@mulmoclaude/core 1.10.0 → 1.12.0

package/dist/google/index.js

@@ -3,7 +3,7 @@ import { t as truncate } from "../text-CjDbP2O1.js";
 import { t as writeFileAtomic } from "../atomic-DPpdrJzO.js";
 import { fetchWithTimeout } from "../utils/fetch.js";
 import { l as parseIsoDate, u as parseIsoDateTime } from "../calendarGrid-CrGxeCOG.js";
-import { J as getWorkspaceRoot, d as storeFor, et as createForwardingLogger, n as discoverCollections, tt as createHostSlot } from "../discovery-_fjsluLx.js";
+import { J as getWorkspaceRoot, d as storeFor, et as createForwardingLogger, n as discoverCollections, tt as createHostSlot } from "../discovery-B4CZvrXR.js";
 import { promises } from "node:fs";
 import path, { join } from "node:path";
 import { randomBytes } from "node:crypto";
@@ -621,7 +621,9 @@ var toEventSummary = (value) => {
 		end: eventTime$1(record.end),
 		htmlLink: stringField(record, "htmlLink"),
 		status: stringField(record, "status"),
-		colorId: stringField(record, "colorId")
+		colorId: stringField(record, "colorId"),
+		description: stringField(record, "description"),
+		location: stringField(record, "location")
 	};
 };
 var toCalendarSummary = (value) => {
@@ -663,6 +665,7 @@ async function createCalendarEvent(accessToken, input) {
 	const body = {
 		summary: input.summary,
 		description: input.description,
+		location: input.location,
 		...resolveEventSpan(input),
 		...input.colorId ? { colorId: input.colorId } : {},
 		...input.eventId ? { id: input.eventId } : {}
@@ -687,6 +690,7 @@ var eventEnd = (key, structured, flat) => {
 var buildEventPatch = (input) => ({
 	...input.summary !== void 0 ? { summary: input.summary } : {},
 	...input.description !== void 0 ? { description: input.description } : {},
+	...input.location !== void 0 ? { location: input.location } : {},
 	...eventEnd("start", input.start, input.startDateTime),
 	...eventEnd("end", input.end, input.endDateTime),
 	...input.colorId ? { colorId: input.colorId } : {}
@@ -837,34 +841,128 @@ function calendarSyncStatePath(workspaceRoot) {
 	return path.join(workspaceRoot ?? getWorkspaceRoot(), "data", "calendar", ".sync-state.json");
 }
 var calendarKey = canonicalCalendarId;
+/** Read one map out of whatever is on disk. Tolerant on purpose: a file written
+*  before `lastSyncedAt` existed simply lacks the key, and a hand-edited one may
+*  hold anything. A dropped entry costs a full re-walk or a duplicate run, never
+*  data — throwing here would stop the sync entirely. */
+function stringRecord(value) {
+	if (typeof value !== "object" || value === null) return {};
+	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
 async function readState$1(workspaceRoot) {
 	const stored = await readJsonOrNull(calendarSyncStatePath(workspaceRoot));
-	return stored?.tokens ? stored : { tokens: {} };
+	return {
+		tokens: stringRecord(stored?.tokens),
+		lastSyncedAt: stringRecord(stored?.lastSyncedAt)
+	};
 }
 var writeQueue$1 = { tail: Promise.resolve() };
-async function updateState$1(mutate, workspaceRoot) {
+/** Decide from the stored state and write the result, both inside the queue, so
+*  nothing in this process can read between the two. A `null` state skips the
+*  write; `result` is what the caller learns about the decision. */
+async function updateStateWith(decide, workspaceRoot) {
 	const run = writeQueue$1.tail.then(async () => {
-		const state = await readState$1(workspaceRoot);
-		await writeJsonAtomicWithMode(calendarSyncStatePath(workspaceRoot), { tokens: mutate(state.tokens) }, SYNC_STATE_MODE);
+		const { state, result } = decide(await readState$1(workspaceRoot));
+		if (state) await writeJsonAtomicWithMode(calendarSyncStatePath(workspaceRoot), state, SYNC_STATE_MODE);
+		return result;
 	});
 	writeQueue$1.tail = run.catch(() => void 0);
 	return await run;
 }
+async function updateState$1(mutate, workspaceRoot) {
+	await updateStateWith((state) => ({
+		state: mutate(state),
+		result: void 0
+	}), workspaceRoot);
+}
+var withoutKey = (record, dropped) => Object.fromEntries(Object.entries(record).filter(([key]) => key !== dropped));
 async function loadCalendarSyncToken(calendarId, workspaceRoot) {
 	return (await readState$1(workspaceRoot)).tokens[calendarKey(calendarId)] ?? null;
 }
 async function saveCalendarSyncToken(calendarId, syncToken, workspaceRoot) {
 	const stored = calendarKey(calendarId);
-	await updateState$1((tokens) => ({
-		...tokens,
-		[stored]: syncToken
+	await updateState$1((state) => ({
+		...state,
+		tokens: {
+			...state.tokens,
+			[stored]: syncToken
+		}
 	}), workspaceRoot);
 }
 /** Drop one calendar's token — used when Google answers 410, so the next run
-*  starts a clean full sync. */
+*  starts a clean full sync. Leaves the sync marker alone: "restart the walk"
+*  says nothing about "nobody is running". */
 async function clearCalendarSyncToken(calendarId, workspaceRoot) {
 	const dropped = calendarKey(calendarId);
-	await updateState$1((tokens) => Object.fromEntries(Object.entries(tokens).filter(([key]) => key !== dropped)), workspaceRoot);
+	await updateState$1((state) => ({
+		...state,
+		tokens: withoutKey(state.tokens, dropped)
+	}), workspaceRoot);
+}
+async function loadCalendarLastSyncedAt(calendarId, workspaceRoot) {
+	return (await readState$1(workspaceRoot)).lastSyncedAt[calendarKey(calendarId)] ?? null;
+}
+/** Stamp when a sync of this calendar started, but only if `mayClaim` accepts
+*  what the marker currently says. Answers whether THIS call is the one that
+*  claimed it.
+*
+*  The decision and the stamp share one pass through the queue on purpose.
+*  Deciding from a snapshot read earlier — as a caller filtering a whole map of
+*  calendars up front must — leaves both hosts believing the calendar is free,
+*  which is the race this exists to close (Codex review #2680). What remains is
+*  the read→write gap BETWEEN processes; closing that needs a real file lock
+*  (#2679), and this stays a soft dedup until then.
+*
+*  The time is passed in rather than read here so the rule stays testable
+*  without freezing the clock. */
+async function claimCalendarSyncIfDue(calendarId, startedAt, mayClaim, workspaceRoot) {
+	const stored = calendarKey(calendarId);
+	return await updateStateWith((state) => {
+		const claimed = mayClaim(state.lastSyncedAt[stored] ?? null);
+		return {
+			state: claimed ? {
+				...state,
+				lastSyncedAt: {
+					...state.lastSyncedAt,
+					[stored]: startedAt
+				}
+			} : null,
+			result: claimed
+		};
+	}, workspaceRoot);
+}
+/** Drop one calendar's marker, so the next tick — on either host — may sync it
+*  immediately instead of waiting the window out. */
+async function clearCalendarLastSyncedAt(calendarId, workspaceRoot) {
+	const dropped = calendarKey(calendarId);
+	await updateState$1((state) => ({
+		...state,
+		lastSyncedAt: withoutKey(state.lastSyncedAt, dropped)
+	}), workspaceRoot);
+}
+//#endregion
+//#region src/google/calendarSyncDue.ts
+/** Slack between a tick and the marker it writes. Without it a lone host reads
+*  its OWN marker as "not due yet" — elapsed lands a hair under the interval
+*  every time — and syncs every other hour. */
+var TICK_JITTER_TOLERANCE_MS = 300 * 1e3;
+/** How long a fresh marker suppresses a sync: one interval, less the slack.
+*  The slack is halved rather than subtracted flat for a very short configured
+*  interval, where a fixed five minutes would swallow the window whole. */
+function calendarSyncDueWindowMs(intervalMs) {
+	return intervalMs - Math.min(TICK_JITTER_TOLERANCE_MS, intervalMs / 2);
+}
+/** True iff no recent enough run stands in for this one.
+*
+*  A marker that cannot be read as a time is treated as due: a stuck calendar is
+*  worse than a duplicate run, which the sync is built to tolerate anyway
+*  (writes are upserts by event id). */
+function isCalendarSyncDue(lastSyncedAt, windowMs, now = Date.now()) {
+	if (!lastSyncedAt) return true;
+	const elapsed = now - Date.parse(lastSyncedAt);
+	if (!Number.isFinite(elapsed)) return true;
+	if (elapsed < -windowMs) return true;
+	return elapsed >= windowMs;
 }
 //#endregion
 //#region src/google/calendarPushState.ts
@@ -877,7 +975,9 @@ var toShadowEvent = (event) => ({
 	summary: event.summary,
 	start: event.start,
 	end: event.end,
-	colorId: event.colorId
+	colorId: event.colorId,
+	description: event.description,
+	location: event.location
 });
 async function readState(workspaceRoot) {
 	const stored = await readJsonOrNull(calendarPushStatePath(workspaceRoot));
@@ -920,14 +1020,142 @@ async function clearCalendarShadow(calendarId, workspaceRoot) {
 	await updateState((events) => Object.fromEntries(Object.entries(events).filter(([key]) => key !== dropped)), workspaceRoot);
 }
 //#endregion
+//#region src/google/calendarLock.ts
+/** Serialise `run` against whatever is already running for `key`.
+*
+*  `locks` is passed in so the queuing rule is testable without module state;
+*  the key is dropped once nothing is queued behind it, so the map cannot grow
+*  an entry per calendar forever. A failed predecessor still releases the
+*  queue — `then(run, run)`. */
+async function withKeyedLock(locks, key, run) {
+	const result = (locks.get(key) ?? Promise.resolve()).then(run, run);
+	const tail = result.then(() => void 0, () => void 0);
+	locks.set(key, tail);
+	try {
+		return await result;
+	} finally {
+		if (locks.get(key) === tail) locks.delete(key);
+	}
+}
+/** In-flight work per canonical calendar id. Module state on purpose: the
+*  scheduler, the create trigger and the Refresh button are three doors into
+*  the same calendar (CodeRabbit review #2566). */
+var calendarLocks = /* @__PURE__ */ new Map();
+/** Serialise anything that touches ONE calendar's sync state.
+*
+*  Shared with the push path (#2598), not only the pull doors: a push that
+*  overtakes an in-flight pull would record a baseline for events the pull is
+*  still writing, so the next push would diff against a future it never saw.
+*
+*  NOT reentrant — a holder must call the lock-free form of whatever it drives,
+*  or it waits on itself forever. */
+async function withCalendarLock(calendarId, run) {
+	return await withKeyedLock(calendarLocks, canonicalCalendarId(calendarId), run);
+}
+//#endregion
+//#region src/google/pushDateTime.ts
+/** RFC3339 zone designator: `Z`, `+09:00`, `-0500`. */
+var ZONE_SUFFIX_RE$1 = /(?:Z|[+-]\d{2}:?\d{2})$/;
+var FRACTIONAL_SECONDS_RE$1 = /\.\d+$/;
+var TWO_DIGITS_RE = /^\d{2}$/;
+var CLOCK_SEPARATOR = ":";
+var DATE_TIME_SEPARATOR = "T";
+var MIN_CLOCK_SEGMENTS = 2;
+var MAX_CLOCK_SEGMENTS = 3;
+var WHOLE_MINUTE_SECONDS = "00";
+var MAX_SECONDS = 59;
+/** Whether `value` is a real calendar day (`2026-02-30` is not).
+*
+*  Delegated to the parser the record lint, the calendar grid and the day view
+*  already share, so the push agrees with the rest of the app on what a valid
+*  stored date IS — and rejects an impossible one here instead of turning it
+*  into an opaque Google 400. */
+var isCalendarDate = (value) => parseIsoDate(value) !== null;
+/** A value Google already accepts verbatim, as the event time to send, or null.
+*
+*  Reached when the schema maps `start` onto a `string` field: `projectValue`
+*  normalises only `datetime` fields, so that column holds Google's own text,
+*  zone and all. The civil part is still validated — matching a trailing `Z` is
+*  not evidence that the rest is a date-time. */
+function rawGoogleTime(value) {
+	if (isCalendarDate(value)) return { date: value };
+	const zone = value.match(ZONE_SUFFIX_RE$1)?.[0];
+	if (zone === void 0) return null;
+	return parseIsoDateTime(value.slice(0, value.length - zone.length).replace(FRACTIONAL_SECONDS_RE$1, "")) === null ? null : { dateTime: value };
+}
+/** Google's own all-day `end` is EXCLUSIVE — a single day on the 12th ends on
+*  the 13th. The pull stores that as `2026-05-13T00:00` and this takes the date
+*  part straight back, so the exclusive end round-trips untouched. Looks
+*  off-by-one; adjusting it would shorten every all-day event by a day. */
+function allDayFrom(datePart) {
+	return { date: datePart };
+}
+/** Split `HH:MM[:SS]` into RFC3339's always-three segments, or null.
+*
+*  Split rather than one regex: expressing the optional seconds as `(?::(\d{2}))?`
+*  nests a quantifier inside a quantified group, which the ReDoS lint rejects. */
+function clockSegments(clockPart) {
+	const segments = clockPart.split(CLOCK_SEPARATOR);
+	if (segments.length < MIN_CLOCK_SEGMENTS || segments.length > MAX_CLOCK_SEGMENTS) return null;
+	if (!segments.every((segment) => TWO_DIGITS_RE.test(segment))) return null;
+	const [hours, minutes, seconds] = segments;
+	if (seconds !== void 0 && Number(seconds) > MAX_SECONDS) return null;
+	return [
+		hours,
+		minutes,
+		seconds ?? WHOLE_MINUTE_SECONDS
+	].join(CLOCK_SEPARATOR);
+}
+/** `YYYY-MM-DDTHH:MM[:SS]` → its date and its RFC3339 clock, or null.
