@acms-subir/core 0.3.63 → 0.3.64

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @acms-subir/core
 
+## 0.3.64
+
+### Patch Changes
+
+- 243474e: The booking recipe no longer puts a booking's manage token in a route. On the web a route is the page address, so the token ended up in history and URL logs, against the app template's own rule. Its confirmation now keeps the token in memory and passes a random key to `app/book/manage.tsx`; after a restart, that screen points to the confirmation email's link instead. The native package has the helpers: `rememberBookingToken(token)` returns the key, and `bookingToken(key)` returns the token (or null). Apps that copied the recipe in 0.3.63 can copy the two changed files (`app/book/details.tsx`, `app/book/manage.tsx`).
+- 445ef91: The Google Calendar sync copies the site's confirmed room bookings to Google, out only. Each linked Google calendar whose link holds the booking's room (direction Both ways or Site → Google only, while the Site URL matches) gets one copy, titled with the booking link's name in the main language, with its time (busy) and a line saying it was booked on the website. Copies never carry the booker's name, email, phone, answers or notes, and never have guests; writes use `sendUpdates=none`. A copy is made when the booking is confirmed (pending bookings never go out), changed when it moves or its link is renamed, moved when the link's rooms change, and deleted when the booking is cancelled, declined or deleted.
+
+  Every copy has a hidden link (`extendedProperties.private` `{ acmsBookingId, acmsSite }`): incoming reads, full resyncs and the first match never take it as a site event or list it under "Only in Google", and `isBooking()` never reads it as a booking page appointment, whatever its title. An edit or delete of a copy in Google never changes the booking: Recent changes lists it once, and the site's version goes back with the booking's next change. Unlinking keeps the copies; linking again pairs them by their hidden links, and deletes stale ones (a booking cancelled, declined or moved to another room meanwhile, or a second copy), but never a copy of a booking the site doesn't have.
+
+  A Google booking page only treats the copies as busy when it checks the room's calendar: tick it under the booking page's **Booked appointment settings → Check calendar availability** (the guide's "Booking pages" section has the steps for replacing booking pages with the site's booking links).
+
+  Migration 73 adds `gcal_booking_items` and triggers on `bookings` and `booking_links` (name and mode) that queue a booking's changes in `gcal_queue` (as `booking:<id>` rows). The guide is `acms docs google-calendar` → Site bookings.
+
 ## 0.3.63
 
 ### Patch Changes

package/cli/migrations.generated.mjs

@@ -519,6 +519,24 @@ var GCAL_MIGRATION = { version: 69, statements: [
   `CREATE TRIGGER gcal_queue_update AFTER UPDATE ON events WHEN ${guard} BEGIN ${enqueue3("NEW.id")} END`,
   `CREATE TRIGGER gcal_queue_delete AFTER DELETE ON events WHEN ${guard} BEGIN ${enqueue3("OLD.id")} END`
 ] };
+var enqueueBooking = (id) => enqueue3(`'booking:'||${id}`);
+var GCAL_BOOKINGS_MIGRATION = { version: 73, statements: [
+  `CREATE TABLE gcal_booking_items (
+    link_id TEXT NOT NULL, google_id TEXT NOT NULL, booking_id TEXT NOT NULL, site TEXT NOT NULL DEFAULT '', google TEXT NOT NULL DEFAULT '',
+    etag TEXT NOT NULL DEFAULT '', html_link TEXT NOT NULL DEFAULT '', gone INTEGER NOT NULL DEFAULT 0, synced_at INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL,
+    PRIMARY KEY (link_id, google_id), UNIQUE (link_id, booking_id)
+  )`,
+  `CREATE INDEX gcal_booking_items_booking ON gcal_booking_items (booking_id)`,
+  `CREATE TRIGGER gcal_booking_insert AFTER INSERT ON bookings WHEN ${guard} AND NEW.kind='booking' AND NEW.status='confirmed' BEGIN ${enqueueBooking("NEW.id")} END`,
+  `CREATE TRIGGER gcal_booking_update AFTER UPDATE OF status, start_at, end_at, resource_id, link_id, kind ON bookings WHEN ${guard} AND (NEW.kind='booking' OR OLD.kind='booking')
+    AND (OLD.status IS NOT NEW.status OR OLD.start_at IS NOT NEW.start_at OR OLD.end_at IS NOT NEW.end_at OR OLD.resource_id IS NOT NEW.resource_id OR OLD.link_id IS NOT NEW.link_id OR OLD.kind IS NOT NEW.kind)
+    BEGIN ${enqueueBooking("NEW.id")} END`,
+  `CREATE TRIGGER gcal_booking_delete AFTER DELETE ON bookings WHEN ${guard} AND OLD.kind='booking' BEGIN ${enqueueBooking("OLD.id")} END`,
+  `CREATE TRIGGER gcal_booking_link_change AFTER UPDATE OF name, mode ON booking_links WHEN ${guard} AND (OLD.name IS NOT NEW.name OR OLD.mode IS NOT NEW.mode) BEGIN
+    INSERT INTO gcal_queue (event_id,version,due_at,attempts,claimed_until,error)
+      SELECT 'booking:'||id,1,${now5},0,0,'' FROM bookings WHERE link_id=NEW.id AND kind='booking' AND status='confirmed' AND end_at>${now5}
+    ON CONFLICT(event_id) DO UPDATE SET version=version+1,due_at=excluded.due_at,attempts=0,error=''; END`
+] };
 
 // src/lib/repo/migrations.ts
 var CONTENT_VERSION_COLUMNS = {
@@ -1377,7 +1395,11 @@ var MIGRATIONS = [
     `ALTER TABLE booking_links ADD COLUMN translations TEXT NOT NULL DEFAULT '{}'`,
     `DROP TRIGGER content_version_booking_links_update`,
     contentVersionTriggers("booking_links", [...CONTENT_VERSION_COLUMNS.booking_links, "translations"])[2]
-  ] }
+  ] },
+  // copies of confirmed room bookings in Google (lib/calendar/google/bookings.ts):
+  // their pairs, and triggers on bookings and booking links feeding gcal_queue.
+  // Not public, so no cache trigger.
+  GCAL_BOOKINGS_MIGRATION
 ];
 var CURRENT_CONTENT_VERSION_COLUMNS = {
   ...CONTENT_VERSION_COLUMNS,

package/docs/calendar.md

@@ -496,6 +496,10 @@ calendars in step, both ways, within a few minutes. The full guide is
 - **Booked appointments** from Google booking pages come in as "Booked" with the
   internal tag `#google-booking` (`GOOGLE_BOOKING_TAG`), holding the link's room. Treat
   them as bookings: the tag never shows publicly.
+- **Site bookings go out.** A confirmed booking of a room a link holds gets a copy in
+  that Google calendar, titled with its booking link's name, never who booked. It's out
+  only: an edit in Google never changes the booking, and a copy never comes back as an
+  event or as "Booked" (`acms docs google-calendar` → Site bookings).
 - **"This and following"** maps to "from this date on", both ways:
   - A Google split changes the event from that date on (`changeFromDate` as `GOOGLE_SYNC`).
   - A change from a date on gives the later part its own Google series.

package/docs/google-calendar.md

@@ -65,7 +65,8 @@ the account can edit. The settings:
   - Site → Google only: Google mirrors the site. Start here, then switch.
   - Google → site only: site edits stay on the site.
 - **Rooms**: the room(s) this Google calendar stands for. Events that come in
-  from it hold those rooms. Site events holding one of them go to it.
+  from it hold those rooms. Site events holding one of them go to it, and so
+  do confirmed bookings of them (see [Site bookings](#site-bookings)).
   - **Also gets this calendar's events that hold no room**: one link per site
     calendar may have this.
   - A link with no rooms carries its whole site calendar.
@@ -140,6 +141,7 @@ suggestion decided.
 | Unpublished or deleted | deleted in Google | site → Google |
 | Deleted in Google | **cancelled** on the site (struck through, room freed, restorable) | Google → site |
 | Hidden link | `extendedProperties.private` `{ acmsEventId, acmsSite }` | site → Google |
+| Confirmed room booking | a copy titled with its booking link's name ([Site bookings](#site-bookings)) | site → Google only |
 
 Never sent:
 
@@ -220,6 +222,66 @@ Changes are compared field by field against what the pair last agreed:
   applies, because it already happened in Google. The clash shows in Recent
   changes and the event editor.
 
