantRef}`;
+            return row ? toTenantExport(row) : null;
+        },
+        async listTenantExports(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return [];
+            const rows = await sql `
+        SELECT *, row_count::text AS row_count, bytes::text AS bytes FROM slotlock.tenant_exports
+         WHERE tenant_ref = ${params.tenantRef}
+         ORDER BY created_at DESC, id DESC`;
+            return rows.map(toTenantExport);
+        },
+        async getTenantExportPart(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId)) {
+                return { ok: false, code: 'export_not_found' };
+            }
+            const [found] = await sql `
+        SELECT made.status, part.table_name, part.content
+          FROM slotlock.tenant_exports made
+          LEFT JOIN slotlock.tenant_export_parts part
+                 ON part.export_id = made.id AND part.tenant_ref = made.tenant_ref AND part.part = ${params.part}
+         WHERE made.id = ${params.exportId} AND made.tenant_ref = ${params.tenantRef}`;
+            if (!found)
+                return { ok: false, code: 'export_not_found' };
+            if (found.status !== 'ready')
+                return { ok: false, code: 'export_not_ready' };
+            if (found.table_name === null || found.content === null)
+                return { ok: false, code: 'export_part_not_found' };
+            return { ok: true, table: found.table_name, lines: found.content.split('\n') };
+        },
+        async deleteTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId))
+                return false;
+            const deleted = await sql `
+        DELETE FROM slotlock.tenant_exports WHERE id = ${params.exportId} AND tenant_ref = ${params.tenantRef}
+        RETURNING 1`;
+            return deleted.length > 0;
+        },
+        async pruneTenantExports(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return { deleted: 0, pending: [] };
+            const deleted = await sql `
+        DELETE FROM slotlock.tenant_exports
+         WHERE tenant_ref = ${params.tenantRef} AND expires_at <= statement_timestamp()
+        RETURNING 1`;
+            const pending = await sql `
+        SELECT id FROM slotlock.tenant_exports
+         WHERE tenant_ref = ${params.tenantRef} AND status = 'pending'
+           AND created_at < statement_timestamp() - interval '2 minutes'
+         ORDER BY created_at`;
+            return { deleted: deleted.length, pending: pending.map((row) => row.id) };
+        },
+        async streamTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return inTransaction(sql, (tx) => readTenantExport(tx, params.tenantRef, ({ table, lines }) => params.onPart({ table, lines })), 'read committed');
+        },
+        async markHoldPaid(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return { ok: false, code: 'invalid_identity' };
+            if (!isValidPaymentRef(params.paymentRef))
+                return { ok: false, code: 'invalid_payment_ref' };
+            if (params.received !== undefined && !isValidAmount(params.received))
+                return { ok: false, code: 'invalid_payment' };
+            if (!isValidResourceId(params.holdId))
+                return { ok: false, code: 'hold_not_found' };
+            return inTransaction(sql, async (tx) => {
+                // One payment record per hold, kept however the hold ends: the same payment told again
+                // (a reloaded return page, a redelivered webhook) after the hold was booked is answered as
+                // recorded, never as a refusal a payment adapter would refund.
+                await lockExternalIdentity(tx, params.tenantRef, `hold-payment:${params.holdId}`);
+                const [recorded] = await tx `
+          SELECT hold_id AS id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at,
+                 NULL::text AS source, true AS payment_required, payment_ref, paid_at,
+                 payment_amount_minor, payment_currency, paid_amount_minor, paid_currency,
+                 booked_at, approval_id
+            FROM slotlock.hold_payments
+           WHERE hold_id = ${params.holdId} AND tenant_ref = ${params.tenantRef}`;
+                if (recorded) {
+                    if (recorded.payment_ref !== params.paymentRef) {
+                        // Named, so an adapter refunds only a payment it can tell is another.
+                        return { ok: false, code: 'payment_conflict', paymentRef: recorded.payment_ref };
+                    }
+                    // Its hold ended without a booking: the payment was never applied, and is refunded.
+                    if (await paidHoldEnded(tx, params.tenantRef, recorded))
+                        return { ok: false, code: 'hold_ended' };
+                    return { ok: true, hold: toHold(recorded), idempotent: true };
+                }
+                const [row] = await tx `
+          SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+                 hold.expires_at, hold.source, hold.hold_group_id, hold.payment_required,
+                 hold.payment_ref, hold.paid_at, hold.payment_amount_minor, hold.payment_currency,
+                 hold.paid_amount_minor, hold.paid_currency, hold.status,
+                 hold.expires_at > statement_timestamp() AS live
+            FROM slotlock.reservations hold
+            JOIN slotlock.resources resource ON resource.id = hold.resource_id
+           WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
+             AND hold.calendar_event_id IS NULL
+           FOR UPDATE OF hold`;
+                if (!row || row.status !== 'held')
+                    return { ok: false, code: 'hold_not_found' };
+                if (!row.payment_required)
+                    return { ok: false, code: 'payment_not_required' };
+                if (row.payment_ref !== null && row.payment_ref !== undefined) {
+                    return row.payment_ref === params.paymentRef
+                        ? { ok: true, hold: toHold(row), idempotent: true }
+                        : { ok: false, code: 'payment_conflict', paymentRef: row.payment_ref };
+                }
+                // Paid after it lapsed: the time may be someone else's by now. The integrator refunds.
+                if (!row.live)
+                    return { ok: false, code: 'hold_expired' };
+                // Less than the hold asks, or in another currency: not its payment (RFC 0004 C3).
+                const expected = amountOf(row.payment_amount_minor, row.payment_currency);
+                if (expected &&
+                    (!params.received ||
+                        params.received.currency !== expected.currency ||
+                        params.received.amountMinor < expected.amountMinor)) {
+                    return { ok: false, code: 'payment_amount_mismatch' };
+                }
+                const [paid] = await tx `
+          UPDATE slotlock.reservations
+             SET payment_ref = ${params.paymentRef}, paid_at = statement_timestamp(),
+                 paid_amount_minor = ${params.received?.amountMinor ?? null},
+                 paid_currency = ${params.received?.currency ?? null}
+           WHERE id = ${params.holdId}
+           RETURNING id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at, source,
+                     hold_group_id, ${tx.unsafe(HOLD_PAYMENT_COLUMNS)}`;
+                if (!paid)
+                    throw new Error('slotlock: hold payment update returned no row');
+                await tx `
+          INSERT INTO slotlock.hold_payments (
+            tenant_ref, hold_id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at,
+            payment_ref, paid_at, payment_amount_minor, payment_currency, paid_amount_minor, paid_currency
+          ) VALUES (
+            ${params.tenantRef}, ${paid.id}, ${paid.resource_id}, ${paid.starts_at}, ${paid.ends_at},
+            ${paid.buffer_after_ms}, ${paid.expires_at}, ${params.paymentRef}, ${paid.paid_at ?? null},
+            ${paid.payment_amount_minor ?? null}, ${paid.payment_currency ?? null},
+            ${params.received?.amountMinor ?? null}, ${params.received?.currency ?? null}
+          )`;
+                await tx `
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          VALUES (${params.tenantRef}, ${paid.resource_id}, 'hold.paid', ${paid.id},
+                  jsonb_build_object(
+                    'id', ${paid.id}::uuid, 'resource_id', ${paid.resource_id}::uuid,
+                    'start', ${paid.starts_at}::timestamptz, 'end', ${paid.ends_at}::timestamptz,
+                    'expires_at', ${paid.expires_at}::timestamptz,
+                    'payment_ref', ${params.paymentRef}::text,
+                    'paid_at', ${paid.paid_at ?? null}::timestamptz,
+                    'amount_minor', ${params.received?.amountMinor ?? null}::bigint,
+                    'currency', ${params.received?.currency ?? null}::text),
+                  NULLIF(current_setting('slotlock.actor', true), ''))`;
+                return { ok: true, hold: toHold(paid), idempotent: false };
+            }, 'read committed');
+        },
+        async getHold(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.holdId))
+                return null;
+            const [row] = await sql `
+        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+               hold.expires_at, hold.source, ${sql.unsafe(HOLD_PAYMENT_COLUMNS_OF_HOLD)}
+          FROM slotlock.reservations hold
+          JOIN slotlock.resources resource ON resource.id = hold.resource_id
+         WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
+           AND hold.status = 'held' AND hold.expires_at > statement_timestamp()`;
+            return row ? toHold(row) : null;
+        },
+        async getHolderHold(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.holderRef)) {
+                throw invalidIdentityError('Slotlock tenant and holder must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.holdId))
+                return null;
+            const [row] = await sql `
+        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+               hold.expires_at, hold.source, ${sql.unsafe(HOLD_PAYMENT_COLUMNS_OF_HOLD)},
+               hold.expires_at > statement_timestamp() AS live
+          FROM slotlock.reservations hold
+          JOIN slotlock.resources resource ON resource.id = hold.resource_id
+         WHERE hold.id = ${params.holdId} AND resource.tenant_ref = ${params.tenantRef}
+           AND hold.status = 'held' AND hold.holder_ref = ${params.holderRef}`;
+            return row ? { hold: toHold(row), live: row.live } : null;
+        },
+        async listHolds(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            if (!isValidResourceId(params.resourceId)) {
+                throw invalidIdentityError('Slotlock resource id must be a UUID');
+            }
+            const limit = pageLimit(params.limit);
+            const after = pageCursor(params.after);
+            const rows = await sql `
+        SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
+               hold.expires_at, hold.source, ${sql.unsafe(HOLD_PAYMENT_COLUMNS_OF_HOLD)}
+          FROM slotlock.reservations hold
+          JOIN slotlock.resources resource ON resource.id = hold.resource_id
          WHERE hold.resource_id = ${params.resourceId} AND resource.tenant_ref = ${params.tenantRef}
            AND hold.status = 'held' AND hold.expires_at > statement_timestamp()
            AND (${after.start}::timestamptz IS NULL
@@ -4079,13 +5515,43 @@ function buildSlotlockStore(sql, options, refusal) {
                     if ((pending?.tenant ?? 0) >= SLOTLOCK_MAX_PENDING_APPROVALS) {
                         return { ok: false, code: 'approval_limit_reached', limit: SLOTLOCK_MAX_PENDING_APPROVALS };
                     }
+                    // The agent's caps, with its other pending approvals and without the hold that gives way
+                    // to this one; under its lock, taken before the resources' as a hold takes it.
+                    const holder = params.holder;
+                    if (holder && isValidIdentity(holder.ref)) {
+                        await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([
+                            'slotlock-holder',
+                            tenantRef,
+                            holder.ref,
+                        ])}, 0))`;
+                        const consumed = params.consumeHold && isValidResourceId(params.consumeHold.holdId) && params.consumeHold.holderRef === holder.ref
+                            ? params.consumeHold.holdId
+                            : undefined;
+                        const held = await holderHeld(tx, tenantRef, holder.ref, consumed);
+                        const holdCap = Math.min(maxHoldsPerHolder, holder.caps?.maxHolds ?? Number.POSITIVE_INFINITY);
+                        if (held.count + params.holds.length > holdCap) {
+                            return { ok: false, code: 'hold_limit_reached', limit: holdCap };
+                        }
+                        const heldHoursCap = holder.caps?.maxHeldHours !== undefined
+                            ? Math.min(maxHeldHoursPerHolder ?? Number.POSITIVE_INFINITY, holder.caps.maxHeldHours)
+                            : maxHeldHoursPerHolder;
+                        const asking = params.holds.reduce((seconds, hold) => seconds + (hold.end.getTime() - hold.start.getTime()) / 1000, 0);
+                        if (heldHoursCap !== undefined && held.seconds + asking > heldHoursCap * 3_600) {
+                            return { ok: false, code: 'held_time_limit_reached', limit: heldHoursCap };
+                        }
+                    }
                     const id = randomUUID();
                     // The requester's own hold of the time gives way to the approval's.
                     if (params.consumeHold && isValidResourceId(params.consumeHold.holdId)) {
+                        // Taken over, not ended: its payment, if any, goes with the approval (booked if granted).
