@mulmoclaude/core 1.11.0 → 1.13.0

package/dist/google/index.cjs

@@ -1,11 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("../rolldown-runtime-D6vf50IK.cjs");
-const require_dist = require("../dist-pWpC-b04.cjs");
+const require_dist = require("../dist-21pMsI1a.cjs");
 const require_text = require("../text-CaAh9ZSO.cjs");
 const require_atomic = require("../atomic-C_7YpMiM.cjs");
 const require_utils_fetch = require("../utils/fetch.cjs");
 const require_calendarGrid = require("../calendarGrid-CaS9er8i.cjs");
-const require_discovery = require("../discovery-NRy3tyUA.cjs");
+const require_project = require("../project-CCtT_fQr.cjs");
+const require_discovery = require("../discovery-DAoMnBYM.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
@@ -838,6 +839,161 @@ async function getCalendarColors(accessToken) {
 	};
 }
 //#endregion
+//#region src/google/calendarStateLock.ts
+var LOCK_MODE = 384;
+/** How long a lock may sit untouched before another process may reclaim it.
+*
+*  Sized against the HOLD time, which is one read plus one atomic write — a few
+*  milliseconds. Generous by three orders of magnitude so a slow disk never
+*  looks like a crash, while a host that died mid-write blocks the others for
+*  at most this long. */
+var LOCK_STALE_MS = 1e4;
+/** How long a caller waits before giving up and proceeding unlocked. */
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MS = 20;
+var liveLockClock = {
+	now: () => Date.now(),
+	sleep: (delay_ms) => new Promise((resolve) => setTimeout(resolve, delay_ms))
+};
+var isEexist = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+/** The file's bytes, or null when it is not there. */
+async function readLockRaw(lockPath) {
+	try {
+		return await (0, node_fs_promises.readFile)(lockPath, "utf-8");
+	} catch {
+		return null;
+	}
+}
+/** Absent means unheld; UNREADABLE does not — see `stealIfStale`. */
+function parseLock(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed !== "object" || parsed === null) return null;
+		const { holder } = parsed;
+		return typeof holder === "string" ? { holder } : null;
+	} catch {
+		return null;
+	}
+}
+async function readLock(lockPath) {
+	const raw = await readLockRaw(lockPath);
+	return raw === null ? null : parseLock(raw);
+}
+/** Take the lock, or answer false because someone else holds a live one. */
+async function tryAcquire(lockPath, holder) {
+	try {
+		const handle = await (0, node_fs_promises.open)(lockPath, "wx", LOCK_MODE);
+		try {
+			await handle.writeFile(JSON.stringify({ holder }));
+		} finally {
+			await handle.close();
+		}
+		return true;
+	} catch (error) {
+		if (!isEexist(error)) throw error;
+		return false;
+	}
+}
+/** How long this lock has existed, per the filesystem that holds it.
+*
+*  From mtime rather than anything the holder wrote down, and for every lock
+*  rather than only the unreadable ones. A timestamp written by one host and
+*  compared against another host's clock is two wall clocks pretending to be
+*  one: skew either way reclaims a live lock or immortalises a dead one (Codex
+*  review #2690). Every host reading this workspace sees the SAME mtime.
+*
+*  This still assumes the reader's clock and the filesystem's are within a TTL
+*  of each other — true by construction on a local disk, and a sub-second NTP
+*  question on a network mount, against a window of ten seconds.
+*
+*  Reading mtime also covers the moment `open("wx")` has created the file but
+*  its payload has not landed yet: "unreadable" is a state every healthy lock
+*  passes through, and one being born reads as newborn rather than dead.
+*
+*  Null when the file is gone, which is not an age but an absence. */
+async function lockAgeMs(lockPath, clock) {
+	const stamped = await (0, node_fs_promises.stat)(lockPath).catch(() => null);
+	return stamped === null ? null : clock.now() - stamped.mtimeMs;
+}
+/** Drop a lock that has sat untouched past the TTL, whatever it says.