+## Site bookings
+
+Confirmed bookings of the site's rooms (`/book`, the app, staff) get a copy
+in each linked Google calendar that holds their room, so the calendar stays a
+mirror of the room, and the room shows as busy there. A Google booking page
+only sees that when it checks the room's calendar (see
+[Booking pages](#booking-pages-appointment-schedules)). They only go out:
+
+- **Which calendars:** links set to Both ways or Site → Google only, whose
+  **Rooms** include the booking's room. A link without rooms gets no bookings.
+  Each Google calendar gets one copy. Links only run while the Site URL
+  matches (see [Safety](#safety)).
+- **Which bookings:** confirmed ones, ending on or after the link's start date.
+  Pending bookings never go out (a first booking waiting for staff goes out
+  once it's approved). Staff blocks and RSVPs never do.
+- **What a copy has:**
+  - the booking link's name in the site's main language ("Rehearsal";
+    "Reserved" when the link was deleted);
+  - its time (a whole-day link's days as all day), marked busy;
+  - one line saying it was booked on the website and is changed there.
+
+  It never has the booker's name, email, phone, answers or notes, and no
+  guests. Every write uses `sendUpdates=none`.
+- **Hidden link:** `extendedProperties.private` `{ acmsBookingId, acmsSite }`.
+- **When it changes:**
+  - **Confirmed:** the copy is made.
+  - **Moved, or its booking link renamed:** the copy is changed.
+  - **The link's rooms change:** the copy moves to the Google calendar that
+    now holds the room.
+  - **Cancelled, declined or deleted:** the copy is deleted.
+
+**Stale copies.** Linking a calendar again finds the copies left from before.
+A copy of a booking that was cancelled, declined or moved to another room in
+the meantime, or a second copy of one booking, is deleted from Google (listed
+in Recent changes), so it doesn't keep the room busy. A copy of a booking the
+site doesn't have (after restoring an older backup) is left alone.
+
+**Edits in Google never change the booking.** Changing or deleting a copy in
+Google is listed once in Recent changes ("A booking's copy was changed in …,
+now …"). The copy stays as Google has it until the booking changes on the
+site. Then the site's version goes back, and a deleted copy is made again.
+
+**Never read back.** Every copy carries its hidden link, so:
+
+- the incoming side, a full resync and the first match never take it as a
+  site event, and never list it under "Only in Google";
+- it's never read as a booked appointment from a booking page, even when its
+  title is one of the link's booking page titles, or "Rehearsal";
+- unlinking keeps the copies, and linking the calendar again pairs them
+  again by their hidden links (Start syncing), with no second copy.
+
+A link turned to Google → site only keeps the copies it has, and they're no
+longer updated. Copies made by another site (staging) are left alone.
+
+Their pairs are `gcal_booking_items` (migration 73). Their outgoing changes
+share `gcal_queue`, as `booking:<id>` rows filled by triggers on `bookings`
+(a confirmed insert, and any change of status, time, room or booking link,
+or a delete) and on a booking link's name or mode (its upcoming confirmed
+bookings).
+
 ## Booking pages (appointment schedules)
 
 Google's API has no marker for appointments booked through a booking page.
@@ -244,6 +306,19 @@ unpairs it.
 Check this against a real booking before relying on it: book one and look
 at it in Recent changes and on the site.
 
+**Replacing them with the site's booking links:**
+1. Add a booking link to the room (for example "Rehearsal", with **Name in
+   Español**). Its bookings go to Google as [Site bookings](#site-bookings).
+2. Until the old booking pages are retired, tick the room's Google calendar
+   under each booking page's **Booked appointment settings → Check calendar
+   availability**, so site bookings block those slots. By default a booking
+   page checks only the account's primary calendar.
+3. Keep the old booking pages' titles under **Booking pages** until their
+   last appointments have passed, so those still come in as "Booked".
+
+Copies of site bookings are never read as booked appointments, even with the
+same title.
+
 ## Safety
 
 - **Nothing before review.** A new link only reads, until Start syncing.
@@ -261,8 +336,8 @@ at it in Recent changes and on the site.
     backup never deletes anything in Google.
 - **Environment sync and backups** never copy the Google account, links or
   pairs. Nothing is stored on the event row.
-- **Unlink** and **Disconnect** keep both copies of every event. Linking again
-  pairs them by their hidden links.
+- **Unlink** and **Disconnect** keep both copies of every event, and the
+  copies of bookings. Linking again pairs them by their hidden links.
 - **Loops**: each pair stores a hash of every synced field, per side, as last
   agreed. A change that already matches is never sent back.
 - **Failures** back off like YouTube's, and honour Google's rate limits:
@@ -289,12 +364,14 @@ Inside the framework, the sync lives in `lib/calendar/google/`:
 
 - `map.ts`: the field mapping, as pure functions;
 - `outbound.ts`, `inbound.ts`, `match.ts`;
+- `bookings.ts`: copies of the site's room bookings (out only);
 - `client.ts`: Google's API over `fetch`;
 - `service.ts`: the scheduler job and Sync now.
 
 Its tables (migration 69): `gcal_account`, `gcal_oauth_states`, `gcal_links`,
 `gcal_items` (one row per pair), `gcal_queue` (filled by triggers on every
-insert, update and delete of `events`) and `gcal_log`.
+insert, update and delete of `events`) and `gcal_log`. Migration 73 adds
+`gcal_booking_items` and the booking triggers ([Site bookings](#site-bookings)).
 
 ## Not yet
 

package/mobile-template/recipes/booking/files/app/book/details.tsx

@@ -3,7 +3,7 @@ import { KeyboardAvoidingView, Platform, Pressable, ScrollView, Switch, Text, Te
 import { Stack, router, useLocalSearchParams } from 'expo-router';
 import * as Crypto from 'expo-crypto';
 import { isAcmsError } from '@acms-subir/client';
-import { Button, fill, formatBookingDate, useBooking, useLayout, useLocale, useResources, useSite, useStrings, useTheme } from '@acms-subir/native';
+import { Button, fill, formatBookingDate, rememberBookingToken, useBooking, useLayout, useLocale, useResources, useSite, useStrings, useTheme } from '@acms-subir/native';
 
 // Details form and confirmation. useBooking keeps one idempotency key per
 // booking intent, so pressing "Book" again after a timeout can't double-book.
@@ -48,7 +48,8 @@ export default function DetailsScreen() {
         <Text style={t.styles.text.body}>{when}</Text>
         <Text style={t.styles.text.muted}>{fill(confirmed ? w.confirmationOnItsWay : w.emailWhenApproved, { email: b.email })}</Text>
         {site.data?.features.bookingChanges
-          ? <Button label={w.bookManage} variant="outline" onPress={() => router.push({ pathname: '/book/manage', params: { token: manageToken } })} />
+          // the token stays in memory: only a random key goes in the route (on the web, the page address)
+          ? <Button label={w.bookManage} variant="outline" onPress={() => router.push({ pathname: '/book/manage', params: { booking: rememberBookingToken(manageToken) } })} />
           : <Text style={t.styles.text.small}>{w.changeByEmail}</Text>}
         <Button label={w.requestDone} onPress={() => { booking.reset(); router.dismissAll(); }} />
       </ScrollView>

package/mobile-template/recipes/booking/files/app/book/manage.tsx

@@ -2,10 +2,13 @@ import { useState } from 'react';
 import { ActivityIndicator, Pressable, ScrollView, Text, View } from 'react-native';
 import { Stack, useLocalSearchParams } from 'expo-router';
 import { isAcmsError } from '@acms-subir/client';
-import { Button, ErrorView, fill, formatBookingDate, lengthText, useCancelBooking, useLayout, useLocale, useManagedBooking, useRescheduleAvailability, useRescheduleBooking, useStrings, useTheme } from '@acms-subir/native';
+import { Button, ErrorView, bookingToken, fill, formatBookingDate, lengthText, useCancelBooking, useLayout, useLocale, useManagedBooking, useRescheduleAvailability, useRescheduleBooking, useStrings, useTheme } from '@acms-subir/native';
 