+                        await tx `SELECT set_config('slotlock.ending', 'approval', true)`;
                         await tx `
               DELETE FROM slotlock.reservations
                WHERE id = ${params.consumeHold.holdId} AND status = 'held'
                  AND holder_ref = ${params.consumeHold.holderRef}`;
+                        await tx `SELECT set_config('slotlock.ending', '', true)`;
+                        await tx `UPDATE slotlock.hold_payments SET approval_id = ${id}::uuid
+                      WHERE hold_id = ${params.consumeHold.holdId} AND tenant_ref = ${tenantRef}`;
                     }
                     const holds = [...params.holds].sort((left, right) => left.resourceId.localeCompare(right.resourceId) || left.start.getTime() - right.start.getTime());
                     // Locked as any booking write locks them, in id order, so a racing booking takes turns.
@@ -4112,7 +5578,8 @@ function buildSlotlockStore(sql, options, refusal) {
               starts_at, ends_at, request_key, expires_at
             ) VALUES (
               ${id}, ${tenantRef}, ${params.policyRef}, ${params.operation}, ${tx.json(params.request)},
-              ${tx.json(params.requester)}, ${held.map((hold) => hold.id)}::uuid[],
+              ${tx.json((holder ? { ...params.requester, holder_ref: holder.ref } : params.requester))},
+              ${held.map((hold) => hold.id)}::uuid[],
               ${[...new Set(holds.map((hold) => hold.resourceId))]}::uuid[], ${params.start}, ${params.end},
               ${params.requestKey}, ${params.expiresAt}
             )
@@ -4239,7 +5706,7 @@ function buildSlotlockStore(sql, options, refusal) {
             }
             const [row] = await sql `
         SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
-               revision, source
+               revision, source, contact_ref, notify, reminder_minutes
           FROM slotlock.reservations
          WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
            AND calendar_event_id IS NULL`;
@@ -4257,7 +5724,7 @@ function buildSlotlockStore(sql, options, refusal) {
             const after = pageCursor(params.after);
             const rows = await sql `
         SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
-               revision, source
+               revision, source, contact_ref, notify, reminder_minutes
           FROM slotlock.reservations
          WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
            AND calendar_event_id IS NULL
@@ -4294,8 +5761,9 @@ function buildSlotlockStore(sql, options, refusal) {
                 const resource = await lockResourceForWrite(tx, owner.resource_id, null);
                 const [row] = await tx `
           SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at, buffer_after_ms,
-                 revision, source, status, (status = 'held' AND expires_at > statement_timestamp()) AS live,
-                 hold_group_id, holder_ref
+                 revision, source, contact_ref, notify, reminder_minutes, status,
+                 (status = 'held' AND expires_at > statement_timestamp()) AS live,
+                 hold_group_id, holder_ref, (payment_required AND paid_at IS NULL) AS unpaid
             FROM slotlock.reservations
            WHERE id = ${holdId}
            FOR UPDATE`;
@@ -4314,8 +5782,16 @@ function buildSlotlockStore(sql, options, refusal) {
                 }
                 if (!row.live)
                     return { ok: false, code: 'hold_expired' };
+                // A hold that waits for payment is booked only once it is paid (RFC 0004 C3).
+                if (row.unpaid)
+                    return { ok: false, code: 'payment_required' };
                 if (resource?.archived !== false)
                     return { ok: false, code: 'resource_archived' };
+                // Busy time a calendar reported since the hold was made (RFC 0004 C1) is refused, as an
+                // agent's confirmation of its hold refuses it: the source's time is not to be booked.
+                if (await sourceBusyLoss(tx, row.resource_id, row.starts_at, new Date(row.ends_at.getTime() + Number(row.buffer_after_ms)))) {
+                    return { ok: false, code: 'overlap' };
+                }
                 if (bookingTenant !== null) {
                     const [retired] = await tx `
             SELECT revision FROM slotlock.reservation_tombstones
@@ -4340,9 +5816,12 @@ function buildSlotlockStore(sql, options, refusal) {
                  tenant_ref = ${bookingTenant}, external_ref = ${bookingTenant === null ? null : holdId}
            WHERE id = ${holdId}
           RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
-                    buffer_after_ms, revision, source`;
+                    buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes`;
                 if (!confirmed)
                     throw new Error('slotlock: hold confirmation returned no row');
+                // Its payment, if any, is applied: never refunded as a hold that ended unbooked.
+                await tx `UPDATE slotlock.hold_payments SET booked_at = statement_timestamp()
+                  WHERE hold_id = ${holdId} AND booked_at IS NULL`;
                 // Its linked alternatives (one group, one holder) are released with it, as booking one
                 // from an agent releases the rest.
                 if (row.hold_group_id !== null && row.holder_ref !== null) {
@@ -4423,6 +5902,8 @@ function buildSlotlockStore(sql, options, refusal) {
              AND (status <> 'held' OR expires_at > statement_timestamp())
           UNION ALL
           ${compositeBusy(sql, resourceId, window)}
+          UNION ALL
+          ${sourceBusy(sql, resourceId, window)}
         ) busy
          ORDER BY occupied_starts_at
          LIMIT ${options.limit ?? null}`;
@@ -4544,7 +6025,8 @@ function buildSlotlockStore(sql, options, refusal) {
               SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
                      summary, description, location, status, transparency, organizer, attendees,
                      reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
-                     materialized_ends_at, recurrence_cursor, revision, source, created_at, updated_at
+                     materialized_ends_at, recurrence_cursor, revision, source, created_at, updated_at,
+                     cutoff_anchor
                 FROM slotlock.calendar_events
                WHERE tenant_ref = ${params.tenantRef}
                  AND owner_ref = ${ownerRef}
@@ -4560,6 +6042,34 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (params.expectedRevision !== currentRevision) {
                             return { ok: false, code: 'revision_conflict', currentRevision };
                         }
+                        // A one-off event changed past its cutoffs (RFC 0004 B5) is refused to a writer held to
+                        // the booking rules: moved in time or to another resource, or made a series (whose
+                        // cancellation no cutoff holds), past its reschedule cutoff; made transparent, letting its
+                        // time go, past its cancel cutoff or once a cancellation fee is due, as a cancellation
+                        // would be (cancelling records the fee).
+                        let movedAnchor = null;
+                        if (found && params.enforceBookingRules === true && found.recurrence_rule === null) {
+                            const moved = found.starts_at.getTime() !== event.start.getTime() ||
+                                found.ends_at.getTime() !== event.end.getTime() ||
+                                found.resource_id !== params.resourceId ||
+                                (event.recurrence?.rrule ?? null) !== null;
+                            const letGo = found.transparency !== 'transparent' && (event.transparency ?? 'opaque') === 'transparent';
+                            if (moved || letGo) {
+                                const judged = await rulesNow(tx, found.resource_id);
+                                if (moved && cutoffRuleBroken(judged.rules, 'reschedule', found.starts_at, judged.now)) {
+                                    return { ok: false, code: 'booking_rule_violated', rule: 'reschedule_cutoff' };
+                                }
+                                const from = cancellationStart(found.starts_at, found.cutoff_anchor);
+                                if (letGo &&
+                                    (cutoffRuleBroken(judged.rules, 'cancel', from, judged.now) ||
+                                        cancellationFeeDue(judged.rules, from, judged.now) !== null)) {
+                                    return { ok: false, code: 'booking_rule_violated', rule: 'cancel_cutoff' };
+                                }
+                                // Moved when cancelling would already be late: it stays as late as it was.
+                                if (moved && cancellationLate(judged.rules, from, judged.now))
+                                    movedAnchor = from;
+                            }
+                        }
                         const series = expanded ?? resumeStoredSeries(event, materializationWindow, found);
                         if (!series)
                             return { ok: false, code: 'invalid_event' };
@@ -4593,6 +6103,7 @@ function buildSlotlockStore(sql, options, refusal) {
                         }
                         const eventId = found?.id ?? randomUUID();
                         const revision = currentRevision + 1;
+                        let heldPaid = false;
                         if (params.fromHold) {
                             const { holdId, holderRef } = params.fromHold;
                             if (!isValidResourceId(holdId) || !isValidIdentity(holderRef)) {
@@ -4600,16 +6111,22 @@ function buildSlotlockStore(sql, options, refusal) {
                             }
                             const [hold] = await tx `
                 SELECT resource_id, starts_at, ends_at, hold_group_id,
-                       expires_at > statement_timestamp() AS live
+                       expires_at > statement_timestamp() AS live,
+                       (payment_required AND paid_at IS NULL) AS unpaid,
+                       (payment_required AND paid_at IS NOT NULL) AS paid
                   FROM slotlock.reservations
                  WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${holderRef}
                  FOR UPDATE`;
                             if (!hold)
                                 return { ok: false, code: 'hold_not_found' };
+                            heldPaid = hold.paid;
                             // The holder's own hold that lapsed and is not yet reaped: named as the application
                             // API's confirm names it. Another holder's stays not found.
                             if (!hold.live)
                                 return { ok: false, code: 'hold_expired' };
+                            // A hold that waits for payment is booked only once paid (RFC 0004 C3).
+                            if (hold.unpaid)
+                                return { ok: false, code: 'payment_required' };
                             const [only] = occurrences;
                             if (hold.resource_id !== params.resourceId ||
                                 occurrences.length !== 1 ||
@@ -4618,17 +6135,35 @@ function buildSlotlockStore(sql, options, refusal) {
                                 only.end > hold.ends_at) {
                                 return { ok: false, code: 'hold_mismatch' };
                             }
+                            // The hold booked is accepted, not let go (slotlock.waitlist_offer_settle); the rest of
+                            // its group is released.
+                            await tx `SELECT set_config('slotlock.ending', 'confirmed', true)`;
+                            await tx `DELETE FROM slotlock.reservations WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${holderRef}`;
+                            await tx `SELECT set_config('slotlock.ending', '', true)`;
+                            // Its payment, if any, is applied to this booking.
+                            await tx `UPDATE slotlock.hold_payments SET booked_at = statement_timestamp()
+                        WHERE hold_id = ${holdId} AND booked_at IS NULL`;
+                            // A set held together (RFC 0004 B7) is booked member by member: its other holds stay.