+*
+*  Readable or not, nothing is reclaimed until it is demonstrably stale. For a
+*  readable one the holder is re-read and compared before the unlink, so a
+*  holder that renewed in between is not evicted. That narrows the window
+*  rather than closing it — two processes can still both decide to clear the
+*  same corpse. The cost of losing that race is one lost update, which is what
+*  this file reduces rather than a new failure, and reaching it takes a host
+*  dying mid-write plus a full TTL of waiting. */
+async function stealIfStale(lockPath, clock) {
+	const raw = await readLockRaw(lockPath);
+	if (raw === null) return;
+	const held = parseLock(raw);
+	const age_ms = await lockAgeMs(lockPath, clock);
+	if (age_ms === null || age_ms < LOCK_STALE_MS) return;
+	if (held === null) {
+		log.warn("google", "reclaiming an unreadable calendar state lock", {
+			lockPath,
+			age_ms
+		});
+		await (0, node_fs_promises.unlink)(lockPath).catch(() => void 0);
+		return;
+	}
+	if ((await readLock(lockPath))?.holder !== held.holder) return;
+	log.warn("google", "reclaiming a calendar state lock whose holder went quiet", {
+		lockPath,
+		age_ms
+	});
+	await (0, node_fs_promises.unlink)(lockPath).catch(() => void 0);
+}
+async function release(lockPath, holder) {
+	if ((await readLock(lockPath))?.holder !== holder) return;
+	await (0, node_fs_promises.unlink)(lockPath).catch(() => void 0);
+}
+/** Run `mutate` with no other process mutating the same file.
+*
+*  Fails OPEN. A workspace that cannot create the lock file — a read-only
+*  mount, a missing directory, an exhausted disk — still syncs, the way it did
+*  before #2679; the lock removes a race, it is not a precondition for
+*  correctness. The same applies to waiting the timeout out: proceeding
+*  unlocked risks the lost update this exists to prevent, whereas refusing
+*  would stop the sync outright.
+*
+*  Note what this cannot promise. `O_EXCL` is atomic on a local filesystem and
+*  on NFSv3+, but a workspace living in a consumer sync folder (Dropbox,
+*  iCloud, Drive) has no such guarantee — there the file is replicated after
+*  the fact and both hosts believe they hold it. */
+async function withCalendarStateLock(lockPath, mutate, clock = liveLockClock) {
+	const holder = (0, node_crypto.randomUUID)();
+	const deadline = clock.now() + LOCK_WAIT_MS;
+	let holding = false;
+	try {
+		holding = await acquireBefore(lockPath, holder, deadline, clock);
+		if (!holding) log.warn("google", "proceeding without the calendar state lock — another host is holding it", { lockPath });
+		return await mutate();
+	} finally {
+		if (holding) await release(lockPath, holder);
+	}
+}
+/** Poll until the lock is ours or the deadline passes. */
+async function acquireBefore(lockPath, holder, deadline, clock) {
+	for (;;) {
+		try {
+			if (await tryAcquire(lockPath, holder)) return true;
+			await stealIfStale(lockPath, clock);
+		} catch (error) {
+			log.warn("google", "could not take the calendar state lock — mutating without it", {
+				lockPath,
+				error: String(error)
+			});
+			return false;
+		}
+		if (clock.now() >= deadline) return false;
+		await clock.sleep(LOCK_RETRY_MS);
+	}
+}
+/** `<state file>.lock`, so each state file is serialised on its own. */
+var stateLockPath = (statePath) => `${statePath}.lock`;
+//#endregion
 //#region src/google/calendarSyncStore.ts
 var SYNC_STATE_MODE = 384;
 /** `<workspace>/data/calendar/.sync-state.json` */
@@ -845,34 +1001,129 @@ function calendarSyncStatePath(workspaceRoot) {
 	return node_path.default.join(workspaceRoot ?? require_discovery.getWorkspaceRoot(), "data", "calendar", ".sync-state.json");