-// The booker's own booking, from its private token (the confirmation screen
-// passes it): its status and time, a new time, or cancel. Needs the site's
+// The booker's own booking, from its private token: its status and time, a
+// new time, or cancel. The confirmation screen keeps the token in memory and
+// passes a key for it (rememberBookingToken), never the token: on the web a
+// route is the page address. After a restart the key means nothing, and the
+// screen points to the email's link. Needs the site's
 // App access switch for booking changes (site.features.bookingChanges); the
 // link in every booking email does the same on the website either way. The
 // booking link's change cutoff applies (can.reschedule / can.cancel).
@@ -14,7 +17,8 @@ export default function ManageBookingScreen() {
   const w = useStrings();
   const { locale } = useLocale();
   const { gutter } = useLayout();
-  const { token } = useLocalSearchParams<{ token: string }>();
+  const { booking } = useLocalSearchParams<{ booking: string }>();
+  const token = bookingToken(booking);
   const managed = useManagedBooking(token);
   const cancel = useCancelBooking(token);
   const move = useRescheduleBooking(token);
@@ -24,6 +28,13 @@ export default function ManageBookingScreen() {
   // a link with several lengths offers new times of the booking's own length
   const length = managed.data?.link?.mode === 'range' ? Math.round((Date.parse(managed.data.booking.end) - Date.parse(managed.data.booking.start)) / 60_000) : undefined;
   const slots = useRescheduleAvailability(token, picking ? { days: 14, minutes: length } : null);
+  // opened again after a restart: the key no longer stands for the token
+  if (!token) return (
+    <View style={{ flex: 1, backgroundColor: t.colors.bg, padding: gutter }}>
+      <Stack.Screen options={{ title: w.yourBooking }} />
+      <Text style={t.styles.text.muted}>{w.changeByEmail}</Text>
+    </View>
+  );
   if (managed.error && !managed.data) return <ErrorView error={managed.error} retry={() => managed.refetch()} />;
   if (!managed.data) return <ActivityIndicator color={t.colors.accent} style={{ marginTop: 32 }} />;
   const { booking: b, title, can, link } = managed.data;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.63",
+  "version": "0.3.64",
   "publishConfig": {
     "access": "public"
   },