                             await tx `
                 DELETE FROM slotlock.reservations
                  WHERE status = 'held' AND holder_ref = ${holderRef}
                    AND (id = ${holdId}
                         OR (${hold.hold_group_id}::uuid IS NOT NULL
-                            AND hold_group_id = ${hold.hold_group_id}::uuid))`;
+                            AND hold_group_id = ${hold.hold_group_id}::uuid
+                            AND source IS DISTINCT FROM 'slotlock:together'))`;
                         }
                         let turnaroundMs = 0;
                         let bufferBeforeMs = 0;
-                        if (params.enforceBookingRules === true && (event.transparency ?? 'opaque') === 'opaque') {
-                            const judge = await bookingJudge(tx, params.resourceId, defaultHours);
+                        // The resource's rules, read once, for its price and the rest alike.
+                        const judge = params.enforceBookingRules === true && (event.transparency ?? 'opaque') === 'opaque'
+                            ? await bookingJudge(tx, params.resourceId, defaultHours)
+                            : null;
+                        // A resource with a hold price (RFC 0004 C3) is booked by an agent only from its own
+                        // hold, once paid: new time on it, or time moved onto it from another resource.
+                        if (judge && (!found || found.resource_id !== params.resourceId) && !heldPaid && judge.holdPrice !== undefined) {
+                            return { ok: false, code: 'payment_required' };
+                        }
+                        if (judge) {
                             for (const [index, occurrence] of occurrences.entries()) {
                                 // A held time's notice and advance were judged when it was held.
                                 const rule = judge.broken(occurrence, { first: index === 0 && !params.fromHold });
@@ -4679,6 +6214,10 @@ function buildSlotlockStore(sql, options, refusal) {
                        source = ${params.source ?? null},
                        buffer_after_ms = ${turnaroundMs},
                        buffer_before_ms = ${bufferBeforeMs},
+                       -- Whether anyone should be told (RFC 0004 P3): as sent, like the rest.
+                       notify = ${params.notify !== false},
+                       -- Kept, or set by a late move (RFC 0004 B5).
+                       cutoff_anchor = COALESCE(${movedAnchor}::timestamptz, cutoff_anchor),
                        updated_at = now()
                  WHERE id = ${eventId}
                    AND tenant_ref = ${params.tenantRef}
@@ -4691,7 +6230,7 @@ function buildSlotlockStore(sql, options, refusal) {
                   summary, description, location, status, transparency, organizer, attendees,
                   reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
                   materialized_ends_at, recurrence_cursor, recurrence_ends_by, revision, source,
-                  buffer_after_ms, buffer_before_ms
+                  buffer_after_ms, buffer_before_ms, notify
                 ) VALUES (
                   ${eventId}, ${params.tenantRef}, ${ownerRef}, ${params.externalRef},
                   ${params.resourceId},
@@ -4705,7 +6244,8 @@ function buildSlotlockStore(sql, options, refusal) {
                   ${tx.json(eventExceptionsForJson(event.recurrence?.exceptions))},
                   ${materializationWindow.start}, ${materializationWindow.end},
                   ${seriesCursorJson(tx, series.cursor)}, ${recurrenceEndsBy}::text::timestamptz,
-                  ${revision}, ${params.source ?? null}, ${turnaroundMs}, ${bufferBeforeMs}
+                  ${revision}, ${params.source ?? null}, ${turnaroundMs}, ${bufferBeforeMs},
+                  ${params.notify !== false}
                 )`;
                         }
                         // The normalized children are canonical; the JSON columns above are a compatibility
@@ -4717,6 +6257,15 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'resource_tenant_mismatch' };
                         if (locked.archived)
                             return { ok: false, code: 'resource_archived' };
+                        // A booking (held to the rules, as agents' are) never takes busy time a calendar reported
+                        // without its events (RFC 0004 C1); events imported from calendars are that time.
+                        if (params.enforceBookingRules === true && (event.transparency ?? 'opaque') === 'opaque') {
+                            for (const occurrence of occurrences) {
+                                if (await sourceBusyLoss(tx, params.resourceId, new Date(occurrence.start.getTime() - bufferBeforeMs), new Date(occurrence.end.getTime() + turnaroundMs))) {
+                                    return { ok: false, code: 'overlap', conflictingReservationId: null };
+                                }
+                            }
+                        }
                         await replaceCalendarEventOccurrences(tx, {
                             tenantRef: params.tenantRef,
                             eventId,
@@ -5042,7 +6591,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     };
                 }
                 const events = await tx `
-          SELECT id, resource_id, revision FROM slotlock.calendar_events
+          SELECT id, resource_id, revision, starts_at, recurrence_rule IS NOT NULL AS recurring, cutoff_anchor
+            FROM slotlock.calendar_events
            WHERE tenant_ref = ${params.tenantRef}
              AND owner_ref = ${ownerRef}
              AND external_ref = ${params.externalRef}
@@ -5059,7 +6609,10 @@ function buildSlotlockStore(sql, options, refusal) {
                 if (params.expectedRevision !== currentRevision) {
                     return { ok: false, code: 'revision_conflict', currentRevision };
                 }
-                return finishCalendarCancel(tx, {
+                const ending = found ? await eventEnding(tx, found, params.enforceBookingRules === true, undefined) : null;
+                if (ending && !ending.ok)
+                    return ending.refusal;
+                const cancelled = await finishCalendarCancel(tx, {
                     tenantRef: params.tenantRef,
                     ownerRef,
                     externalRef: params.externalRef,
@@ -5069,9 +6622,15 @@ function buildSlotlockStore(sql, options, refusal) {
                     idempotencyKey: params.idempotencyKey,
                     payloadHash,
                 });
+                if (ending)
+                    await noteEnding(tx, null, null);
+                return cancelled.ok && ending?.fee ? { ...cancelled, cancellationFee: ending.fee } : cancelled;
             });
         },
         async cancelCalendarEventById(params) {
+            if (params.overrideReason !== undefined && !isValidOverrideReason(params.overrideReason)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
             if (!isValidIdentity(params.tenantRef) ||
                 !isValidResourceId(params.eventId) ||
                 !isValidIdentity(params.idempotencyKey) ||
@@ -5122,7 +6681,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     return { ok: false, code: 'event_not_found' };
                 await lockCalendarEventIdentity(tx, params.tenantRef, identity.owner_ref, identity.external_ref);
                 const [found] = await tx `
-          SELECT id, resource_id, revision FROM slotlock.calendar_events
+          SELECT id, resource_id, revision, starts_at, recurrence_rule IS NOT NULL AS recurring, cutoff_anchor
+            FROM slotlock.calendar_events
            WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}
            FOR UPDATE`;
                 if (!found)
@@ -5135,7 +6695,11 @@ function buildSlotlockStore(sql, options, refusal) {
                 if (params.expectedRevision !== currentRevision) {
                     return { ok: false, code: 'revision_conflict', currentRevision };
                 }
-                return finishCalendarCancel(tx, {
+                // The tenant's own cancellation is held to the cutoff too, unless an admin gives a reason.
+                const ending = await eventEnding(tx, found, true, params.overrideReason);
+                if (!ending.ok)
+                    return ending.refusal;
+                const cancelled = await finishCalendarCancel(tx, {
                     tenantRef: params.tenantRef,
                     ownerRef: identity.owner_ref,
                     externalRef: identity.external_ref,
@@ -5145,6 +6709,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     idempotencyKey: params.idempotencyKey,
                     payloadHash,
                 });
+                await noteEnding(tx, null, null);
+                return cancelled.ok && ending.fee ? { ...cancelled, cancellationFee: ending.fee } : cancelled;
             });
         },
         async followZoneRules(params) {
@@ -5228,7 +6794,197 @@ function buildSlotlockStore(sql, options, refusal) {
                     conflicts++;
                 }
             }
-            return { shifted: shifted.length, moved, conflicts };
+            // A series' occurrences to come (RFC 0004 B9): said on the feed, once each; with `move`, each
+            // series moves whole, in one transaction, where Node's zone rules agree with the database's.
+            const occurrences = await sql `
+        SELECT occurrence.event_id, occurrence.recurrence_id, event.resource_id, occurrence.reservation_id,
+               event.timezone, to_char(occurrence.wall_starts_at, 'YYYY-MM-DD"T"HH24:MI:SS') AS wall,
+               occurrence.starts_at, occurrence.ends_at,
+               slotlock.zoned_instant(occurrence.wall_starts_at, event.timezone) AS moved_start
+          FROM slotlock.calendar_event_occurrences occurrence
+          JOIN slotlock.calendar_events event ON event.id = occurrence.event_id
+         WHERE event.tenant_ref = ${params.tenantRef} AND event.recurrence_rule IS NOT NULL
+           AND occurrence.starts_at > now() AND occurrence.zone_shift_reported_at IS NULL
+           AND occurrence.wall_starts_at IS NOT NULL
+           AND slotlock.zoned_instant(occurrence.wall_starts_at, event.timezone) IS NOT NULL
+           AND slotlock.zoned_instant(occurrence.wall_starts_at, event.timezone) <> occurrence.starts_at
+         ORDER BY occurrence.starts_at, occurrence.event_id
+         LIMIT ${limit}`;
+            const reportOccurrence = async (occurrence, type, reason) => {
+                await sql `
+          UPDATE slotlock.calendar_event_occurrences SET zone_shift_reported_at = now()
+           WHERE event_id = ${occurrence.event_id} AND recurrence_id = ${occurrence.recurrence_id}`;
+                const shift = occurrence.moved_start.getTime() - occurrence.starts_at.getTime();
+                await sql `
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          VALUES (${params.tenantRef}, ${occurrence.resource_id}, ${type}, ${occurrence.event_id},
+                  ${sql.json({
+                    id: occurrence.event_id,
+                    recurrence_id: occurrence.recurrence_id,
+                    resource_id: occurrence.resource_id,
+                    start: occurrence.starts_at.toISOString(),
+                    end: occurrence.ends_at.toISOString(),
+                    zone_start: occurrence.moved_start.toISOString(),
+                    zone_end: new Date(occurrence.ends_at.getTime() + shift).toISOString(),
+                    ...(reason ? { reason } : {}),
+                })}, 'slotlock:tzdata')`;
+            };
+            const series = new Map();
+            for (const occurrence of occurrences) {
+                const list = series.get(occurrence.event_id) ?? [];
+                list.push(occurrence);
+                series.set(occurrence.event_id, list);
+            }
+            for (const batch of series.values()) {
+                if (!params.move) {
+                    for (const occurrence of batch)
+                        await reportOccurrence(occurrence, 'event.timezone_shifted');
+                    continue;
+                }
+                // The whole series moves at once: every occurrence to come that shifted, past the batch.
+                const shiftedOccurrences = await sql `
+          SELECT occurrence.event_id, occurrence.recurrence_id, event.resource_id, occurrence.reservation_id,
+                 event.timezone, to_char(occurrence.wall_starts_at, 'YYYY-MM-DD"T"HH24:MI:SS') AS wall,
+                 occurrence.starts_at, occurrence.ends_at,
+                 slotlock.zoned_instant(occurrence.wall_starts_at, event.timezone) AS moved_start
+            FROM slotlock.calendar_event_occurrences occurrence
+            JOIN slotlock.calendar_events event ON event.id = occurrence.event_id
+           WHERE event.tenant_ref = ${params.tenantRef} AND occurrence.event_id = ${batch[0].event_id}
+             AND occurrence.starts_at > now() AND occurrence.zone_shift_reported_at IS NULL
+             AND occurrence.wall_starts_at IS NOT NULL
+             AND slotlock.zoned_instant(occurrence.wall_starts_at, event.timezone) IS NOT NULL
+             AND slotlock.zoned_instant(occurrence.wall_starts_at, event.timezone) <> occurrence.starts_at
+           ORDER BY occurrence.starts_at`;
+                if (shiftedOccurrences.length === 0)
+                    continue;
+                // Moved only where this server's zone rules put each wall time where the database's do: a
+                // server with older rules would compute the old times again on the series' next write.
