slotlock 0.9.0 → 0.10.0

package/store.js

@@ -1,15 +1,17 @@
 // DB mechanics for the Slotlock core: explicit `postgres` client in, structured results out.
 import { SLOTLOCK_MAX_LOCATION_DEPTH, SLOTLOCK_MAX_LOCATIONS, SLOTLOCK_MAX_RESOURCE_GROUPS, SLOTLOCK_POOL_ORDERS, SLOTLOCK_RESOURCE_KINDS, isSlotlockResourceScope, parseSlotlockLocation, parseSlotlockResourceGroup, parseSlotlockResourceProfile, slotlockGroupingRef, } from './resource-profile.js';
 import { readSlotlockTenantUsage } from './usage.js';
+import { isSlotlockWorkspaceRole } from './workspace-roles.js';
 import { slotlockPlanReadRefusal } from './plans.js';
 import { SLOTLOCK_CHANGE_ORIGINS, SLOTLOCK_CHANGE_RETENTION_DAYS, isSlotlockChangeOrigin, slotlockEventFeedMethods, } from './event-feed.js';
 import { cancellationFeeDue, cutoffRuleBroken, bookingBufferBeforeMs, bookingSearchBlocked, bookingSearchReach, parseBookingRuleDefaults, parseEffectiveBookingRules, bookingBufferAfterMs, bookingRuleBroken, bookingSearch, parseBookingRules, } from './booking-rules.js';
-import { createHash, randomUUID } from 'node:crypto';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import ICAL from 'ical.js';
 import { SLOTLOCK_ASSISTANT_CHAT_ID, SLOTLOCK_ASSISTANT_MAX_CHATS, SLOTLOCK_CORE_DDL, SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH, SLOTLOCK_DEPLOYMENT_CHECKS, SLOTLOCK_SCHEMA_CONTROL_REFUSAL, SLOTLOCK_SCHEMA_NEWER_REFUSAL, SLOTLOCK_SCHEMA_VERSION, SLOTLOCK_STRUCTURE_DDL, SLOTLOCK_TENANT_CONTEXT_SETTING, SLOTLOCK_RESOURCE_SCOPED_TABLES, SLOTLOCK_RESOURCE_SCOPE_SETTING, SLOTLOCK_TENANT_TABLES, SLOTLOCK_VALIDATION_DDL, createSlotlockApplicationRoleGrantsDdl, createSlotlockTenantRlsDdl, slotlockCoverageChangeRenameSql, slotlockTenantLockKey, } from './ddl.js';
 import { findNextAvailable, mergeIntervals } from './engine.js';
 import { SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX, assertBoundedSearchWindow, expandRules, invalidWindowError, } from './rules.js';
 import { CalendarContractError, CalendarExpansionLimitError, expandCalendarEventSeries, normalizeCalendarEventContent, } from './sync.js';
+import { SLOTLOCK_SUBJECT_TABLES, SLOTLOCK_TENANT_EXPORT_TABLES, } from './types.js';
 import { parseAvailabilityRules } from './weekly-hours.js';
 import { applicableHours, exceptionQueryDays } from './hours.js';
 import { zonedDateTimeToUtc } from './timezone.js';
@@ -34,6 +36,29 @@ const MAX_HOLD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const MAX_BUFFER_AFTER_MS = 30 * 24 * 60 * 60 * 1000;
 /** A day, as bufferBeforeMinutes allows: a read by start can then still use the index. */
 const MAX_BUFFER_BEFORE_MS = 24 * 60 * 60 * 1000;
+/** An audit action: `area.verb` (or `area.thing.verb`), lowercase. */
+const AUDIT_ACTION = /^[a-z][a-z_]{0,31}(\.[a-z][a-z_]{0,31}){1,2}$/;
+const AUDIT_TARGET_TYPE = /^[a-z][a-z_]{0,31}$/;
+const AUDIT_ACTOR_TYPES = new Set(['person', 'api_key', 'assistant', 'system']);
+/** Text cut to at most `max` UTF-8 bytes on a character boundary; null when absent or empty. */
+function cutBytes(value, max) {
+    if (value === undefined || value === '')
+        return null;
+    if (Buffer.byteLength(value, 'utf8') <= max)
+        return value;
+    let out = '';
+    for (const character of value) {
+        if (Buffer.byteLength(out + character, 'utf8') > max)
+            break;
+        out += character;
+    }
+    return out === '' ? null : out;
+}
+/** Audit metadata kept under the column's 4 KB: past it, the event says it was cut. */
+function boundAuditMetadata(metadata) {
+    const text = JSON.stringify(metadata);
+    return text !== undefined && Buffer.byteLength(text, 'utf8') <= 3_000 ? metadata : { truncated: true };
+}
 export { SLOTLOCK_CALENDAR_HORIZON_DAYS, SLOTLOCK_SOURCE_BUSY_MAX };
 /**
  * Longest one-off event (ten years and some leap days); a recurring series is bounded by its
@@ -875,6 +900,169 @@ function pageLimit(limit) {
 function sandboxTestOnlyError() {
     return Object.assign(new Error('Slotlock does this only in a test environment (a tenant ending ~test)'), { code: 'sandbox_test_only' });
 }
+/** Columns an export leaves out of a table it holds: secrets, and leases only a server reads. */
+const TENANT_EXPORT_LEFT_OUT_COLUMNS = {
+    webhook_endpoints: ['secret', 'lease_token', 'lease_until'],
+    assistant_settings: ['sealed_key'],
+};
+/**
+ * Every table an export holds, as one statement (so one snapshot): each row as its table's name
+ * and a JSON line, without the tenant. `$1` is the tenant. A hold keeps no tenant of its own: its
+ * resource's is its. API keys come from slotlock.list_api_keys, which holds no digest.
+ */
+const TENANT_EXPORT_SQL = SLOTLOCK_TENANT_EXPORT_TABLES.map((table) => {
+    if (table === 'api_keys') {
+        return `SELECT 'api_keys'::text AS table_name, (pg_catalog.to_jsonb(kept) - 'key_tenant_ref')::text AS line
+  FROM slotlock.list_api_keys($1) kept`;
+    }
+    const dropped = ['tenant_ref', ...(TENANT_EXPORT_LEFT_OUT_COLUMNS[table] ?? [])].map((column) => ` - '${column}'`).join('');
+    const where = table === 'reservations'
+        ? `kept.tenant_ref = $1 OR (kept.tenant_ref IS NULL AND kept.resource_id IN (
+           SELECT owned.id FROM slotlock.resources owned WHERE owned.tenant_ref = $1))`
+        : 'kept.tenant_ref = $1';
+    return `SELECT '${table}'::text AS table_name, (pg_catalog.to_jsonb(kept)${dropped})::text AS line
+  FROM slotlock.${table} kept WHERE ${where}`;
+}).join('\nUNION ALL\n');
+/**
+ * Read everything the tenant keeps through one cursor (one snapshot), handing each part (one
+ * table's rows, up to SLOTLOCK_TENANT_EXPORT_PART_ROWS or about a megabyte) to `onPart`.
+ */
+async function readTenantExport(tx, tenantRef, onPart) {
+    const totals = { rows: 0, bytes: 0, tables: {} };
+    let current = null;
+    const flush = async () => {
+        if (current && current.lines.length > 0)
+            await onPart(current);
+        current = null;
+    };
+    await tx.unsafe(`DECLARE slotlock_tenant_export NO SCROLL CURSOR FOR\n${TENANT_EXPORT_SQL}`, [tenantRef]);
+    for (;;) {
+        const rows = await tx.unsafe('FETCH 1000 FROM slotlock_tenant_export');
+        if (rows.length === 0)
+            break;
+        for (const row of rows) {
+            const open = current;
+            if (open &&
+                (open.table !== row.table_name ||
+                    open.lines.length >= SLOTLOCK_TENANT_EXPORT_PART_ROWS ||
+                    open.bytes >= TENANT_EXPORT_PART_BYTES)) {
+                await flush();
+            }
+            current ??= { table: row.table_name, lines: [], bytes: 0 };
+            const bytes = Buffer.byteLength(row.line) + 1;
+            current.lines.push(row.line);
+            current.bytes += bytes;
+            totals.rows += 1;
+            totals.bytes += bytes;
+            totals.tables[row.table_name] = (totals.tables[row.table_name] ?? 0) + 1;
+        }
+    }
+    await flush();
+    await tx.unsafe('CLOSE slotlock_tenant_export');
+    return totals;
+}
+function toTenantExport(row) {
+    return {
+        id: row.id,
+        status: row.status,
+        requestedBy: row.requested_by,
+        createdAt: row.created_at,
+        finishedAt: row.finished_at,
+        expiresAt: row.expires_at,
+        parts: row.parts,
+        rows: Number(row.row_count),
+        bytes: Number(row.bytes),
+        tables: row.tables,
+        error: row.error,
+    };
+}
+function tenantExportRefusal(code) {
+    const message = {
+        export_in_progress: 'Slotlock builds one export of a tenant at a time: wait for the one asked for',
+        export_limit_reached: `Slotlock keeps at most ${SLOTLOCK_MAX_TENANT_EXPORTS} exports of a tenant: delete one first`,
+        export_too_large: `Slotlock exports at most ${SLOTLOCK_TENANT_EXPORT_MAX_BYTES / 1024 / 1024} MB through the API: its operator runs slotlock tenant export`,
+    }[code];
+    return Object.assign(new Error(message), { code });
+}
+/** A subject request's email: one address, compared without case. */
+const SUBJECT_EMAIL = /^[^\s@]+@[^\s@]+$/;
+/** Whom a subject request names, checked; null when it names none, more than one, or a bad one. */
+function subjectKey(subject) {
+    if (typeof subject !== 'object' || subject === null)
+        return null;
+    const named = Object.entries(subject).filter(([, value]) => value !== undefined);
+    if (named.length !== 1)
+        return null;
+    const [kind, raw] = named[0];
+    if (typeof raw !== 'string')
+        return null;
+    if (kind === 'email') {
+        const value = raw.trim().toLowerCase();
+        const bytes = Buffer.byteLength(value);
+        return bytes >= 3 && bytes <= 320 && SUBJECT_EMAIL.test(value) ? { kind, value } : null;
+    }
+    if (kind === 'contact')
+        return isValidContactRef(raw) ? { kind, value: raw } : null;
+    if (kind === 'holder' || kind === 'reference')
+        return isValidIdentity(raw) ? { kind, value: raw } : null;
+    return null;
+}
+function invalidSubjectError() {
+    return Object.assign(new Error('Slotlock names a person by exactly one of email, holder, contact or reference'), { code: 'invalid_subject' });
+}
+function emptySubjectCounts() {
+    return Object.fromEntries(SLOTLOCK_SUBJECT_TABLES.map((table) => [table, 0]));
+}
+/** The request fields an approval may keep a booking's or an event's reference in. */
+const SUBJECT_REFERENCE_KEYS = ['reference', 'reservation_ref', 'external_ref', 'event_ref'];