+*
+*  Validity comes from the shared strict parser, so an out-of-range clock or an
+*  impossible day is refused here rather than sent to Google. */
+function parseStoredDateTime(value) {
+	if (parseIsoDateTime(value) === null) return null;
+	const [datePart, clockPart, ...extra] = value.split(DATE_TIME_SEPARATOR);
+	if (datePart === void 0 || clockPart === void 0 || extra.length > 0) return null;
+	const clock = clockSegments(clockPart);
+	return clock === null ? null : {
+		datePart,
+		clock
+	};
+}
+/** The zone designator to re-attach, or null when `previous` carries none. */
+function zoneSuffixOf(previous) {
+	if (previous === void 0) return null;
+	return previous.match(ZONE_SUFFIX_RE$1)?.[0] ?? null;
+}
+/** Build the event time to send for one field.
+*
+*  `previous` is the value Google last reported for this event, absent for a
+*  locally-created record. Returns null when `local` is neither a stored
+*  datetime nor a raw Google value — the caller reports that record rather than
+*  letting this invent a time Google would silently accept. */
+function toGoogleEventTime(local, previous, calendarTimeZone) {
+	if (typeof local !== "string") return null;
+	const trimmed = local.trim();
+	if (trimmed.length === 0) return null;
+	const raw = rawGoogleTime(trimmed);
+	if (raw !== null) return raw;
+	const parts = parseStoredDateTime(trimmed);
+	if (parts === null) return null;
+	if (previous !== void 0 && isCalendarDate(previous)) return allDayFrom(parts.datePart);
+	const zone = zoneSuffixOf(previous);
+	const dateTime = `${parts.datePart}${DATE_TIME_SEPARATOR}${parts.clock}`;
+	return zone === null ? {
+		dateTime,
+		timeZone: calendarTimeZone
+	} : { dateTime: `${dateTime}${zone}` };
+}
+//#endregion
 //#region src/google/collectionDateTime.ts
 /** All-day events carry no clock; midnight is where the day view places them. */
 var ALL_DAY_CLOCK = "00:00";
 var DATE_ONLY_RE = /^\d{4}-\d{2}-\d{2}$/;
 /** RFC3339 zone designator: `Z`, `+09:00`, `-0500`. */
-var ZONE_SUFFIX_RE$1 = /(?:Z|[+-]\d{2}:?\d{2})$/;
+var ZONE_SUFFIX_RE = /(?:Z|[+-]\d{2}:?\d{2})$/;
 /** Fractional seconds have no place in the collection datetime shape. */
-var FRACTIONAL_SECONDS_RE$1 = /\.\d+$/;
+var FRACTIONAL_SECONDS_RE = /\.\d+$/;
 /** Normalise one Google Calendar time value for storage in a `datetime` field.
 *  Anything that isn't a recognisable Google shape (empty string, non-string,
 *  free text) is returned untouched — the record lint should report it rather
@@ -937,12 +1165,10 @@ function toCollectionDateTime(value) {
 	const trimmed = value.trim();
 	if (DATE_ONLY_RE.test(trimmed)) return `${trimmed}T${ALL_DAY_CLOCK}`;
 	if (!trimmed.includes("T")) return value;
-	return trimmed.replace(ZONE_SUFFIX_RE$1, "").replace(FRACTIONAL_SECONDS_RE$1, "");
+	return trimmed.replace(ZONE_SUFFIX_RE, "").replace(FRACTIONAL_SECONDS_RE, "");
 }
 //#endregion
-//#region src/google/collectionSync.ts
-var GOOGLE_CALENDAR_SYNC_TASK_ID = "system:google-calendar-sync";
-var DEFAULT_SYNC_INTERVAL_MS = 3600 * 1e3;
+//#region src/google/collectionProjection.ts
 var DATETIME_FIELD_TYPE = "datetime";
 /** Own-property lookup, mirroring what the record lint reads: a spec reachable
 *  only through the prototype chain is not a DECLARED field, so it must not
@@ -967,848 +1193,1054 @@ function toCollectionRecord(event, map, primaryKey, fields) {
 		[primaryKey]: event.id
 	};
 }
-function classifyWrite(eventId, kind) {
-	if (kind === "ok") return { kind: "written" };
-	if (kind === "invalid-id") return {
-		kind: "unwritable",
-		message: `write ${eventId}: invalid-id`
-	};
-	return {
-		kind: "error",
-		message: `write ${eventId}: ${kind}`
-	};
-}
-function classifyDelete(eventId, kind) {
-	if (kind === "ok") return { kind: "removed" };
-	if (kind === "not-found") return { kind: "skipped" };
-	if (kind === "invalid-id") return {
-		kind: "unwritable",
-		message: `delete ${eventId}: invalid-id`
-	};
+/** Google's mapped values laid over whatever the record already holds.
+*
+*  A record file is written whole (`writeItem`), so projecting alone would drop
+*  every column the map does not name — a collection cannot then carry a local
+*  note next to a mirrored event, because the next pull that touches that event
+*  silently deletes it. The projection still wins on the fields it covers: those
+*  are Google's to own. */
+function mergeIntoExisting(existing, projected) {
 	return {
-		kind: "error",
-		message: `delete ${eventId}: ${kind}`
+		...existing ?? {},
+		...projected
 	};
 }
-async function applyEvent(collection, event, workspaceRoot) {
-	const { schema } = collection;
-	try {
-		const store = storeFor(collection, { workspaceRoot });
-		if (!store.write || !store.delete) return {
-			kind: "unwritable",
-			message: `collection '${collection.slug}' is read-only`
-		};
-		if (event.status === "cancelled") {
-			const deleted = await store.delete(event.id);
-			return classifyDelete(event.id, deleted.kind);
-		}
-		const record = toCollectionRecord(event, schema.googleCalendar?.map ?? {}, schema.primaryKey, schema.fields);
-		const written = await store.write(event.id, record);
-		return classifyWrite(event.id, written.kind);
-	} catch (error) {
-		return {
-			kind: "error",
-			message: `apply ${event.id}: ${String(error)}`
-		};
-	}
-}
-async function restartFullSync(accessToken, calendarId, workspaceRoot) {
-	await clearCalendarSyncToken(calendarId, workspaceRoot);
-	await clearCalendarShadow(calendarId, workspaceRoot);
-	return await syncCalendarEvents(accessToken, { calendarId });
+//#endregion
+//#region src/google/pushPlan.ts
+/** The event fields Google lets a caller write. `htmlLink` and `status` are
+*  read-only, so a record column mapped to either is ignored here rather than
+*  rejected — the mapping was authored for the pull, and a push has no business
+*  invalidating it. */
+var PUSHABLE_SOURCE_FIELDS = [
+	"summary",
+	"start",
+	"end",
+	"colorId",
+	"description",
+	"location"
+];
+var isPushableSource = (source) => PUSHABLE_SOURCE_FIELDS.includes(source);
+/** The subset of a schema's `map` a push can act on: collection field → event field. */
+function pushableMap(map) {
+	return Object.fromEntries(Object.entries(map).filter((entry) => isPushableSource(entry[1])));
 }
-/** Serialise `run` against whatever is already running for `key`.
-*
-*  `locks` is passed in so the queuing rule is testable without module state;
-*  the key is dropped once nothing is queued behind it, so the map cannot grow
-*  an entry per calendar forever. A failed predecessor still releases the
-*  queue — `then(run, run)`. */
-async function withKeyedLock(locks, key, run) {
-	const result = (locks.get(key) ?? Promise.resolve()).then(run, run);
-	const tail = result.then(() => void 0, () => void 0);
-	locks.set(key, tail);
-	try {
-		return await result;
-	} finally {
-		if (locks.get(key) === tail) locks.delete(key);
-	}
+/** Event field → the record column feeding it. The schema authors the map the
+*  other way round (for the pull); a push looks up by event field. Two columns
+*  mapped to one event field is already ambiguous for the pull — last wins. */
+function bySourceField(map) {
+	return Object.fromEntries(Object.entries(map).map(([field, source]) => [source, field]));
 }
-/** In-flight sync per canonical calendar id. Module state on purpose: the
-*  scheduler, the create trigger and the Refresh button are three doors into
-*  the same calendar (CodeRabbit review #2566). */
-var calendarLocks = /* @__PURE__ */ new Map();
-/** Sync ONE calendar and fan its events out to every collection bound to it.
+/** Google accepts a caller-chosen event id of 5-1024 base32hex characters. A
+*  record id outside that (a semantic id like `team-standup`) cannot be used,
+*  and v1 reports it instead of re-keying the record — see the plan. */
+var CLIENT_EVENT_ID_RE = /^[0-9a-v]{5,1024}$/;
+var isClientSettableEventId = (eventId) => CLIENT_EVENT_ID_RE.test(eventId);
+/** A field's value as comparable/sendable text.
 *
-*  The fan-out is not an optimisation, it is correctness: the sync token is
-*  keyed by `calendarId`, so syncing collection-by-collection would let the
-*  first collection advance the shared token and leave every later collection
-*  on the same calendar reading an already-consumed window — silently missing
-*  those events forever. Fetch once, apply to all, then advance the token.
-*  (Codex + CodeRabbit review on #2184.)
+*  Absent, null and `""` all collapse to `""`: Google reports an inherited colour
+*  as `""` while the record file may omit the key entirely, and treating those as
+*  different would report a local edit on every single push.
 *
-*  Queued per calendar for the same reason the fan-out exists: two passes over
-*  one calendar (a Refresh click landing during the scheduled run) would each
-*  load the SAME stored token and walk the same window. That is idempotent —
-*  writes are upserts by event id — but it is a wasted full walk. Queued, the
-*  second pass resumes from the token the first just stored and fetches only
-*  what is genuinely new. */
-/** Serialise anything that touches ONE calendar's sync state.
+*  A non-primitive is JSON-encoded rather than left to `String`, whose
+*  `[object Object]` would make two DIFFERENT objects compare equal — a
+*  silently-skipped edit. */
+var fieldText = (value) => {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
+	return JSON.stringify(value) ?? "";
+};
+/** A stored datetime with no seconds — what the collection's own date-time input
+*  produces. Google's values always carry seconds, so the pull writes them and a
+*  hand-typed value does not. */
+var SECONDLESS_DATETIME_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}$/;
+var WHOLE_MINUTE = ":00";
+/** Field text with `…T09:30` and `…T09:30:00` collapsed to one spelling.
 *
-*  Shared with the push path (#2598), not only the pull doors: a push that
-*  overtakes an in-flight pull would record a baseline for events the pull is
-*  still writing, so the next push would diff against a future it never saw. */
-async function withCalendarLock(calendarId, run) {
-	return await withKeyedLock(calendarLocks, canonicalCalendarId(calendarId), run);
+*  Without this, a record the user typed a time into never stops looking edited:
+*  the push writes it, Google answers with seconds, the baseline projection keeps
+*  them, and the seconds-less record then differs from its own baseline on every
+*  later push — re-PATCHing the same event on every click, forever.
+*
+*  A value that carries a zone offset (a `start` mapped onto a `string` field) is
+*  left alone: it is Google's own text on both sides already. */
+var comparableText = (value) => {
+	const text = fieldText(value);
+	return SECONDLESS_DATETIME_RE.test(text) ? `${text}${WHOLE_MINUTE}` : text;
+};
+/** A baseline shaped as the event it came from, so the comparison can run
+*  through the very projection that wrote the record. `htmlLink`/`status` are
+*  never pushable, so their absence from the baseline cannot matter. */
+var asEventSummary = (eventId, shadow) => ({
+	id: eventId,
+	htmlLink: "",
+	status: "",
+	...shadow
+});
+/** What the record WOULD hold if nobody had edited it since the baseline.
+*
+*  Deliberately `toCollectionRecord` — the same function the pull writes with —
+*  so "unchanged" here means exactly "the pull would produce this". A private
+*  re-implementation would drift from it and report phantom edits. */
+function baselineRecord(eventId, shadow, map, primaryKey, fields) {
+	return toCollectionRecord(asEventSummary(eventId, shadow), map, primaryKey, fields);
 }
-async function syncCalendarGroup(calendarId, collections, workspaceRoot) {
-	return await withCalendarLock(calendarId, () => syncCalendarGroupNow(calendarId, collections, workspaceRoot));
+/** The mapped fields whose local value no longer matches the baseline. */
+function locallyChangedFields(record, baseline, map) {
+	return Object.entries(map).filter(([field]) => comparableText(record[field]) !== comparableText(baseline[field])).map(([, source]) => source);
 }
-async function syncCalendarGroupNow(calendarId, collections, workspaceRoot) {
-	const accessToken = await getGoogleAccessToken();
-	const first = await syncCalendarEvents(accessToken, {
-		calendarId,
-		syncToken: await loadCalendarSyncToken(calendarId, workspaceRoot) ?? void 0
-	});
-	const result = first.fullResyncRequired ? await restartFullSync(accessToken, calendarId, workspaceRoot) : first;
-	const results = [];
-	for (const collection of collections) results.push(await applyEventsToCollection(collection, result.events, workspaceRoot));
-	const unwritable = results.flatMap((entry) => entry.unwritable);
-	if (unwritable.length > 0) log.warn("google", "skipping calendar events that can never be stored", {
-		calendarId,
-		unwritable
-	});
-	const failed = results.flatMap((entry) => entry.errors);
-	if (failed.length > 0) {
-		log.warn("google", "holding back calendar sync token after failed writes", {
-			calendarId,
-			failed: failed.length
-		});
-		return results;
-	}
-	await saveCalendarShadow(calendarId, shadowUpdates(result.events), workspaceRoot);
-	if (result.nextSyncToken) await advanceToken(calendarId, result.nextSyncToken, collections, workspaceRoot);
-	return results;
+/** The fields Google changed since the baseline, restricted to the ones the
+*  local edit touches.