 }
 var calendarKey = canonicalCalendarId;
+/** Read one map out of whatever is on disk. Tolerant on purpose: a file written
+*  before `lastSyncedAt` existed simply lacks the key, and a hand-edited one may
+*  hold anything. A dropped entry costs a full re-walk or a duplicate run, never
+*  data — throwing here would stop the sync entirely. */
+function stringRecord(value) {
+	if (typeof value !== "object" || value === null) return {};
+	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
 async function readState$1(workspaceRoot) {
 	const stored = await readJsonOrNull(calendarSyncStatePath(workspaceRoot));
-	return stored?.tokens ? stored : { tokens: {} };
+	return {
+		tokens: stringRecord(stored?.tokens),
+		lastSyncedAt: stringRecord(stored?.lastSyncedAt)
+	};
 }
 var writeQueue$1 = { tail: Promise.resolve() };
-async function updateState$1(mutate, workspaceRoot) {
-	const run = writeQueue$1.tail.then(async () => {
-		const state = await readState$1(workspaceRoot);
-		await writeJsonAtomicWithMode(calendarSyncStatePath(workspaceRoot), { tokens: mutate(state.tokens) }, SYNC_STATE_MODE);
-	});
+/** Decide from the stored state and write the result, both inside the queue, so
+*  nothing in this process can read between the two. A `null` state skips the
+*  write; `result` is what the caller learns about the decision. */
+async function updateStateWith(decide, workspaceRoot) {
+	const statePath = calendarSyncStatePath(workspaceRoot);
+	const run = writeQueue$1.tail.then(async () => await withCalendarStateLock(stateLockPath(statePath), async () => {
+		const { state, result } = decide(await readState$1(workspaceRoot));
+		if (state) await writeJsonAtomicWithMode(statePath, state, SYNC_STATE_MODE);
+		return result;
+	}));
 	writeQueue$1.tail = run.catch(() => void 0);
 	return await run;
 }
+async function updateState$1(mutate, workspaceRoot) {
+	await updateStateWith((state) => ({
+		state: mutate(state),
+		result: void 0
+	}), workspaceRoot);
+}
+var withoutKey = (record, dropped) => Object.fromEntries(Object.entries(record).filter(([key]) => key !== dropped));
 async function loadCalendarSyncToken(calendarId, workspaceRoot) {
 	return (await readState$1(workspaceRoot)).tokens[calendarKey(calendarId)] ?? null;
 }
 async function saveCalendarSyncToken(calendarId, syncToken, workspaceRoot) {
 	const stored = calendarKey(calendarId);
-	await updateState$1((tokens) => ({
-		...tokens,
-		[stored]: syncToken
+	await updateState$1((state) => ({
+		...state,
+		tokens: {
+			...state.tokens,
+			[stored]: syncToken
+		}
 	}), workspaceRoot);
 }
 /** Drop one calendar's token — used when Google answers 410, so the next run
-*  starts a clean full sync. */
+*  starts a clean full sync. Leaves the sync marker alone: "restart the walk"
+*  says nothing about "nobody is running". */
 async function clearCalendarSyncToken(calendarId, workspaceRoot) {
 	const dropped = calendarKey(calendarId);
-	await updateState$1((tokens) => Object.fromEntries(Object.entries(tokens).filter(([key]) => key !== dropped)), workspaceRoot);
+	await updateState$1((state) => ({
+		...state,
+		tokens: withoutKey(state.tokens, dropped)
+	}), workspaceRoot);
+}
+async function loadCalendarLastSyncedAt(calendarId, workspaceRoot) {
+	return (await readState$1(workspaceRoot)).lastSyncedAt[calendarKey(calendarId)] ?? null;
+}
+/** Stamp when a sync of this calendar started, but only if `mayClaim` accepts
+*  what the marker currently says. Answers whether THIS call is the one that
+*  claimed it.
+*
+*  The decision and the stamp share one pass through the queue on purpose.