+/** The approvals whose request names the subject (SQL, on `approval`). */
+function subjectApprovalSql(tx, key, contactRefs) {
+    const value = key.value;
+    switch (key.kind) {
+        case 'email':
+            return tx `(lower(approval.request -> 'organizer' ->> 'email') = ${value}
+                 OR (jsonb_typeof(approval.request -> 'attendees') = 'array'
+                     AND EXISTS (SELECT 1 FROM jsonb_array_elements(approval.request -> 'attendees') AS attendee(value)
+                                  WHERE lower(attendee.value ->> 'email') = ${value}))
+                 OR approval.request ->> 'contact_ref' = ANY(${contactRefs}::text[]))`;
+        case 'holder':
+            return tx `approval.request ->> 'holder_ref' = ${value}`;
+        case 'contact':
+            return tx `approval.request ->> 'contact_ref' = ${value}`;
+        case 'reference':
+            return tx `EXISTS (SELECT 1 FROM unnest(${[...SUBJECT_REFERENCE_KEYS]}::text[]) AS field(name)
+                         WHERE approval.request ->> field.name = ${value})`;
+    }
+}
+/** An approval's request with the subject taken out (SQL, on `approval`). */
+function subjectScrubbedRequestSql(tx, key, contactRefs, replacement) {
+    const value = key.value;
+    switch (key.kind) {
+        case 'email':
+            return tx `(
+        SELECT CASE WHEN lower(kept.request -> 'organizer' ->> 'email') = ${value} THEN kept.request - 'organizer'
+                    ELSE kept.request END
+          FROM (SELECT CASE
+                         WHEN jsonb_typeof(scrubbed.request -> 'attendees') = 'array'
+                         THEN jsonb_set(scrubbed.request, '{attendees}', coalesce((
+                           SELECT jsonb_agg(attendee.value ORDER BY attendee.ordinality)
+                             FROM jsonb_array_elements(scrubbed.request -> 'attendees')
+                                  WITH ORDINALITY AS attendee(value, ordinality)
+                            WHERE lower(attendee.value ->> 'email') IS DISTINCT FROM ${value}), '[]'::jsonb))
+                         ELSE scrubbed.request END AS request
+                  FROM (SELECT CASE WHEN approval.request ->> 'contact_ref' = ANY(${contactRefs}::text[])
+                                    THEN approval.request - 'contact_ref' ELSE approval.request END AS request) scrubbed) kept)`;
+        case 'holder':
+            return tx `jsonb_set(approval.request, '{holder_ref}', to_jsonb(${replacement}::text))`;
+        case 'contact':
+            return tx `approval.request - 'contact_ref'`;
+        case 'reference':
+            return tx `(
+        SELECT approval.request || coalesce(jsonb_object_agg(field.name, to_jsonb(${replacement}::text)), '{}'::jsonb)
+          FROM unnest(${[...SUBJECT_REFERENCE_KEYS]}::text[]) AS field(name)
+         WHERE approval.request ->> field.name = ${value})`;
+    }
+}
 function invalidIdentityError(message) {
     return Object.assign(new Error(message), { code: 'invalid_identity' });
 }
@@ -1319,6 +1507,7 @@ async function bookingRuling(tx, resourceId, interval, defaultHours) {
         rule: judge.broken(interval),
         turnaroundMs: judge.turnaroundMs,
         bufferBeforeMs: judge.bufferBeforeMs,
+        holdPrice: judge.holdPrice,
     };
 }
 /**
@@ -1351,10 +1540,23 @@ async function localStartFor(tx, resourceId, localStart, start) {
 async function sourceBusyLoss(tx, resourceId, start, end) {
     const [hit] = await tx `
     SELECT 1 FROM slotlock.source_busy
-     WHERE resource_id = ${resourceId} AND starts_at < ${end} AND ends_at > ${start}
+     WHERE resource_id IN (${compositeKin(tx, resourceId)}) AND starts_at < ${end} AND ends_at > ${start}
      LIMIT 1`;
     return hit !== undefined;
 }
+/**
+ * The resources whose busy time keeps this one busy (RFC 0003 G8, RFC 0004 C1), as a subquery: it,
+ * its composite if it is a part (the whole is in use), and its parts if it is a composite (a part
+ * in use takes the whole). Never its sibling parts, which are booked apart.
+ */
+function compositeKin(executor, resourceId) {
+    return executor `
+    SELECT ${resourceId}::uuid
+    UNION ALL
+    SELECT parent_id FROM slotlock.resources WHERE id = ${resourceId}::uuid AND parent_id IS NOT NULL
+    UNION ALL
+    SELECT id FROM slotlock.resources WHERE parent_id = ${resourceId}::uuid`;
+}
 /**
  * A source's busy time as kept: each interval valid, clipped to the window, sorted and merged
  * (touching ones too). Null when any is not an interval, or there are too many.
@@ -1488,6 +1690,42 @@ async function rulesNow(tx, resourceId) {
  * Mark what the next change of a booking records on the feed (RFC 0004 B5): a cancellation's fee
  * and an admin's reason for going past a cutoff. Cleared with nulls.
  */
+/**
+ * Whether a paid hold ended without a booking (RFC 0004 C3), so its payment was never applied:
+ * not booked (confirmed, or booked from), not still held, and not taken over by an approval that
+ * was granted or may still be.
+ */
+async function paidHoldEnded(tx, tenantRef, payment) {
+    if (payment.booked_at)
+        return false;
+    const [hold] = await tx `
+    SELECT status, expires_at > statement_timestamp() AS live FROM slotlock.reservations WHERE id = ${payment.id}`;
+    if (hold)
+        return hold.status === 'held' && !hold.live;
+    if (payment.approval_id) {
+        const [approval] = await tx `
+      SELECT status, expires_at > statement_timestamp() AS live FROM slotlock.approvals
+       WHERE id = ${payment.approval_id}::uuid AND tenant_ref = ${tenantRef}`;
+        if (approval?.status === 'granted')
+            return false;
+        if (approval?.status === 'pending' && approval.live)
+            return false;
+    }
+    return true;
+}
+/**
+ * Whether cancelling a booking that starts at `start` would be late now (RFC 0004 B5): past its
+ * cancel cutoff, or inside the window its cancellation fee is due in. A move made then keeps that
+ * start as the booking's cutoff anchor, so a move cannot take it out of what a cancellation owes.
+ */
+function cancellationLate(rules, start, now) {
+    return (cutoffRuleBroken(rules, 'cancel', start, now) !== null ||
+        (rules?.cancellationFee?.withinMinutes !== undefined && cancellationFeeDue(rules, start, now) !== null));
+}
+/** The start a cancellation is judged from: the cutoff anchor a late move kept, if earlier. */
+function cancellationStart(start, anchor) {
+    return anchor && anchor.getTime() < start.getTime() ? anchor : start;
+}
 async function noteEnding(tx, fee, overrideReason) {
     await tx `
     SELECT set_config('slotlock.cancellation_fee', ${fee ? JSON.stringify(fee) : ''}, true),
@@ -1502,18 +1740,22 @@ async function eventEnding(tx, event, enforce, overrideReason) {
     if (event.recurring)
         return { ok: true, fee: null };
     const judged = await rulesNow(tx, event.resource_id);
+    // From the start it had when a late move kept it, if one did.
+    const start = cancellationStart(event.starts_at, event.cutoff_anchor);
     let note = null;
-    if (enforce && cutoffRuleBroken(judged.rules, 'cancel', event.starts_at, judged.now)) {
+    if (enforce && cutoffRuleBroken(judged.rules, 'cancel', start, judged.now)) {
         if (overrideReason === undefined) {
             return { ok: false, refusal: { ok: false, code: 'booking_rule_violated', rule: 'cancel_cutoff' } };
         }
         note = overrideReason;
     }
-    const due = cancellationFeeDue(judged.rules, event.starts_at, judged.now);
+    const due = cancellationFeeDue(judged.rules, start, judged.now);
     const fee = due ? { amountMinor: due.amountMinor, currency: due.currency } : null;
     await noteEnding(tx, fee ? { amount_minor: fee.amountMinor, currency: fee.currency } : null, note);
     return { ok: true, fee };
 }
+/** How long busy time a calendar reported is kept after it ended: the feed's retention. */
+const SOURCE_BUSY_RETENTION_DAYS = 30;
 /** How recently a sync must have read a resource whose booking rules require certainty. */
 const CERTAIN_COVERAGE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /**
@@ -1530,7 +1772,7 @@ async function bookingJudge(tx, resourceId, defaultHours) {
            to_char((statement_timestamp() AT TIME ZONE 'UTC')::date - 2, 'YYYY-MM-DD') AS today
       FROM slotlock.resources WHERE id = ${resourceId}`;
     if (!row || row.effective_booking_rules === null || row.effective_booking_rules === undefined) {
-        return { broken: () => null, turnaroundMs: 0, bufferBeforeMs: 0 };
+        return { broken: () => null, turnaroundMs: 0, bufferBeforeMs: 0, holdPrice: undefined };
     }
     const resource = toResource({
         id: resourceId,
@@ -1583,6 +1825,7 @@ async function bookingJudge(tx, resourceId, defaultHours) {
         }) ?? (uncertain(interval) ? 'uncertain' : null),
         turnaroundMs,
         bufferBeforeMs,
+        holdPrice: rules?.holdPrice,
     };
 }
 function sameExternalPayload(row, params, turnaroundMs = 0) {
@@ -1594,6 +1837,29 @@ function sameExternalPayload(row, params, turnaroundMs = 0) {
         Number(row.revision) === params.revision &&
         row.source === (params.source ?? null));
 }
+/**
+ * What a holder holds in the tenant, live: its own holds, and those of approvals it asked for that
+ * a person has yet to decide (RFC 0004 A4), which hold time for it just the same. Counted for its
+ * caps under the holder's lock. `except` leaves out a hold about to give way to an approval.