+*
+*  Field-level on purpose: Google moving an event the user retitled locally is
+*  not a conflict, because the patch only carries the title. Comparing whole
+*  events would refuse those pushes for no reason. */
+function conflictingFields(shadow, current, changed) {
+	return changed.filter((source) => comparableText(shadow[source]) !== comparableText(current[source]));
 }
-/** The baseline this window establishes: what Google now says per event, and
-*  `null` for a cancelled one so a recreate cannot resume from a dead baseline. */
-function shadowUpdates(events) {
-	return Object.fromEntries(events.map((event) => [event.id, event.status === "cancelled" ? null : toShadowEvent(event)]));
+/** Classify one record against its baseline, before Google is consulted.
+*
+*  No baseline means the record never came from a sync, so it is local-only and
+*  has to be created. Google is queried ONLY for a `changed` record, which is
+*  what keeps a push over a large collection cheap. */
+function planRecord(eventId, record, shadow, map, primaryKey, fields) {
+	if (shadow === void 0) return { kind: "create" };
+	const changed = locallyChangedFields(record, baselineRecord(eventId, shadow, map, primaryKey, fields), map);
+	return changed.length === 0 ? { kind: "unchanged" } : {
+		kind: "changed",
+		fields: changed
+	};
 }
-/** Save the window's token unless every collection that consumed it was deleted
-*  while the sync was in flight.
+/** Whether an event that already holds this record's id may be adopted as its
+*  baseline.
 *
-*  The sync opens with a `discoverCollections()` snapshot, so a delete landing
-*  mid-run has already cleared this calendar's token by the time we get here
-*  (`releaseOrphanedCalendarToken`). Saving anyway would resurrect exactly the
-*  orphan the delete removed, and the next collection on this calendar would
-*  resume from a token describing records it never received (#2428).
+*  A 409 from `insert` usually means a previous push created the event but its
+*  baseline never landed. It can ALSO mean an unrelated event happens to hold
+*  this id, and adopting that would bind the record to a stranger's event — so
+*  adoption needs evidence the two are the same logical event, not just the same
+*  id (Codex review).
 *
-*  One survivor is enough: it still needs the incremental position. */
-async function advanceToken(calendarId, nextSyncToken, collections, workspaceRoot) {
-	if (!await anySyncedCollectionSurvives(collections)) {
-		log.info("google", "not advancing the sync token — every collection on this calendar was deleted mid-sync", { calendarId });
-		return;
-	}
-	await saveCalendarSyncToken(calendarId, nextSyncToken, workspaceRoot);
-}
-async function pathExists(absPath) {
-	try {
-		await stat(absPath);
-		return true;
-	} catch {
-		return false;
-	}
+*  The evidence is that the remote event ALREADY equals what this record would
+*  write. Adoption then records a baseline and writes nothing, so it cannot
+*  modify whatever that event is. Anything else is refused. */
+function mayAdoptExisting(eventId, record, existing, map, primaryKey, fields) {
+	return locallyChangedFields(record, baselineRecord(eventId, existing, map, primaryKey, fields), map).length === 0;
 }
-/** Liveness of the collections a sync just wrote to, checked against the skill
-*  dir `deleteCollection` removes. `exists` is injected so the rule is testable
-*  without a filesystem. An empty group has no survivor by definition. */
-async function anySyncedCollectionSurvives(collections, exists = pathExists) {
-	return (await Promise.all(collections.map((collection) => exists(collection.skillDir)))).some(Boolean);
+/** Record ids the baseline knows but the collection no longer holds — deleted
+*  locally. v1 reports the count and pushes nothing: `calendarDeleteEvent`
+*  removes the event for every attendee and cannot be undone. */
+function locallyDeletedIds(shadow, presentIds) {
+	const present = new Set(presentIds);
+	return Object.keys(shadow).filter((eventId) => !present.has(eventId));
 }
-async function applyEventsToCollection(collection, events, workspaceRoot) {
-	const outcomes = [];
-	for (const event of events) outcomes.push(await applyEvent(collection, event, workspaceRoot));
+//#endregion
+//#region src/google/collectionPush.ts
+/** Access roles that may write events. `reader` / `freeBusyReader` cannot, and a
+*  push under them fails per event with an opaque 403 — checked once up front so
+*  the user is told the real reason. */
+var WRITABLE_ACCESS_ROLES = ["owner", "writer"];
+/** Whether to refuse the whole push before touching a single event.
+*
+*  Only on POSITIVE evidence of a non-writable role. An unlisted calendar is
+*  unknown and must fall through: hard-denying it would block the feature
+*  outright for a calendar the user can in fact write to. Those attempts surface
+*  Google's own 403 per record if the write really is not allowed. */
+var isDeniedAccessRole = (accessRole) => accessRole !== null && !WRITABLE_ACCESS_ROLES.includes(accessRole);
+/** Resolve the calendar a schema names, for its writability and its timezone.
+*
+*  The list is consulted first because only it reports `accessRole`, which is
+*  what lets a read-only calendar be refused with the real reason instead of an
+*  opaque per-event 403. `"primary"` is matched on the `primary` flag, not the
+*  id — the primary calendar's own id is the account's email address, which never
+*  equals the literal the schema declares.
+*
+*  A calendar absent from the list is NOT denied: it is fetched by id for its
+*  timezone and its role left unknown. A 404 there means the calendar really is
+*  unreachable, and propagates as a `failed` outcome. */
+async function liveCalendarMeta(accessToken, calendarId) {
+	const key = canonicalCalendarId(calendarId);
+	const calendars = await listCalendars(accessToken);
+	const listed = key === "primary" ? calendars.find((calendar) => calendar.primary) : calendars.find((calendar) => calendar.id === key);
+	if (listed) return {
+		accessRole: listed.accessRole,
+		timeZone: listed.timeZone
+	};
+	const direct = await getCalendar(accessToken, calendarId);
+	log.info("google", "calendar is not in the user's list — pushing without an up-front role check", { calendarId: key });
 	return {
-		slug: collection.slug,
-		written: outcomes.filter((outcome) => outcome.kind === "written").length,
-		removed: outcomes.filter((outcome) => outcome.kind === "removed").length,
-		unwritable: outcomes.flatMap((outcome) => outcome.kind === "unwritable" ? [outcome.message] : []),
-		errors: outcomes.flatMap((outcome) => outcome.kind === "error" ? [outcome.message] : [])
+		accessRole: null,
+		timeZone: direct.timeZone
 	};
 }
-/** A refresh token is what lets the scheduler run unattended; without one
-*  there is nothing to sync with. */
-async function isGoogleLinked() {
-	return Boolean((await loadGoogleTokens())?.refresh_token);
+async function findCalendarCollection(slug, workspaceRoot) {
+	return (await discoverCollections({ workspaceRoot })).find((collection) => collection.slug === slug && collection.schema.googleCalendar) ?? null;
 }
-/** Group the declaring collections by the calendar they read, so each calendar
-*  is fetched exactly once.
-*
-*  Keyed by the CANONICAL id, not the declared one: an omitted `calendarId` and
-*  an explicit `"primary"` address the same calendar and therefore share one
-*  sync token, so grouping them apart would let one group advance the token out
-*  from under the other — the very loss this grouping exists to prevent
-*  (Codex review #2184). */
-function groupByCalendar(collections) {
-	const groups = /* @__PURE__ */ new Map();
-	for (const collection of collections) {
-		const key = canonicalCalendarId(collection.schema.googleCalendar?.calendarId);
-		groups.set(key, [...groups.get(key) ?? [], collection]);
-	}
-	return groups;
+var liveDeps = {
+	findCollection: findCalendarCollection,
+	isLinked: async () => Boolean((await loadGoogleTokens())?.refresh_token),
+	accessToken: getGoogleAccessToken,
+	calendarMeta: liveCalendarMeta
+};
+var localValue = (ctx, record, source) => {
+	const field = ctx.bySource[source];
+	return field === void 0 ? void 0 : record[field];
+};
+/** One end of the span, rebuilt from the stored clock plus whatever the baseline
+*  remembers about the original (zone, all-day). */
+function eventTime(ctx, record, source, previous) {
+	const value = localValue(ctx, record, source);
+	if (value === void 0) return {
+		ok: false,
+		reason: `no \`${source}\` field is mapped`
+	};
+	const time = toGoogleEventTime(value, previous, ctx.timeZone);
+	if (time === null) return {
+		ok: false,
+		reason: `\`${source}\` is not a date-time Google accepts (got ${JSON.stringify(value)})`
+	};
+	if ("dateTime" in time && time.timeZone === "") return {
+		ok: false,
+		reason: `the calendar reports no timezone, so \`${source}\` cannot be sent without one`
+	};
+	return {
+		ok: true,
+		time
+	};
 }
-/** The canonical calendar whose sync token nothing needs any more, or null.
-*
-*  Sync tokens are keyed by calendar, NOT by collection, so a deleted
-*  collection's token outlives it. Recreating a collection on the same calendar
-*  then resumes from that token and receives only the delta — the new
-*  collection never gets the history (#2428).
-*
-*  Returns null while ANY remaining collection still reads that calendar:
-*  clearing a live calendar's token costs a full re-walk on the next sync. The
-*  comparison is on the CANONICAL id for the same reason `groupByCalendar` is —
-*  an omitted `calendarId` and an explicit `"primary"` are one calendar. */
-function orphanedCalendarId(deleted, remaining) {
-	if (!deleted.googleCalendar) return null;
-	const key = canonicalCalendarId(deleted.googleCalendar.calendarId);
-	return remaining.some((other) => other.googleCalendar && canonicalCalendarId(other.googleCalendar.calendarId) === key) ? null : key;
+/** `description` / `location` for a create — omitted when empty, since there is
+*  nothing to state about an event that carries neither. */
+var optionalText = (ctx, record) => {
+	const description = fieldText(localValue(ctx, record, "description"));
+	const location = fieldText(localValue(ctx, record, "location"));
+	return {
+		...description ? { description } : {},
+		...location ? { location } : {}
+	};
+};
+async function createFromRecord(ctx, eventId, record) {
+	if (!isClientSettableEventId(eventId)) return {
+		kind: "skipped",
+		message: `${eventId}: the record id cannot be used as a Google event id (needs 5-1024 characters from 0-9a-v)`
+	};
+	const start = eventTime(ctx, record, "start", void 0);
+	const end = eventTime(ctx, record, "end", void 0);
+	if (!start.ok) return {
+		kind: "skipped",
+		message: `${eventId}: ${start.reason}`
+	};
+	if (!end.ok) return {
+		kind: "skipped",
+		message: `${eventId}: ${end.reason}`
+	};
+	const colorId = fieldText(localValue(ctx, record, "colorId"));
+	return {
+		kind: "created",
+		event: await createCalendarEvent(ctx.accessToken, {
+			eventId,
+			calendarId: ctx.calendarId,
+			summary: fieldText(localValue(ctx, record, "summary")),
+			start: start.time,
+			end: end.time,
+			...optionalText(ctx, record),
+			...colorId ? { colorId } : {}
+		})
+	};
 }
-/** Drop the sync token of a just-deleted collection's calendar, unless another
-*  collection still reads it. Call AFTER the delete lands — the check reads the
-*  collections that survive it.
-*
-*  Returns the cleared calendar id, or null when nothing was cleared. Never
-*  throws: a failed cleanup must not fail the delete it follows. */
-async function releaseOrphanedCalendarToken(deleted, workspaceRoot) {
+/** The free-text fields of a patch, each only when the local edit touched it.
+*  Unlike `colorId`, `""` is a real value here — Google clears the field. */
+var textPatch = (ctx, record, changed) => {
+	const touched = [
+		"summary",
+		"description",
+		"location"
+	].filter((source) => changed.includes(source));
+	return Object.fromEntries(touched.map((source) => [source, fieldText(localValue(ctx, record, source))]));
+};
+/** Only the fields the local edit touched — PATCH semantics, so an untouched
+*  attendee list / recurrence rule is left alone. */
+function buildPatch(ctx, record, changed, shadow) {
+	const resolved = ["start", "end"].filter((source) => changed.includes(source)).map((source) => ({
+		source,
+		result: eventTime(ctx, record, source, shadow[source])
+	}));
+	const [failure] = resolved.flatMap((entry) => entry.result.ok ? [] : [entry.result.reason]);
+	if (failure !== void 0) return {
+		ok: false,
+		reason: failure
+	};
+	const colorId = fieldText(localValue(ctx, record, "colorId"));
+	if (changed.includes("colorId") && colorId === "") return {
+		ok: false,
+		reason: "Google cannot clear an event colour once set"
+	};
+	return {
+		ok: true,
+		patch: {
+			...textPatch(ctx, record, changed),
+			...changed.includes("colorId") ? { colorId } : {},
+			...Object.fromEntries(resolved.flatMap((entry) => entry.result.ok ? [[entry.source, entry.result.time]] : []))
+		}
+	};
+}
+async function updateFromRecord(ctx, eventId, record, changed, shadow) {
+	const fetched = await getCalendarEvent(ctx.accessToken, {
+		calendarId: ctx.calendarId,
+		eventId
+	});
+	if (fetched === null || fetched.event.status === "cancelled") return {
+		kind: "skipped",
+		message: `${eventId}: the event no longer exists in Google — sync first, then re-create it`
+	};
+	if (conflictingFields(shadow, toShadowEvent(fetched.event), changed).length > 0) return { kind: "conflict" };
+	const built = buildPatch(ctx, record, changed, shadow);
+	if (!built.ok) return {
+		kind: "skipped",
+		message: `${eventId}: ${built.reason}`
+	};
 	try {
-		if (!deleted.googleCalendar) return null;
-		const orphaned = orphanedCalendarId(deleted, (await discoverCollections({ workspaceRoot })).map((collection) => collection.schema));
-		if (orphaned === null) return null;
-		await clearCalendarSyncToken(orphaned, workspaceRoot);
-		await clearCalendarShadow(orphaned, workspaceRoot);
-		log.info("google", "cleared the sync token of a calendar no collection reads any more", { calendarId: orphaned });
-		return orphaned;
+		return {
+			kind: "updated",
+			event: await updateCalendarEvent(ctx.accessToken, {
+				eventId,
+				calendarId: ctx.calendarId,
+				ifMatch: fetched.etag,
+				...built.patch
+			})
+		};
 	} catch (error) {
-		log.warn("google", "could not release the deleted collection's calendar sync token", { error: String(error) });
-		return null;
+		if (isGoogleApiError(error) && error.status === 412) return { kind: "conflict" };
+		throw error;
 	}
 }
-/** Every declaring collection, grouped by the calendar it reads. */
-async function declaringGroups(workspaceRoot) {
-	return groupByCalendar((await discoverCollections({ workspaceRoot })).filter((collection) => collection.schema.googleCalendar));
-}
-/** Whether a background sync of these groups may run at all.