package/src/lib/calendar/google/bookings.ts

@@ -0,0 +1,296 @@
+// Site → Google for room bookings: a confirmed booking of a room that a link
+// holds (GcalLink.roomIds) gets a copy in that link's Google calendar, so the
+// room shows as busy there (a Google booking page can't double-book it) and
+// the calendar stays a mirror of the room. Out only:
+// - only links that send (both, out) and run on this site (its Site URL), and
+//   only the Google calendars whose link holds the booking's room: one copy
+//   in each. A link holding no room gets no bookings. Pending, declined and
+//   cancelled bookings, staff blocks and RSVPs never go out.
+// - a copy has the booking link's name in the site's main language
+//   ("Reserved" once the link is gone), the time and a line saying it's a
+//   website booking: never the booker's name, email, phone, notes or answers,
+//   and no guests. Google never emails anyone (sendUpdates=none).
+// - made when the booking is confirmed, patched when it moves or its link is
+//   renamed, moved to another Google calendar when the rooms change, deleted
+//   when it's cancelled, declined or deleted
+// - every copy carries a hidden link (extendedProperties.private
+//   acmsBookingId / acmsSite): the incoming side, a full resync and the first
+//   match never take it as an event, never list it under "Only in Google",
+//   and isBooking() never reads it as an appointment from a booking page
+// - an edit or delete in Google never changes the booking: it's listed in
+//   Recent changes once, and the site's version goes back to Google with the
+//   booking's next change
+//
+// The queue is gcal_queue's: a booking's row is 'booking:<id>' (migration 73's triggers).
+import type { ContentRepository } from '../../repo/types';
+import type { Booking, BookingLink, Resource, Settings } from '../../schema';
+import { tzParts } from '../ics';
+import { addWallDays, formatWall, parseWall } from '../events';
+import type { SyncContext } from './context';
+import { GoogleError } from './client';
+import { describe, fieldHash, googleTimes, plainText, wallFromGoogle, windowStart, type Fields, type When } from './map';
+import type { GcalBookingItem, GcalLink, GoogleEvent, GoogleTime, NewLogEntry } from './types';
+
+const QUEUE_PREFIX = 'booking:';
+/** A booking's row in gcal_queue. */
+export const bookingQueueKey = (bookingId: string) => `${QUEUE_PREFIX}${bookingId}`;
+/** The booking a gcal_queue row stands for, or null for an event's row. */
+export const queuedBookingId = (key: string) => (key.startsWith(QUEUE_PREFIX) ? key.slice(QUEUE_PREFIX.length) : null);
+
+/** A copy of a site booking (any site's): never an event, never a booked appointment. */
+export const isBookingCopy = (g: Pick<GoogleEvent, 'extendedProperties'>) => !!g.extendedProperties?.private?.acmsBookingId;
+
+/** The hidden link on every copy. */
+export const bookingHiddenLink = (bookingId: string, origin: string) => ({ private: { acmsBookingId: bookingId, acmsSite: origin } });
+
+/**
+ * The Google id for a booking's copy, chosen by the site so a run that
+ * crashed after Google saved it finds that copy again. "acmsk" can never
+ * start an event's copy id (those go on with hex digits); a copy made again
+ * after Google deleted the first gets a new id (deleted ids stay taken).
+ */
+export function bookingCopyId(bookingId: string, again = 0): string | undefined {
+  const hex = bookingId.toLowerCase().replace(/-/g, '');
+  if (!/^[0-9a-f]{32}$/.test(hex)) return undefined;
+  return `acmsk${hex}${again ? `r${again.toString(32)}` : ''}`;
+}
+
+/** Whether this link gets a copy of the booking: confirmed, a room the link holds, from the link's start date on. */
+export function linkCarriesBooking(link: Pick<GcalLink, 'roomIds' | 'startDate'>, b: Booking | null, settings: Pick<Settings, 'timezone'>): b is Booking {
+  return !!b && b.kind === 'booking' && b.status === 'confirmed' && link.roomIds.includes(b.resourceId) && b.end > windowStart(link, settings);
+}
+
+const pad = (n: number) => String(n).padStart(2, '0');
+const wallOf = (ms: number, tz: string) => { const p = tzParts(ms, tz); return `${p.y}-${pad(p.m)}-${pad(p.d)}T${pad(p.hh)}:${pad(p.mm)}`; };
+
+/** The booking's time as the sync's When: wall-clock in its room's zone; a whole-day link's days (end inclusive). */
+export function bookingWhen(b: Pick<Booking, 'start' | 'end' | 'timezone'>, link: Pick<BookingLink, 'mode'> | null, settings: Pick<Settings, 'timezone'>): When {
+  const tz = b.timezone || settings.timezone || 'UTC';
+  if (link?.mode === 'day') {
+    const first = wallOf(b.start, tz).slice(0, 10);
+    const last = formatWall({ ...addWallDays(parseWall(wallOf(b.end, tz).slice(0, 10))!, -1), dateOnly: true });
+    return { allDay: true, start: first, end: last < first ? first : last, tz: '' };
+  }
+  return { allDay: false, start: wallOf(b.start, tz), end: wallOf(b.end, tz), tz };
+}
+
+/** The copy's title: its booking link's name in the main language, else "Reserved". */
+export const bookingCopyTitle = (link: Pick<BookingLink, 'name'> | null, words: SyncContext['map']['words']) => link?.name.trim() || words.reserved;
+
+/** The whole copy: title, a line saying where to change it, its time, busy, and the hidden link. Nothing about who booked. */
+export function bookingBody(b: Booking, link: BookingLink | null, ctx: Pick<SyncContext, 'settings' | 'origin' | 'map'>): Record<string, unknown> {
+  return {
+    summary: bookingCopyTitle(link, ctx.map.words),
+    description: ctx.map.words.bookingNote,
+    ...googleTimes(bookingWhen(b, link, ctx.settings)),
+    transparency: 'opaque',
+    extendedProperties: bookingHiddenLink(b.id, ctx.origin),
+  };
+}
+
+// a start or end as the same text whichever way Google writes it (an offset or a zone)
+const instantKey = (t: GoogleTime | undefined) => (t?.date ? t.date : wallFromGoogle(t, 'UTC') ?? '');
+/** A copy's title, time and description as one hash: what the site sent, or what Google has. */
+export const bookingCopyHash = (g: Pick<GoogleEvent, 'summary' | 'description' | 'start' | 'end'>) =>
+  fieldHash({ title: (g.summary ?? '').trim(), start: instantKey(g.start), end: instantKey(g.end), desc: plainText(g.description ?? '') });
+
+// "Rehearsal (Sanctuary), Sat, Jan 4, 10:00 AM – 12:00 PM": for Recent changes (staff, the main language)
+function described(b: Booking, link: BookingLink | null, room: Resource | null, ctx: SyncContext) {
+  const when = describe('when', { when: bookingWhen(b, link, ctx.settings) } as Fields);
+  return `${room ? `${room.name}, ` : ''}${when}`;
+}
+const logEntry = (link: GcalLink, googleId: string, bookingId: string, title: string, e: Omit<NewLogEntry, 'linkId' | 'googleId' | 'eventId' | 'title'>): NewLogEntry =>
+  ({ ...e, linkId: link.id, googleId, eventId: '', title, data: { bookingId, ...(e.data ?? {}) } });
+
+/**
+ * One booking against every link that may carry it. Each link is tried on
+ * its own (one link's error doesn't hold up the others; the booking is
+ * retried). Google refusing a copy (403) is listed once and not retried.
+ */
+export async function pushBooking(ctx: SyncContext, bookingId: string) {
+  const b = await ctx.repo.getBooking(bookingId);
+  const items = await ctx.repo.gcal.bookingItemsFor(bookingId);
+  if (!b && !items.length) return;
+  const [link, room] = b ? await Promise.all([b.linkId ? ctx.repo.getBookingLink(b.linkId) : null, b.resourceId ? ctx.repo.getResource(b.resourceId) : null]) : [null, null];
+  let failure: unknown = null;
+  for (const l of ctx.links) {
+    if (l.state !== 'active' || l.direction === 'in') continue;
+    const item = items.find((i) => i.linkId === l.id);
+    try { await pushToLink(ctx, l, b, link, room, item); }
+    catch (err) {
+      if (err instanceof GoogleError && (err.code === 'auth' || err.code === 'quota')) throw err;
+      if (err instanceof GoogleError && err.code === 'forbidden') {
+        await ctx.repo.gcal.log([logEntry(l, item?.googleId ?? '', bookingId, bookingCopyTitle(link, ctx.map.words), { direction: 'out', action: 'failed',
+          summary: `${err.message} The booking stays on the site; ${l.googleName} doesn’t get its copy.` })], ctx.now);
+        continue;
+      }
+      failure ??= err;
+    }
+  }
+  if (failure) throw failure;
+}
+
+const removedWhy = (b: Booking | null, l: GcalLink) =>
+  !b ? 'Deleted on the site' : b.status === 'cancelled' ? 'Cancelled on the site' : b.status === 'declined' ? 'Declined on the site'
+    : b.status !== 'confirmed' ? 'No longer confirmed on the site' : !l.roomIds.includes(b.resourceId) ? `Its room isn’t on ${l.googleName} any more` : 'Before the link’s start date';
+
+async function pushToLink(ctx: SyncContext, l: GcalLink, b: Booking | null, link: BookingLink | null, room: Resource | null, item: GcalBookingItem | undefined) {
+  const title = bookingCopyTitle(link, ctx.map.words);
+  if (!linkCarriesBooking(l, b, ctx.settings)) {
+    if (!item) return;
+    if (!item.gone) await ctx.client.deleteEvent(l.googleId, item.googleId);
+    await ctx.repo.gcal.deleteBookingItem(l.id, item.googleId);
+    if (!item.gone) await ctx.repo.gcal.log([logEntry(l, item.googleId, item.bookingId, title, { direction: 'out', action: 'removed', summary: `${removedWhy(b, l)}: the booking’s copy was removed from ${l.googleName}.` })], ctx.now);
+    return;
+  }
+  const body = bookingBody(b, link, ctx);
+  const want = bookingCopyHash(body as GoogleEvent);
+  const what = described(b, link, room, ctx);
+  if (!item) return void await createCopy(ctx, l, b, body, want, title, `${what}: copied to ${l.googleName}.`);
+  // nothing changed on the site since the copy was sent (an edit in Google stays there until it does)
+  if (item.site === want) return;
+  // deleted in Google: the site's change makes it again