+ */
+async function holderHeld(tx, tenantRef, holderRef, except) {
+    const [held] = await tx `
+    SELECT count(*)::int AS count,
+           COALESCE(sum(extract(epoch FROM
+             ends_at + (buffer_after_ms + buffer_before_ms) * interval '1 millisecond'
+               - starts_at)), 0)::float8
+             AS seconds
+      FROM slotlock.reservations
+     WHERE tenant_ref IS NULL AND status = 'held'
+       AND expires_at > statement_timestamp()
+       AND resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef})
+       AND (${except ?? null}::uuid IS NULL OR id <> ${except ?? null}::uuid)
+       AND (holder_ref = ${holderRef}
+            OR holder_ref IN (SELECT 'approval:' || approval.id FROM slotlock.approvals approval
+                               WHERE approval.tenant_ref = ${tenantRef} AND approval.status = 'pending'
+                                 AND approval.requester ->> 'holder_ref' = ${holderRef}))`;
+    return { count: held?.count ?? 0, seconds: held?.seconds ?? 0 };
+}
 async function lockExternalIdentity(tx, tenantRef, externalRef) {
     // JSON is unambiguous for this pair and has no NUL byte (Postgres text rejects U+0000).
     await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([tenantRef, externalRef])}, 0))`;
@@ -1982,6 +2248,24 @@ async function rollStoredSeries(tx, tenantRef, eventId, horizon) {
         cursor: row.recurrence_cursor ?? null,
         stored: true,
     });
+    // Busy time a calendar reported (RFC 0004 C1) is refused to a rolled occurrence as an overlap is:
+    // nothing is written, the series is put off, and the roll counts it a conflict.
+    if ((event.transparency ?? 'opaque') === 'opaque' && occurrences.length > 0) {
+        const beforeMs = Number(row.buffer_before_ms ?? 0);
+        const afterMs = Number(row.buffer_after_ms ?? 0);
+        const [met] = await tx `
+      SELECT 1
+        FROM slotlock.source_busy busy
+        JOIN ROWS FROM (
+               pg_catalog.unnest(${occurrences.map((each) => new Date(each.start.getTime() - beforeMs).toISOString())}::text[]::timestamptz[]),
+               pg_catalog.unnest(${occurrences.map((each) => new Date(each.end.getTime() + afterMs).toISOString())}::text[]::timestamptz[]))
+             AS occurrence(starts_at, ends_at)
+          ON busy.starts_at < occurrence.ends_at AND busy.ends_at > occurrence.starts_at
+       WHERE busy.resource_id IN (${compositeKin(tx, row.resource_id)})
+       LIMIT 1`;
+        if (met)
+            throw Object.assign(new Error('slotlock: a rolled occurrence meets reported busy time'), { code: EXCLUSION_VIOLATION });
+    }
     await replaceCalendarEventOccurrences(tx, {
         tenantRef,
         eventId: row.id,
@@ -2157,6 +2441,35 @@ async function rollSeriesBehind(executor, resourceId, start, end, exceptEventId)
         // Rolled back whole (its own transaction, or a savepoint of the caller's).
     }
 }
+/** An audit event as the API and `slotlock audit export` give it: snake_case, nulls kept. */
+export function slotlockAuditEventRecord(event) {
+    return {
+        id: event.id,
+        occurred_at: event.occurredAt.toISOString(),
+        action: event.action,
+        actor_type: event.actorType,
+        actor_ref: event.actorRef,
+        actor_role: event.actorRole ?? null,
+        target_type: event.targetType ?? null,
+        target_ref: event.targetRef ?? null,
+        outcome: event.outcome,
+        reason: event.reason ?? null,
+        ip_address: event.ipAddress ?? null,
+        user_agent: event.userAgent ?? null,
+        metadata: event.metadata,
+        chain_index: event.chainIndex,
+        hash: event.hash,
+    };
+}
+/** Hours a tenant export is kept once ready, or since it was asked for if it never is. */
+export const SLOTLOCK_TENANT_EXPORT_HOURS = 24;
+/** The most a tenant export holds: past it, the export fails (`export_too_large`). */
+export const SLOTLOCK_TENANT_EXPORT_MAX_BYTES = 512 * 1024 * 1024;
+/** The most exports a tenant keeps at once. */
+export const SLOTLOCK_MAX_TENANT_EXPORTS = 5;
+/** A part of an export: one table's rows, at most this many, or about this many bytes. */
+export const SLOTLOCK_TENANT_EXPORT_PART_ROWS = 5_000;
+const TENANT_EXPORT_PART_BYTES = 1024 * 1024;
 const MAX_TENANT_LIMIT = 10_000_000;
 function tenantLimitsOption(limits) {
     const valid = {};
@@ -2448,7 +2761,7 @@ function sourceBusy(executor, resourceId, window) {
     return executor `
     SELECT busy.starts_at AS occupied_starts_at, busy.ends_at AS occupied_ends_at
       FROM slotlock.source_busy busy
-     WHERE busy.resource_id = ${resourceId}
+     WHERE busy.resource_id IN (${compositeKin(executor, resourceId)})
        AND busy.starts_at < ${window.end} AND busy.ends_at > ${window.start}`;
 }
 /**
@@ -2560,6 +2873,24 @@ export function createTenantSlots(max) {
 function lockTimeoutError(cause) {
     return Object.assign(new Error('Slotlock tenant transaction waited too long for a lock: retry later', { cause }), { code: 'lock_timeout' });
 }
+/**
+ * Build a pending tenant export (RFC 0004 D3) in its own tenant transaction, and mark it failed if
+ * that fails (`export_too_large`, else `export_failed`). Null when it was not pending, or another
+ * server is building it. Never throws: a server builds it after answering, and maintenance builds
+ * one left pending.
+ */
+export async function buildSlotlockTenantExport(store, tenantRef, exportId) {
+    try {
+        return await store.withTenant(tenantRef, (tenant) => tenant.buildTenantExport({ tenantRef, exportId }));
+    }
+    catch (error) {
+        const reason = error?.code === 'export_too_large' ? 'export_too_large' : 'export_failed';
+        await store
+            .withTenant(tenantRef, (tenant) => tenant.failTenantExport({ tenantRef, exportId, error: reason }))
+            .catch(() => undefined);
+        return null;
+    }
+}
 export function createSlotlockStore(sql, options = {}) {
     return buildSlotlockStore(sql, options, null);
 }
@@ -3977,7 +4308,7 @@ function buildSlotlockStore(sql, options, refusal) {
                         await lockExternalIdentity(tx, params.tenantRef, params.externalRef);
                         const existing = await tx `
               SELECT id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
-                     buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes
+                     buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes, cutoff_anchor
                 FROM slotlock.reservations
                WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
                  AND calendar_event_id IS NULL
@@ -4011,6 +4342,7 @@ function buildSlotlockStore(sql, options, refusal) {
                             found.ends_at.getTime() !== params.end.getTime() ||
                             found.resource_id !== params.resourceId;
                         let overrideNote = null;
+                        let cutoffAnchor = found.cutoff_anchor;
                         if (moved) {
                             const judged = await rulesNow(tx, found.resource_id);
                             if (cutoffRuleBroken(judged.rules, 'reschedule', found.starts_at, judged.now)) {
@@ -4019,6 +4351,10 @@ function buildSlotlockStore(sql, options, refusal) {
                                 }
                                 overrideNote = params.overrideReason;
                             }
+                            // Moved when cancelling would already be late: it stays as late as it was.
+                            const from = cancellationStart(found.starts_at, cutoffAnchor);
+                            if (cancellationLate(judged.rules, from, judged.now))
+                                cutoffAnchor = from;
                         }
                         const resourceState = await tenantResourceState(tx, params.resourceId, params.tenantRef);
                         if (resourceState === 'missing')
@@ -4072,7 +4408,8 @@ function buildSlotlockStore(sql, options, refusal) {
                      checked_in_at = CASE
                        WHEN starts_at = ${params.start} AND resource_id = ${params.resourceId}
                        THEN checked_in_at
-                     END
+                     END,
+                     cutoff_anchor = ${cutoffAnchor ?? null}::timestamptz
                WHERE id = ${found.id}
                RETURNING id, resource_id, tenant_ref, external_ref, starts_at, ends_at,
                          buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes`;
@@ -4125,7 +4462,7 @@ function buildSlotlockStore(sql, options, refusal) {
                         : { ok: false, code: 'reservation_cancelled' };
                 }
                 const existing = await tx `
-          SELECT id, revision, resource_id, starts_at FROM slotlock.reservations
+          SELECT id, revision, resource_id, starts_at, cutoff_anchor FROM slotlock.reservations
            WHERE tenant_ref = ${params.tenantRef} AND external_ref = ${params.externalRef}
              AND calendar_event_id IS NULL
            FOR UPDATE`;
@@ -4142,13 +4479,15 @@ function buildSlotlockStore(sql, options, refusal) {
                         return { ok: false, code: 'revision_conflict' };
                     }
                     const judged = await rulesNow(tx, found.resource_id);
-                    if (cutoffRuleBroken(judged.rules, 'cancel', found.starts_at, judged.now)) {
+                    // From the start it had when a late move kept it, if one did.
+                    const start = cancellationStart(found.starts_at, found.cutoff_anchor);
+                    if (cutoffRuleBroken(judged.rules, 'cancel', start, judged.now)) {
                         if (params.overrideReason === undefined) {
                             return { ok: false, code: 'booking_rule_violated', rule: 'cancel_cutoff' };
                         }
                         overrideNote = params.overrideReason;
                     }
-                    fee = cancellationFeeDue(judged.rules, found.starts_at, judged.now);
+                    fee = cancellationFeeDue(judged.rules, start, judged.now);
                 }
                 if (!found) {
                     // This reference is a calendar event's occupation, not a booking: nothing to cancel or
@@ -4296,6 +4635,24 @@ function buildSlotlockStore(sql, options, refusal) {
                             return { ok: false, code: 'resource_archived' };
                         if (holdLimit !== null)
                             return { ok: false, code: 'hold_limit_reached', limit: holdLimit };
+                        // An agent's hold takes the tenant's price, never its own (RFC 0004 C3).
+                        let holdPaymentRequired = paymentRequired;
+                        let holdPayment = params.payment;
+                        let holdTtlSeconds = ttlSeconds;
+                        // The resource's rules, read once: its price here, the rest judged below.