+/** Create, recovering from the one 409 that is provably safe to recover from.
 *
-*  Authoring the collection before linking the account is an expected state,
-*  not a failure. Checking once here keeps it a quiet skip instead of an
-*  access-token throw per calendar, every hour, until the user links (#2188).
-*  A user-triggered sync answers differently — it says so out loud. */
-async function backgroundSyncAllowed(groups) {
-	if (groups.size === 0) return false;
-	if (await isGoogleLinked()) return true;
-	log.info("google", "skipping calendar sync — no Google account linked on this host", { calendars: groups.size });
-	return false;
-}
-/** Run each group, isolating failures per calendar — one unreachable calendar
-*  (or a revoked grant) must not stop the others. */
-async function runCalendarGroups(groups, workspaceRoot) {
-	const results = [];
-	for (const [calendarId, collections] of groups) try {
-		results.push(...await syncCalendarGroup(calendarId, collections, workspaceRoot));
+*  A 409 means the id is taken, which is USUALLY a previous push whose baseline
+*  never landed. It can also be an unrelated event that happens to hold this id,
+*  so the recovery never writes: it adopts the baseline only when the remote
+*  event already equals what this record would write, and otherwise reports the
+*  fix. Patching whatever answered the 409 would let a push modify a stranger's
+*  event (Codex review).
+*
+*  Refusal is not a dead end — a Sync writes both the record and its baseline,
+*  after which the record pushes normally. */
+async function createOrAdopt(ctx, eventId, record) {
+	try {
+		return await createFromRecord(ctx, eventId, record);
 	} catch (error) {
-		log.warn("google", "calendar sync failed", {
-			calendarId,
-			error: String(error)
+		if (!isGoogleApiError(error) || error.status !== 409) throw error;
+		const fetched = await getCalendarEvent(ctx.accessToken, {
+			calendarId: ctx.calendarId,
+			eventId
 		});
-		results.push(...collections.map((collection) => ({
-			slug: collection.slug,
-			written: 0,
-			removed: 0,
-			unwritable: [],
-			errors: [String(error)]
-		})));
+		if (fetched === null) throw error;
+		if (mayAdoptExisting(eventId, record, toShadowEvent(fetched.event), ctx.map, ctx.primaryKey, ctx.fields)) return {
+			kind: "unchanged",
+			event: fetched.event
+		};
+		return {
+			kind: "skipped",
+			message: `${eventId}: an event with this id already exists in Google and differs from this record — press Sync to adopt it, then push again`
+		};
 	}
-	return results;
-}
-/** Sync every collection that declares `googleCalendar`. */
-async function syncDueCalendarCollections(workspaceRoot) {
-	const groups = await declaringGroups(workspaceRoot);
-	return await backgroundSyncAllowed(groups) ? await runCalendarGroups(groups, workspaceRoot) : [];
-}
-/** The groups whose calendar has never synced. A missing token IS the "created
-*  since the last sync" signal — nothing else distinguishes a new collection
-*  from an edited one on the write path this feeds (#2427).
-*
-*  Self-silencing by construction: the first sync stores a token, so a calendar
-*  matches at most once. `loadToken` is injected so the rule is testable without
-*  a workspace on disk. */
-async function unsyncedGroups(groups, loadToken) {
-	const checked = await Promise.all([...groups].map(async (entry) => await loadToken(entry[0]) === null ? entry : null));
-	return new Map(checked.filter((entry) => entry !== null));
-}
-/** Sync only the calendars that have never synced — the first sync for a
-*  just-created collection, which otherwise stays empty until the hourly
-*  scheduler run (#2427). Cheap and safe to call on every config write. */
-async function syncNewCalendarCollections(workspaceRoot) {
-	const pending = await unsyncedGroups(await declaringGroups(workspaceRoot), (calendarId) => loadCalendarSyncToken(calendarId, workspaceRoot));
-	if (!await backgroundSyncAllowed(pending)) return [];
-	log.info("google", "running the first sync for newly declared calendars", { calendars: [...pending.keys()] });
-	return await runCalendarGroups(pending, workspaceRoot);
 }
-var liveManualSyncDeps = {
-	loadGroups: declaringGroups,
-	isLinked: isGoogleLinked,
-	runGroups: runCalendarGroups
-};
-/** Sync the calendar ONE collection reads, on demand (the Refresh button).
-*
-*  Deliberately syncs the whole group, not just `slug`: the sync token is keyed
-*  by calendar, so consuming a window for one collection would leave the others
-*  on that calendar reading an already-consumed one. Returns every result of the
-*  group so the caller can report the requested slug's own counts.
-*
-*  "Does this collection sync at all" is answered BEFORE "is Google linked":
-*  telling someone to link their account for a collection that never declared a
-*  calendar sends them fixing the wrong thing. */
-async function syncCalendarForCollection(slug, workspaceRoot, deps = liveManualSyncDeps) {
-	const owning = [...await deps.loadGroups(workspaceRoot)].filter(([, collections]) => collections.some((collection) => collection.slug === slug));
-	if (owning.length === 0) return { kind: "not-a-calendar" };
-	if (!await deps.isLinked()) return { kind: "not-linked" };
-	return {
-		kind: "synced",
-		results: await deps.runGroups(new Map(owning), workspaceRoot)
+/** A 403 on a write is a permissions answer, but `googleApiError` appends the
+*  "is the API enabled for the Cloud project?" hint to every 403 — true for a
+*  disabled API, misleading here. Reached when the up-front role check could not
+*  run because the calendar is not in the user's list, which is exactly when the
+*  user needs the real reason. */
+function writeFailure(eventId, error) {
+	if (isGoogleApiError(error) && error.status === 403) return {
+		kind: "skipped",
+		message: `${eventId}: Google refused the write — you may not have permission to change events on this calendar`
 	};
-}
-/** Scheduler registration, shaped like `feedRefreshTaskDef` so hosts wire it
-*  with a single line. */
-function googleCalendarSyncTaskDef(opts) {
 	return {
-		id: GOOGLE_CALENDAR_SYNC_TASK_ID,
-		name: "Google Calendar sync",
-		description: "Pulls changed Google Calendar events into any collection declaring `googleCalendar`, without invoking the LLM.",
-		schedule: {
-			type: SCHEDULE_TYPES.interval,
-			intervalMs: opts?.intervalMs ?? DEFAULT_SYNC_INTERVAL_MS
-		},
-		missedRunPolicy: MISSED_RUN_POLICIES.runOnce,
-		run: () => syncDueCalendarCollections(opts?.workspaceRoot ?? getWorkspaceRoot()).then(() => {})
+		kind: "error",
+		message: `${eventId}: ${String(error)}`
 	};
 }
-//#endregion
-//#region src/google/pushDateTime.ts
-/** RFC3339 zone designator: `Z`, `+09:00`, `-0500`. */
-var ZONE_SUFFIX_RE = /(?:Z|[+-]\d{2}:?\d{2})$/;
-var FRACTIONAL_SECONDS_RE = /\.\d+$/;
-var TWO_DIGITS_RE = /^\d{2}$/;
-var CLOCK_SEPARATOR = ":";
-var DATE_TIME_SEPARATOR = "T";
-var MIN_CLOCK_SEGMENTS = 2;
-var MAX_CLOCK_SEGMENTS = 3;
-var WHOLE_MINUTE_SECONDS = "00";
-var MAX_SECONDS = 59;
-/** Whether `value` is a real calendar day (`2026-02-30` is not).
-*
-*  Delegated to the parser the record lint, the calendar grid and the day view
-*  already share, so the push agrees with the rest of the app on what a valid
-*  stored date IS — and rejects an impossible one here instead of turning it
-*  into an opaque Google 400. */
-var isCalendarDate = (value) => parseIsoDate(value) !== null;
-/** A value Google already accepts verbatim, as the event time to send, or null.
-*
-*  Reached when the schema maps `start` onto a `string` field: `projectValue`
-*  normalises only `datetime` fields, so that column holds Google's own text,
-*  zone and all. The civil part is still validated — matching a trailing `Z` is
-*  not evidence that the rest is a date-time. */
-function rawGoogleTime(value) {
-	if (isCalendarDate(value)) return { date: value };
-	const zone = value.match(ZONE_SUFFIX_RE)?.[0];
-	if (zone === void 0) return null;
-	return parseIsoDateTime(value.slice(0, value.length - zone.length).replace(FRACTIONAL_SECONDS_RE, "")) === null ? null : { dateTime: value };
+async function pushRecord(ctx, eventId, record) {
+	try {
+		const shadow = ctx.shadow[eventId];
+		const plan = planRecord(eventId, record, shadow, ctx.map, ctx.primaryKey, ctx.fields);
+		if (plan.kind === "unchanged") return { kind: "unchanged" };
+		if (plan.kind === "create" || shadow === void 0) return await createOrAdopt(ctx, eventId, record);
+		return await updateFromRecord(ctx, eventId, record, plan.fields, shadow);
+	} catch (error) {
+		return writeFailure(eventId, error);
+	}
 }
-/** Google's own all-day `end` is EXCLUSIVE — a single day on the 12th ends on
-*  the 13th. The pull stores that as `2026-05-13T00:00` and this takes the date
-*  part straight back, so the exclusive end round-trips untouched. Looks
-*  off-by-one; adjusting it would shorten every all-day event by a day. */
-function allDayFrom(datePart) {
-	return { date: datePart };
+/** The baseline an outcome establishes, so the next push sees the record as
+*  unchanged instead of pushing it again. Empty for anything that wrote nothing
+*  and had no baseline to repair. */
+function pushedShadow(outcomes) {
+	const written = outcomes.flatMap((outcome) => "event" in outcome && outcome.event !== void 0 ? [outcome.event] : []);
+	return Object.fromEntries(written.map((event) => [event.id, toShadowEvent(event)]));
 }
-/** Split `HH:MM[:SS]` into RFC3339's always-three segments, or null.
-*
-*  Split rather than one regex: expressing the optional seconds as `(?::(\d{2}))?`
-*  nests a quantifier inside a quantified group, which the ReDoS lint rejects. */
-function clockSegments(clockPart) {
-	const segments = clockPart.split(CLOCK_SEPARATOR);
-	if (segments.length < MIN_CLOCK_SEGMENTS || segments.length > MAX_CLOCK_SEGMENTS) return null;
-	if (!segments.every((segment) => TWO_DIGITS_RE.test(segment))) return null;
-	const [hours, minutes, seconds] = segments;
-	if (seconds !== void 0 && Number(seconds) > MAX_SECONDS) return null;
-	return [
-		hours,
-		minutes,
-		seconds ?? WHOLE_MINUTE_SECONDS
-	].join(CLOCK_SEPARATOR);
+/** See `unpushedIds` on the result for why `skipped` is not in this set. */
+var UNPUSHED_KINDS = ["conflict", "error"];
+/** Whether this outcome leaves a local edit that only exists locally, so the
+*  pull must not overwrite the record and the baseline must not advance. */
+var isUnpushed = (kind) => UNPUSHED_KINDS.includes(kind);
+function tally(slug, attempts, localDeletes) {
+	const outcomes = attempts.map((attempt) => attempt.outcome);
+	const count = (kind) => outcomes.filter((outcome) => outcome.kind === kind).length;
+	return {
+		slug,
+		created: count("created"),
+		updated: count("updated"),
+		conflicts: count("conflict"),
+		localDeletes,
+		skipped: outcomes.flatMap((outcome) => outcome.kind === "skipped" ? [outcome.message] : []),
+		errors: outcomes.flatMap((outcome) => outcome.kind === "error" ? [outcome.message] : []),
+		unpushedIds: attempts.filter((attempt) => isUnpushed(attempt.outcome.kind)).map((attempt) => attempt.eventId)
+	};
 }
-/** `YYYY-MM-DDTHH:MM[:SS]` → its date and its RFC3339 clock, or null.
+/** Record ids whose local value no longer matches the baseline — edits that have
+*  not reached Google.
 *
-*  Validity comes from the shared strict parser, so an out-of-range clock or an
-*  impossible day is refused here rather than sent to Google. */
-function parseStoredDateTime(value) {
-	if (parseIsoDateTime(value) === null) return null;
-	const [datePart, clockPart, ...extra] = value.split(DATE_TIME_SEPARATOR);
-	if (datePart === void 0 || clockPart === void 0 || extra.length > 0) return null;
-	const clock = clockSegments(clockPart);
-	return clock === null ? null : {
-		datePart,
-		clock
-	};
+*  Pure, and deliberately built from `planRecord`, so it answers with exactly the
+*  records a push WOULD have acted on. A private re-implementation would drift
+*  from the push and protect the wrong set. */
+function locallyEditedIds(records, shadow, map, primaryKey, fields) {
+	return records.map((record) => ({
+		eventId: fieldText(record[primaryKey]),
+		record
+	})).filter(({ eventId, record }) => planRecord(eventId, record, shadow[eventId], map, primaryKey, fields).kind !== "unchanged").map(({ eventId }) => eventId);
+}
+/** The same set, read from the workspace.