+                const agree = shiftedOccurrences.every((occurrence) => {
+                    const wall = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})$/.exec(occurrence.wall);
+                    if (!wall)
+                        return false;
+                    try {
+                        const node = zonedDateTimeToUtc({
+                            year: Number(wall[1]),
+                            month: Number(wall[2]),
+                            day: Number(wall[3]),
+                            hour: Number(wall[4]),
+                            minute: Number(wall[5]),
+                            second: Number(wall[6]),
+                        }, occurrence.timezone);
+                        return node.getTime() === occurrence.moved_start.getTime();
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+                if (!agree) {
+                    for (const occurrence of shiftedOccurrences)
+                        await reportOccurrence(occurrence, 'event.timezone_shifted', 'rules_disagree');
+                    continue;
+                }
+                const eventId = shiftedOccurrences[0].event_id;
+                try {
+                    await inTransaction(sql, async (tx) => {
+                        await tx `SELECT set_config('slotlock.actor', 'slotlock:tzdata', true)`;
+                        for (const occurrence of shiftedOccurrences) {
+                            const movedEnd = new Date(occurrence.ends_at.getTime() + occurrence.moved_start.getTime() - occurrence.starts_at.getTime());
+                            await tx `
+                UPDATE slotlock.calendar_event_occurrences
+                   SET starts_at = ${occurrence.moved_start}, ends_at = ${movedEnd}
+                 WHERE event_id = ${eventId} AND recurrence_id = ${occurrence.recurrence_id}`;
+                            if (occurrence.reservation_id !== null) {
+                                await tx `
+                  UPDATE slotlock.reservations SET starts_at = ${occurrence.moved_start}, ends_at = ${movedEnd}
+                   WHERE id = ${occurrence.reservation_id}::uuid`;
+                            }
+                        }
+                        // The series at its next revision; its anchor too, while it is still to come.
+                        const [bumped] = await tx `
+              UPDATE slotlock.calendar_events
+                 SET starts_at = CASE WHEN starts_at > now()
+                                      THEN COALESCE(slotlock.zoned_instant(wall_starts_at, timezone), starts_at)
+                                      ELSE starts_at END,
+                     ends_at = CASE WHEN starts_at > now()
+                                    THEN COALESCE(slotlock.zoned_instant(wall_ends_at, timezone), ends_at)
+                                    ELSE ends_at END,
+                     revision = revision + 1, updated_at = now()
+               WHERE id = ${eventId}
+               RETURNING revision`;
+                        await tx `UPDATE slotlock.reservations SET revision = ${Number(bumped?.revision)} WHERE calendar_event_id = ${eventId}`;
+                    });
+                    moved++;
+                }
+                catch (error) {
+                    if (pgCode(error) !== EXCLUSION_VIOLATION)
+                        throw error;
+                    // Something is in the way: the series keeps its times, said once, at its first shifted one.
+                    await reportOccurrence(shiftedOccurrences[0], 'event.timezone_conflict');
+                    for (const occurrence of shiftedOccurrences.slice(1)) {
+                        await sql `
+              UPDATE slotlock.calendar_event_occurrences SET zone_shift_reported_at = now()
+               WHERE event_id = ${occurrence.event_id} AND recurrence_id = ${occurrence.recurrence_id}`;
+                    }
+                    conflicts++;
+                }
+            }
+            // Reservations that carry the wall time they were booked for (RFC 0004 B9).
+            const reservations = await sql `
+        SELECT booking.id, booking.external_ref, booking.resource_id, booking.starts_at, booking.ends_at,
+               slotlock.zoned_instant(booking.wall_starts_at, resource.timezone) AS moved_start
+          FROM slotlock.reservations booking
+          JOIN slotlock.resources resource ON resource.id = booking.resource_id
+         WHERE booking.tenant_ref = ${params.tenantRef} AND resource.tenant_ref = ${params.tenantRef}
+           AND booking.status = 'confirmed' AND booking.calendar_event_id IS NULL
+           AND booking.starts_at > now() AND booking.wall_starts_at IS NOT NULL
+           AND booking.zone_shift_reported_at IS NULL
+           AND slotlock.zoned_instant(booking.wall_starts_at, resource.timezone) IS NOT NULL
+           AND slotlock.zoned_instant(booking.wall_starts_at, resource.timezone) <> booking.starts_at
+         ORDER BY booking.starts_at, booking.id
+         LIMIT ${limit}`;
+            const reportReservation = async (booking, type) => {
+                await sql `UPDATE slotlock.reservations SET zone_shift_reported_at = now() WHERE id = ${booking.id}`;
+                const shift = booking.moved_start.getTime() - booking.starts_at.getTime();
+                await sql `
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          VALUES (${params.tenantRef}, ${booking.resource_id}, ${type}, ${booking.external_ref},
+                  ${sql.json({
+                    id: booking.id,
+                    reference: booking.external_ref,
+                    resource_id: booking.resource_id,
+                    start: booking.starts_at.toISOString(),
+                    end: booking.ends_at.toISOString(),
+                    zone_start: booking.moved_start.toISOString(),
+                    zone_end: new Date(booking.ends_at.getTime() + shift).toISOString(),
+                })}, 'slotlock:tzdata')`;
+            };
+            for (const booking of reservations) {
+                if (!params.move) {
+                    await reportReservation(booking, 'reservation.timezone_shifted');
+                    continue;
+                }
+                try {
+                    await inTransaction(sql, async (tx) => {
+                        await tx `SELECT set_config('slotlock.actor', 'slotlock:tzdata', true)`;
+                        const shift = booking.moved_start.getTime() - booking.starts_at.getTime();
+                        // The wall time it was booked for, at the instant the rules now give it: a move at the
+                        // next revision, on the feed as any move.
+                        await tx `
+              UPDATE slotlock.reservations
+                 SET starts_at = ${booking.moved_start}, ends_at = ${new Date(booking.ends_at.getTime() + shift)},
+                     revision = revision + 1
+               WHERE id = ${booking.id}`;
+                    });
+                    moved++;
+                }
+                catch (error) {
+                    if (pgCode(error) !== EXCLUSION_VIOLATION)
+                        throw error;
+                    await reportReservation(booking, 'reservation.timezone_conflict');
+                    conflicts++;
+                }
+            }
+            return { shifted: shifted.length + occurrences.length + reservations.length, moved, conflicts };
         },
         async pruneBookingRetention(params) {
             if (!isValidIdentity(params.tenantRef)) {
@@ -5311,6 +7067,18 @@ function buildSlotlockStore(sql, options, refusal) {
           )
           SELECT count(*)::int AS deleted FROM deleted`;
                 const tombstonesDeleted = Number(tombstones?.deleted ?? 0);
+                // Busy time a calendar reported (RFC 0004 C1) that ended a month ago keeps nothing out any
+                // more: it goes, as the feed's changes do, so a person's schedule is not kept for good.
+                const [busy] = await tx `
+          WITH ended AS (
+            SELECT ctid FROM slotlock.source_busy
+             WHERE tenant_ref = ${params.tenantRef}
+               AND ends_at < statement_timestamp() - make_interval(days => ${SOURCE_BUSY_RETENTION_DAYS})
+             LIMIT ${limit}
+          ), deleted AS (
+            DELETE FROM slotlock.source_busy busy USING ended WHERE busy.ctid = ended.ctid RETURNING 1
+          )
+          SELECT count(*)::int AS deleted FROM deleted`;
                 return {
                     expiredHoldsDeleted,
                     holdCommandsDeleted,
@@ -5318,7 +7086,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     hasMore: legacy.length === limit ||
                         expiredHoldsDeleted === limit ||
                         holdCommandsDeleted === limit ||
-                        tombstonesDeleted === limit,
+                        tombstonesDeleted === limit ||
+                        Number(busy?.deleted ?? 0) === limit,
                 };
             });
         },
@@ -5488,6 +7257,165 @@ function buildSlotlockStore(sql, options, refusal) {
                 return { ok: true, revision: params.revision, idempotent: false };
             });
         },
+        async replaceSourceBusy(params) {
+            if (!isValidIdentity(params.tenantRef) ||
+                !isValidIdentity(params.source) ||
+                !isValidResourceId(params.resourceId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            let window;
+            try {
+                window = calendarWindow(params.window);
+            }
+            catch {
+                return { ok: false, code: 'invalid_window' };
+            }
+            const busy = mergeSourceBusy(params.busy, window);
+            if (busy === null)
+                return { ok: false, code: 'invalid_busy' };
+            return inTransaction(sql, async (tx) => {
+                // In turn with every booking on the resource, each of which reads this time (sourceBusyLoss):
+                // a booking either sees the new busy time or is seen by it here.
+                if (!(await lockResourceForWrite(tx, params.resourceId, params.tenantRef))) {
+                    return { ok: false, code: 'resource_tenant_mismatch' };
+                }
+                const recorded = await buildSlotlockStore(tx, options, null).recordCalendarCoverage({
+                    tenantRef: params.tenantRef,
+                    resourceId: params.resourceId,
+                    source: params.source,
+                    window,
+                    revision: params.revision,
+                });
+                if (!recorded.ok)
+                    return recorded;
+                if (recorded.idempotent)
+                    return { ...recorded, busy: busy.length, conflicts: 0 };
+                const starts = busy.map((interval) => interval.start.toISOString());
+                const ends = busy.map((interval) => interval.end.toISOString());
+                // Confirmed bookings in the way of what the source now says, but not of what it said
+                // before: a conflict already reported is not reported again on every read.
+                const conflicts = await tx `
+          WITH reported AS (
+            SELECT starts_at, ends_at
+              FROM ROWS FROM (pg_catalog.unnest(${starts}::text[]::timestamptz[]),
+                              pg_catalog.unnest(${ends}::text[]::timestamptz[])) AS busy(starts_at, ends_at)
+          )
+          SELECT DISTINCT ON (booking.id)
+                 booking.id, booking.external_ref, booking.calendar_event_id,
+                 booking.starts_at, booking.ends_at,
+                 reported.starts_at AS busy_start, reported.ends_at AS busy_end
+            FROM slotlock.reservations booking
+            JOIN reported ON booking.starts_at < reported.ends_at AND booking.ends_at > reported.starts_at
+           WHERE booking.resource_id IN (${compositeKin(tx, params.resourceId)})
+             AND booking.status = 'confirmed'
+             AND booking.starts_at < ${window.end} AND booking.ends_at > ${window.start}
+             AND NOT EXISTS (
+               SELECT 1 FROM slotlock.source_busy previous
+                WHERE previous.resource_id = ${params.resourceId} AND previous.source = ${params.source}
+                  AND previous.starts_at < booking.ends_at AND previous.ends_at > booking.starts_at)
+           ORDER BY booking.id, reported.starts_at`;
+                // What the source said of the window goes; what it said outside it stays.