+  if (item.gone) return void await createCopy(ctx, l, b, body, want, title, `${what}: changed on the site, so its copy is back in ${l.googleName}.`, item);
+  let g: GoogleEvent | null;
+  try { g = await ctx.client.patchEvent(l.googleId, item.googleId, body); }
+  catch (err) {
+    if (!(err instanceof GoogleError && (err.code === 'notfound' || err.code === 'gone'))) throw err;
+    g = null;
+  }
+  // deleted in Google without the site seeing it (a Site → Google only link reads nothing): a patch doesn't bring it back
+  if (!g || g.status === 'cancelled') return void await createCopy(ctx, l, b, body, want, title, `${what}: its copy was missing from ${l.googleName}, so it was made again.`, item);
+  await ctx.repo.gcal.putBookingItem({ ...item, site: want, google: bookingCopyHash(g), etag: g.etag ?? item.etag, htmlLink: g.htmlLink ?? item.htmlLink, gone: false, syncedAt: ctx.now });
+  await ctx.repo.gcal.log([logEntry(l, item.googleId, b.id, title, { direction: 'out', action: 'updated', summary: `${what} → ${l.googleName}` })], ctx.now);
+}
+
+async function createCopy(ctx: SyncContext, l: GcalLink, b: Booking, body: Record<string, unknown>, want: string, title: string, summary: string, previous?: GcalBookingItem) {
+  const id = bookingCopyId(b.id, previous ? Math.floor(ctx.now / 1000) : 0);
+  let g: GoogleEvent;
+  try { g = await ctx.client.insertEvent(l.googleId, id ? { id, ...body } : body); }
+  catch (err) {
+    if (!(err instanceof GoogleError && err.code === 'conflict' && id)) throw err;
+    // that id is taken: our own copy from a run that stopped before saving the pair, or one Google deleted (ids stay taken)
+    const found = await ctx.client.getEvent(l.googleId, id).catch(() => null);
+    g = found && found.status !== 'cancelled' && found.extendedProperties?.private?.acmsBookingId === b.id
+      ? await ctx.client.patchEvent(l.googleId, id, body)
+      : await ctx.client.insertEvent(l.googleId, body);
+  }
+  await ctx.repo.gcal.putBookingItem({ linkId: l.id, googleId: g.id, bookingId: b.id, site: want, google: bookingCopyHash(g), etag: g.etag ?? '', htmlLink: g.htmlLink ?? '',
+    gone: false, syncedAt: ctx.now, createdAt: previous?.createdAt ?? ctx.now });
+  await ctx.repo.gcal.log([logEntry(l, g.id, b.id, title, { direction: 'out', action: 'created', summary })], ctx.now);
+}
+
+// ---- what Google does to a copy ----
+
+// what the copy says in Google now, for Recent changes
+function googleWords(g: GoogleEvent, l: GcalLink, ctx: SyncContext) {
+  const tz = g.start?.timeZone || l.googleTz || ctx.settings.timezone || 'UTC';
+  const start = g.start?.date ?? wallFromGoogle(g.start, tz), end = g.end?.date ?? wallFromGoogle(g.end, tz);
+  const allDay = !!g.start?.date;
+  const last = allDay && end ? formatWall({ ...addWallDays(parseWall(end)!, -1), dateOnly: true }) : end;
+  const when = start ? describe('when', { when: { allDay, start, end: last ?? start, tz } } as Fields) : '';
+  return [`“${(g.summary ?? '').trim()}”`, when].filter(Boolean).join(', ');
+}
+
+/**
+ * A copy of a site booking came in from Google (a change list, a full read,
+ * the first match). Never an event. A copy this link pairs: an edit or delete
+ * there is listed once (the booking stays as it is; its next change on the
+ * site goes back). A copy of this site's that the link doesn't pair:
+ * - of a booking it carries and has no live copy of (a crashed run, a link
+ *   made again): paired by its hidden link;
+ * - of a booking that's no longer confirmed or no longer in the link's rooms
+ *   (changed while unlinked), or a second copy of one: deleted, so it doesn't
+ *   keep the room busy in Google;
+ * - of a booking the site doesn't have (an older backup was restored), or
+ *   another site's: left alone, as an older backup never deletes anything in Google.
+ */
+export async function bookingCopySeen(ctx: SyncContext, l: GcalLink, g: GoogleEvent) {
+  const item = await ctx.repo.gcal.getBookingItem(l.id, g.id);
+  const hidden = g.extendedProperties?.private;
+  if (!item) {
+    if (g.status === 'cancelled' || hidden?.acmsSite !== ctx.origin || !hidden.acmsBookingId || l.direction === 'in') return;
+    const b = await ctx.repo.getBooking(hidden.acmsBookingId);
+    if (!b) return;
+    const link = b.linkId ? await ctx.repo.getBookingLink(b.linkId) : null;
+    const title = bookingCopyTitle(link, ctx.map.words);
+    // a booking before the link's start date isn't the link's business
+    const stale = b.kind !== 'booking' || b.status !== 'confirmed' || !l.roomIds.includes(b.resourceId);
+    if (!stale && !linkCarriesBooking(l, b, ctx.settings)) return;
+    const paired = (await ctx.repo.gcal.bookingItemsFor(b.id)).find((i) => i.linkId === l.id);
+    // its pair's copy is still there: this one is a second copy (checked in Google, as a run making the
+    // pair's copy again may not have saved it yet)
+    const live = !stale && paired && !paired.gone && await ctx.client.getEvent(l.googleId, paired.googleId)
+      .then((p) => p.status !== 'cancelled', (err) => { if (err instanceof GoogleError && (err.code === 'notfound' || err.code === 'gone')) return false; throw err; });
+    if (stale || live) {
+      await ctx.client.deleteEvent(l.googleId, g.id);
+      await ctx.repo.gcal.log([logEntry(l, g.id, b.id, title, { direction: 'out', action: 'removed',
+        summary: `${stale ? removedWhy(b, l) : 'A second copy of this booking'}: a stale copy of it was removed from ${l.googleName}.` })], ctx.now);
+      return;
+    }
+    const h = bookingCopyHash(g);
+    // replaces a pair whose copy Google deleted
+    await ctx.repo.gcal.putBookingItem({ linkId: l.id, googleId: g.id, bookingId: b.id, site: h, google: h, etag: g.etag ?? '', htmlLink: g.htmlLink ?? '', gone: false, syncedAt: ctx.now, createdAt: paired?.createdAt ?? ctx.now });
+    await ctx.repo.gcal.log([logEntry(l, g.id, b.id, title, { direction: 'info', action: 'paired', summary: `Found a booking’s copy in ${l.googleName} again by its hidden link.` })], ctx.now);
+    // the copy as the booking is now, if Google's differs
+    await ctx.repo.gcal.enqueue([bookingQueueKey(b.id)], ctx.now);
+    return;
+  }
+  const title = (g.summary ?? '').trim() || 'A booking';
+  if (g.status === 'cancelled') {
+    if (item.gone) return;
+    await ctx.repo.gcal.patchBookingItem(l.id, g.id, { gone: true, etag: g.etag ?? item.etag, syncedAt: ctx.now });
+    await ctx.repo.gcal.log([logEntry(l, g.id, item.bookingId, title, { direction: 'in', action: 'removed',
+      summary: `A booking’s copy was deleted in ${l.googleName}. The booking stays on the site; its copy comes back with its next change there.` })], ctx.now);
+    return;
+  }
+  const h = bookingCopyHash(g);
+  if (item.gone) {
+    await ctx.repo.gcal.patchBookingItem(l.id, g.id, { gone: false, google: h, etag: g.etag ?? item.etag, syncedAt: ctx.now });
+    await ctx.repo.gcal.log([logEntry(l, g.id, item.bookingId, title, { direction: 'in', action: 'restored', summary: `A booking’s copy is back in ${l.googleName}.` })], ctx.now);
+    if (h !== item.site) await ctx.repo.gcal.enqueue([bookingQueueKey(item.bookingId)], ctx.now);
+    return;
+  }
+  if (h === item.google) {
+    if (g.etag && g.etag !== item.etag) await ctx.repo.gcal.patchBookingItem(l.id, g.id, { etag: g.etag });
+    return;
+  }
+  await ctx.repo.gcal.patchBookingItem(l.id, g.id, { google: h, etag: g.etag ?? item.etag, syncedAt: ctx.now });
+  await ctx.repo.gcal.log([logEntry(l, g.id, item.bookingId, title, { direction: 'in', action: 'edited',
+    summary: `A booking’s copy was changed in ${l.googleName} (now ${googleWords(g, l, ctx)}). The booking on the site stays as it is; its next change there goes back to Google.` })], ctx.now);
+}
+
+/** After a full read: copies Google didn't list (deleted long ago) are checked one by one. */
+export async function sweepBookingCopies(ctx: SyncContext, l: GcalLink, listed: GoogleEvent[]) {
+  const seen = new Set(listed.map((g) => g.id));
+  for (const item of (await ctx.repo.gcal.bookingItemsForLink(l.id)).filter((i) => !i.gone && !seen.has(i.googleId)).slice(0, 200)) {
+    const g = await ctx.client.getEvent(l.googleId, item.googleId).catch((err) => { if (err instanceof GoogleError && (err.code === 'notfound' || err.code === 'gone')) return null; throw err; });
+    await bookingCopySeen(ctx, l, g ?? { id: item.googleId, status: 'cancelled' });
+  }
+}
+
+/**
+ * A link starting, resuming or now holding other rooms: the bookings of its
+ * rooms from its start date on, and the bookings it has copies of (a copy
+ * that no longer belongs is removed). After a restore, a copy whose booking
+ * the backup doesn't have is forgotten instead: an older backup never deletes
+ * anything in Google.
+ */
+export async function queueLinkBookings(repo: ContentRepository, l: GcalLink, settings: Pick<Settings, 'timezone'>, restored = false) {
+  const items = await repo.gcal.bookingItemsForLink(l.id);
+  const keep: GcalBookingItem[] = [];
+  for (const i of items) {
+    if (restored && !await repo.getBooking(i.bookingId)) await repo.gcal.deleteBookingItem(l.id, i.googleId);
+    else keep.push(i);
+  }
+  const bookings = l.roomIds.length ? await repo.listBookings({ from: windowStart(l, settings), statuses: ['confirmed'], kinds: ['booking'] }) : [];
+  const ids = [...bookings.filter((b) => l.roomIds.includes(b.resourceId)).map((b) => b.id), ...keep.map((i) => i.bookingId)];
+  if (ids.length) await repo.gcal.enqueue([...new Set(ids)].map(bookingQueueKey));
+}
+
+/** What a queued booking is called in Recent changes when it couldn't be sent. */
+export async function queuedBookingTitle(ctx: SyncContext, bookingId: string): Promise<string> {
+  const b = await ctx.repo.getBooking(bookingId).catch(() => null);
+  const link = b?.linkId ? await ctx.repo.getBookingLink(b.linkId).catch(() => null) : null;
+  return bookingCopyTitle(link, ctx.map.words);
+}