+*
+*  Needed when a push cannot run AT ALL — a calendar whose role degraded to
+*  reader, a revoked grant, an IO failure. The pull still runs, since reading
+*  needs no write access, and would overwrite exactly these records while
+*  advancing their baseline past the edit (CodeRabbit review #2666). Computed
+*  from the stored baseline alone, so it works precisely when Google is the
+*  thing that is unreachable. */
+async function unsentLocalEdits(collection, workspaceRoot) {
+	const { schema } = collection;
+	const shadow = await loadCalendarShadow(schema.googleCalendar?.calendarId, workspaceRoot);
+	return locallyEditedIds(await storeFor(collection, { workspaceRoot }).list(), shadow, pushableMap(schema.googleCalendar?.map ?? {}), schema.primaryKey, schema.fields);
 }
-/** The zone designator to re-attach, or null when `previous` carries none. */
-function zoneSuffixOf(previous) {
-	if (previous === void 0) return null;
-	return previous.match(ZONE_SUFFIX_RE)?.[0] ?? null;
+/** Push one collection WITHOUT taking the calendar lock.
+*
+*  The caller must already hold it. The scheduled push→pull cycle
+*  (`collectionSync.ts`) runs inside the lock it took for the pull, and the lock
+*  is not reentrant — going through `pushCalendarForCollection` there would make
+*  the sync wait on itself forever. */
+async function pushCollectionNow(collection, workspaceRoot, deps = liveDeps) {
+	const { schema, slug } = collection;
+	const calendarId = schema.googleCalendar?.calendarId;
+	const accessToken = await deps.accessToken();
+	const meta = await deps.calendarMeta(accessToken, calendarId);
+	if (isDeniedAccessRole(meta.accessRole)) return {
+		kind: "read-only",
+		accessRole: meta.accessRole ?? ""
+	};
+	const map = pushableMap(schema.googleCalendar?.map ?? {});
+	const shadow = await loadCalendarShadow(calendarId, workspaceRoot);
+	const records = await storeFor(collection, { workspaceRoot }).list();
+	const ctx = {
+		accessToken,
+		calendarId,
+		timeZone: meta.timeZone,
+		map,
+		bySource: bySourceField(map),
+		primaryKey: schema.primaryKey,
+		fields: schema.fields,
+		shadow
+	};
+	const attempts = [];
+	for (const record of records) {
+		const eventId = fieldText(record[schema.primaryKey]);
+		const outcome = await pushRecord(ctx, eventId, record);
+		attempts.push({
+			eventId,
+			outcome
+		});
+		await saveCalendarShadow(calendarId, pushedShadow([outcome]), workspaceRoot);
+	}
+	const result = tally(slug, attempts, locallyDeletedIds(shadow, records.map((record) => fieldText(record[schema.primaryKey]))).length);
+	if (result.errors.length > 0) log.warn("google", "calendar push finished with errors", {
+		slug,
+		errors: result.errors.length
+	});
+	return {
+		kind: "pushed",
+		result
+	};
 }
-/** Build the event time to send for one field.
+/** Push ONE collection's records to the calendar it declares.
 *
-*  `previous` is the value Google last reported for this event, absent for a
-*  locally-created record. Returns null when `local` is neither a stored
-*  datetime nor a raw Google value — the caller reports that record rather than
-*  letting this invent a time Google would silently accept. */
-function toGoogleEventTime(local, previous, calendarTimeZone) {
-	if (typeof local !== "string") return null;
-	const trimmed = local.trim();
-	if (trimmed.length === 0) return null;
-	const raw = rawGoogleTime(trimmed);
-	if (raw !== null) return raw;
-	const parts = parseStoredDateTime(trimmed);
-	if (parts === null) return null;
-	if (previous !== void 0 && isCalendarDate(previous)) return allDayFrom(parts.datePart);
-	const zone = zoneSuffixOf(previous);
-	const dateTime = `${parts.datePart}${DATE_TIME_SEPARATOR}${parts.clock}`;
-	return zone === null ? {
-		dateTime,
-		timeZone: calendarTimeZone
-	} : { dateTime: `${dateTime}${zone}` };
+*  "Does this collection sync at all" is answered before "is Google linked", for
+*  the reason `syncCalendarForCollection` gives: telling someone to link their
+*  account for a collection that never declared a calendar sends them fixing the
+*  wrong thing. */
+async function pushCalendarForCollection(slug, workspaceRoot, deps = liveDeps) {
+	try {
+		const collection = await deps.findCollection(slug, workspaceRoot);
+		if (collection === null) return { kind: "not-a-calendar" };
+		if (!await deps.isLinked()) return { kind: "not-linked" };
+		return await withCalendarLock(collection.schema.googleCalendar?.calendarId, () => pushCollectionNow(collection, workspaceRoot, deps));
+	} catch (error) {
+		log.warn("google", "calendar push could not start", {
+			slug,
+			error: String(error)
+		});
+		return {
+			kind: "failed",
+			message: String(error)
+		};
+	}
 }
 //#endregion
-//#region src/google/pushPlan.ts
-/** The event fields Google lets a caller write. `htmlLink` and `status` are
-*  read-only, so a record column mapped to either is ignored here rather than
-*  rejected — the mapping was authored for the pull, and a push has no business
-*  invalidating it. */
-var PUSHABLE_SOURCE_FIELDS = [
-	"summary",
-	"start",
-	"end",
-	"colorId"
-];
-var isPushableSource = (source) => PUSHABLE_SOURCE_FIELDS.includes(source);
-/** The subset of a schema's `map` a push can act on: collection field → event field. */
-function pushableMap(map) {
-	return Object.fromEntries(Object.entries(map).filter((entry) => isPushableSource(entry[1])));
+//#region src/google/collectionSync.ts
+var GOOGLE_CALENDAR_SYNC_TASK_ID = "system:google-calendar-sync";
+var DEFAULT_SYNC_INTERVAL_MS = 3600 * 1e3;
+function classifyWrite(eventId, kind) {
+	if (kind === "ok") return { kind: "written" };
+	if (kind === "invalid-id") return {
+		kind: "unwritable",
+		message: `write ${eventId}: invalid-id`
+	};
+	return {
+		kind: "error",
+		message: `write ${eventId}: ${kind}`
+	};
 }
-/** Event field → the record column feeding it. The schema authors the map the
-*  other way round (for the pull); a push looks up by event field. Two columns
-*  mapped to one event field is already ambiguous for the pull — last wins. */
-function bySourceField(map) {
-	return Object.fromEntries(Object.entries(map).map(([field, source]) => [source, field]));
+function classifyDelete(eventId, kind) {
+	if (kind === "ok") return { kind: "removed" };
+	if (kind === "not-found") return { kind: "skipped" };
+	if (kind === "invalid-id") return {
+		kind: "unwritable",
+		message: `delete ${eventId}: invalid-id`
+	};
+	return {
+		kind: "error",
+		message: `delete ${eventId}: ${kind}`
+	};
 }
-/** Google accepts a caller-chosen event id of 5-1024 base32hex characters. A
-*  record id outside that (a semantic id like `team-standup`) cannot be used,
-*  and v1 reports it instead of re-keying the record — see the plan. */
-var CLIENT_EVENT_ID_RE = /^[0-9a-v]{5,1024}$/;
-var isClientSettableEventId = (eventId) => CLIENT_EVENT_ID_RE.test(eventId);
-/** A field's value as comparable/sendable text.
+async function applyEvent(collection, event, workspaceRoot) {
+	const { schema } = collection;
+	try {
+		const store = storeFor(collection, { workspaceRoot });
+		if (!store.write || !store.delete) return {
+			kind: "unwritable",
+			message: `collection '${collection.slug}' is read-only`
+		};
+		if (event.status === "cancelled") {
+			const deleted = await store.delete(event.id);
+			return classifyDelete(event.id, deleted.kind);
+		}
+		const record = toCollectionRecord(event, schema.googleCalendar?.map ?? {}, schema.primaryKey, schema.fields);
+		const written = await store.write(event.id, mergeIntoExisting(await store.read(event.id), record));
+		return classifyWrite(event.id, written.kind);
+	} catch (error) {
+		return {
+			kind: "error",
+			message: `apply ${event.id}: ${String(error)}`
+		};
+	}
+}
+/** The events of a window a pull may act on.
 *
-*  Absent, null and `""` all collapse to `""`: Google reports an inherited colour
-*  as `""` while the record file may omit the key entirely, and treating those as
-*  different would report a local edit on every single push.
+*  A record the push just refused to send is edited on BOTH sides. Writing
+*  Google's value over it destroys the local edit the push declined to resolve,
+*  so the local one stands. Single-sourced because the record write and the
+*  baseline write must agree exactly on which events they skip — disagreeing is
+*  what would silently overwrite Google on the next push (#2620). */
+function pullableEvents(events, unpushed) {
+	return events.filter((event) => !unpushed.has(event.id));
+}
+/** Report what an automatic push did, since nobody is watching a scheduled run.
+*  A conflict or an error means that record now diverges from Google until
+*  someone resolves it, which must not be silent. */
+function reportAutoPush(slug, result) {
+	const { created, updated, conflicts, skipped, errors, unpushedIds } = result;
+	if (created + updated > 0) log.info("google", "auto-pushed local calendar edits", {
+		slug,
+		created,
+		updated
+	});
+	if (unpushedIds.length > 0) log.warn("google", "records the auto push could not send — the pull will leave them alone", {
+		slug,
+		conflicts,
+		unpushedIds
+	});
+	if (skipped.length > 0) log.warn("google", "records the auto push skipped", {
+		slug,
+		skipped
+	});
+	if (errors.length > 0) log.warn("google", "auto push errors", {
+		slug,
+		errors
+	});
+}
+var NOTHING_UNPUSHED = /* @__PURE__ */ new Set();
+/** A collection whose protection is unknown must not be pulled this run.
 *
-*  A non-primitive is JSON-encoded rather than left to `String`, whose
-*  `[object Object]` would make two DIFFERENT objects compare equal — a
-*  silently-skipped edit. */
-var fieldText = (value) => {
-	if (value === void 0 || value === null) return "";
-	if (typeof value === "string") return value;
-	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
-	return JSON.stringify(value) ?? "";
+*  Reported through the retryable `errors` channel rather than as a special case:
+*  that already holds the sync token AND skips the baseline save, so the window
+*  simply replays next run with nothing lost. Failing OPEN here — pulling with no
+*  protection — would overwrite the very edits this exists to protect; the read
+*  that failed is no evidence that the pull's own writes would fail too, so they
+*  would land (CodeRabbit review #2666). */
+var PROTECTION_UNKNOWN = "could not work out which records to protect after a failed push";
+/** What ONE collection's pull must leave alone: only what ITS OWN push failed to
+*  send.
+*
+*  Scoped per collection because a calendar can back several of them, and a
+*  conflict in one says nothing about the others. Sharing one set across the
+*  group starved a collection that never even declares `autoPush`: it cannot
+*  conflict, yet a neighbour's conflict froze its records — and the sync token
+*  still advanced, so Google never resent them (Codex review #2666). */
+var unpushedFor = (unpushed, slug) => {
+	const protection = unpushed.get(slug);
+	return protection === void 0 ? NOTHING_UNPUSHED : protection;
 };
-/** A stored datetime with no seconds — what the collection's own date-time input
-*  produces. Google's values always carry seconds, so the pull writes them and a
-*  hand-typed value does not. */
-var SECONDLESS_DATETIME_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}$/;
-var WHOLE_MINUTE = ":00";
-/** Field text with `…T09:30` and `…T09:30:00` collapsed to one spelling.
+/** What the calendar's BASELINE must leave alone: the union over every
+*  collection.
 *
-*  Without this, a record the user typed a time into never stops looking edited:
-*  the push writes it, Google answers with seconds, the baseline projection keeps
-*  them, and the seconds-less record then differs from its own baseline on every
-*  later push — re-PATCHing the same event on every click, forever.
+*  Deliberately not per collection, unlike the records above. `.push-state.json`
+*  holds ONE baseline per calendar, shared by every collection on it, so there is
+*  no per-collection baseline to hold back. Advancing it while any collection
+*  still has an unresolved conflict is the failure that silently overwrites
+*  Google on the next push, and holding it back only ever means "keep reporting
+*  the conflict" — so the union is the safe side of an asymmetry the shared
+*  storage forces.
 *
-*  A value that carries a zone offset (a `start` mapped onto a `string` field) is
-*  left alone: it is Google's own text on both sides already. */
-var comparableText = (value) => {
-	const text = fieldText(value);
-	return SECONDLESS_DATETIME_RE.test(text) ? `${text}${WHOLE_MINUTE}` : text;
-};
-/** A baseline shaped as the event it came from, so the comparison can run
-*  through the very projection that wrote the record. `htmlLink`/`status` are
-*  never pushable, so their absence from the baseline cannot matter. */
-var asEventSummary = (eventId, shadow) => ({
-	id: eventId,
-	htmlLink: "",
-	status: "",
-	...shadow
-});
-/** What the record WOULD hold if nobody had edited it since the baseline.
+*  A `null` (unknown) entry contributes nothing, because that collection reports
+*  a retryable error instead — which stops the baseline being saved at all. */
+var allUnpushed = (unpushed) => new Set([...unpushed.values()].flatMap((ids) => ids === null ? [] : [...ids]));
+/** What a collection's pull must protect when its push did not run AT ALL.
 *
-*  Deliberately `toCollectionRecord` — the same function the pull writes with —
-*  so "unchanged" here means exactly "the pull would produce this". A private
-*  re-implementation would drift from it and report phantom edits. */
-function baselineRecord(eventId, shadow, map, primaryKey, fields) {
-	return toCollectionRecord(asEventSummary(eventId, shadow), map, primaryKey, fields);
-}
-/** The mapped fields whose local value no longer matches the baseline. */
-function locallyChangedFields(record, baseline, map) {
-	return Object.entries(map).filter(([field]) => comparableText(record[field]) !== comparableText(baseline[field])).map(([, source]) => source);
+*  Registering nothing here was a silent data loss of exactly the kind this
+*  feature exists to prevent: a calendar whose role degrades to reader refuses
+*  the whole push, yet the pull still runs — reading needs no write access — and
+*  overwrote every unsent local edit while advancing its baseline past it, so the
+*  next push could not even report the conflict (CodeRabbit review #2666).