+                await tx `
+          WITH removed AS (
+            DELETE FROM slotlock.source_busy
+             WHERE resource_id = ${params.resourceId} AND source = ${params.source}
+               AND starts_at < ${window.end} AND ends_at > ${window.start}
+            RETURNING starts_at, ends_at
+          )
+          INSERT INTO slotlock.source_busy (tenant_ref, resource_id, source, starts_at, ends_at)
+          SELECT ${params.tenantRef}::text, ${params.resourceId}::uuid, ${params.source}::text, starts_at,
+                 ${window.start}::timestamptz
+            FROM removed WHERE starts_at < ${window.start}
+          UNION ALL
+          SELECT ${params.tenantRef}::text, ${params.resourceId}::uuid, ${params.source}::text,
+                 ${window.end}::timestamptz, ends_at
+            FROM removed WHERE ends_at > ${window.end}`;
+                if (busy.length > 0) {
+                    await tx `
+            INSERT INTO slotlock.source_busy (tenant_ref, resource_id, source, starts_at, ends_at)
+            SELECT ${params.tenantRef}::text, ${params.resourceId}::uuid, ${params.source}::text, starts_at, ends_at
+              FROM ROWS FROM (pg_catalog.unnest(${starts}::text[]::timestamptz[]),
+                              pg_catalog.unnest(${ends}::text[]::timestamptz[])) AS busy(starts_at, ends_at)`;
+                }
+                if (conflicts.length > 0) {
+                    // Named as every coverage change is, by the source's source_id (never the source); the
+                    // booking it is in the way of is in the data (an event's by its id).
+                    await tx `
+            INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+            SELECT ${params.tenantRef}, ${params.resourceId}, 'coverage.conflict', coverage.source_id,
+                   jsonb_strip_nulls(jsonb_build_object(
+                     'resource_id', ${params.resourceId}::uuid,
+                     'source_id', coverage.source_id,
+                     'reason', 'busy_in_calendar',
+                     'id', CASE WHEN conflict.event_id IS NULL THEN conflict.id END,
+                     'reference', conflict.reference,
+                     'event_id', conflict.event_id,
+                     'start', conflict.starts_at, 'end', conflict.ends_at,
+                     'busy_start', conflict.busy_start, 'busy_end', conflict.busy_end)),
+                   NULLIF(current_setting('slotlock.actor', true), '')
+              FROM ROWS FROM (
+                     pg_catalog.unnest(${conflicts.map((row) => row.id)}::text[]::uuid[]),
+                     pg_catalog.unnest(${conflicts.map((row) => row.external_ref)}::text[]),
+                     pg_catalog.unnest(${conflicts.map((row) => row.calendar_event_id)}::text[]::uuid[]),
+                     pg_catalog.unnest(${conflicts.map((row) => row.starts_at.toISOString())}::text[]::timestamptz[]),
+                     pg_catalog.unnest(${conflicts.map((row) => row.ends_at.toISOString())}::text[]::timestamptz[]),
+                     pg_catalog.unnest(${conflicts.map((row) => row.busy_start.toISOString())}::text[]::timestamptz[]),
+                     pg_catalog.unnest(${conflicts.map((row) => row.busy_end.toISOString())}::text[]::timestamptz[]))
+                   AS conflict(id, reference, event_id, starts_at, ends_at, busy_start, busy_end)
+              CROSS JOIN (SELECT source_id FROM slotlock.calendar_coverage
+                           WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+                             AND source = ${params.source}) coverage`;
+                }
+                return { ...recorded, busy: busy.length, conflicts: conflicts.length };
+            }, 'read committed');
+        },
+        async reportCoverageConflict(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.source) || !isValidResourceId(params.resourceId)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            const byEvent = 'eventId' in params.booking;
+            if (byEvent ? !isValidResourceId(params.booking.eventId) : !isValidIdentity(params.booking.reservationRef)) {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            if (params.reason !== 'changed_in_calendar' && params.reason !== 'removed_from_calendar') {
+                return { ok: false, code: 'invalid_identity' };
+            }
+            if (params.calendar !== undefined && !isFiniteWindow(params.calendar))
+                return { ok: false, code: 'invalid_window' };
+            return inTransaction(sql, async (tx) => {
+                const [coverage] = await tx `
+          SELECT source_id FROM slotlock.calendar_coverage
+           WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId} AND source = ${params.source}`;
+                if (!coverage)
+                    return { ok: false, code: 'coverage_not_found' };
+                const [booking] = byEvent
+                    ? await tx `
+              SELECT id, NULL::text AS reference, starts_at, ends_at FROM slotlock.calendar_events
+               WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+                 AND id = ${params.booking.eventId}::uuid`
+                    : await tx `
+              SELECT id, external_ref AS reference, starts_at, ends_at FROM slotlock.reservations
+               WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+                 AND external_ref = ${params.booking.reservationRef}
+                 AND calendar_event_id IS NULL AND status = 'confirmed'`;
+                if (!booking) {
+                    return { ok: false, code: byEvent ? 'event_not_found' : 'reservation_not_found' };
+                }
+                await tx `
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          VALUES (${params.tenantRef}, ${params.resourceId}, 'coverage.conflict', ${coverage.source_id},
+                  jsonb_strip_nulls(jsonb_build_object(
+                    'resource_id', ${params.resourceId}::uuid, 'source_id', ${coverage.source_id}::text,
+                    'reason', ${params.reason}::text,
+                    'id', ${byEvent ? null : booking.id}::uuid, 'reference', ${booking.reference}::text,
+                    'event_id', ${byEvent ? booking.id : null}::uuid,
+                    'start', ${booking.starts_at}::timestamptz, 'end', ${booking.ends_at}::timestamptz,
+                    'calendar_start', ${params.calendar?.start ?? null}::timestamptz,
+                    'calendar_end', ${params.calendar?.end ?? null}::timestamptz)),
+                  NULLIF(current_setting('slotlock.actor', true), ''))`;
+                return { ok: true };
+            }, 'read committed');
+        },
         async recordCoverageFailure(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.source) || !isValidResourceId(params.resourceId)) {
                 return { ok: false, code: 'invalid_identity' };
@@ -5506,6 +7434,11 @@ function buildSlotlockStore(sql, options, refusal) {
                 return false;
             }
             const rows = await sql `
+        WITH busy AS (
+          DELETE FROM slotlock.source_busy
+           WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
+             AND source = ${params.source}
+        )
         DELETE FROM slotlock.calendar_coverage
          WHERE tenant_ref = ${params.tenantRef} AND resource_id = ${params.resourceId}
            AND source = ${params.source}
@@ -5535,6 +7468,110 @@ function buildSlotlockStore(sql, options, refusal) {
                 stale: row.stale,
             }));
         },
+        async dueReminders(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 500;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 5_000) {
+                throw new RangeError('limit must be a whole number from 1 to 5000');
+            }
+            const rows = await sql `
+        WITH candidates AS (
+          -- Reminders due at the same time are said once (the first in the list).
+          SELECT DISTINCT ON (occurrence.event_id, occurrence.recurrence_id,
+                              occurrence.starts_at - make_interval(mins => reminder.minutes_before_start))
+                 occurrence.event_id, occurrence.recurrence_id, reminder.ordinal, reminder.action,
+                 reminder.minutes_before_start, occurrence.starts_at, occurrence.ends_at,
+                 event.resource_id,
+                 occurrence.starts_at - make_interval(mins => reminder.minutes_before_start) AS due_at
+            FROM slotlock.calendar_event_occurrences occurrence
+            JOIN slotlock.calendar_events event
+              ON event.id = occurrence.event_id AND event.tenant_ref = occurrence.tenant_ref
+            JOIN slotlock.calendar_event_reminders reminder
+              ON reminder.event_id = occurrence.event_id AND reminder.tenant_ref = occurrence.tenant_ref
+           WHERE occurrence.tenant_ref = ${params.tenantRef}
+             AND event.notify AND event.status <> 'cancelled'
+             AND occurrence.starts_at > statement_timestamp()
+             AND occurrence.starts_at - make_interval(mins => reminder.minutes_before_start)
+                 <= statement_timestamp()
+             AND occurrence.starts_at - make_interval(mins => reminder.minutes_before_start)
+                 > statement_timestamp() - interval '1 day'
+             -- Said once per time it is due, whatever its place in the list: one added or
+             -- reordered says nothing again; an occurrence moved since is reminded again.
+             AND NOT EXISTS (
+               SELECT 1 FROM slotlock.reminder_dispatches sent
+                WHERE sent.event_id = occurrence.event_id AND sent.recurrence_id = occurrence.recurrence_id
+                  AND sent.due_at = occurrence.starts_at - make_interval(mins => reminder.minutes_before_start))
+           ORDER BY occurrence.event_id, occurrence.recurrence_id,
+                    occurrence.starts_at - make_interval(mins => reminder.minutes_before_start), reminder.ordinal
+        ), due AS (
+          SELECT * FROM candidates ORDER BY due_at, event_id, recurrence_id LIMIT ${limit}
+        ), dispatched AS (
+          INSERT INTO slotlock.reminder_dispatches (tenant_ref, event_id, recurrence_id, ordinal, due_at)
+          SELECT ${params.tenantRef}, event_id, recurrence_id, ordinal, due_at FROM due
+          ON CONFLICT (event_id, recurrence_id, due_at) DO NOTHING
+          RETURNING event_id, recurrence_id, due_at
+        ), reported AS (
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          SELECT ${params.tenantRef}, due.resource_id, 'reminder.due', due.event_id::text,
+                 jsonb_build_object(
+                   'event_id', due.event_id, 'recurrence_id', due.recurrence_id,
+                   'resource_id', due.resource_id, 'ordinal', due.ordinal, 'action', due.action,
+                   'minutes_before_start', due.minutes_before_start, 'due_at', due.due_at,
+                   'start', due.starts_at, 'end', due.ends_at),
+                 'slotlock:maintenance'
+            FROM due JOIN dispatched USING (event_id, recurrence_id, due_at)
+          RETURNING 1
+        )
+        SELECT count(*)::int AS count FROM reported`;
+            const events = rows[0]?.count ?? 0;
+            if (events >= limit)
+                return events;
+            // A booking's reminders too, named by its reference, with whom to tell.
+            const [bookings] = await sql `
+        WITH candidates AS (
+          SELECT DISTINCT ON (booking.id, booking.starts_at - make_interval(mins => reminder.minutes))
+                 booking.id, booking.external_ref, booking.resource_id, booking.contact_ref,
+                 booking.starts_at, booking.ends_at, (reminder.ordinal - 1)::int AS ordinal,
+                 reminder.minutes,
+                 booking.starts_at - make_interval(mins => reminder.minutes) AS due_at
+            FROM slotlock.reservations booking,
+                 LATERAL unnest(booking.reminder_minutes) WITH ORDINALITY AS reminder(minutes, ordinal)
+           WHERE booking.tenant_ref = ${params.tenantRef} AND booking.status = 'confirmed'
+             AND booking.calendar_event_id IS NULL AND booking.notify
+             AND booking.reminder_minutes IS NOT NULL
+             AND booking.starts_at > statement_timestamp()
+             AND booking.starts_at - make_interval(mins => reminder.minutes) <= statement_timestamp()
+             AND booking.starts_at - make_interval(mins => reminder.minutes) > statement_timestamp() - interval '1 day'
+             -- Said once per time it is due, as an event's reminders are.