+                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
+                        if (params.priceFromRules === true) {
+                            const price = ruling.holdPrice;
+                            if (params.payment !== undefined &&
+                                (!price || price.amountMinor !== params.payment.amountMinor || price.currency !== params.payment.currency)) {
+                                return { ok: false, code: 'payment_price_mismatch' };
+                            }
+                            if (price) {
+                                holdPaymentRequired = true;
+                                holdPayment = { amountMinor: price.amountMinor, currency: price.currency };
+                                holdTtlSeconds = Math.min(ttlSeconds, SLOTLOCK_PAYMENT_HOLD_MAX_TTL_MS / 1000);
+                            }
+                        }
                         let heldSeconds = null;
                         if (holderRef !== undefined) {
                             // Counted under a lock on the holder, so racing holds stop at the cap: an agent
@@ -4305,23 +4662,13 @@ function buildSlotlockStore(sql, options, refusal) {
                                 tenantRef,
                                 holderRef,
                             ])}, 0))`;
-                            const [held] = await tx `
-                SELECT count(*)::int AS count,
-                       COALESCE(sum(extract(epoch FROM
-                         ends_at + (buffer_after_ms + buffer_before_ms) * interval '1 millisecond'
-                           - starts_at)), 0)::float8
-                         AS seconds
-                  FROM slotlock.reservations
-                 WHERE holder_ref = ${holderRef} AND tenant_ref IS NULL AND status = 'held'
-                   AND expires_at > statement_timestamp()
-                   AND resource_id IN (SELECT id FROM slotlock.resources WHERE tenant_ref = ${tenantRef ?? null})`;
-                            if ((held?.count ?? 0) >= holdCap) {
+                            const held = await holderHeld(tx, tenantRef ?? null, holderRef);
+                            if (held.count >= holdCap) {
                                 return { ok: false, code: 'hold_limit_reached', limit: holdCap };
                             }
                             if (heldHoursCap !== undefined)
-                                heldSeconds = held?.seconds ?? 0;
+                                heldSeconds = held.seconds;
                         }
-                        const ruling = await bookingRuling(tx, params.resourceId, params, defaultHours);
                         if (ruling.rule)
                             return { ok: false, code: 'booking_rule_violated', rule: ruling.rule };
                         written = Math.max(bufferAfterMs, ruling.turnaroundMs);
@@ -4358,9 +4705,9 @@ function buildSlotlockStore(sql, options, refusal) {
                 payment_amount_minor, payment_currency
               ) VALUES (
                 ${params.resourceId}, ${params.start}, ${params.end}, ${written}, ${writtenBefore}, 'held',
-                statement_timestamp() + make_interval(secs => ${ttlSeconds}), ${params.source ?? null},
-                ${holderRef ?? null}, ${params.groupId ?? null}, ${paymentRequired},
-                ${params.payment?.amountMinor ?? null}, ${params.payment?.currency ?? null}
+                statement_timestamp() + make_interval(secs => ${holdTtlSeconds}), ${params.source ?? null},
+                ${holderRef ?? null}, ${params.groupId ?? null}, ${holdPaymentRequired},
+                ${holdPayment?.amountMinor ?? null}, ${holdPayment?.currency ?? null}
               )
               RETURNING id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at, source,
                         hold_group_id, ${tx.unsafe(HOLD_PAYMENT_COLUMNS)}`;
@@ -4494,6 +4841,382 @@ function buildSlotlockStore(sql, options, refusal) {
                 return { deleted: deleted.length > 0, bookings: bookings.length };
             }, 'read committed');
         },
+        async exportSubject(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const key = subjectKey(params.subject);
+            if (!key)
+                throw invalidSubjectError();
+            const limit = params.limit ?? 1_000;
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 10_000) {
+                throw Object.assign(new RangeError('Slotlock subject export limit must be 1-10000'), { code: 'invalid_limit' });
+            }
+            const tenantRef = params.tenantRef;
+            const value = key.value;
+            const take = limit + 1;
+            return inTransaction(sql, async (tx) => {
+                // The contacts an email or a contact reference names; the bookings, changes and approvals
+                // that name those contacts are theirs too.
+                const contactRefs = key.kind === 'email'
+                    ? (await tx `
+                SELECT ref FROM slotlock.contacts WHERE tenant_ref = ${tenantRef} AND lower(email) = ${value}`).map((row) => row.ref)
+                    : key.kind === 'contact'
+                        ? [value]
+                        : [];
+                const records = Object.fromEntries(SLOTLOCK_SUBJECT_TABLES.map((table) => [table, []]));
+                const read = async (table, rows) => {
+                    records[table] = (await rows).map((entry) => entry.row);
+                };
+                if (contactRefs.length > 0) {
+                    await read('contacts', tx `
+            SELECT to_jsonb(contact) - 'tenant_ref' AS row FROM slotlock.contacts contact
+             WHERE contact.tenant_ref = ${tenantRef} AND contact.ref = ANY(${contactRefs}::text[])
+             ORDER BY contact.ref LIMIT ${take}`);
+                    await read('reservations', tx `
+            SELECT to_jsonb(booking) - 'tenant_ref' AS row FROM slotlock.reservations booking
+             WHERE booking.tenant_ref = ${tenantRef} AND booking.contact_ref = ANY(${contactRefs}::text[])
+             ORDER BY booking.created_at, booking.id LIMIT ${take}`);
+                    await read('outbox', tx `
+            SELECT jsonb_build_object('id', change.id::text, 'type', change.type, 'subject', change.subject,
+                                      'data', change.data, 'occurred_at', change.occurred_at) AS row
+              FROM slotlock.outbox change
+             WHERE change.tenant_ref = ${tenantRef} AND change.data ->> 'contact_ref' = ANY(${contactRefs}::text[])
+             ORDER BY change.id LIMIT ${take}`);
+                }
+                if (key.kind === 'email') {
+                    await read('calendar_event_attendees', tx `
+            SELECT to_jsonb(attendee) - 'tenant_ref' AS row FROM slotlock.calendar_event_attendees attendee
+             WHERE attendee.tenant_ref = ${tenantRef} AND lower(attendee.email) = ${value}
+             ORDER BY attendee.event_id, attendee.ordinal LIMIT ${take}`);
+                }
+                if (key.kind === 'email' || key.kind === 'reference') {
+                    // An event's time and title, and its organizer only when that is them: never the others
+                    // it names.
+                    await read('calendar_events', tx `
+            SELECT jsonb_strip_nulls(jsonb_build_object(
+                     'id', event.id, 'external_ref', event.external_ref, 'resource_id', event.resource_id,
+                     'starts_at', event.starts_at, 'ends_at', event.ends_at, 'timezone', event.timezone,
+                     'summary', event.summary, 'status', event.status,
+                     'recurring', event.recurrence_rule IS NOT NULL, 'created_at', event.created_at,
+                     'organizer', CASE WHEN lower(event.organizer ->> 'email') = ${value} THEN event.organizer END)) AS row
+              FROM slotlock.calendar_events event
+             WHERE event.tenant_ref = ${tenantRef}
+               AND ${key.kind === 'email'
+                        ? tx `(lower(event.organizer ->> 'email') = ${value}
+                         OR EXISTS (SELECT 1 FROM jsonb_array_elements(event.attendees) AS attendee(value)
+                                     WHERE lower(attendee.value ->> 'email') = ${value}))`
+                        : tx `event.external_ref = ${value}`}
+             ORDER BY event.created_at, event.id LIMIT ${take}`);
+                }
+                if (key.kind === 'holder') {
+                    // A hold may keep no tenant of its own: its resource's is its.
+                    await read('reservations', tx `
+            SELECT to_jsonb(booking) - 'tenant_ref' AS row FROM slotlock.reservations booking
+             WHERE booking.holder_ref = ${value}
+               AND (booking.tenant_ref = ${tenantRef}
+                    OR (booking.tenant_ref IS NULL AND booking.resource_id IN (
+                      SELECT resource.id FROM slotlock.resources resource WHERE resource.tenant_ref = ${tenantRef})))
+             ORDER BY booking.created_at, booking.id LIMIT ${take}`);
+                    await read('waitlist_entries', tx `
+            SELECT to_jsonb(entry) - 'tenant_ref' AS row FROM slotlock.waitlist_entries entry
+             WHERE entry.tenant_ref = ${tenantRef} AND entry.holder_ref = ${value}
+             ORDER BY entry.created_at, entry.id LIMIT ${take}`);
+                    await read('outbox', tx `
+            SELECT jsonb_build_object('id', change.id::text, 'type', change.type, 'subject', change.subject,
+                                      'data', change.data, 'occurred_at', change.occurred_at) AS row
+              FROM slotlock.outbox change
+             WHERE change.tenant_ref = ${tenantRef} AND change.data ->> 'holder_ref' = ${value}
+             ORDER BY change.id LIMIT ${take}`);
+                }
+                if (key.kind === 'reference') {
+                    await read('reservations', tx `
+            SELECT to_jsonb(booking) - 'tenant_ref' AS row FROM slotlock.reservations booking
+             WHERE booking.tenant_ref = ${tenantRef} AND booking.external_ref = ${value}
+               AND booking.calendar_event_id IS NULL
+             ORDER BY booking.created_at, booking.id LIMIT ${take}`);
+                    for (const table of [
+                        'reservation_tombstones',
+                        'reservation_conflict_archive',
+                        'calendar_event_tombstones',
+                        'calendar_event_commands',
+                    ]) {
+                        await read(table, tx `
+              SELECT to_jsonb(kept) - 'tenant_ref' AS row FROM ${tx(`slotlock.${table}`)} kept
+               WHERE kept.tenant_ref = ${tenantRef} AND kept.external_ref = ${value}
+               LIMIT ${take}`);
+                    }
+                    await read('outbox', tx `
+            SELECT jsonb_build_object('id', change.id::text, 'type', change.type, 'subject', change.subject,
+                                      'data', change.data, 'occurred_at', change.occurred_at) AS row
+              FROM slotlock.outbox change
+             WHERE change.tenant_ref = ${tenantRef} AND change.data ->> 'reference' = ${value}
+             ORDER BY change.id LIMIT ${take}`);
+                }
+                // An approval's decision, never its request: that may name others.
+                await read('approvals', tx `
+          SELECT jsonb_strip_nulls(jsonb_build_object(
+                   'id', approval.id, 'policy_ref', approval.policy_ref, 'status', approval.status,
+                   'operation', approval.operation, 'starts_at', approval.starts_at,
+                   'ends_at', approval.ends_at, 'expires_at', approval.expires_at,
+                   'decided_at', approval.decided_at, 'created_at', approval.created_at)) AS row
+            FROM slotlock.approvals approval
+           WHERE approval.tenant_ref = ${tenantRef} AND ${subjectApprovalSql(tx, key, contactRefs)}
+           ORDER BY approval.created_at, approval.id LIMIT ${take}`);
+                let truncated = false;
+                for (const table of SLOTLOCK_SUBJECT_TABLES) {
+                    if (records[table].length > limit) {
+                        records[table] = records[table].slice(0, limit);
+                        truncated = true;
+                    }
+                }
+                return { records, truncated };
+            }, 'read committed');
+        },
+        async eraseSubject(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const key = subjectKey(params.subject);
+            if (!key)
+                throw invalidSubjectError();
+            const tenantRef = params.tenantRef;
+            const value = key.value;
+            // One name for what the erasure reached, so what was one holder or booking still reads as one.