+*
+*  Protects the edited records rather than all of them, so an unchanged record
+*  keeps syncing normally. `null` when even that could not be worked out — the
+*  caller then refuses to pull the collection at all, because failing open here
+*  destroys exactly what this protects. */
+async function protectUnsentEdits(collection, workspaceRoot) {
+	try {
+		const edited = await unsentLocalEdits(collection, workspaceRoot);
+		if (edited.length > 0) log.warn("google", "protecting local edits a failed push could not send", {
+			slug: collection.slug,
+			edited
+		});
+		return new Set(edited);
+	} catch (error) {
+		log.warn("google", PROTECTION_UNKNOWN, {
+			slug: collection.slug,
+			error: String(error)
+		});
+		return null;
+	}
 }
-/** The fields Google changed since the baseline, restricted to the ones the
-*  local edit touches.
+/** Push every `autoPush` collection in this group, and answer with the records
+*  whose local edit did not reach Google, keyed by collection.
 *
-*  Field-level on purpose: Google moving an event the user retitled locally is
-*  not a conflict, because the patch only carries the title. Comparing whole
-*  events would refuse those pushes for no reason. */
-function conflictingFields(shadow, current, changed) {
-	return changed.filter((source) => comparableText(shadow[source]) !== comparableText(current[source]));
+*  MUST run inside the calendar lock the caller already holds — hence
+*  `pushCollectionNow` rather than `pushCalendarForCollection`, which would take
+*  the same non-reentrant lock and wait on itself forever.
+*
+*  A failed push must not stop the pull: the pull is what keeps the collection
+*  fresh, and a revoked write grant is no reason to freeze reading. */
+async function pushAutoCollections(collections, workspaceRoot) {
+	const unpushed = /* @__PURE__ */ new Map();
+	for (const collection of collections.filter((entry) => entry.schema.googleCalendar?.autoPush)) try {
+		const outcome = await pushCollectionNow(collection, workspaceRoot);
+		if (outcome.kind === "pushed") {
+			reportAutoPush(collection.slug, outcome.result);
+			unpushed.set(collection.slug, new Set(outcome.result.unpushedIds));
+			continue;
+		}
+		log.warn("google", "auto push did not run", {
+			slug: collection.slug,
+			reason: outcome.kind
+		});
+		unpushed.set(collection.slug, await protectUnsentEdits(collection, workspaceRoot));
+	} catch (error) {
+		log.warn("google", "auto push failed — pulling anyway", {
+			slug: collection.slug,
+			error: String(error)
+		});
+		unpushed.set(collection.slug, await protectUnsentEdits(collection, workspaceRoot));
+	}
+	return unpushed;
+}
+async function restartFullSync(accessToken, calendarId, workspaceRoot) {
+	await clearCalendarSyncToken(calendarId, workspaceRoot);
+	await clearCalendarShadow(calendarId, workspaceRoot);
+	return await syncCalendarEvents(accessToken, { calendarId });
 }
-/** Classify one record against its baseline, before Google is consulted.
+var ALWAYS_CLAIM = () => true;
+/** Sync ONE calendar and fan its events out to every collection bound to it.
 *
-*  No baseline means the record never came from a sync, so it is local-only and
-*  has to be created. Google is queried ONLY for a `changed` record, which is
-*  what keeps a push over a large collection cheap. */
-function planRecord(eventId, record, shadow, map, primaryKey, fields) {
-	if (shadow === void 0) return { kind: "create" };
-	const changed = locallyChangedFields(record, baselineRecord(eventId, shadow, map, primaryKey, fields), map);
-	return changed.length === 0 ? { kind: "unchanged" } : {
-		kind: "changed",
-		fields: changed
-	};
+*  The fan-out is not an optimisation, it is correctness: the sync token is
+*  keyed by `calendarId`, so syncing collection-by-collection would let the
+*  first collection advance the shared token and leave every later collection
+*  on the same calendar reading an already-consumed window — silently missing
+*  those events forever. Fetch once, apply to all, then advance the token.
+*  (Codex + CodeRabbit review on #2184.)
+*
+*  Queued per calendar for the same reason the fan-out exists: two passes over
+*  one calendar (a Refresh click landing during the scheduled run) would each
+*  load the SAME stored token and walk the same window. That is idempotent —
+*  writes are upserts by event id — but it is a wasted full walk. Queued, the
+*  second pass resumes from the token the first just stored and fetches only
+*  what is genuinely new. That queue is module state, so it orders the doors
+*  into THIS process only; `claimThenSync` is what other hosts can see. */
+async function syncCalendarGroup(calendarId, collections, workspaceRoot, mayClaim = ALWAYS_CLAIM) {
+	return await withCalendarLock(calendarId, () => claimThenSync(calendarId, collections, workspaceRoot, mayClaim));
 }
-/** Whether an event that already holds this record's id may be adopted as its
-*  baseline.
+/** Take the workspace-shared marker BEFORE the calendar is touched, sync only if
+*  this run got it, and drop it again if the run could not happen at all.
 *
-*  A 409 from `insert` usually means a previous push created the event but its
-*  baseline never landed. It can ALSO mean an unrelated event happens to hold
-*  this id, and adopting that would bind the record to a stranger's event — so
-*  adoption needs evidence the two are the same logical event, not just the same
-*  id (Codex review).
+*  Claiming first is the whole point: hosts tick in the same minute (interval
+*  schedules align to wall-clock boundaries), so a marker written on completion
+*  would leave the entire run — minutes, for a first full walk — open for a
+*  second host to start alongside this one and lose the push baseline it writes.
 *
-*  The evidence is that the remote event ALREADY equals what this record would
-*  write. Adoption then records a baseline and writes nothing, so it cannot
-*  modify whatever that event is. Anything else is refused. */
-function mayAdoptExisting(eventId, record, existing, map, primaryKey, fields) {
-	return locallyChangedFields(record, baselineRecord(eventId, existing, map, primaryKey, fields), map).length === 0;
+*  Released only when the sync could not run at all. A run that finished with
+*  retryable per-collection errors KEEPS the marker: it already held the token
+*  and the baseline back, so it replays on the next tick either way, and
+*  releasing would hand a permanently-failing calendar back to both hosts at
+*  once — the very overlap this guards (observed during Claude review). */
+async function claimThenSync(calendarId, collections, workspaceRoot, mayClaim) {
+	if (!await claimCalendarSync(calendarId, workspaceRoot, mayClaim)) {
+		log.info("google", "skipping a calendar this workspace synced recently — another host may be on it", { calendarId });
+		return [];
+	}
+	try {
+		return await syncCalendarGroupNow(calendarId, collections, workspaceRoot);
+	} catch (error) {
+		await releaseCalendarSyncClaim(calendarId, workspaceRoot);
+		throw error;
+	}
 }
-/** Record ids the baseline knows but the collection no longer holds — deleted
-*  locally. v1 reports the count and pushes nothing: `calendarDeleteEvent`
-*  removes the event for every attendee and cannot be undone. */
-function locallyDeletedIds(shadow, presentIds) {
-	const present = new Set(presentIds);
-	return Object.keys(shadow).filter((eventId) => !present.has(eventId));
+/** Never throws, and fails OPEN: the marker guards against duplicate work, it is
+*  not a precondition for syncing correctly. A workspace that cannot store it
+*  syncs the way it did before #2678. */
+async function claimCalendarSync(calendarId, workspaceRoot, mayClaim) {
+	try {
+		return await claimCalendarSyncIfDue(calendarId, (/* @__PURE__ */ new Date()).toISOString(), mayClaim, workspaceRoot);
+	} catch (error) {
+		log.warn("google", "could not stamp the calendar sync marker — another host may sync this calendar in parallel", {
+			calendarId,
+			error: String(error)
+		});
+		return true;
+	}
 }
-//#endregion
-//#region src/google/collectionPush.ts
-/** Access roles that may write events. `reader` / `freeBusyReader` cannot, and a
-*  push under them fails per event with an opaque 403 — checked once up front so
-*  the user is told the real reason. */
-var WRITABLE_ACCESS_ROLES = ["owner", "writer"];
-/** Whether to refuse the whole push before touching a single event.
+async function releaseCalendarSyncClaim(calendarId, workspaceRoot) {
+	try {
+		await clearCalendarLastSyncedAt(calendarId, workspaceRoot);
+	} catch (error) {
+		log.warn("google", "could not release the calendar sync marker after a failed run", {
+			calendarId,
+			error: String(error)
+		});
+	}
+}
+async function syncCalendarGroupNow(calendarId, collections, workspaceRoot) {
+	const unpushed = await pushAutoCollections(collections, workspaceRoot);
+	const accessToken = await getGoogleAccessToken();
+	const first = await syncCalendarEvents(accessToken, {
+		calendarId,
+		syncToken: await loadCalendarSyncToken(calendarId, workspaceRoot) ?? void 0
+	});
+	const result = first.fullResyncRequired ? await restartFullSync(accessToken, calendarId, workspaceRoot) : first;
+	const results = await applyWindowToGroup(collections, result.events, workspaceRoot, unpushed);
+	if (windowFullyLanded(calendarId, results)) {
+		await saveCalendarShadow(calendarId, shadowUpdates(result.events, allUnpushed(unpushed)), workspaceRoot);
+		if (result.nextSyncToken) await advanceToken(calendarId, result.nextSyncToken, collections, workspaceRoot);
+	}
+	return results;
+}
+/** Apply one window to every collection on the calendar, honouring what each
+*  one's own push protected. A collection whose protection could not be worked
+*  out is not pulled at all — it reports a retryable error instead, which holds
+*  the token and the baseline back for the whole group. */
+async function applyWindowToGroup(collections, events, workspaceRoot, unpushed) {
+	const results = [];
+	for (const collection of collections) {
+		const protection = unpushedFor(unpushed, collection.slug);
+		results.push(protection === null ? {
+			slug: collection.slug,
+			written: 0,
+			removed: 0,
+			unwritable: [],
+			errors: [PROTECTION_UNKNOWN]
+		} : await applyEventsToCollection(collection, events, workspaceRoot, protection));
+	}
+	return results;
+}
+/** Whether the token and baseline may advance past this window.
 *
-*  Only on POSITIVE evidence of a non-writable role. An unlisted calendar is
-*  unknown and must fall through: hard-denying it would block the feature
-*  outright for a calendar the user can in fact write to. Those attempts surface
-*  Google's own 403 per record if the write really is not allowed. */
-var isDeniedAccessRole = (accessRole) => accessRole !== null && !WRITABLE_ACCESS_ROLES.includes(accessRole);
-/** Resolve the calendar a schema names, for its writability and its timezone.
+*  Google never resends a window, so advancing past a failed write would lose
+*  those events for good; holding the token back just replays them next run
+*  (writes are idempotent). An `unwritable` event can never succeed, so it does
+*  NOT hold the token — but it is logged loudly, since it will silently never
+*  appear in the collection. */
+function windowFullyLanded(calendarId, results) {
+	results.filter((entry) => entry.unwritable.length > 0).forEach((entry) => log.warn("google", "skipping calendar events that can never be stored", {
+		calendarId,
+		slug: entry.slug,
+		unwritable: entry.unwritable
+	}));
+	const failed = results.filter((entry) => entry.errors.length > 0);
+	failed.forEach((entry) => log.warn("google", "holding back calendar sync token after failed writes", {
+		calendarId,
+		slug: entry.slug,
+		errors: entry.errors
+	}));
+	return failed.length === 0;
+}
+/** The baseline this window establishes: what Google now says per event, and
+*  `null` for a cancelled one so a recreate cannot resume from a dead baseline.
 *
-*  The list is consulted first because only it reports `accessRole`, which is
-*  what lets a read-only calendar be refused with the real reason instead of an
-*  opaque per-event 403. `"primary"` is matched on the `primary` flag, not the
-*  id — the primary calendar's own id is the account's email address, which never
-*  equals the literal the schema declares.
+*  An event whose record the push could not send is left OUT, and that omission
+*  is load-bearing. Advancing its baseline to Google's new value while the record
+*  keeps the local one would make the next push read a plain one-sided edit —
+*  no conflict to detect any more — and quietly overwrite Google. Held back, the
+*  baseline stays older than both sides, so the conflict keeps being reported
+*  until someone resolves it (#2620). */
+function shadowUpdates(events, unpushed = /* @__PURE__ */ new Set()) {
+	const carried = pullableEvents(events, unpushed);
+	return Object.fromEntries(carried.map((event) => [event.id, event.status === "cancelled" ? null : toShadowEvent(event)]));
+}
+/** Save the window's token unless every collection that consumed it was deleted
+*  while the sync was in flight.
 *
-*  A calendar absent from the list is NOT denied: it is fetched by id for its
-*  timezone and its role left unknown. A 404 there means the calendar really is
-*  unreachable, and propagates as a `failed` outcome. */
-async function liveCalendarMeta(accessToken, calendarId) {
-	const key = canonicalCalendarId(calendarId);
-	const calendars = await listCalendars(accessToken);
-	const listed = key === "primary" ? calendars.find((calendar) => calendar.primary) : calendars.find((calendar) => calendar.id === key);
-	if (listed) return {
-		accessRole: listed.accessRole,
-		timeZone: listed.timeZone
-	};
-	const direct = await getCalendar(accessToken, calendarId);
-	log.info("google", "calendar is not in the user's list — pushing without an up-front role check", { calendarId: key });
-	return {
-		accessRole: null,
-		timeZone: direct.timeZone
-	};
+*  The sync opens with a `discoverCollections()` snapshot, so a delete landing
+*  mid-run has already cleared this calendar's token by the time we get here
+*  (`releaseOrphanedCalendarToken`). Saving anyway would resurrect exactly the
+*  orphan the delete removed, and the next collection on this calendar would
+*  resume from a token describing records it never received (#2428).