+             AND NOT EXISTS (
+               SELECT 1 FROM slotlock.reservation_reminder_dispatches sent
+                WHERE sent.reservation_id = booking.id
+                  AND sent.due_at = booking.starts_at - make_interval(mins => reminder.minutes))
+           ORDER BY booking.id, booking.starts_at - make_interval(mins => reminder.minutes), reminder.ordinal
+        ), due AS (
+          SELECT * FROM candidates ORDER BY due_at, id LIMIT ${limit - events}
+        ), dispatched AS (
+          INSERT INTO slotlock.reservation_reminder_dispatches (tenant_ref, reservation_id, ordinal, due_at)
+          SELECT ${params.tenantRef}, id, ordinal, due_at FROM due
+          ON CONFLICT (reservation_id, due_at) DO NOTHING
+          RETURNING reservation_id AS id, due_at
+        ), reported AS (
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          SELECT ${params.tenantRef}, due.resource_id, 'reminder.due', due.external_ref,
+                 jsonb_strip_nulls(jsonb_build_object(
+                   'reservation_id', due.id, 'reference', due.external_ref,
+                   'resource_id', due.resource_id, 'contact_ref', due.contact_ref,
+                   'ordinal', due.ordinal, 'minutes_before_start', due.minutes, 'due_at', due.due_at,
+                   'start', due.starts_at, 'end', due.ends_at)),
+                 'slotlock:maintenance'
+            FROM due JOIN dispatched USING (id, due_at)
+          RETURNING 1
+        )
+        SELECT count(*)::int AS count FROM reported`;
+            return events + (bookings?.count ?? 0);
+        },
         async reportStaleCoverage(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
@@ -5604,6 +7641,45 @@ function buildSlotlockStore(sql, options, refusal) {
                 return { ok: true, reference: params.externalRef, checkedInAt: row.checked_in_at };
             });
         },
+        async completeEndedBookings(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const limit = params.limit ?? 500;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 5_000) {
+                throw invalidIdentityError('Slotlock completion limit must be 1-5,000');
+            }
+            // A suspended tenant's bookings stay as they are.
+            if (refusal)
+                return 0;
+            const rows = await sql `
+        WITH done AS (
+          UPDATE slotlock.reservations booking
+             SET completed_at = statement_timestamp()
+           WHERE booking.id IN (
+             SELECT id FROM slotlock.reservations
+              WHERE tenant_ref = ${params.tenantRef} AND status = 'confirmed'
+                AND calendar_event_id IS NULL AND completed_at IS NULL
+                AND ends_at <= statement_timestamp()
+                AND ends_at > statement_timestamp() - interval '7 days'
+              ORDER BY ends_at, id
+              LIMIT ${limit}
+              FOR UPDATE SKIP LOCKED)
+          RETURNING booking.id, booking.resource_id, booking.external_ref, booking.starts_at,
+                    booking.ends_at, booking.revision, booking.checked_in_at
+        )
+        INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+        SELECT ${params.tenantRef}, done.resource_id, 'reservation.completed',
+               COALESCE(done.external_ref, done.id::text),
+               jsonb_strip_nulls(jsonb_build_object(
+                 'id', done.id, 'reference', done.external_ref, 'resource_id', done.resource_id,
+                 'start', done.starts_at, 'end', done.ends_at, 'revision', done.revision,
+                 'checked_in_at', done.checked_in_at)),
+               'slotlock:maintenance'
+          FROM done
+        RETURNING id`;
+            return rows.length;
+        },
         async releaseNoShows(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
@@ -5645,8 +7721,8 @@ function buildSlotlockStore(sql, options, refusal) {
                         return false;
                     const revision = Number(row.revision) + 1;
                     await tx `
-            INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray)
-            VALUES (${tenantRef}, ${row.external_ref}, ${revision}, false)`;
+            INSERT INTO slotlock.reservation_tombstones (tenant_ref, external_ref, revision, stray, end_reason)
+            VALUES (${tenantRef}, ${row.external_ref}, ${revision}, false, 'no_show')`;
                     // The deletion is the change: the feed's trigger names it reservation.no_show (one change,
                     // not a cancellation too), by maintenance, with the check-in window it missed.
                     await tx `
@@ -5684,6 +7760,14 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!Number.isSafeInteger(offerTtlMs) || offerTtlMs < 60_000 || offerTtlMs > 86_400_000) {
                 return { ok: false, code: 'invalid_ttl' };
             }
+            const durationMs = params.durationMs ?? null;
+            if (durationMs !== null &&
+                (!Number.isSafeInteger(durationMs) ||
+                    durationMs < 60_000 ||
+                    durationMs % 60_000 !== 0 ||
+                    durationMs > window.end.getTime() - window.start.getTime())) {
+                return { ok: false, code: 'invalid_window' };
+            }
             const key = params.idempotencyKey;
             if (key !== undefined && !isValidIdentity(key))
                 return { ok: false, code: 'invalid_identity' };
@@ -5697,6 +7781,7 @@ function buildSlotlockStore(sql, options, refusal) {
                     window.end.toISOString(),
                     holderRef,
                     offerTtlMs,
+                    ...(durationMs === null ? [] : [durationMs]),
                 ]))
                     .digest('hex');
             return inTransaction(sql, async (tx) => {
@@ -5742,11 +7827,20 @@ function buildSlotlockStore(sql, options, refusal) {
                 const [row] = await tx `
           INSERT INTO slotlock.waitlist_entries
             (tenant_ref, resource_id, pool_ref, starts_at, ends_at, holder_ref, offer_ttl_ms,
-             idempotency_key, payload_hash)
+             idempotency_key, payload_hash, duration_ms)
           VALUES (${tenantRef}, ${params.resourceId ?? null}, ${params.pool ?? null}, ${window.start},
-                  ${window.end}, ${holderRef}, ${offerTtlMs}, ${key ?? null}, ${payloadHash})
+                  ${window.end}, ${holderRef}, ${offerTtlMs}, ${key ?? null}, ${payloadHash}, ${durationMs})
           RETURNING ${tx.unsafe(WAITLIST_COLUMNS)}`;
-                return { ok: true, entry: toWaitlistEntry(row), replayed: false };
+                const entry = row;
+                await tx `
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          VALUES (${tenantRef}, ${entry.resource_id}::uuid, 'waitlist.joined', ${entry.id},
+                  jsonb_strip_nulls(jsonb_build_object(
+                    'id', ${entry.id}::uuid, 'resource_id', ${entry.resource_id}::uuid, 'pool', ${entry.pool_ref}::text,
+                    'start', ${entry.starts_at}::timestamptz, 'end', ${entry.ends_at}::timestamptz,
+                    'duration_ms', ${durationMs}::bigint, 'holder_ref', ${entry.holder_ref}::text)),
+                  NULLIF(current_setting('slotlock.actor', true), ''))`;
+                return { ok: true, entry: toWaitlistEntry(entry), replayed: false };
             });
         },
         async listWaitlist(params) {
@@ -5776,9 +7870,19 @@ function buildSlotlockStore(sql, options, refusal) {
           DELETE FROM slotlock.waitlist_entries
            WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id}
              AND (${params.holderRef ?? null}::text IS NULL OR holder_ref = ${params.holderRef ?? null})
-          RETURNING hold_id`;
+          RETURNING hold_id, status, resource_id, pool_ref, holder_ref`;
                 if (!left)
                     return false;
+                await tx `
+          INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
+          VALUES (${params.tenantRef}, ${left.resource_id}::uuid, 'waitlist.left', ${params.id},
+                  jsonb_strip_nulls(jsonb_build_object(
+                    'id', ${params.id}::uuid, 'resource_id', ${left.resource_id}::uuid, 'pool', ${left.pool_ref}::text,
+                    'status', ${left.status}::text, 'holder_ref', ${left.holder_ref}::text)),
+                  NULLIF(current_setting('slotlock.actor', true), ''))`;
+                // An offer still open goes with it; the entry is gone, so its hold's end changes no entry.
+                if (left.status !== 'offered')
+                    return true;
                 // An untaken offer's hold goes too; a confirmed one is a booking now and stays.
                 if (left.hold_id) {
                     await buildSlotlockStore(tx, options, null).releaseHold(left.hold_id, { tenantRef: params.tenantRef });
@@ -5786,6 +7890,57 @@ function buildSlotlockStore(sql, options, refusal) {
                 return true;
             });
         },
+        async holdGroup(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.holderRef) || !isValidResourceId(params.groupId)) {
+                return [];
+            }
+            if (params.alignExpiry === true) {
+                await sql `
+          UPDATE slotlock.reservations held
+             SET expires_at = earliest.at
+            FROM (SELECT min(expires_at) AS at FROM slotlock.reservations
+                   WHERE hold_group_id = ${params.groupId}::uuid AND holder_ref = ${params.holderRef}
+                     AND status = 'held') earliest
+           WHERE held.hold_group_id = ${params.groupId}::uuid AND held.holder_ref = ${params.holderRef}
+             AND held.status = 'held' AND held.expires_at <> earliest.at`;
+            }
+            const rows = await sql `
+        SELECT held.id, held.resource_id, held.starts_at, held.ends_at, held.expires_at, held.source
+          FROM slotlock.reservations held
+          JOIN slotlock.resources resource ON resource.id = held.resource_id
+         WHERE held.hold_group_id = ${params.groupId}::uuid AND held.holder_ref = ${params.holderRef}
+           AND resource.tenant_ref = ${params.tenantRef} AND held.status = 'held'
+           AND held.expires_at > statement_timestamp()
+         ORDER BY held.resource_id`;
+            return rows.map((row) => ({
+                holdId: row.id,
+                resourceId: row.resource_id,
+                start: row.starts_at,
+                end: row.ends_at,
+                expiresAt: row.expires_at,
+                source: row.source,
+            }));
+        },
+        async declineWaitlistOffer(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.id))
+                return null;
+            if (params.holderRef !== undefined && !isValidIdentity(params.holderRef))
+                return null;
+            return inTransaction(sql, async (tx) => {
+                const [offer] = await tx `
+          SELECT hold_id FROM slotlock.waitlist_entries
+           WHERE tenant_ref = ${params.tenantRef} AND id = ${params.id} AND status = 'offered'
+             AND (${params.holderRef ?? null}::text IS NULL OR holder_ref = ${params.holderRef ?? null})
+           FOR UPDATE`;
+                if (!offer)
+                    return null;
+                // Letting the hold go declines the entry (slotlock.waitlist_offer_settle) and frees the time.