+            const replacement = `erased-${randomBytes(16).toString('hex')}`;
+            return inTransaction(sql, async (tx) => {
+                const erased = emptySubjectCounts();
+                const count = async (table, rows) => {
+                    erased[table] += (await rows).length;
+                };
+                const changes = async (kind, name) => {
+                    const [row] = await tx `
+            SELECT slotlock.erase_subject_changes(${tenantRef}::text, ${kind}::text, ${name}::text,
+                                                  ${kind === 'contact' ? null : replacement}::text) AS changed`;
+                    erased.outbox += Number(row?.changed ?? 0);
+                };
+                const contactRefs = key.kind === 'email'
+                    ? (await tx `
+                SELECT ref FROM slotlock.contacts WHERE tenant_ref = ${tenantRef} AND lower(email) = ${value}
+                 ORDER BY ref`).map((row) => row.ref)
+                    : key.kind === 'contact'
+                        ? [value]
+                        : [];
+                // As deleteContact: a contact written meanwhile waits, then finds itself gone or kept.
+                for (const ref of contactRefs)
+                    await lockExternalIdentity(tx, tenantRef, `contact:${ref}`);
+                if (key.kind === 'reference')
+                    await lockExternalIdentity(tx, tenantRef, value);
+                // Approvals first, while their requests still match what is being erased.
+                await count('approvals', tx `
+          UPDATE slotlock.approvals approval
+             SET request = ${subjectScrubbedRequestSql(tx, key, contactRefs, replacement)}
+           WHERE approval.tenant_ref = ${tenantRef} AND ${subjectApprovalSql(tx, key, contactRefs)}
+          RETURNING 1`);
+                if (contactRefs.length > 0) {
+                    await count('contacts', tx `
+            DELETE FROM slotlock.contacts
+             WHERE tenant_ref = ${tenantRef} AND ref = ANY(${contactRefs}::text[])
+            RETURNING 1`);
+                    // The bookings stay; they no longer name whom to tell.
+                    await count('reservations', tx `
+            UPDATE slotlock.reservations SET contact_ref = NULL
+             WHERE tenant_ref = ${tenantRef} AND contact_ref = ANY(${contactRefs}::text[])
+            RETURNING 1`);
+                    for (const ref of contactRefs)
+                        await changes('contact', ref);
+                }
+                if (key.kind === 'email') {
+                    await count('calendar_event_attendees', tx `
+            DELETE FROM slotlock.calendar_event_attendees
+             WHERE tenant_ref = ${tenantRef} AND lower(email) = ${value}
+            RETURNING 1`);
+                    // The event keeps its revision: nothing it books changed, and no one is told of it again.
+                    await count('calendar_events', tx `
+            UPDATE slotlock.calendar_events event
+               SET attendees = coalesce((
+                     SELECT jsonb_agg(attendee.value ORDER BY attendee.ordinality)
+                       FROM jsonb_array_elements(event.attendees) WITH ORDINALITY AS attendee(value, ordinality)
+                      WHERE lower(attendee.value ->> 'email') IS DISTINCT FROM ${value}), '[]'::jsonb),
+                   organizer = CASE WHEN lower(event.organizer ->> 'email') = ${value} THEN NULL ELSE event.organizer END
+             WHERE event.tenant_ref = ${tenantRef}
+               AND (lower(event.organizer ->> 'email') = ${value}
+                    OR EXISTS (SELECT 1 FROM jsonb_array_elements(event.attendees) AS attendee(value)
+                                WHERE lower(attendee.value ->> 'email') = ${value}))
+            RETURNING 1`);
+                }
+                if (key.kind === 'holder') {
+                    await count('waitlist_entries', tx `
+            DELETE FROM slotlock.waitlist_entries
+             WHERE tenant_ref = ${tenantRef} AND holder_ref = ${value}
+            RETURNING 1`);
+                    // Holds and bookings stay as time taken, held by a name that is no one's.
+                    await count('reservations', tx `
+            UPDATE slotlock.reservations booking SET holder_ref = ${replacement}
+             WHERE booking.holder_ref = ${value}
+               AND (booking.tenant_ref = ${tenantRef}
+                    OR (booking.tenant_ref IS NULL AND booking.resource_id IN (
+                      SELECT resource.id FROM slotlock.resources resource WHERE resource.tenant_ref = ${tenantRef})))
+            RETURNING 1`);
+                    await changes('holder', value);
+                }
+                if (key.kind === 'reference') {
+                    // A booking keeps its time under a name that is no one's; so do its ended bookings and
+                    // events. The reference is free to book again.
+                    await count('reservations', tx `
+            UPDATE slotlock.reservations SET external_ref = ${replacement}
+             WHERE tenant_ref = ${tenantRef} AND external_ref = ${value} AND calendar_event_id IS NULL
+            RETURNING 1`);
+                    for (const table of [
+                        'reservation_tombstones',
+                        'reservation_conflict_archive',
+                        'calendar_events',
+                        'calendar_event_tombstones',
+                        'calendar_event_commands',
+                    ]) {
+                        await count(table, tx `
+              UPDATE ${tx(`slotlock.${table}`)} SET external_ref = ${replacement}
+               WHERE tenant_ref = ${tenantRef} AND external_ref = ${value}
+              RETURNING 1`);
+                    }
+                    await changes('reference', value);
+                }
+                return { erased };
+            }, 'read committed');
+        },
+        async createTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            const tenantRef = params.tenantRef;
+            return inTransaction(sql, async (tx) => {
+                await lockExternalIdentity(tx, tenantRef, 'tenant-export');
+                const [kept] = await tx `
+          SELECT count(*) FILTER (WHERE status = 'pending')::int AS pending, count(*)::int AS kept
+            FROM slotlock.tenant_exports
+           WHERE tenant_ref = ${tenantRef} AND expires_at > statement_timestamp()`;
+                if ((kept?.pending ?? 0) > 0)
+                    throw tenantExportRefusal('export_in_progress');
+                if ((kept?.kept ?? 0) >= SLOTLOCK_MAX_TENANT_EXPORTS)
+                    throw tenantExportRefusal('export_limit_reached');
+                const requestedBy = params.requestedBy === undefined ? null : cutBytes(params.requestedBy, 200) ?? null;
+                const [row] = await tx `
+          INSERT INTO slotlock.tenant_exports (tenant_ref, requested_by, expires_at)
+          VALUES (${tenantRef}, ${requestedBy},
+                  statement_timestamp() + make_interval(hours => ${SLOTLOCK_TENANT_EXPORT_HOURS}))
+          RETURNING *, row_count::text AS row_count, bytes::text AS bytes`;
+                if (!row)
+                    throw new Error('slotlock: tenant export insert returned no row');
+                return toTenantExport(row);
+            }, 'read committed');
+        },
+        async buildTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId))
+                return null;
+            const tenantRef = params.tenantRef;
+            const exportId = params.exportId;
+            return inTransaction(sql, async (tx) => {
+                // Held to the end: another server building it skips it rather than waiting.
+                const [claimed] = await tx `
+          SELECT id FROM slotlock.tenant_exports
+           WHERE id = ${exportId} AND tenant_ref = ${tenantRef} AND status = 'pending'
+           FOR UPDATE SKIP LOCKED`;
+                if (!claimed)
+                    return null;
+                let part = 0;
+                let written = 0;
+                const totals = await readTenantExport(tx, tenantRef, async (read) => {
+                    // Refused as soon as it is too large, so nothing past the limit is read or kept.
+                    written += read.bytes;
+                    if (written > SLOTLOCK_TENANT_EXPORT_MAX_BYTES)
+                        throw tenantExportRefusal('export_too_large');
+                    part += 1;
+                    await tx `
+            INSERT INTO slotlock.tenant_export_parts (export_id, tenant_ref, part, table_name, row_count, content)
+            VALUES (${exportId}, ${tenantRef}, ${part}, ${read.table}, ${read.lines.length}, ${read.lines.join('\n')})`;
+                });
+                const [row] = await tx `
+          UPDATE slotlock.tenant_exports
+             SET status = 'ready', finished_at = statement_timestamp(),
+                 expires_at = statement_timestamp() + make_interval(hours => ${SLOTLOCK_TENANT_EXPORT_HOURS}),
+                 parts = ${part}, row_count = ${totals.rows}, bytes = ${totals.bytes},
+                 tables = ${tx.json(totals.tables)}
+           WHERE id = ${exportId} AND tenant_ref = ${tenantRef}
+          RETURNING *, row_count::text AS row_count, bytes::text AS bytes`;
+                return row ? toTenantExport(row) : null;
+            }, 'read committed');
+        },
+        async failTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId))
+                return;
+            await sql `
+        UPDATE slotlock.tenant_exports
+           SET status = 'failed', finished_at = statement_timestamp(), error = ${cutBytes(params.error, 200) ?? 'export_failed'}
+         WHERE id = ${params.exportId} AND tenant_ref = ${params.tenantRef} AND status = 'pending'`;
+        },
+        async getTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId))
+                return null;
+            const [row] = await sql `
+        SELECT *, row_count::text AS row_count, bytes::text AS bytes FROM slotlock.tenant_exports
+         WHERE id = ${params.exportId} AND tenant_ref = ${params.tenantRef}`;
+            return row ? toTenantExport(row) : null;
+        },
+        async listTenantExports(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return [];
+            const rows = await sql `
+        SELECT *, row_count::text AS row_count, bytes::text AS bytes FROM slotlock.tenant_exports
+         WHERE tenant_ref = ${params.tenantRef}
+         ORDER BY created_at DESC, id DESC`;
+            return rows.map(toTenantExport);
+        },
+        async getTenantExportPart(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId)) {
+                return { ok: false, code: 'export_not_found' };
+            }
+            const [found] = await sql `
+        SELECT made.status, part.table_name, part.content
+          FROM slotlock.tenant_exports made
+          LEFT JOIN slotlock.tenant_export_parts part
+                 ON part.export_id = made.id AND part.tenant_ref = made.tenant_ref AND part.part = ${params.part}
+         WHERE made.id = ${params.exportId} AND made.tenant_ref = ${params.tenantRef}`;
+            if (!found)
+                return { ok: false, code: 'export_not_found' };
+            if (found.status !== 'ready')
+                return { ok: false, code: 'export_not_ready' };
+            if (found.table_name === null || found.content === null)
+                return { ok: false, code: 'export_part_not_found' };
+            return { ok: true, table: found.table_name, lines: found.content.split('\n') };
+        },
+        async deleteTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef) || !isValidResourceId(params.exportId))
+                return false;
+            const deleted = await sql `
+        DELETE FROM slotlock.tenant_exports WHERE id = ${params.exportId} AND tenant_ref = ${params.tenantRef}
+        RETURNING 1`;
+            return deleted.length > 0;
+        },
+        async pruneTenantExports(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return { deleted: 0, pending: [] };
+            const deleted = await sql `
+        DELETE FROM slotlock.tenant_exports
+         WHERE tenant_ref = ${params.tenantRef} AND expires_at <= statement_timestamp()
+        RETURNING 1`;
+            const pending = await sql `
+        SELECT id FROM slotlock.tenant_exports
+         WHERE tenant_ref = ${params.tenantRef} AND status = 'pending'
+           AND created_at < statement_timestamp() - interval '2 minutes'
+         ORDER BY created_at`;
+            return { deleted: deleted.length, pending: pending.map((row) => row.id) };
+        },
+        async streamTenantExport(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');
+            }
+            return inTransaction(sql, (tx) => readTenantExport(tx, params.tenantRef, ({ table, lines }) => params.onPart({ table, lines })), 'read committed');
+        },
         async markHoldPaid(params) {
             if (!isValidIdentity(params.tenantRef))
                 return { ok: false, code: 'invalid_identity' };
@@ -4511,13 +5234,19 @@ function buildSlotlockStore(sql, options, refusal) {
                 const [recorded] = await tx `
           SELECT hold_id AS id, resource_id, starts_at, ends_at, buffer_after_ms, expires_at,
                  NULL::text AS source, true AS payment_required, payment_ref, paid_at,
-                 payment_amount_minor, payment_currency, paid_amount_minor, paid_currency
+                 payment_amount_minor, payment_currency, paid_amount_minor, paid_currency,
+                 booked_at, approval_id
             FROM slotlock.hold_payments
            WHERE hold_id = ${params.holdId} AND tenant_ref = ${params.tenantRef}`;
                 if (recorded) {
-                    return recorded.payment_ref === params.paymentRef
-                        ? { ok: true, hold: toHold(recorded), idempotent: true }
-                        : { ok: false, code: 'payment_conflict' };
+                    if (recorded.payment_ref !== params.paymentRef) {
+                        // Named, so an adapter refunds only a payment it can tell is another.