package/src/lib/calendar/google/inbound.ts

@@ -39,6 +39,7 @@ import {
   type DateState, type Fields,
 } from './map';
 import type { GcalItem, GcalLink, GoogleEvent, Hashes, NewLogEntry } from './types';
+import { bookingCopySeen, isBookingCopy, sweepBookingCopies } from './bookings';
 
 export interface InboundOptions {
   /** a full read: no member pushes (Q10) */
@@ -104,7 +105,10 @@ export async function syncIncoming(ctx: SyncContext, link: GcalLink) {
     listing = await listChanges(ctx, link, true);
   }
   const handled = await processEvents(ctx, link, listing.items, { quiet: full });
-  if (full) await sweepMissing(ctx, link, listing.items, { quiet: true });
+  if (full) {
+    await sweepMissing(ctx, link, listing.items, { quiet: true });
+    await sweepBookingCopies(ctx, link, listing.items);
+  }
   return { handled, syncToken: listing.syncToken, full };
 }
 
@@ -141,6 +145,8 @@ async function failed(ctx: SyncContext, link: GcalLink, g: GoogleEvent, e: unkno
 
 async function handleEvent(ctx: SyncContext, link: GcalLink, g: GoogleEvent, opts: InboundOptions) {
   if (opts.skip?.has(g.id)) return;
+  // a copy of one of the site's bookings: never a site event (./bookings.ts)
+  if (isBookingCopy(g)) return void await bookingCopySeen(ctx, link, g);
   const item = await ctx.repo.gcal.getItem(link.id, g.id);
   if (g.status === 'cancelled') { if (item && !item.gone) await googleDeleted(ctx, link, item, opts); return; }
   if (item) {

package/src/lib/calendar/google/links.ts

@@ -13,6 +13,7 @@ import type { Settings } from '../../schema';
 import { parseWall } from '../events';
 import { siteOriginOf } from './connect';
 import { linkCarries } from './map';
+import { queueLinkBookings } from './bookings';
 import { Direction, PrefixRule, type GcalLink } from './types';
 
 export const LinkInput = z.object({
@@ -91,6 +92,8 @@ async function catchUp(repo: ContentRepository, link: GcalLink, restored = false
   if (restored) for (const i of items) if (!known.has(i.eventId)) await repo.gcal.deleteItem(link.id, i.googleId);
   const ids = events.filter((e) => e.calendarIds.includes(link.calendarId)).map((e) => e.id);
   await repo.gcal.enqueue([...ids, ...items.filter((i) => !restored || known.has(i.eventId)).map((i) => i.eventId)]);
+  // and the bookings of its rooms (their copies: ./bookings.ts)
+  await queueLinkBookings(repo, link, await repo.getSettings(), restored);
 }
 
 /** Direction, rooms, the "no room" flag, rules and booking titles. Copies follow at the next run: events that now belong here go out, ones that don't leave. */

package/src/lib/calendar/google/map.ts

@@ -29,11 +29,13 @@ const pad = (n: number) => String(n).padStart(2, '0');
 /** The internal tag on booked appointments from Google booking pages (Q16): never shown publicly. */
 export { BOOKING_TAG } from '../events';
 
-/** The few words the sync writes, in the site's main language (Q9). */
-export interface SyncWords { cancelled: string; details: string; link: string; booked: string; untitled: string }
+/** The few words the sync writes, in the site's main language (Q9). reserved and bookingNote: copies of the site's bookings (./bookings.ts). */
+export interface SyncWords { cancelled: string; details: string; link: string; booked: string; untitled: string; reserved: string; bookingNote: string }
 const WORDS: Record<string, SyncWords> = {
-  en: { cancelled: 'Cancelled: ', details: 'Details: ', link: 'Link: ', booked: 'Booked', untitled: 'Untitled event' },
-  es: { cancelled: 'Cancelado: ', details: 'Detalles: ', link: 'Enlace: ', booked: 'Reservado', untitled: 'Evento sin título' },
+  en: { cancelled: 'Cancelled: ', details: 'Details: ', link: 'Link: ', booked: 'Booked', untitled: 'Untitled event', reserved: 'Reserved',
+    bookingNote: 'Booked on the website. Change or cancel it there: changes made here don’t reach the booking.' },
+  es: { cancelled: 'Cancelado: ', details: 'Detalles: ', link: 'Enlace: ', booked: 'Reservado', untitled: 'Evento sin título', reserved: 'Reservado',
+    bookingNote: 'Reservado en el sitio web. Cámbialo o cancélalo allí: los cambios hechos aquí no llegan a la reserva.' },
 };
 export const syncWords = (lang: string): SyncWords => WORDS[(lang || 'en').toLowerCase().split('-')[0]] ?? WORDS.en;
 // every language's "Cancelled: ", so a Google title reads the same whichever one wrote it
@@ -428,9 +430,11 @@ export const notAnEvent = (g: Pick<GoogleEvent, 'eventType'>) => !!g.eventType &
  * page's title into each booked event, so a link names its booking pages: an
  * event with one of those titles (or that title and the booker's name after
  * it) and a guest is a booking. So is one whose description links to a
- * Google booking page.
+ * Google booking page. A copy of one of the site's own bookings (its hidden
+ * acmsBookingId, ./bookings.ts) never is, whatever its title.
  */
 export function isBooking(g: GoogleEvent, link: Pick<GcalLink, 'bookingTitles'>): boolean {
+  if (g.extendedProperties?.private?.acmsBookingId) return false;
   const title = titleKey(g.summary ?? '').toLowerCase();
   const guest = (g.attendees ?? []).some((a) => !a.self && !a.organizer && !a.resource);
   const named = link.bookingTitles.some((t) => {

package/src/lib/calendar/google/match.ts

@@ -10,13 +10,16 @@
 // (Q18), and so does every other field and date, as the agreed starting point.
 // Events only in Google come to the site, events only on the site go to
 // Google, pairs marked "Not the same" count as two events, and no member
-// notifications are sent for any of it (Q10).
+// notifications are sent for any of it (Q10). Copies of the site's own
+// bookings aren't events on either side: they're paired again by their
+// hidden link when syncing starts.
 import { ApiError } from '../../api';
 import { hasTag } from '../../schema';
 import type { SyncContext } from './context';
 import { processEvents, listChanges, pairExisting } from './inbound';
 import { queueLinkCalendar } from './links';
 import { BOOKING_TAG, asSiteEvent, comparableTitle, googleFields, inWindow, isBooking, linkCarries, notAnEvent, sameButEnd, windowStart } from './map';
+import { isBookingCopy } from './bookings';
 import type { GcalLink, MatchPair, MatchState } from './types';
 
 const REASON_WORDS: Record<MatchPair['reason'], string> = {
@@ -28,7 +31,8 @@ export const reasonWords = (r: MatchPair['reason']) => REASON_WORDS[r];
 export async function buildMatch(ctx: SyncContext, link: GcalLink): Promise<MatchState> {
   const startMs = windowStart(link, ctx.settings);
   const { items } = await listChanges(ctx, link, true);
-  const google = items.filter((g) => !g.recurringEventId && g.status !== 'cancelled' && !notAnEvent(g))
+  // copies of the site's own bookings are neither pairs nor "Only in Google" (./bookings.ts)
+  const google = items.filter((g) => !g.recurringEventId && g.status !== 'cancelled' && !notAnEvent(g) && !isBookingCopy(g))
     .map((g) => { const f = googleFields(g, link, ctx.settings); return f ? { g, f, shape: asSiteEvent(f, ctx.settings) } : null; })
     .filter((x): x is NonNullable<typeof x> => !!x && inWindow(x.shape, startMs, ctx.settings));
   const site = (await ctx.repo.listEvents()).filter((e) => linkCarries(e, link) && !hasTag(e.tags, BOOKING_TAG) && inWindow(e, startMs, ctx.settings));