+*
+*  One survivor is enough: it still needs the incremental position. */
+async function advanceToken(calendarId, nextSyncToken, collections, workspaceRoot) {
+	if (!await anySyncedCollectionSurvives(collections)) {
+		log.info("google", "not advancing the sync token — every collection on this calendar was deleted mid-sync", { calendarId });
+		return;
+	}
+	await saveCalendarSyncToken(calendarId, nextSyncToken, workspaceRoot);
 }
-async function findCalendarCollection(slug, workspaceRoot) {
-	return (await discoverCollections({ workspaceRoot })).find((collection) => collection.slug === slug && collection.schema.googleCalendar) ?? null;
+async function pathExists(absPath) {
+	try {
+		await stat(absPath);
+		return true;
+	} catch {
+		return false;
+	}
 }
-var liveDeps = {
-	findCollection: findCalendarCollection,
-	isLinked: async () => Boolean((await loadGoogleTokens())?.refresh_token),
-	accessToken: getGoogleAccessToken,
-	calendarMeta: liveCalendarMeta
-};
-var localValue = (ctx, record, source) => {
-	const field = ctx.bySource[source];
-	return field === void 0 ? void 0 : record[field];
-};
-/** One end of the span, rebuilt from the stored clock plus whatever the baseline
-*  remembers about the original (zone, all-day). */
-function eventTime(ctx, record, source, previous) {
-	const value = localValue(ctx, record, source);
-	if (value === void 0) return {
-		ok: false,
-		reason: `no \`${source}\` field is mapped`
-	};
-	const time = toGoogleEventTime(value, previous, ctx.timeZone);
-	if (time === null) return {
-		ok: false,
-		reason: `\`${source}\` is not a date-time Google accepts (got ${JSON.stringify(value)})`
-	};
-	if ("dateTime" in time && time.timeZone === "") return {
-		ok: false,
-		reason: `the calendar reports no timezone, so \`${source}\` cannot be sent without one`
-	};
-	return {
-		ok: true,
-		time
-	};
+/** Liveness of the collections a sync just wrote to, checked against the skill
+*  dir `deleteCollection` removes. `exists` is injected so the rule is testable
+*  without a filesystem. An empty group has no survivor by definition. */
+async function anySyncedCollectionSurvives(collections, exists = pathExists) {
+	return (await Promise.all(collections.map((collection) => exists(collection.skillDir)))).some(Boolean);
 }
-async function createFromRecord(ctx, eventId, record) {
-	if (!isClientSettableEventId(eventId)) return {
-		kind: "skipped",
-		message: `${eventId}: the record id cannot be used as a Google event id (needs 5-1024 characters from 0-9a-v)`
-	};
-	const start = eventTime(ctx, record, "start", void 0);
-	const end = eventTime(ctx, record, "end", void 0);
-	if (!start.ok) return {
-		kind: "skipped",
-		message: `${eventId}: ${start.reason}`
-	};
-	if (!end.ok) return {
-		kind: "skipped",
-		message: `${eventId}: ${end.reason}`
-	};
-	const colorId = fieldText(localValue(ctx, record, "colorId"));
+async function applyEventsToCollection(collection, events, workspaceRoot, unpushed) {
+	const outcomes = [];
+	for (const event of pullableEvents(events, unpushed)) outcomes.push(await applyEvent(collection, event, workspaceRoot));
 	return {
-		kind: "created",
-		event: await createCalendarEvent(ctx.accessToken, {
-			eventId,
-			calendarId: ctx.calendarId,
-			summary: fieldText(localValue(ctx, record, "summary")),
-			start: start.time,
-			end: end.time,
-			...colorId ? { colorId } : {}
-		})
+		slug: collection.slug,
+		written: outcomes.filter((outcome) => outcome.kind === "written").length,
+		removed: outcomes.filter((outcome) => outcome.kind === "removed").length,
+		unwritable: outcomes.flatMap((outcome) => outcome.kind === "unwritable" ? [outcome.message] : []),
+		errors: outcomes.flatMap((outcome) => outcome.kind === "error" ? [outcome.message] : [])
 	};
 }
-/** Only the fields the local edit touched — PATCH semantics, so an untouched
-*  attendee list / recurrence rule is left alone. */
-function buildPatch(ctx, record, changed, shadow) {
-	const resolved = ["start", "end"].filter((source) => changed.includes(source)).map((source) => ({
-		source,
-		result: eventTime(ctx, record, source, shadow[source])
-	}));
-	const [failure] = resolved.flatMap((entry) => entry.result.ok ? [] : [entry.result.reason]);
-	if (failure !== void 0) return {
-		ok: false,
-		reason: failure
-	};
-	const colorId = fieldText(localValue(ctx, record, "colorId"));
-	if (changed.includes("colorId") && colorId === "") return {
-		ok: false,
-		reason: "Google cannot clear an event colour once set"
-	};
-	return {
-		ok: true,
-		patch: {
-			...changed.includes("summary") ? { summary: fieldText(localValue(ctx, record, "summary")) } : {},
-			...changed.includes("colorId") ? { colorId } : {},
-			...Object.fromEntries(resolved.flatMap((entry) => entry.result.ok ? [[entry.source, entry.result.time]] : []))
-		}
-	};
+/** A refresh token is what lets the scheduler run unattended; without one
+*  there is nothing to sync with. */
+async function isGoogleLinked() {
+	return Boolean((await loadGoogleTokens())?.refresh_token);
+}
+/** Group the declaring collections by the calendar they read, so each calendar
+*  is fetched exactly once.
+*
+*  Keyed by the CANONICAL id, not the declared one: an omitted `calendarId` and
+*  an explicit `"primary"` address the same calendar and therefore share one
+*  sync token, so grouping them apart would let one group advance the token out
+*  from under the other — the very loss this grouping exists to prevent
+*  (Codex review #2184). */
+function groupByCalendar(collections) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const key = canonicalCalendarId(collection.schema.googleCalendar?.calendarId);
+		groups.set(key, [...groups.get(key) ?? [], collection]);
+	}
+	return groups;
 }
-async function updateFromRecord(ctx, eventId, record, changed, shadow) {
-	const fetched = await getCalendarEvent(ctx.accessToken, {
-		calendarId: ctx.calendarId,
-		eventId
-	});
-	if (fetched === null || fetched.event.status === "cancelled") return {
-		kind: "skipped",
-		message: `${eventId}: the event no longer exists in Google — sync first, then re-create it`
-	};
-	if (conflictingFields(shadow, toShadowEvent(fetched.event), changed).length > 0) return { kind: "conflict" };
-	const built = buildPatch(ctx, record, changed, shadow);
-	if (!built.ok) return {
-		kind: "skipped",
-		message: `${eventId}: ${built.reason}`
-	};
+/** The canonical calendar whose sync token nothing needs any more, or null.
+*
+*  Sync tokens are keyed by calendar, NOT by collection, so a deleted
+*  collection's token outlives it. Recreating a collection on the same calendar
+*  then resumes from that token and receives only the delta — the new
+*  collection never gets the history (#2428).
+*
+*  Returns null while ANY remaining collection still reads that calendar:
+*  clearing a live calendar's token costs a full re-walk on the next sync. The
+*  comparison is on the CANONICAL id for the same reason `groupByCalendar` is —
+*  an omitted `calendarId` and an explicit `"primary"` are one calendar. */
+function orphanedCalendarId(deleted, remaining) {
+	if (!deleted.googleCalendar) return null;
+	const key = canonicalCalendarId(deleted.googleCalendar.calendarId);
+	return remaining.some((other) => other.googleCalendar && canonicalCalendarId(other.googleCalendar.calendarId) === key) ? null : key;
+}
+/** Drop the sync token of a just-deleted collection's calendar, unless another
+*  collection still reads it. Call AFTER the delete lands — the check reads the
+*  collections that survive it.
+*
+*  Returns the cleared calendar id, or null when nothing was cleared. Never
+*  throws: a failed cleanup must not fail the delete it follows. */
+async function releaseOrphanedCalendarToken(deleted, workspaceRoot) {
 	try {
-		return {
-			kind: "updated",
-			event: await updateCalendarEvent(ctx.accessToken, {
-				eventId,
-				calendarId: ctx.calendarId,
-				ifMatch: fetched.etag,
-				...built.patch
-			})
-		};
+		if (!deleted.googleCalendar) return null;
+		const orphaned = orphanedCalendarId(deleted, (await discoverCollections({ workspaceRoot })).map((collection) => collection.schema));
+		if (orphaned === null) return null;
+		await clearCalendarSyncToken(orphaned, workspaceRoot);
+		await clearCalendarShadow(orphaned, workspaceRoot);
+		await clearCalendarLastSyncedAt(orphaned, workspaceRoot);
+		log.info("google", "cleared the sync token of a calendar no collection reads any more", { calendarId: orphaned });
+		return orphaned;
 	} catch (error) {
-		if (isGoogleApiError(error) && error.status === 412) return { kind: "conflict" };
-		throw error;
+		log.warn("google", "could not release the deleted collection's calendar sync token", { error: String(error) });
+		return null;
 	}
 }
-/** Create, recovering from the one 409 that is provably safe to recover from.
+/** Every declaring collection, grouped by the calendar it reads. */
+async function declaringGroups(workspaceRoot) {
+	return groupByCalendar((await discoverCollections({ workspaceRoot })).filter((collection) => collection.schema.googleCalendar));
+}
+/** Whether a background sync of these groups may run at all.
 *
-*  A 409 means the id is taken, which is USUALLY a previous push whose baseline
-*  never landed. It can also be an unrelated event that happens to hold this id,
-*  so the recovery never writes: it adopts the baseline only when the remote
-*  event already equals what this record would write, and otherwise reports the
-*  fix. Patching whatever answered the 409 would let a push modify a stranger's
-*  event (Codex review).
+*  Authoring the collection before linking the account is an expected state,
+*  not a failure. Checking once here keeps it a quiet skip instead of an
+*  access-token throw per calendar, every hour, until the user links (#2188).
+*  A user-triggered sync answers differently — it says so out loud.
 *
-*  Refusal is not a dead end — a Sync writes both the record and its baseline,
-*  after which the record pushes normally. */
-async function createOrAdopt(ctx, eventId, record) {
-	try {
-		return await createFromRecord(ctx, eventId, record);
+*  Deliberately not phrased as a per-host state: the link lives in
+*  `~/.config/mulmo`, which carries no app name, so every host on the machine
+*  shares one answer. Reading it as "linked on this host only" is what made the
+*  calendar look implicitly exclusive when it never was (#2678). */
+async function backgroundSyncAllowed(groups) {
+	if (groups.size === 0) return false;
+	if (await isGoogleLinked()) return true;
+	log.info("google", "skipping calendar sync — no Google account linked", { calendars: groups.size });
+	return false;
+}
+/** Run each group, isolating failures per calendar — one unreachable calendar
+*  (or a revoked grant) must not stop the others. `mayClaim` is evaluated per
+*  calendar as it comes up, never once for the whole map: an earlier calendar's
+*  full walk takes minutes, and a decision made before it started says nothing
+*  about who holds this one now. */
+async function runCalendarGroups(groups, workspaceRoot, mayClaim = ALWAYS_CLAIM) {
+	const results = [];
+	for (const [calendarId, collections] of groups) try {
+		results.push(...await syncCalendarGroup(calendarId, collections, workspaceRoot, mayClaim));
 	} catch (error) {
-		if (!isGoogleApiError(error) || error.status !== 409) throw error;
-		const fetched = await getCalendarEvent(ctx.accessToken, {
-			calendarId: ctx.calendarId,
-			eventId
+		log.warn("google", "calendar sync failed", {
+			calendarId,
+			error: String(error)
 		});
-		if (fetched === null) throw error;
-		if (mayAdoptExisting(eventId, record, toShadowEvent(fetched.event), ctx.map, ctx.primaryKey, ctx.fields)) return {
-			kind: "unchanged",
-			event: fetched.event
-		};
-		return {
-			kind: "skipped",
-			message: `${eventId}: an event with this id already exists in Google and differs from this record — press Sync to adopt it, then push again`
-		};
+		results.push(...collections.map((collection) => ({
+			slug: collection.slug,
+			written: 0,
+			removed: 0,
+			unwritable: [],
+			errors: [String(error)]
+		})));
 	}
+	return results;
 }
-/** A 403 on a write is a permissions answer, but `googleApiError` appends the
-*  "is the API enabled for the Cloud project?" hint to every 403 — true for a
-*  disabled API, misleading here. Reached when the up-front role check could not
-*  run because the calendar is not in the user's list, which is exactly when the
-*  user needs the real reason. */
-function writeFailure(eventId, error) {
-	if (isGoogleApiError(error) && error.status === 403) return {
-		kind: "skipped",
-		message: `${eventId}: Google refused the write — you may not have permission to change events on this calendar`
-	};
-	return {
-		kind: "error",
-		message: `${eventId}: ${String(error)}`
-	};
+/** Sync every collection whose calendar is due — no host in this workspace has
+*  started one within `intervalMs` (#2678). Without that gate this walked every
+*  declaring group on every tick, so a second host registering the same task
+*  simply doubled the runs, concurrently.
+*
+*  Dueness is not decided here, only described: the guard is handed down and
+*  evaluated where the marker is written, so the answer cannot go stale between
+*  deciding and claiming (Codex review #2680). */
+async function syncDueCalendarCollections(workspaceRoot, intervalMs = DEFAULT_SYNC_INTERVAL_MS) {
+	const groups = await declaringGroups(workspaceRoot);
+	if (!await backgroundSyncAllowed(groups)) return [];
+	const windowMs = calendarSyncDueWindowMs(intervalMs);
+	return await runCalendarGroups(groups, workspaceRoot, (lastSyncedAt) => isCalendarSyncDue(lastSyncedAt, windowMs));
 }
-async function pushRecord(ctx, eventId, record) {
-	try {
-		const shadow = ctx.shadow[eventId];
-		const plan = planRecord(eventId, record, shadow, ctx.map, ctx.primaryKey, ctx.fields);
-		if (plan.kind === "unchanged") return { kind: "unchanged" };
-		if (plan.kind === "create" || shadow === void 0) return await createOrAdopt(ctx, eventId, record);
-		return await updateFromRecord(ctx, eventId, record, plan.fields, shadow);
-	} catch (error) {
-		return writeFailure(eventId, error);
-	}
+/** The groups whose calendar has never synced. A missing token IS the "created
+*  since the last sync" signal — nothing else distinguishes a new collection
+*  from an edited one on the write path this feeds (#2427).