+                        return { ok: false, code: 'payment_conflict', paymentRef: recorded.payment_ref };
+                    }
+                    // Its hold ended without a booking: the payment was never applied, and is refunded.
+                    if (await paidHoldEnded(tx, params.tenantRef, recorded))
+                        return { ok: false, code: 'hold_ended' };
+                    return { ok: true, hold: toHold(recorded), idempotent: true };
                 }
                 const [row] = await tx `
           SELECT hold.id, hold.resource_id, hold.starts_at, hold.ends_at, hold.buffer_after_ms,
@@ -4537,7 +5266,7 @@ function buildSlotlockStore(sql, options, refusal) {
                 if (row.payment_ref !== null && row.payment_ref !== undefined) {
                     return row.payment_ref === params.paymentRef
                         ? { ok: true, hold: toHold(row), idempotent: true }
-                        : { ok: false, code: 'payment_conflict' };
+                        : { ok: false, code: 'payment_conflict', paymentRef: row.payment_ref };
                 }
                 // Paid after it lapsed: the time may be someone else's by now. The integrator refunds.
                 if (!row.live)
@@ -4786,13 +5515,43 @@ function buildSlotlockStore(sql, options, refusal) {
                     if ((pending?.tenant ?? 0) >= SLOTLOCK_MAX_PENDING_APPROVALS) {
                         return { ok: false, code: 'approval_limit_reached', limit: SLOTLOCK_MAX_PENDING_APPROVALS };
                     }
+                    // The agent's caps, with its other pending approvals and without the hold that gives way
+                    // to this one; under its lock, taken before the resources' as a hold takes it.
+                    const holder = params.holder;
+                    if (holder && isValidIdentity(holder.ref)) {
+                        await tx `SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([
+                            'slotlock-holder',
+                            tenantRef,
+                            holder.ref,
+                        ])}, 0))`;
+                        const consumed = params.consumeHold && isValidResourceId(params.consumeHold.holdId) && params.consumeHold.holderRef === holder.ref
+                            ? params.consumeHold.holdId
+                            : undefined;
+                        const held = await holderHeld(tx, tenantRef, holder.ref, consumed);
+                        const holdCap = Math.min(maxHoldsPerHolder, holder.caps?.maxHolds ?? Number.POSITIVE_INFINITY);
+                        if (held.count + params.holds.length > holdCap) {
+                            return { ok: false, code: 'hold_limit_reached', limit: holdCap };
+                        }
+                        const heldHoursCap = holder.caps?.maxHeldHours !== undefined
+                            ? Math.min(maxHeldHoursPerHolder ?? Number.POSITIVE_INFINITY, holder.caps.maxHeldHours)
+                            : maxHeldHoursPerHolder;
+                        const asking = params.holds.reduce((seconds, hold) => seconds + (hold.end.getTime() - hold.start.getTime()) / 1000, 0);
+                        if (heldHoursCap !== undefined && held.seconds + asking > heldHoursCap * 3_600) {
+                            return { ok: false, code: 'held_time_limit_reached', limit: heldHoursCap };
+                        }
+                    }
                     const id = randomUUID();
                     // The requester's own hold of the time gives way to the approval's.
                     if (params.consumeHold && isValidResourceId(params.consumeHold.holdId)) {
+                        // Taken over, not ended: its payment, if any, goes with the approval (booked if granted).
+                        await tx `SELECT set_config('slotlock.ending', 'approval', true)`;
                         await tx `
               DELETE FROM slotlock.reservations
                WHERE id = ${params.consumeHold.holdId} AND status = 'held'
                  AND holder_ref = ${params.consumeHold.holderRef}`;
+                        await tx `SELECT set_config('slotlock.ending', '', true)`;
+                        await tx `UPDATE slotlock.hold_payments SET approval_id = ${id}::uuid
+                      WHERE hold_id = ${params.consumeHold.holdId} AND tenant_ref = ${tenantRef}`;
                     }
                     const holds = [...params.holds].sort((left, right) => left.resourceId.localeCompare(right.resourceId) || left.start.getTime() - right.start.getTime());
                     // Locked as any booking write locks them, in id order, so a racing booking takes turns.
@@ -4819,7 +5578,8 @@ function buildSlotlockStore(sql, options, refusal) {
               starts_at, ends_at, request_key, expires_at
             ) VALUES (
               ${id}, ${tenantRef}, ${params.policyRef}, ${params.operation}, ${tx.json(params.request)},
-              ${tx.json(params.requester)}, ${held.map((hold) => hold.id)}::uuid[],
+              ${tx.json((holder ? { ...params.requester, holder_ref: holder.ref } : params.requester))},
+              ${held.map((hold) => hold.id)}::uuid[],
               ${[...new Set(holds.map((hold) => hold.resourceId))]}::uuid[], ${params.start}, ${params.end},
               ${params.requestKey}, ${params.expiresAt}
             )
@@ -5027,6 +5787,11 @@ function buildSlotlockStore(sql, options, refusal) {
                     return { ok: false, code: 'payment_required' };
                 if (resource?.archived !== false)
                     return { ok: false, code: 'resource_archived' };
+                // Busy time a calendar reported since the hold was made (RFC 0004 C1) is refused, as an
+                // agent's confirmation of its hold refuses it: the source's time is not to be booked.
+                if (await sourceBusyLoss(tx, row.resource_id, row.starts_at, new Date(row.ends_at.getTime() + Number(row.buffer_after_ms)))) {
+                    return { ok: false, code: 'overlap' };
+                }
                 if (bookingTenant !== null) {
                     const [retired] = await tx `
             SELECT revision FROM slotlock.reservation_tombstones
@@ -5054,6 +5819,9 @@ function buildSlotlockStore(sql, options, refusal) {
                     buffer_after_ms, revision, source, contact_ref, notify, reminder_minutes`;
                 if (!confirmed)
                     throw new Error('slotlock: hold confirmation returned no row');
+                // Its payment, if any, is applied: never refunded as a hold that ended unbooked.
+                await tx `UPDATE slotlock.hold_payments SET booked_at = statement_timestamp()
+                  WHERE hold_id = ${holdId} AND booked_at IS NULL`;
                 // Its linked alternatives (one group, one holder) are released with it, as booking one
                 // from an agent releases the rest.
                 if (row.hold_group_id !== null && row.holder_ref !== null) {
@@ -5257,7 +6025,8 @@ function buildSlotlockStore(sql, options, refusal) {
               SELECT id, tenant_ref, owner_ref, external_ref, resource_id, starts_at, ends_at, timezone,
                      summary, description, location, status, transparency, organizer, attendees,
                      reminders, recurrence_rule, recurrence_exceptions, materialized_starts_at,
-                     materialized_ends_at, recurrence_cursor, revision, source, created_at, updated_at
+                     materialized_ends_at, recurrence_cursor, revision, source, created_at, updated_at,
+                     cutoff_anchor
                 FROM slotlock.calendar_events
                WHERE tenant_ref = ${params.tenantRef}
                  AND owner_ref = ${ownerRef}
@@ -5273,17 +6042,32 @@ function buildSlotlockStore(sql, options, refusal) {
                         if (params.expectedRevision !== currentRevision) {
                             return { ok: false, code: 'revision_conflict', currentRevision };
                         }
-                        // A one-off event moved in time or to another resource, past its reschedule cutoff
-                        // (RFC 0004 B5), is refused to a writer held to the booking rules.
-                        if (found &&
-                            params.enforceBookingRules === true &&
-                            found.recurrence_rule === null &&
-                            (found.starts_at.getTime() !== event.start.getTime() ||
+                        // A one-off event changed past its cutoffs (RFC 0004 B5) is refused to a writer held to
+                        // the booking rules: moved in time or to another resource, or made a series (whose
+                        // cancellation no cutoff holds), past its reschedule cutoff; made transparent, letting its
+                        // time go, past its cancel cutoff or once a cancellation fee is due, as a cancellation
+                        // would be (cancelling records the fee).