package/src/lib/calendar/google/migration.ts

@@ -69,3 +69,37 @@ export const GCAL_MIGRATION = { version: 69, statements: [
   `CREATE TRIGGER gcal_queue_update AFTER UPDATE ON events WHEN ${guard} BEGIN ${enqueue('NEW.id')} END`,
   `CREATE TRIGGER gcal_queue_delete AFTER DELETE ON events WHEN ${guard} BEGIN ${enqueue('OLD.id')} END`,
 ] };
+
+// v73: copies of the site's room bookings in Google (lib/calendar/google/bookings.ts).
+// Out only: a confirmed booking of a room a link holds gets a copy in that
+// link's Google calendar, and Google-side edits never change the booking.
+//
+// - gcal_booking_items: one row per copy (a booking ⇄ its copy in one link),
+//   with the hash of what the site last sent and of the copy as Google last
+//   had it (an edit or delete in Google is listed once, not undone)
+// - the outgoing queue is gcal_queue's: a booking's row is keyed
+//   'booking:<id>' (event ids never start so), so it shares the run, its
+//   lease, retries and the waiting count
+//
+// The triggers queue a room booking on every insert as confirmed, every
+// change to its status, times, room or link, and its deletion, and every
+// upcoming confirmed booking of a booking link whose name (the copy's title)
+// or mode (whole days or times) changed, with the same guard as the events triggers.
+const enqueueBooking = (id: string) => enqueue(`'booking:'||${id}`);
+export const GCAL_BOOKINGS_MIGRATION = { version: 73, statements: [
+  `CREATE TABLE gcal_booking_items (
+    link_id TEXT NOT NULL, google_id TEXT NOT NULL, booking_id TEXT NOT NULL, site TEXT NOT NULL DEFAULT '', google TEXT NOT NULL DEFAULT '',
+    etag TEXT NOT NULL DEFAULT '', html_link TEXT NOT NULL DEFAULT '', gone INTEGER NOT NULL DEFAULT 0, synced_at INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL,
+    PRIMARY KEY (link_id, google_id), UNIQUE (link_id, booking_id)
+  )`,
+  `CREATE INDEX gcal_booking_items_booking ON gcal_booking_items (booking_id)`,
+  `CREATE TRIGGER gcal_booking_insert AFTER INSERT ON bookings WHEN ${guard} AND NEW.kind='booking' AND NEW.status='confirmed' BEGIN ${enqueueBooking('NEW.id')} END`,
+  `CREATE TRIGGER gcal_booking_update AFTER UPDATE OF status, start_at, end_at, resource_id, link_id, kind ON bookings WHEN ${guard} AND (NEW.kind='booking' OR OLD.kind='booking')
+    AND (OLD.status IS NOT NEW.status OR OLD.start_at IS NOT NEW.start_at OR OLD.end_at IS NOT NEW.end_at OR OLD.resource_id IS NOT NEW.resource_id OR OLD.link_id IS NOT NEW.link_id OR OLD.kind IS NOT NEW.kind)
+    BEGIN ${enqueueBooking('NEW.id')} END`,
+  `CREATE TRIGGER gcal_booking_delete AFTER DELETE ON bookings WHEN ${guard} AND OLD.kind='booking' BEGIN ${enqueueBooking('OLD.id')} END`,
+  `CREATE TRIGGER gcal_booking_link_change AFTER UPDATE OF name, mode ON booking_links WHEN ${guard} AND (OLD.name IS NOT NEW.name OR OLD.mode IS NOT NEW.mode) BEGIN
+    INSERT INTO gcal_queue (event_id,version,due_at,attempts,claimed_until,error)
+      SELECT 'booking:'||id,1,${now},0,0,'' FROM bookings WHERE link_id=NEW.id AND kind='booking' AND status='confirmed' AND end_at>${now}
+    ON CONFLICT(event_id) DO UPDATE SET version=version+1,due_at=excluded.due_at,attempts=0,error=''; END`,
+] };

package/src/lib/calendar/google/outbound.ts

@@ -24,6 +24,7 @@ import type { SyncContext } from './context';
 import { entry } from './context';
 import { GoogleError } from './client';
 import { applyGoogleChange, applySegmentChange } from './inbound';
+import { pushBooking, queuedBookingId, queuedBookingTitle } from './bookings';
 import {
   BOOKING_TAG, NONE, changed, dateHash, fieldHashes, fieldWord, googleBody, googleFields, googleIdFor, googlePatch, inWindow, instanceBody,
   instanceState, keyStart, linkCarries, originalStart, siteFields, windowStart, type DateState, type Fields,
@@ -34,14 +35,15 @@ const LEASE = 5 * 60_000;
 /** a change Google kept refusing is dropped (and listed) after this many runs */
 const MAX_ATTEMPTS = 8;
 
-/** Works the outgoing queue. Returns how many events it finished. Throws GoogleError('auth') when Google refused the sign-in (everything waits). */
+/** Works the outgoing queue (events, and the site's bookings: ./bookings.ts). Returns how many it finished. Throws GoogleError('auth') when Google refused the sign-in (everything waits). */
 export async function runOutbound(ctx: SyncContext, limit = 25): Promise<number> {
   const rows = await ctx.repo.gcal.claimQueue(ctx.now, limit, LEASE);
   let done = 0;
   for (let i = 0; i < rows.length; i++) {
     const row = rows[i];
+    const bookingId = queuedBookingId(row.eventId);
     try {
-      await pushEvent(ctx, row.eventId);
+      await (bookingId ? pushBooking(ctx, bookingId) : pushEvent(ctx, row.eventId));
       await ctx.repo.gcal.finishQueue(row.eventId, row.version);
       done++;
     } catch (e) {
@@ -56,6 +58,11 @@ export async function runOutbound(ctx: SyncContext, limit = 25): Promise<number>
         break;
       }
       if (row.attempts >= MAX_ATTEMPTS) {
+        if (bookingId) {
+          await ctx.repo.gcal.log([{ direction: 'out', action: 'failed', title: await queuedBookingTitle(ctx, bookingId), data: { bookingId }, summary: `A booking’s copy wasn’t sent to Google after ${MAX_ATTEMPTS} tries: ${message} It goes again with the booking’s next change.` }], ctx.now);
+          await ctx.repo.gcal.finishQueue(row.eventId, row.version);
+          continue;
+        }
         const event = await ctx.repo.getEvent(row.eventId).catch(() => null);
         await ctx.repo.gcal.log([{ direction: 'out', action: 'failed', eventId: row.eventId, title: event?.title ?? '', summary: `Not sent to Google after ${MAX_ATTEMPTS} tries: ${message} Edit the event to try again.` }], ctx.now);
         await ctx.repo.gcal.finishQueue(row.eventId, row.version);

package/src/lib/calendar/google/store.ts

@@ -1,6 +1,6 @@
 import { randomInt } from 'node:crypto';
 import type { SqlDriver, SqlStatement } from '../../repo/sql';
-import type { Conflict, GcalAccount, GcalItem, GcalLink, GoogleCalendarEntry, Hashes, LogEntry, MatchState, NewLogEntry, PrefixRule } from './types';
+import type { Conflict, GcalAccount, GcalBookingItem, GcalItem, GcalLink, GoogleCalendarEntry, Hashes, LogEntry, MatchState, NewLogEntry, PrefixRule } from './types';
 
 // Storage for the Google Calendar sync (tables: ./migration.ts). Links use
 // the live module's job fields: a claim takes a lease (90 s, so a crashed run
@@ -35,6 +35,10 @@ function item(r: Row): GcalItem {
     descGoogle: !!r.desc_google, booking: !!r.booking, gone: !!r.gone, leftOut: Number(r.gone) === 2, conflict: parse<Conflict | null>(r.conflict, null), syncedAt: Number(r.synced_at ?? 0), createdAt: Number(r.created_at),
   };
 }
+function bookingItem(r: Row): GcalBookingItem {
+  return { linkId: String(r.link_id), googleId: String(r.google_id), bookingId: String(r.booking_id), site: String(r.site ?? ''), google: String(r.google ?? ''),
+    etag: String(r.etag ?? ''), htmlLink: String(r.html_link ?? ''), gone: !!r.gone, syncedAt: Number(r.synced_at ?? 0), createdAt: Number(r.created_at) };
+}
 function logEntry(r: Row): LogEntry {
   return { id: Number(r.id), at: Number(r.at), linkId: String(r.link_id ?? ''), eventId: String(r.event_id ?? ''), googleId: String(r.google_id ?? ''),
     direction: r.direction as LogEntry['direction'], action: String(r.action), title: String(r.title ?? ''), summary: String(r.summary ?? ''),
@@ -48,12 +52,13 @@ const linkColumns: Record<string, string> = { googleName: 'google_name', googleT
   fullSync: 'full_sync', nextAt: 'next_at', failures: 'failures', failingSince: 'failing_since', alertedAt: 'alerted_at', lastOkAt: 'last_ok_at', error: 'error' };
 const itemColumns: Record<string, string> = { eventId: 'event_id', icalUid: 'ical_uid', kind: 'kind', segmentFrom: 'segment_from', etag: 'etag', htmlLink: 'html_link',
   site: 'site', google: 'google', descGoogle: 'desc_google', booking: 'booking', gone: 'gone', conflict: 'conflict', syncedAt: 'synced_at' };
+const bookingItemColumns: Record<string, string> = { site: 'site', google: 'google', etag: 'etag', htmlLink: 'html_link', gone: 'gone', syncedAt: 'synced_at' };
 const jsonish = new Set(['calendars', 'roomIds', 'rules', 'bookingTitles', 'match', 'site', 'google', 'conflict']);
 const goneValue = (i: Pick<GcalItem, 'gone' | 'leftOut'>) => (i.gone ? (i.leftOut ? 2 : 1) : 0);
-function sets(data: Record<string, unknown>, columns: Record<string, string>) {
+function sets(data: Record<string, unknown>, columns: Record<string, string>, json = jsonish) {
   if ('leftOut' in data && data.leftOut !== undefined) data = { ...data, gone: goneValue({ gone: data.gone !== undefined ? !!data.gone : true, leftOut: !!data.leftOut }) };
   const entries = Object.entries(data).filter(([k, v]) => columns[k] && v !== undefined);
-  return { sql: entries.map(([k]) => `${columns[k]}=?`), args: entries.map(([k, v]) => jsonish.has(k) ? (v === null ? null : JSON.stringify(v)) : typeof v === 'boolean' ? Number(v) : v) };
+  return { sql: entries.map(([k]) => `${columns[k]}=?`), args: entries.map(([k, v]) => json.has(k) ? (v === null ? null : JSON.stringify(v)) : typeof v === 'boolean' ? Number(v) : v) };
 }
 