+                await buildSlotlockStore(tx, options, null).releaseHold(offer.hold_id, { tenantRef: params.tenantRef });
+                const [row] = await tx `
+          SELECT ${tx.unsafe(WAITLIST_COLUMNS)} FROM slotlock.waitlist_entries WHERE id = ${params.id}`;
+                return row ? toWaitlistEntry(row) : null;
+            });
+        },
         async getAssistantSettings(params) {
             if (!isValidIdentity(params.tenantRef))
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
@@ -5847,42 +8002,106 @@ function buildSlotlockStore(sql, options, refusal) {
         RETURNING 1`;
             return rows.length > 0;
         },
-        async getAssistantConversation(params) {
+        async listAssistantChats(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef))
+                return [];
+            const limit = params.limit ?? SLOTLOCK_ASSISTANT_MAX_CHATS;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > SLOTLOCK_ASSISTANT_MAX_CHATS) {
+                throw invalidIdentityError(`Slotlock assistant chat list limit must be 1-${String(SLOTLOCK_ASSISTANT_MAX_CHATS)}`);
+            }
+            const rows = await sql `
+        SELECT chat_id, title, updated_at FROM slotlock.assistant_chats
+         WHERE tenant_ref = ${params.tenantRef} AND member_ref = ${params.memberRef}
+           AND (expires_at IS NULL OR expires_at > statement_timestamp())
+         ORDER BY updated_at DESC, chat_id
+         LIMIT ${limit}`;
+            return rows.map((row) => ({ id: row.chat_id, title: row.title, updatedAt: row.updated_at }));
+        },
+        async getAssistantChat(params) {
+            if (!isValidIdentity(params.tenantRef) ||
+                !isValidIdentity(params.memberRef) ||
+                !SLOTLOCK_ASSISTANT_CHAT_ID.test(params.chatId)) {
                 return null;
+            }
             const [row] = await sql `
-        SELECT messages, actions, updated_at, expires_at FROM slotlock.assistant_conversations
+        SELECT title, messages, actions, created_at, updated_at, expires_at FROM slotlock.assistant_chats
          WHERE tenant_ref = ${params.tenantRef} AND member_ref = ${params.memberRef}
-           AND expires_at > statement_timestamp()`;
+           AND chat_id = ${params.chatId}
+           AND (expires_at IS NULL OR expires_at > statement_timestamp())`;
             if (!row)
                 return null;
             return {
+                id: params.chatId,
+                title: row.title,
                 messages: row.messages,
                 actions: row.actions,
+                createdAt: row.created_at,
                 updatedAt: row.updated_at,
                 expiresAt: row.expires_at,
             };
         },
-        async putAssistantConversation(params) {
+        async putAssistantChat(params) {
             if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef)) {
                 throw invalidIdentityError('Slotlock tenant and member references must be 1-500 UTF-8 bytes');
             }
-            if (!Number.isSafeInteger(params.ttlMs) || params.ttlMs < 1_000 || params.ttlMs > 86_400_000) {
-                throw invalidIdentityError('Slotlock assistant conversation ttlMs must be 1 second to a day');
+            if (!SLOTLOCK_ASSISTANT_CHAT_ID.test(params.chatId)) {
+                throw invalidIdentityError('Slotlock assistant chat id must be 16 URL-safe characters');
+            }
+            const title = params.title.trim();
+            if ([...title].length < 1 || [...title].length > 120) {
+                throw invalidIdentityError('Slotlock assistant chat title must be 1-120 characters');
             }
+            if (params.ttlMs !== null &&
+                (!Number.isSafeInteger(params.ttlMs) || params.ttlMs < 1_000 || params.ttlMs > 3_650 * 86_400_000)) {
+                throw invalidIdentityError('Slotlock assistant conversation ttlMs must be 1 second to 3,650 days');
+            }
+            const ttlSeconds = params.ttlMs === null ? null : params.ttlMs / 1_000;
             const messages = sql.json(params.messages);
             const added = sql.json(params.added);
             const keep = [...params.keep];
+            // One member's chats are written one at a time, so the trim below sees every insert before it.
             await sql `
-        DELETE FROM slotlock.assistant_conversations
-         WHERE tenant_ref = ${params.tenantRef} AND expires_at <= statement_timestamp()`;
+        SELECT pg_advisory_xact_lock(hashtextextended(
+          ${`slotlock:assistant-chats:${params.tenantRef}\n${params.memberRef}`}::text, 0))`;
+            if (params.create === false) {
+                // Only one still there: a chat deleted while its turn ran stays deleted.
+                const changed = await sql `
+          UPDATE slotlock.assistant_chats AS stored
+             SET messages = ${messages},
+                 actions = (
+                   SELECT coalesce(jsonb_object_agg(existing.key, existing.value), '{}'::jsonb)
+                     FROM jsonb_each(stored.actions) AS existing
+                    WHERE existing.key = ANY(${keep}::text[])
+                 ) || (
+                   SELECT coalesce(jsonb_object_agg(fresh.key, fresh.value), '{}'::jsonb)
+                     FROM jsonb_each(${added}::jsonb) AS fresh
+                    WHERE NOT stored.actions ? fresh.key
+                 ),
+                 updated_at = statement_timestamp(),
+                 expires_at = CASE WHEN ${ttlSeconds}::double precision IS NULL THEN NULL
+                                   ELSE statement_timestamp() + make_interval(secs => ${ttlSeconds}::double precision) END
+           WHERE stored.tenant_ref = ${params.tenantRef} AND stored.member_ref = ${params.memberRef}
+             AND stored.chat_id = ${params.chatId}
+             AND (stored.expires_at IS NULL OR stored.expires_at > statement_timestamp())
+          RETURNING 1`;
+                if (changed.length === 0)
+                    return false;
+                if (ttlSeconds !== null) {
+                    await sql `
+            SELECT slotlock.register_assistant_tenant(
+              ${params.tenantRef}::text,
+              statement_timestamp() + make_interval(secs => ${ttlSeconds}::double precision))`;
+                }
+                return true;
+            }
             await sql `
-        INSERT INTO slotlock.assistant_conversations AS stored
-          (tenant_ref, member_ref, messages, actions, updated_at, expires_at)
-        VALUES (${params.tenantRef}, ${params.memberRef}, ${messages}, ${added},
-                statement_timestamp(),
-                statement_timestamp() + make_interval(secs => ${params.ttlMs / 1_000}))
-        ON CONFLICT (tenant_ref, member_ref) DO UPDATE SET
+        INSERT INTO slotlock.assistant_chats AS stored
+          (tenant_ref, member_ref, chat_id, title, messages, actions, created_at, updated_at, expires_at)
+        VALUES (${params.tenantRef}, ${params.memberRef}, ${params.chatId}, ${title}, ${messages}, ${added},
+                statement_timestamp(), statement_timestamp(),
+                CASE WHEN ${ttlSeconds}::double precision IS NULL THEN NULL
+                     ELSE statement_timestamp() + make_interval(secs => ${ttlSeconds}::double precision) END)
+        ON CONFLICT (tenant_ref, member_ref, chat_id) DO UPDATE SET
           messages = EXCLUDED.messages,
           -- The stored ones kept, as they stand, then the new ones: never a settled one again.
           actions = (
@@ -5896,21 +8115,55 @@ function buildSlotlockStore(sql, options, refusal) {
           ),
           updated_at = EXCLUDED.updated_at,
           expires_at = EXCLUDED.expires_at`;
+            // The member keeps the most recent; past the limit, the least recently used go.
             await sql `
-        SELECT slotlock.register_assistant_tenant(
-          ${params.tenantRef}::text,
-          statement_timestamp() + make_interval(secs => ${params.ttlMs / 1_000}))`;
+        DELETE FROM slotlock.assistant_chats gone
+         WHERE gone.tenant_ref = ${params.tenantRef} AND gone.member_ref = ${params.memberRef}
+           AND gone.chat_id IN (
+             SELECT kept.chat_id FROM slotlock.assistant_chats kept
+              WHERE kept.tenant_ref = ${params.tenantRef} AND kept.member_ref = ${params.memberRef}
+              ORDER BY kept.updated_at DESC, kept.chat_id
+             OFFSET ${SLOTLOCK_ASSISTANT_MAX_CHATS})`;
+            if (ttlSeconds !== null) {
+                await sql `
+          SELECT slotlock.register_assistant_tenant(
+            ${params.tenantRef}::text,
+            statement_timestamp() + make_interval(secs => ${ttlSeconds}::double precision))`;
+            }
+            return true;
+        },
+        async renameAssistantChat(params) {
+            if (!isValidIdentity(params.tenantRef) ||
+                !isValidIdentity(params.memberRef) ||
+                !SLOTLOCK_ASSISTANT_CHAT_ID.test(params.chatId)) {
+                return false;
+            }
+            const title = params.title.trim();
+            if ([...title].length < 1 || [...title].length > 120) {
+                throw invalidIdentityError('Slotlock assistant chat title must be 1-120 characters');
+            }
+            const rows = await sql `
+        UPDATE slotlock.assistant_chats SET title = ${title}
+         WHERE tenant_ref = ${params.tenantRef} AND member_ref = ${params.memberRef}
+           AND chat_id = ${params.chatId}
+           AND (expires_at IS NULL OR expires_at > statement_timestamp())
+        RETURNING 1`;
+            return rows.length > 0;
         },
         async settleAssistantAction(params) {
-            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef))
+            if (!isValidIdentity(params.tenantRef) ||
+                !isValidIdentity(params.memberRef) ||
+                !SLOTLOCK_ASSISTANT_CHAT_ID.test(params.chatId)) {
                 return null;
+            }
             const patch = sql.json(params.patch);
             const [row] = await sql `
-        UPDATE slotlock.assistant_conversations
+        UPDATE slotlock.assistant_chats
            SET actions = jsonb_set(actions, ARRAY[${params.actionId}::text],
                                    (actions -> ${params.actionId}::text) || ${patch}::jsonb)
          WHERE tenant_ref = ${params.tenantRef} AND member_ref = ${params.memberRef}
-           AND expires_at > statement_timestamp()
+           AND chat_id = ${params.chatId}
+           AND (expires_at IS NULL OR expires_at > statement_timestamp())
            AND actions -> ${params.actionId}::text ->> 'status' = ${params.from}
         RETURNING actions -> ${params.actionId}::text AS action`;
             return row?.action ?? null;
@@ -5922,7 +8175,17 @@ function buildSlotlockStore(sql, options, refusal) {
             if (!Number.isSafeInteger(limit) || limit < 1 || limit > 10_000) {
                 throw invalidIdentityError('Slotlock assistant prune limit must be 1-10,000');
             }
-            const rows = await sql `
+            // The conversations a deployment gave a lifetime, past it; and those 0.8 kept, past theirs.
+            const chats = await sql `
+        DELETE FROM slotlock.assistant_chats
+         WHERE tenant_ref = ${params.tenantRef}
+           AND (member_ref, chat_id) IN (
+             SELECT member_ref, chat_id FROM slotlock.assistant_chats
+              WHERE tenant_ref = ${params.tenantRef} AND expires_at <= statement_timestamp()
+              LIMIT ${limit})
+           AND expires_at <= statement_timestamp()
+        RETURNING 1`;
+            const old = await sql `
         DELETE FROM slotlock.assistant_conversations
          WHERE tenant_ref = ${params.tenantRef}
            AND member_ref IN (
@@ -5931,7 +8194,7 @@ function buildSlotlockStore(sql, options, refusal) {
               LIMIT ${limit})
            AND expires_at <= statement_timestamp()
         RETURNING 1`;
-            return rows.length;
+            return chats.length + old.length;
         },
         async sweepAssistantConversations(params) {
             const limit = params?.limit ?? 10_000;
@@ -5942,14 +8205,113 @@ function buildSlotlockStore(sql, options, refusal) {
         SELECT slotlock.sweep_assistant_conversations(${limit}::integer) AS deleted`;
             return Number(row?.deleted ?? 0);
         },
-        async deleteAssistantConversation(params) {
-            if (!isValidIdentity(params.tenantRef) || !isValidIdentity(params.memberRef))
+        async sweepDashboardRecords() {
+            // Each its own statement: an erasure that runs long never takes the prunes with it.