+                        let movedAnchor = null;
+                        if (found && params.enforceBookingRules === true && found.recurrence_rule === null) {
+                            const moved = found.starts_at.getTime() !== event.start.getTime() ||
                                 found.ends_at.getTime() !== event.end.getTime() ||
-                                found.resource_id !== params.resourceId)) {
-                            const judged = await rulesNow(tx, found.resource_id);
-                            if (cutoffRuleBroken(judged.rules, 'reschedule', found.starts_at, judged.now)) {
-                                return { ok: false, code: 'booking_rule_violated', rule: 'reschedule_cutoff' };
+                                found.resource_id !== params.resourceId ||
+                                (event.recurrence?.rrule ?? null) !== null;
+                            const letGo = found.transparency !== 'transparent' && (event.transparency ?? 'opaque') === 'transparent';
+                            if (moved || letGo) {
+                                const judged = await rulesNow(tx, found.resource_id);
+                                if (moved && cutoffRuleBroken(judged.rules, 'reschedule', found.starts_at, judged.now)) {
+                                    return { ok: false, code: 'booking_rule_violated', rule: 'reschedule_cutoff' };
+                                }
+                                const from = cancellationStart(found.starts_at, found.cutoff_anchor);
+                                if (letGo &&
+                                    (cutoffRuleBroken(judged.rules, 'cancel', from, judged.now) ||
+                                        cancellationFeeDue(judged.rules, from, judged.now) !== null)) {
+                                    return { ok: false, code: 'booking_rule_violated', rule: 'cancel_cutoff' };
+                                }
+                                // Moved when cancelling would already be late: it stays as late as it was.
+                                if (moved && cancellationLate(judged.rules, from, judged.now))
+                                    movedAnchor = from;
                             }
                         }
                         const series = expanded ?? resumeStoredSeries(event, materializationWindow, found);
@@ -5319,6 +6103,7 @@ function buildSlotlockStore(sql, options, refusal) {
                         }
                         const eventId = found?.id ?? randomUUID();
                         const revision = currentRevision + 1;
+                        let heldPaid = false;
                         if (params.fromHold) {
                             const { holdId, holderRef } = params.fromHold;
                             if (!isValidResourceId(holdId) || !isValidIdentity(holderRef)) {
@@ -5327,12 +6112,14 @@ function buildSlotlockStore(sql, options, refusal) {
                             const [hold] = await tx `
                 SELECT resource_id, starts_at, ends_at, hold_group_id,
                        expires_at > statement_timestamp() AS live,
-                       (payment_required AND paid_at IS NULL) AS unpaid
+                       (payment_required AND paid_at IS NULL) AS unpaid,
+                       (payment_required AND paid_at IS NOT NULL) AS paid
                   FROM slotlock.reservations
                  WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${holderRef}
                  FOR UPDATE`;
                             if (!hold)
                                 return { ok: false, code: 'hold_not_found' };
+                            heldPaid = hold.paid;
                             // The holder's own hold that lapsed and is not yet reaped: named as the application
                             // API's confirm names it. Another holder's stays not found.
                             if (!hold.live)
@@ -5353,6 +6140,9 @@ function buildSlotlockStore(sql, options, refusal) {
                             await tx `SELECT set_config('slotlock.ending', 'confirmed', true)`;
                             await tx `DELETE FROM slotlock.reservations WHERE id = ${holdId} AND status = 'held' AND holder_ref = ${holderRef}`;
                             await tx `SELECT set_config('slotlock.ending', '', true)`;
+                            // Its payment, if any, is applied to this booking.
+                            await tx `UPDATE slotlock.hold_payments SET booked_at = statement_timestamp()
+                        WHERE hold_id = ${holdId} AND booked_at IS NULL`;
                             // A set held together (RFC 0004 B7) is booked member by member: its other holds stay.
                             await tx `
                 DELETE FROM slotlock.reservations
@@ -5364,8 +6154,16 @@ function buildSlotlockStore(sql, options, refusal) {
                         }
                         let turnaroundMs = 0;
                         let bufferBeforeMs = 0;
-                        if (params.enforceBookingRules === true && (event.transparency ?? 'opaque') === 'opaque') {
-                            const judge = await bookingJudge(tx, params.resourceId, defaultHours);
+                        // The resource's rules, read once, for its price and the rest alike.
+                        const judge = params.enforceBookingRules === true && (event.transparency ?? 'opaque') === 'opaque'
+                            ? await bookingJudge(tx, params.resourceId, defaultHours)
+                            : null;
+                        // A resource with a hold price (RFC 0004 C3) is booked by an agent only from its own
+                        // hold, once paid: new time on it, or time moved onto it from another resource.
+                        if (judge && (!found || found.resource_id !== params.resourceId) && !heldPaid && judge.holdPrice !== undefined) {
+                            return { ok: false, code: 'payment_required' };
+                        }
+                        if (judge) {
                             for (const [index, occurrence] of occurrences.entries()) {
                                 // A held time's notice and advance were judged when it was held.
                                 const rule = judge.broken(occurrence, { first: index === 0 && !params.fromHold });
@@ -5418,6 +6216,8 @@ function buildSlotlockStore(sql, options, refusal) {
                        buffer_before_ms = ${bufferBeforeMs},
                        -- Whether anyone should be told (RFC 0004 P3): as sent, like the rest.
                        notify = ${params.notify !== false},
+                       -- Kept, or set by a late move (RFC 0004 B5).
+                       cutoff_anchor = COALESCE(${movedAnchor}::timestamptz, cutoff_anchor),
                        updated_at = now()
                  WHERE id = ${eventId}
                    AND tenant_ref = ${params.tenantRef}
@@ -5791,7 +6591,7 @@ function buildSlotlockStore(sql, options, refusal) {
                     };
                 }
                 const events = await tx `
-          SELECT id, resource_id, revision, starts_at, recurrence_rule IS NOT NULL AS recurring
+          SELECT id, resource_id, revision, starts_at, recurrence_rule IS NOT NULL AS recurring, cutoff_anchor
             FROM slotlock.calendar_events
            WHERE tenant_ref = ${params.tenantRef}
              AND owner_ref = ${ownerRef}
@@ -5881,7 +6681,7 @@ function buildSlotlockStore(sql, options, refusal) {
                     return { ok: false, code: 'event_not_found' };
                 await lockCalendarEventIdentity(tx, params.tenantRef, identity.owner_ref, identity.external_ref);
                 const [found] = await tx `
-          SELECT id, resource_id, revision, starts_at, recurrence_rule IS NOT NULL AS recurring
+          SELECT id, resource_id, revision, starts_at, recurrence_rule IS NOT NULL AS recurring, cutoff_anchor
             FROM slotlock.calendar_events
            WHERE tenant_ref = ${params.tenantRef} AND id = ${params.eventId}
            FOR UPDATE`;
@@ -6267,6 +7067,18 @@ function buildSlotlockStore(sql, options, refusal) {
           )
           SELECT count(*)::int AS deleted FROM deleted`;
                 const tombstonesDeleted = Number(tombstones?.deleted ?? 0);
+                // Busy time a calendar reported (RFC 0004 C1) that ended a month ago keeps nothing out any
+                // more: it goes, as the feed's changes do, so a person's schedule is not kept for good.
+                const [busy] = await tx `
+          WITH ended AS (
+            SELECT ctid FROM slotlock.source_busy
+             WHERE tenant_ref = ${params.tenantRef}
+               AND ends_at < statement_timestamp() - make_interval(days => ${SOURCE_BUSY_RETENTION_DAYS})
+             LIMIT ${limit}
+          ), deleted AS (
+            DELETE FROM slotlock.source_busy busy USING ended WHERE busy.ctid = ended.ctid RETURNING 1
+          )
+          SELECT count(*)::int AS deleted FROM deleted`;
                 return {
                     expiredHoldsDeleted,
                     holdCommandsDeleted,
@@ -6274,7 +7086,8 @@ function buildSlotlockStore(sql, options, refusal) {
                     hasMore: legacy.length === limit ||
                         expiredHoldsDeleted === limit ||
                         holdCommandsDeleted === limit ||
-                        tombstonesDeleted === limit,
+                        tombstonesDeleted === limit ||
+                        Number(busy?.deleted ?? 0) === limit,
                 };
             });
         },
@@ -6493,7 +7306,7 @@ function buildSlotlockStore(sql, options, refusal) {
                  reported.starts_at AS busy_start, reported.ends_at AS busy_end
             FROM slotlock.reservations booking
             JOIN reported ON booking.starts_at < reported.ends_at AND booking.ends_at > reported.starts_at
-           WHERE booking.resource_id = ${params.resourceId}
+           WHERE booking.resource_id IN (${compositeKin(tx, params.resourceId)})
              AND booking.status = 'confirmed'
              AND booking.starts_at < ${window.end} AND booking.ends_at > ${window.start}
              AND NOT EXISTS (
@@ -6664,8 +7477,11 @@ function buildSlotlockStore(sql, options, refusal) {
                 throw new RangeError('limit must be a whole number from 1 to 5000');
             }
             const rows = await sql `
-        WITH due AS (
-          SELECT occurrence.event_id, occurrence.recurrence_id, reminder.ordinal, reminder.action,
+        WITH candidates AS (
+          -- Reminders due at the same time are said once (the first in the list).
+          SELECT DISTINCT ON (occurrence.event_id, occurrence.recurrence_id,
+                              occurrence.starts_at - make_interval(mins => reminder.minutes_before_start))
+                 occurrence.event_id, occurrence.recurrence_id, reminder.ordinal, reminder.action,
                  reminder.minutes_before_start, occurrence.starts_at, occurrence.ends_at,
                  event.resource_id,
                  occurrence.starts_at - make_interval(mins => reminder.minutes_before_start) AS due_at
@@ -6681,21 +7497,21 @@ function buildSlotlockStore(sql, options, refusal) {
                  <= statement_timestamp()
              AND occurrence.starts_at - make_interval(mins => reminder.minutes_before_start)
                  > statement_timestamp() - interval '1 day'
-             -- Said once per time it is due: an occurrence moved since is reminded again.
+             -- Said once per time it is due, whatever its place in the list: one added or
+             -- reordered says nothing again; an occurrence moved since is reminded again.