 export interface QueueRow { eventId: string; version: number; attempts: number }
@@ -140,9 +145,10 @@ export class GcalStore {
       AND ${force ? "state<>'paused'" : "state='active' AND next_at<=?"} RETURNING *`, force ? [lease, now + 150_000, id, now] : [lease, now + 150_000, id, now, now]);
     return rows[0] ? link(rows[0]) : null;
   }
-  /** Unlink: the pairs go, both copies of every event stay. Recent changes are kept. */
+  /** Unlink: the pairs go, both copies of every event (and the bookings' copies) stay. Recent changes are kept. */
   async deleteLink(id: string) {
-    await (await this.db()).batch([{ sql: 'DELETE FROM gcal_items WHERE link_id=?', args: [id] }, { sql: 'DELETE FROM gcal_links WHERE id=?', args: [id] }]);
+    await (await this.db()).batch([{ sql: 'DELETE FROM gcal_items WHERE link_id=?', args: [id] }, { sql: 'DELETE FROM gcal_booking_items WHERE link_id=?', args: [id] },
+      { sql: 'DELETE FROM gcal_links WHERE id=?', args: [id] }]);
   }
   /** Restore: every link waits for someone to check it, and changes queued before it describe content it replaced. */
   static restoreStatements(): SqlStatement[] {
@@ -184,6 +190,33 @@ export class GcalStore {
   }
   async deleteItem(linkId: string, googleId: string) { await (await this.db()).run('DELETE FROM gcal_items WHERE link_id=? AND google_id=?', [linkId, googleId]); }
 
+  // ---- copies of the site's bookings (out only) ----
+  async bookingItemsFor(bookingId: string) { return (await (await this.db()).all('SELECT * FROM gcal_booking_items WHERE booking_id=?', [bookingId])).map(bookingItem); }
+  async bookingItemsForLink(linkId: string) { return (await (await this.db()).all('SELECT * FROM gcal_booking_items WHERE link_id=?', [linkId])).map(bookingItem); }
+  async getBookingItem(linkId: string, googleId: string) {
+    const r = (await (await this.db()).all('SELECT * FROM gcal_booking_items WHERE link_id=? AND google_id=?', [linkId, googleId]))[0];
+    return r ? bookingItem(r) : null;
+  }
+  /** Saves a copy's pair; a copy made again (a new Google id) replaces the booking's old pair in that link. */
+  async putBookingItem(i: GcalBookingItem) {
+    await (await this.db()).batch([
+      { sql: 'DELETE FROM gcal_booking_items WHERE link_id=? AND booking_id=? AND google_id<>?', args: [i.linkId, i.bookingId, i.googleId] },
+      { sql: `INSERT INTO gcal_booking_items (link_id,google_id,booking_id,site,google,etag,html_link,gone,synced_at,created_at) VALUES (?,?,?,?,?,?,?,?,?,?)
+        ON CONFLICT(link_id,google_id) DO UPDATE SET booking_id=excluded.booking_id,site=excluded.site,google=excluded.google,etag=excluded.etag,html_link=excluded.html_link,
+        gone=excluded.gone,synced_at=excluded.synced_at`, args: [i.linkId, i.googleId, i.bookingId, i.site, i.google, i.etag, i.htmlLink, i.gone ? 1 : 0, i.syncedAt, i.createdAt] },
+    ]);
+  }
+  async patchBookingItem(linkId: string, googleId: string, data: Partial<GcalBookingItem>) {
+    // a booking copy's hashes are plain text
+    const s = sets(data, bookingItemColumns, new Set());
+    if (s.sql.length) await (await this.db()).run(`UPDATE gcal_booking_items SET ${s.sql.join(',')} WHERE link_id=? AND google_id=?`, [...s.args, linkId, googleId]);
+  }
+  async deleteBookingItem(linkId: string, googleId: string) { await (await this.db()).run('DELETE FROM gcal_booking_items WHERE link_id=? AND google_id=?', [linkId, googleId]); }
+  async countBookingItems() {
+    const rows = await (await this.db()).all('SELECT link_id, COUNT(*) AS n FROM gcal_booking_items WHERE gone=0 GROUP BY link_id');
+    return new Map(rows.map((r) => [String(r.link_id), Number(r.n)]));
+  }
+
   // ---- the outgoing queue ----
   /** Due events, oldest first, each held for `leaseMs` (another run skips them meanwhile). */
   async claimQueue(now: number, limit: number, leaseMs: number): Promise<QueueRow[]> {

package/src/lib/calendar/google/types.ts

@@ -125,6 +125,23 @@ export interface GcalItem {
   createdAt: number;
 }
 
+/** A copy of a site room booking in one link's Google calendar (lib/calendar/google/bookings.ts). Out only. */
+export interface GcalBookingItem {
+  linkId: string;
+  googleId: string;
+  bookingId: string;
+  /** the hash of the copy the site last sent (bookingCopyHash) */
+  site: string;
+  /** the hash of the copy as Google last had it: an edit there is listed once */
+  google: string;
+  etag: string;
+  htmlLink: string;
+  /** deleted in Google: made again only on the site's next change to the booking */
+  gone: boolean;
+  syncedAt: number;
+  createdAt: number;
+}
+
 export type LogDirection = 'in' | 'out' | 'clash' | 'info';
 export interface LogEntry {
   id: number;

package/src/lib/repo/migrations.ts

@@ -12,7 +12,7 @@ import { SYNC_MIGRATION } from '../sync/migration';
 import { ANNOUNCEMENT_TABLE, ANNOUNCEMENT_VISIBLE_COLUMNS } from '../announcements/migration';
 import { SCREENS_MIGRATION } from '../display/store';
 import { REQUEST_TABLE } from '../calendar/request-migration';
-import { GCAL_MIGRATION } from '../calendar/google/migration';
+import { GCAL_BOOKINGS_MIGRATION, GCAL_MIGRATION } from '../calendar/google/migration';
 // Versioned schema migrations shared by the two SQLite-dialect adapters
 // (D1 and libSQL). Applied versions are recorded in the `migrations` table;
 // each adapter's runner applies whatever is newer, in order, at startup.
@@ -755,6 +755,10 @@ export const MIGRATIONS: Migration[] = [
     `DROP TRIGGER content_version_booking_links_update`,
     contentVersionTriggers('booking_links', [...CONTENT_VERSION_COLUMNS.booking_links, 'translations'])[2],
   ] },
+  // copies of confirmed room bookings in Google (lib/calendar/google/bookings.ts):
+  // their pairs, and triggers on bookings and booking links feeding gcal_queue.
+  // Not public, so no cache trigger.
+  GCAL_BOOKINGS_MIGRATION,
 ];
 
 // Current cache coverage; keep earlier migration inputs frozen for upgrade compatibility.