+*
+*  Self-silencing by construction: the first sync stores a token, so a calendar
+*  matches at most once. `loadToken` is injected so the rule is testable without
+*  a workspace on disk. */
+async function unsyncedGroups(groups, loadToken) {
+	const checked = await Promise.all([...groups].map(async (entry) => await loadToken(entry[0]) === null ? entry : null));
+	return new Map(checked.filter((entry) => entry !== null));
 }
-/** The baseline an outcome establishes, so the next push sees the record as
-*  unchanged instead of pushing it again. Empty for anything that wrote nothing
-*  and had no baseline to repair. */
-function pushedShadow(outcomes) {
-	const written = outcomes.flatMap((outcome) => "event" in outcome && outcome.event !== void 0 ? [outcome.event] : []);
-	return Object.fromEntries(written.map((event) => [event.id, toShadowEvent(event)]));
+/** Sync only the calendars that have never synced — the first sync for a
+*  just-created collection, which otherwise stays empty until the hourly
+*  scheduler run (#2427). Cheap and safe to call on every config write. */
+async function syncNewCalendarCollections(workspaceRoot) {
+	const pending = await unsyncedGroups(await declaringGroups(workspaceRoot), (calendarId) => loadCalendarSyncToken(calendarId, workspaceRoot));
+	if (!await backgroundSyncAllowed(pending)) return [];
+	log.info("google", "running the first sync for newly declared calendars", { calendars: [...pending.keys()] });
+	return await runCalendarGroups(pending, workspaceRoot);
 }
-function tally(slug, outcomes, localDeletes) {
-	const count = (kind) => outcomes.filter((outcome) => outcome.kind === kind).length;
+var liveManualSyncDeps = {
+	loadGroups: declaringGroups,
+	isLinked: isGoogleLinked,
+	runGroups: runCalendarGroups
+};
+/** Sync the calendar ONE collection reads, on demand (the Refresh button).
+*
+*  Deliberately syncs the whole group, not just `slug`: the sync token is keyed
+*  by calendar, so consuming a window for one collection would leave the others
+*  on that calendar reading an already-consumed one. Returns every result of the
+*  group so the caller can report the requested slug's own counts.
+*
+*  "Does this collection sync at all" is answered BEFORE "is Google linked":
+*  telling someone to link their account for a collection that never declared a
+*  calendar sends them fixing the wrong thing. */
+async function syncCalendarForCollection(slug, workspaceRoot, deps = liveManualSyncDeps) {
+	const owning = [...await deps.loadGroups(workspaceRoot)].filter(([, collections]) => collections.some((collection) => collection.slug === slug));
+	if (owning.length === 0) return { kind: "not-a-calendar" };
+	if (!await deps.isLinked()) return { kind: "not-linked" };
 	return {
-		slug,
-		created: count("created"),
-		updated: count("updated"),
-		conflicts: count("conflict"),
-		localDeletes,
-		skipped: outcomes.flatMap((outcome) => outcome.kind === "skipped" ? [outcome.message] : []),
-		errors: outcomes.flatMap((outcome) => outcome.kind === "error" ? [outcome.message] : [])
+		kind: "synced",
+		results: await deps.runGroups(new Map(owning), workspaceRoot)
 	};
 }
-async function pushNow(collection, workspaceRoot, deps) {
-	const { schema, slug } = collection;
-	const calendarId = schema.googleCalendar?.calendarId;
-	const accessToken = await deps.accessToken();
-	const meta = await deps.calendarMeta(accessToken, calendarId);
-	if (isDeniedAccessRole(meta.accessRole)) return {
-		kind: "read-only",
-		accessRole: meta.accessRole ?? ""
-	};
-	const map = pushableMap(schema.googleCalendar?.map ?? {});
-	const shadow = await loadCalendarShadow(calendarId, workspaceRoot);
-	const records = await storeFor(collection, { workspaceRoot }).list();
-	const ctx = {
-		accessToken,
-		calendarId,
-		timeZone: meta.timeZone,
-		map,
-		bySource: bySourceField(map),
-		primaryKey: schema.primaryKey,
-		fields: schema.fields,
-		shadow
-	};
-	const outcomes = [];
-	for (const record of records) {
-		const outcome = await pushRecord(ctx, fieldText(record[schema.primaryKey]), record);
-		outcomes.push(outcome);
-		await saveCalendarShadow(calendarId, pushedShadow([outcome]), workspaceRoot);
-	}
-	const result = tally(slug, outcomes, locallyDeletedIds(shadow, records.map((record) => fieldText(record[schema.primaryKey]))).length);
-	if (result.errors.length > 0) log.warn("google", "calendar push finished with errors", {
-		slug,
-		errors: result.errors.length
-	});
-	return {
-		kind: "pushed",
-		result
-	};
+/** The interval this task is scheduled on right now. A non-interval schedule
+*  cannot be reached — the factory below builds an interval one — but the type
+*  allows it, so it falls back rather than asserting. */
+function scheduledIntervalMs(task) {
+	return task.schedule.type === SCHEDULE_TYPES.interval ? task.schedule.intervalMs : DEFAULT_SYNC_INTERVAL_MS;
 }
-/** Push ONE collection's records to the calendar it declares.
+/** Scheduler registration, shaped like `feedRefreshTaskDef` so hosts wire it
+*  with a single line.
 *
-*  "Does this collection sync at all" is answered before "is Google linked", for
-*  the reason `syncCalendarForCollection` gives: telling someone to link their
-*  account for a collection that never declared a calendar sends them fixing the
-*  wrong thing. */
-async function pushCalendarForCollection(slug, workspaceRoot, deps = liveDeps) {
-	try {
-		const collection = await deps.findCollection(slug, workspaceRoot);
-		if (collection === null) return { kind: "not-a-calendar" };
-		if (!await deps.isLinked()) return { kind: "not-linked" };
-		return await withCalendarLock(collection.schema.googleCalendar?.calendarId, () => pushNow(collection, workspaceRoot, deps));
-	} catch (error) {
-		log.warn("google", "calendar push could not start", {
-			slug,
-			error: String(error)
-		});
-		return {
-			kind: "failed",
-			message: String(error)
-		};
-	}
+*  `run` reads the interval back off the definition instead of closing over the
+*  option: a host rewrites `schedule` from its own overrides file AFTER this
+*  returns, and the due window has to follow it. Frozen at the default, a
+*  shortened interval would tick often and skip nearly every tick. */
+function googleCalendarSyncTaskDef(opts) {
+	const def = {
+		id: GOOGLE_CALENDAR_SYNC_TASK_ID,
+		name: "Google Calendar sync",
+		description: "Pulls changed Google Calendar events into any collection declaring `googleCalendar`, without invoking the LLM.",
+		schedule: {
+			type: SCHEDULE_TYPES.interval,
+			intervalMs: opts?.intervalMs ?? DEFAULT_SYNC_INTERVAL_MS
+		},
+		missedRunPolicy: MISSED_RUN_POLICIES.runOnce,
+		run: () => syncDueCalendarCollections(opts?.workspaceRoot ?? getWorkspaceRoot(), scheduledIntervalMs(def)).then(() => {})
+	};
+	return def;
 }
 //#endregion
 //#region src/google/tasks.ts
@@ -2005,6 +2437,6 @@ async function deleteDriveFile(accessToken, input) {
 	await googleRequest(DRIVE_API_LABEL, accessToken, `${DRIVE_FILES_URL}/${encodeURIComponent(input.fileId)}`, { method: "DELETE" });
 }
 //#endregion
-export { CANCELLED_EVENT_STATUS, DEFAULT_LIST_MAX_RESULTS, GOOGLE_AUTH_CANCELLED, GOOGLE_CALENDARLIST_SCOPE, GOOGLE_CALENDAR_SCOPE, GOOGLE_CALENDAR_SYNC_TASK_ID, GOOGLE_DRIVE_FILE_SCOPE, GOOGLE_SCOPES, GOOGLE_TASKS_SCOPE, GoogleApiError, HTTP_CONFLICT, HTTP_FORBIDDEN, HTTP_PRECONDITION_FAILED, MAX_LIST_RESULTS, PUSHABLE_SOURCE_FIELDS, anySyncedCollectionSurvives, assertSafeMimeType, authorizeGoogle, baselineRecord, brokerBaseUrl, brokerExchange, brokerRefresh, brokerStart, buildEventPatch, buildMultipartBody, buildTaskPatch, bySourceField, calendarApiError, calendarPushStatePath, calendarSyncStatePath, canonicalCalendarId, canonicalTaskListId, classifyDelete, classifyWrite, clearCalendarShadow, clearCalendarSyncToken, clientSecretPresence, collectCalendarPages, commitLinkedTokens, completeTask, configureGoogleHost, conflictingFields, createCalendarEvent, createDriveFile, createGoogleAuthFlow, createTask, deleteCalendarEvent, deleteDriveFile, deleteGoogleTokens, deleteTask, fieldText, findClientSecretPath, getCalendar, getCalendarColors, getCalendarEvent, getGoogleAccessToken, googleApiError, googleAuthFlow, googleCalendarSyncTaskDef, googleConfigDir, googleSecretsDir, googleTokenPath, groupByCalendar, isClientSettableEventId, isDeniedAccessRole, isGoogleApiError, isIsoDateTimeWithOffset, isTextMimeType, legacyGoogleTokenPath, listCalendarEvents, listCalendars, listDriveFiles, listTaskLists, listTasks, loadCalendarShadow, loadCalendarSyncToken, loadClientSecret, loadGoogleTokens, locallyChangedFields, locallyDeletedIds, mayAdoptExisting, mergeGoogleTokens, mergeShadow, orphanedCalendarId, pickBoundary, planRecord, pushCalendarForCollection, pushableMap, readDriveFile, releaseOrphanedCalendarToken, resolveEventSpan, saveCalendarShadow, saveCalendarSyncToken, saveGoogleTokens, shadowUpdates, syncCalendarEvents, syncCalendarForCollection, syncCalendarGroup, syncDueCalendarCollections, syncNewCalendarCollections, toCalendarSummary, toCollectionDateTime, toCollectionRecord, toDriveFileSummary, toEventSummary, toGoogleEventTime, toShadowEvent, toTaskListSummary, toTaskSummary, uncompleteTask, unlinkGoogle, unsyncedGroups, updateCalendarEvent, updateTask, waitForAuthCode, withCalendarLock, withKeyedLock, zoneSuffixOf };
+export { CANCELLED_EVENT_STATUS, DEFAULT_LIST_MAX_RESULTS, GOOGLE_AUTH_CANCELLED, GOOGLE_CALENDARLIST_SCOPE, GOOGLE_CALENDAR_SCOPE, GOOGLE_CALENDAR_SYNC_TASK_ID, GOOGLE_DRIVE_FILE_SCOPE, GOOGLE_SCOPES, GOOGLE_TASKS_SCOPE, GoogleApiError, HTTP_CONFLICT, HTTP_FORBIDDEN, HTTP_PRECONDITION_FAILED, MAX_LIST_RESULTS, PROTECTION_UNKNOWN, PUSHABLE_SOURCE_FIELDS, allUnpushed, anySyncedCollectionSurvives, assertSafeMimeType, authorizeGoogle, baselineRecord, brokerBaseUrl, brokerExchange, brokerRefresh, brokerStart, buildEventPatch, buildMultipartBody, buildTaskPatch, bySourceField, calendarApiError, calendarPushStatePath, calendarSyncDueWindowMs, calendarSyncStatePath, canonicalCalendarId, canonicalTaskListId, claimCalendarSyncIfDue, classifyDelete, classifyWrite, clearCalendarLastSyncedAt, clearCalendarShadow, clearCalendarSyncToken, clientSecretPresence, collectCalendarPages, commitLinkedTokens, completeTask, configureGoogleHost, conflictingFields, createCalendarEvent, createDriveFile, createGoogleAuthFlow, createTask, deleteCalendarEvent, deleteDriveFile, deleteGoogleTokens, deleteTask, fieldText, findClientSecretPath, getCalendar, getCalendarColors, getCalendarEvent, getGoogleAccessToken, googleApiError, googleAuthFlow, googleCalendarSyncTaskDef, googleConfigDir, googleSecretsDir, googleTokenPath, groupByCalendar, isCalendarSyncDue, isClientSettableEventId, isDeniedAccessRole, isGoogleApiError, isIsoDateTimeWithOffset, isTextMimeType, isUnpushed, legacyGoogleTokenPath, listCalendarEvents, listCalendars, listDriveFiles, listTaskLists, listTasks, loadCalendarLastSyncedAt, loadCalendarShadow, loadCalendarSyncToken, loadClientSecret, loadGoogleTokens, locallyChangedFields, locallyDeletedIds, locallyEditedIds, mayAdoptExisting, mergeGoogleTokens, mergeIntoExisting, mergeShadow, orphanedCalendarId, pickBoundary, planRecord, pullableEvents, pushCalendarForCollection, pushCollectionNow, pushableMap, readDriveFile, releaseOrphanedCalendarToken, resolveEventSpan, saveCalendarShadow, saveCalendarSyncToken, saveGoogleTokens, shadowUpdates, syncCalendarEvents, syncCalendarForCollection, syncCalendarGroup, syncDueCalendarCollections, syncNewCalendarCollections, toCalendarSummary, toCollectionDateTime, toCollectionRecord, toDriveFileSummary, toEventSummary, toGoogleEventTime, toShadowEvent, toTaskListSummary, toTaskSummary, uncompleteTask, unlinkGoogle, unpushedFor, unsentLocalEdits, unsyncedGroups, updateCalendarEvent, updateTask, waitForAuthCode, withCalendarLock, withKeyedLock, zoneSuffixOf };
 
 //# sourceMappingURL=index.js.map