              AND NOT EXISTS (
                SELECT 1 FROM slotlock.reminder_dispatches sent
                 WHERE sent.event_id = occurrence.event_id AND sent.recurrence_id = occurrence.recurrence_id
-                  AND sent.ordinal = reminder.ordinal
                   AND sent.due_at = occurrence.starts_at - make_interval(mins => reminder.minutes_before_start))
-           ORDER BY due_at, occurrence.event_id, occurrence.recurrence_id, reminder.ordinal
-           LIMIT ${limit}
+           ORDER BY occurrence.event_id, occurrence.recurrence_id,
+                    occurrence.starts_at - make_interval(mins => reminder.minutes_before_start), reminder.ordinal
+        ), due AS (
+          SELECT * FROM candidates ORDER BY due_at, event_id, recurrence_id LIMIT ${limit}
         ), dispatched AS (
           INSERT INTO slotlock.reminder_dispatches (tenant_ref, event_id, recurrence_id, ordinal, due_at)
           SELECT ${params.tenantRef}, event_id, recurrence_id, ordinal, due_at FROM due
-          ON CONFLICT (event_id, recurrence_id, ordinal) DO UPDATE
-             SET due_at = EXCLUDED.due_at, dispatched_at = statement_timestamp()
-           WHERE slotlock.reminder_dispatches.due_at <> EXCLUDED.due_at
-          RETURNING event_id, recurrence_id, ordinal
+          ON CONFLICT (event_id, recurrence_id, due_at) DO NOTHING
+          RETURNING event_id, recurrence_id, due_at
         ), reported AS (
           INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
           SELECT ${params.tenantRef}, due.resource_id, 'reminder.due', due.event_id::text,
@@ -6705,7 +7521,7 @@ function buildSlotlockStore(sql, options, refusal) {
                    'minutes_before_start', due.minutes_before_start, 'due_at', due.due_at,
                    'start', due.starts_at, 'end', due.ends_at),
                  'slotlock:maintenance'
-            FROM due JOIN dispatched USING (event_id, recurrence_id, ordinal)
+            FROM due JOIN dispatched USING (event_id, recurrence_id, due_at)
           RETURNING 1
         )
         SELECT count(*)::int AS count FROM reported`;
@@ -6714,8 +7530,9 @@ function buildSlotlockStore(sql, options, refusal) {
                 return events;
             // A booking's reminders too, named by its reference, with whom to tell.
             const [bookings] = await sql `
-        WITH due AS (
-          SELECT booking.id, booking.external_ref, booking.resource_id, booking.contact_ref,
+        WITH candidates AS (
+          SELECT DISTINCT ON (booking.id, booking.starts_at - make_interval(mins => reminder.minutes))
+                 booking.id, booking.external_ref, booking.resource_id, booking.contact_ref,
                  booking.starts_at, booking.ends_at, (reminder.ordinal - 1)::int AS ordinal,
                  reminder.minutes,
                  booking.starts_at - make_interval(mins => reminder.minutes) AS due_at
@@ -6727,19 +7544,19 @@ function buildSlotlockStore(sql, options, refusal) {
              AND booking.starts_at > statement_timestamp()
              AND booking.starts_at - make_interval(mins => reminder.minutes) <= statement_timestamp()
              AND booking.starts_at - make_interval(mins => reminder.minutes) > statement_timestamp() - interval '1 day'
+             -- Said once per time it is due, as an event's reminders are.
              AND NOT EXISTS (
                SELECT 1 FROM slotlock.reservation_reminder_dispatches sent
-                WHERE sent.reservation_id = booking.id AND sent.ordinal = reminder.ordinal - 1
+                WHERE sent.reservation_id = booking.id
                   AND sent.due_at = booking.starts_at - make_interval(mins => reminder.minutes))
-           ORDER BY due_at, booking.id, reminder.ordinal
-           LIMIT ${limit - events}
+           ORDER BY booking.id, booking.starts_at - make_interval(mins => reminder.minutes), reminder.ordinal
+        ), due AS (
+          SELECT * FROM candidates ORDER BY due_at, id LIMIT ${limit - events}
         ), dispatched AS (
           INSERT INTO slotlock.reservation_reminder_dispatches (tenant_ref, reservation_id, ordinal, due_at)
           SELECT ${params.tenantRef}, id, ordinal, due_at FROM due
-          ON CONFLICT (reservation_id, ordinal) DO UPDATE
-             SET due_at = EXCLUDED.due_at, dispatched_at = statement_timestamp()
-           WHERE slotlock.reservation_reminder_dispatches.due_at <> EXCLUDED.due_at
-          RETURNING reservation_id AS id, ordinal
+          ON CONFLICT (reservation_id, due_at) DO NOTHING
+          RETURNING reservation_id AS id, due_at
         ), reported AS (
           INSERT INTO slotlock.outbox (tenant_ref, resource_id, type, subject, data, actor)
           SELECT ${params.tenantRef}, due.resource_id, 'reminder.due', due.external_ref,
@@ -6749,7 +7566,7 @@ function buildSlotlockStore(sql, options, refusal) {
                    'ordinal', due.ordinal, 'minutes_before_start', due.minutes, 'due_at', due.due_at,
                    'start', due.starts_at, 'end', due.ends_at)),
                  'slotlock:maintenance'
-            FROM due JOIN dispatched USING (id, ordinal)
+            FROM due JOIN dispatched USING (id, due_at)
           RETURNING 1
         )
         SELECT count(*)::int AS count FROM reported`;
@@ -7388,6 +8205,14 @@ function buildSlotlockStore(sql, options, refusal) {
         SELECT slotlock.sweep_assistant_conversations(${limit}::integer) AS deleted`;
             return Number(row?.deleted ?? 0);
         },
+        async sweepDashboardRecords() {
+            // Each its own statement: an erasure that runs long never takes the prunes with it.
+            const [pruned] = await sql `
+        SELECT slotlock.prune_workspace_invitations() + slotlock.prune_dashboard_sessions()
+               + slotlock.prune_workspace_domains() + slotlock.prune_sso() AS deleted`;
+            const [erased] = await sql `SELECT slotlock.erase_deleted_teams() AS erased`;
+            return Number(pruned?.deleted ?? 0) + Number(erased?.erased ?? 0);
+        },
         async deleteAssistantChat(params) {
             if (!isValidIdentity(params.tenantRef) ||
                 !isValidIdentity(params.memberRef) ||
@@ -7400,6 +8225,93 @@ function buildSlotlockStore(sql, options, refusal) {
            AND chat_id = ${params.chatId} RETURNING 1`;
             return rows.length > 0;
         },
+        async recordAuditEvent(params) {
+            if (!isValidIdentity(params.tenantRef)) {
+                throw invalidIdentityError('Slotlock tenant references must be 1-500 UTF-8 bytes');
+            }
+            const event = params.event;
+            if (!AUDIT_ACTION.test(event.action) || !AUDIT_ACTOR_TYPES.has(event.actorType) || !isValidIdentity(event.actorRef)) {
+                throw invalidIdentityError('Slotlock audit events need an action (area.verb), an actor type and an actor reference');
+            }
+            if (event.targetType !== undefined && !AUDIT_TARGET_TYPE.test(event.targetType)) {
+                throw invalidIdentityError('Slotlock audit event target types are lowercase words');
+            }
+            if (event.actorRole !== undefined && event.actorRole !== null && !isSlotlockWorkspaceRole(event.actorRole)) {
+                throw invalidIdentityError('Slotlock audit event roles are workspace roles');
+            }
+            await sql `
+        INSERT INTO slotlock.audit_events
+          (tenant_ref, action, actor_type, actor_ref, actor_role, target_type, target_ref, outcome,
+           reason, ip_address, user_agent, metadata)
+        VALUES (${params.tenantRef}, ${event.action}, ${event.actorType}, ${event.actorRef},
+                ${event.actorRole ?? null}, ${event.targetType ?? null}, ${cutBytes(event.targetRef, 500)},
+                ${event.outcome === 'denied' ? 'denied' : 'success'}, ${cutBytes(event.reason, 200)},
+                ${cutBytes(event.ipAddress, 64)}, ${cutBytes(event.userAgent, 256)},
+                ${sql.json(boundAuditMetadata(event.metadata ?? {}))})`;
+        },
+        async listAuditEvents(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return [];
+            const limit = Math.min(Math.max(Math.trunc(params.limit ?? 50), 1), 200);
+            const before = params.before;
+            const action = params.action !== undefined && AUDIT_ACTION.test(params.action) ? params.action : null;
+            const actor = params.actorRef !== undefined && isValidIdentity(params.actorRef) ? params.actorRef : null;
+            const beforeId = params.beforeId !== undefined && isValidResourceId(params.beforeId) ? params.beforeId : null;
+            if (params.beforeId !== undefined && beforeId === null)
+                return [];
+            const rows = await sql `
+        SELECT id, occurred_at, action, actor_type, actor_ref, actor_role, target_type, target_ref,
+               outcome, reason, ip_address, user_agent, metadata, chain_index, hash
+          FROM slotlock.audit_events
+         WHERE tenant_ref = ${params.tenantRef}
+           AND (${action}::text IS NULL OR action = ${action}::text)
+           AND (${actor}::text IS NULL OR actor_ref = ${actor}::text)
+           AND (${before?.occurredAt ?? null}::timestamptz IS NULL
+                OR (occurred_at, id) < (${before?.occurredAt ?? null}::timestamptz, ${before?.id ?? null}::uuid))
+           AND (${beforeId}::uuid IS NULL
+                OR (occurred_at, id) < (SELECT kept.occurred_at, kept.id FROM slotlock.audit_events kept
+                                         WHERE kept.tenant_ref = ${params.tenantRef} AND kept.id = ${beforeId}::uuid))
+         ORDER BY occurred_at DESC, id DESC
+         LIMIT ${limit}`;
+            return rows.map((row) => ({
+                id: row.id,
+                occurredAt: row.occurred_at,
+                action: row.action,
+                actorType: row.actor_type,
+                actorRef: row.actor_ref,
+                actorRole: row.actor_role,
+                ...(row.target_type !== null ? { targetType: row.target_type } : {}),
+                ...(row.target_ref !== null ? { targetRef: row.target_ref } : {}),
+                outcome: row.outcome,
+                ...(row.reason !== null ? { reason: row.reason } : {}),
+                ...(row.ip_address !== null ? { ipAddress: row.ip_address } : {}),
+                ...(row.user_agent !== null ? { userAgent: row.user_agent } : {}),
+                chainIndex: row.chain_index === null ? null : Number(row.chain_index),
+                hash: row.hash === null ? null : row.hash.toString('hex'),
+                metadata: row.metadata,
+            }));
+        },
+        async tenantPlan(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return null;
+            const [row] = await sql `
+        SELECT plan, status FROM slotlock.tenant_plan(${params.tenantRef}::text) LIMIT 1`;
+            return row ? { plan: row.plan, status: row.status } : null;
+        },
+        async pruneAuditEvents(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return 0;
+            const [row] = await sql `
+        SELECT slotlock.prune_audit_events(${params.tenantRef}::text) AS pruned`;
+            return Number(row?.pruned ?? 0);
+        },
+        async verifyAuditChain(params) {
+            if (!isValidIdentity(params.tenantRef))
+                return { checked: 0, brokenAt: null };
+            const [row] = await sql `
+        SELECT checked, broken_at FROM slotlock.verify_audit_chain(${params.tenantRef}::text)`;
+            return { checked: Number(row?.checked ?? 0), brokenAt: row?.broken_at === null || row === undefined ? null : Number(row.broken_at) };
+        },
         async offerWaitlist(params) {
             if (!isValidIdentity(params.tenantRef)) {
                 throw invalidIdentityError('Slotlock tenant reference must be 1-500 UTF-8 bytes');