+            const [pruned] = await sql `
+        SELECT slotlock.prune_workspace_invitations() + slotlock.prune_dashboard_sessions()
+               + slotlock.prune_workspace_domains() + slotlock.prune_sso() AS deleted`;
+            const [erased] = await sql `SELECT slotlock.erase_deleted_teams() AS erased`;
+            return Number(pruned?.deleted ?? 0) + Number(erased?.erased ?? 0);
+        },
+        async deleteAssistantChat(params) {
+            if (!isValidIdentity(params.tenantRef) ||
+                !isValidIdentity(params.memberRef) ||
+                !SLOTLOCK_ASSISTANT_CHAT_ID.test(params.chatId)) {
                 return false;
+            }
             const rows = await sql `
-        DELETE FROM slotlock.assistant_conversations
-         WHERE tenant_ref = ${params.tenantRef} AND member_ref = ${params.memberRef} RETURNING 1`;
+        DELETE FROM slotlock.assistant_chats
+         WHERE tenant_ref = ${params.tenantRef} AND member_ref = ${params.memberRef}
+           AND chat_id = ${params.chatId} RETURNING 1`;
             return rows.length > 0;
         },
+        async recordAuditEvent(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant references must be 1-500 UTF-8 bytes');
+            }
+            const event = params.event;
+            if (!AUDIT_ACTION.test(event.action) || !AUDIT_ACTOR_TYPES.has(event.actorType) || !isValidIdentity(event.actorRef)) {
+                throw invalidIdentityError('Slotlock audit events need an action (area.verb), an actor type and an actor reference');
+            }
+            if (event.targetType !== undefined && !AUDIT_TARGET_TYPE.test(event.targetType)) {
+                throw invalidIdentityError('Slotlock audit event target types are lowercase words');
+            }
+            if (event.actorRole !== undefined && event.actorRole !== null && !isSlotlockWorkspaceRole(event.actorRole)) {
+                throw invalidIdentityError('Slotlock audit event roles are workspace roles');
+            }
+            await sql `
+        INSERT INTO slotlock.audit_events
+          (tenant_ref, action, actor_type, actor_ref, actor_role, target_type, target_ref, outcome,
+           reason, ip_address, user_agent, metadata)
+        VALUES (${params.tenantRef}, ${event.action}, ${event.actorType}, ${event.actorRef},
+                ${event.actorRole ?? null}, ${event.targetType ?? null}, ${cutBytes(event.targetRef, 500)},
+                ${event.outcome === 'denied' ? 'denied' : 'success'}, ${cutBytes(event.reason, 200)},
+                ${cutBytes(event.ipAddress, 64)}, ${cutBytes(event.userAgent, 256)},
+                ${sql.json(boundAuditMetadata(event.metadata ?? {}))})`;
+        },
+        async listAuditEvents(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return [];
+            const limit = Math.min(Math.max(Math.trunc(params.limit ?? 50), 1), 200);
+            const before = params.before;
+            const action = params.action !== undefined && AUDIT_ACTION.test(params.action) ? params.action : null;
+            const actor = params.actorRef !== undefined && isValidIdentity(params.actorRef) ? params.actorRef : null;
+            const beforeId = params.beforeId !== undefined && isValidResourceId(params.beforeId) ? params.beforeId : null;
+            if (params.beforeId !== undefined && beforeId === null)
+                return [];
+            const rows = await sql `
+        SELECT id, occurred_at, action, actor_type, actor_ref, actor_role, target_type, target_ref,
+               outcome, reason, ip_address, user_agent, metadata, chain_index, hash
+          FROM slotlock.audit_events
+         WHERE tenant_ref = ${params.tenantRef}
+           AND (${action}::text IS NULL OR action = ${action}::text)
+           AND (${actor}::text IS NULL OR actor_ref = ${actor}::text)
+           AND (${before?.occurredAt ?? null}::timestamptz IS NULL
+                OR (occurred_at, id) < (${before?.occurredAt ?? null}::timestamptz, ${before?.id ?? null}::uuid))
+           AND (${beforeId}::uuid IS NULL
+                OR (occurred_at, id) < (SELECT kept.occurred_at, kept.id FROM slotlock.audit_events kept
+                                         WHERE kept.tenant_ref = ${params.tenantRef} AND kept.id = ${beforeId}::uuid))
+         ORDER BY occurred_at DESC, id DESC
+         LIMIT ${limit}`;
+            return rows.map((row) => ({
+                id: row.id,
+                occurredAt: row.occurred_at,
+                action: row.action,
+                actorType: row.actor_type,
+                actorRef: row.actor_ref,
+                actorRole: row.actor_role,
+                ...(row.target_type !== null ? { targetType: row.target_type } : {}),
+                ...(row.target_ref !== null ? { targetRef: row.target_ref } : {}),
+                outcome: row.outcome,
+                ...(row.reason !== null ? { reason: row.reason } : {}),
+                ...(row.ip_address !== null ? { ipAddress: row.ip_address } : {}),
+                ...(row.user_agent !== null ? { userAgent: row.user_agent } : {}),
+                chainIndex: row.chain_index === null ? null : Number(row.chain_index),
+                hash: row.hash === null ? null : row.hash.toString('hex'),
+                metadata: row.metadata,
+            }));
+        },
+        async tenantPlan(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return null;
+            const [row] = await sql `
+        SELECT plan, status FROM slotlock.tenant_plan(${params.tenantRef}::text) LIMIT 1`;
+            return row ? { plan: row.plan, status: row.status } : null;
+        },
+        async pruneAuditEvents(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return 0;
+            const [row] = await sql `
+        SELECT slotlock.prune_audit_events(${params.tenantRef}::text) AS pruned`;
+            return Number(row?.pruned ?? 0);
+        },
+        async verifyAuditChain(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return { checked: 0, brokenAt: null };
+            const [row] = await sql `
+        SELECT checked, broken_at FROM slotlock.verify_audit_chain(${params.tenantRef}::text)`;
+            return { checked: Number(row?.checked ?? 0), brokenAt: row?.broken_at === null || row === undefined ? null : Number(row.broken_at) };
+        },
         async offerWaitlist(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
@@ -5967,10 +8329,21 @@ function buildSlotlockStore(sql, options, refusal) {
                 await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify(['slotlock-waitlist', tenantRef])}, 0))`;
                 let expired = 0;
                 if (!after) {
+                    // Offers whose hold ran out lapse (slotlock.waitlist_offer_settle), freeing their time.
+                    await tx `
+            DELETE FROM slotlock.reservations offer
+             USING slotlock.resources resource
+             WHERE resource.id = offer.resource_id AND resource.tenant_ref = ${tenantRef}
+               AND offer.status = 'held' AND offer.source = 'slotlock:waitlist'
+               AND offer.expires_at <= statement_timestamp()`;
                     const [gone] = await tx `
             WITH gone AS (
               UPDATE slotlock.waitlist_entries SET status = 'expired'
-               WHERE tenant_ref = ${tenantRef} AND status = 'waiting' AND starts_at <= statement_timestamp()
+               WHERE tenant_ref = ${tenantRef} AND status = 'waiting'
+                 -- The whole window once it starts; a length once no slot of it fits before the end.
+                 AND (CASE WHEN duration_ms IS NULL THEN starts_at
+                           ELSE ends_at - make_interval(secs => duration_ms / 1000.0) END)
+                     <= statement_timestamp()
               RETURNING id, resource_id, pool_ref, starts_at, ends_at, holder_ref
             ), reported AS (
               INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
@@ -6004,6 +8377,15 @@ function buildSlotlockStore(sql, options, refusal) {
              WHERE id = ${entry.id} AND status = 'waiting' FOR UPDATE`;
                     if (!still)
                         continue;
+                    if (entry.duration_ms !== null) {
+                        // Any slot of its length within its window (RFC 0004 B6), on its resource or any member.
+                        const slot = await offerSlotOfLength(tx, inner, tenantRef, entry);
+                        if (slot) {
+                            await recordWaitlistOffer(tx, tenantRef, entry, slot);
+                            offered += 1;
+                        }
+                        continue;
+                    }
                     // Only resources that look free (buffers included) are tried: a refused hold keeps its
                     // locks until the transaction ends.
                     const candidates = await tx `
@@ -6026,6 +8408,12 @@ function buildSlotlockStore(sql, options, refusal) {
                         && tstzrange(${entry.starts_at}::timestamptz - make_interval(mins => buffers.before_minutes),
                                      ${entry.ends_at}::timestamptz + make_interval(mins => buffers.after_minutes), '[)')
                     AND (taken.status <> 'held' OR taken.expires_at > statement_timestamp()))
+               -- Nor busy time a calendar reported (RFC 0004 C1), which the hold would be refused.
+               AND NOT EXISTS (
+                 SELECT 1 FROM slotlock.source_busy busy
+                  WHERE busy.resource_id = resources.id
+                    AND busy.starts_at < ${entry.ends_at}::timestamptz + make_interval(mins => buffers.after_minutes)
+                    AND busy.ends_at > ${entry.starts_at}::timestamptz - make_interval(mins => buffers.before_minutes))
              ORDER BY resources.id
              LIMIT ${OFFER_CANDIDATES}`;
                     for (const { id: resourceId } of candidates) {
@@ -6040,21 +8428,13 @@ function buildSlotlockStore(sql, options, refusal) {
                         });
                         if (!hold.ok)
                             continue;
-                        await tx `
-              UPDATE slotlock.waitlist_entries
-                 SET status = 'offered', hold_id = ${hold.hold.id}, offered_resource_id = ${resourceId},
-                     offered_at = statement_timestamp()
-               WHERE id = ${entry.id}`;
-                        await tx `
-              INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
-              VALUES (${tenantRef}, ${resourceId}, 'waitlist.offered', ${entry.id},
-                      jsonb_strip_nulls(jsonb_build_object(
-                        'id', ${entry.id}::uuid, 'hold_id', ${hold.hold.id}::uuid,
-                        'resource_id', ${resourceId}::uuid, 'pool', ${entry.pool_ref}::text,
-                        'start', ${entry.starts_at}::timestamptz, 'end', ${entry.ends_at}::timestamptz,
-                        'expires_at', ${hold.hold.expiresAt}::timestamptz,
-                        'holder_ref', ${entry.holder_ref}::text)),
-                      'slotlock:maintenance')`;
+                        await recordWaitlistOffer(tx, tenantRef, entry, {
+                            resourceId,
+                            holdId: hold.hold.id,
+                            start: entry.starts_at,
+                            end: entry.ends_at,
+                            expiresAt: hold.hold.expiresAt,
+                        });
                         offered += 1;
                         break;
                     }
@@ -6111,6 +8491,8 @@ function buildSlotlockStore(sql, options, refusal) {
            AND (reservation.status <> 'held' OR reservation.expires_at > statement_timestamp())
         UNION ALL
         ${compositeBusy(sql, params.resourceId, window)}
+        UNION ALL
+        ${sourceBusy(sql, params.resourceId, window)}
          ORDER BY 1
          LIMIT ${MAX_FREE_BUSY_INTERVALS + 1}`;
             if (busyRows.length > MAX_FREE_BUSY_INTERVALS) {