+*  Deciding from a snapshot read earlier — as a caller filtering a whole map of
+*  calendars up front must — leaves both hosts believing the calendar is free,
+*  which is the race this exists to close (Codex review #2680). What remains is
+*  the read→write gap BETWEEN processes; closing that needs a real file lock
+*  (#2679), and this stays a soft dedup until then.
+*
+*  The time is passed in rather than read here so the rule stays testable
+*  without freezing the clock. */
+async function claimCalendarSyncIfDue(calendarId, startedAt, mayClaim, workspaceRoot) {
+	const stored = calendarKey(calendarId);
+	return await updateStateWith((state) => {
+		const claimed = mayClaim(state.lastSyncedAt[stored] ?? null);
+		return {
+			state: claimed ? {
+				...state,
+				lastSyncedAt: {
+					...state.lastSyncedAt,
+					[stored]: startedAt
+				}
+			} : null,
+			result: claimed
+		};
+	}, workspaceRoot);
+}
+/** Drop one calendar's marker, so the next tick — on either host — may sync it
+*  immediately instead of waiting the window out. */
+async function clearCalendarLastSyncedAt(calendarId, workspaceRoot) {
+	const dropped = calendarKey(calendarId);
+	await updateState$1((state) => ({
+		...state,
+		lastSyncedAt: withoutKey(state.lastSyncedAt, dropped)
+	}), workspaceRoot);
+}
+//#endregion
+//#region src/google/calendarSyncDue.ts
+/** Slack between a tick and the marker it writes. Without it a lone host reads
+*  its OWN marker as "not due yet" — elapsed lands a hair under the interval
+*  every time — and syncs every other hour. */
+var TICK_JITTER_TOLERANCE_MS = 300 * 1e3;
+/** How long a fresh marker suppresses a sync: one interval, less the slack.
+*  The slack is halved rather than subtracted flat for a very short configured
+*  interval, where a fixed five minutes would swallow the window whole. */
+function calendarSyncDueWindowMs(intervalMs) {
+	return intervalMs - Math.min(TICK_JITTER_TOLERANCE_MS, intervalMs / 2);
+}
+/** True iff no recent enough run stands in for this one.
+*
+*  A marker that cannot be read as a time is treated as due: a stuck calendar is
+*  worse than a duplicate run, which the sync is built to tolerate anyway
+*  (writes are upserts by event id). */
+function isCalendarSyncDue(lastSyncedAt, windowMs, now = Date.now()) {
+	if (!lastSyncedAt) return true;
+	const elapsed = now - Date.parse(lastSyncedAt);
+	if (!Number.isFinite(elapsed)) return true;
+	if (elapsed < -windowMs) return true;
+	return elapsed >= windowMs;
 }
 //#endregion
 //#region src/google/calendarPushState.ts
@@ -895,10 +1146,11 @@ async function readState(workspaceRoot) {
 }
 var writeQueue = { tail: Promise.resolve() };
 async function updateState(mutate, workspaceRoot) {
-	const run = writeQueue.tail.then(async () => {
+	const statePath = calendarPushStatePath(workspaceRoot);
+	const run = writeQueue.tail.then(async () => await withCalendarStateLock(stateLockPath(statePath), async () => {
 		const state = await readState(workspaceRoot);
-		await writeJsonAtomicWithMode(calendarPushStatePath(workspaceRoot), { events: mutate(state.events) }, PUSH_STATE_MODE);
-	});
+		await writeJsonAtomicWithMode(statePath, { events: mutate(state.events) }, PUSH_STATE_MODE);
+	}));
 	writeQueue.tail = run.catch(() => void 0);
 	return await run;
 }
@@ -1103,19 +1355,6 @@ function toCollectionRecord(event, map, primaryKey, fields) {
 		[primaryKey]: event.id
 	};
 }
-/** Google's mapped values laid over whatever the record already holds.
-*
-*  A record file is written whole (`writeItem`), so projecting alone would drop
-*  every column the map does not name — a collection cannot then carry a local
-*  note next to a mirrored event, because the next pull that touches that event
-*  silently deletes it. The projection still wins on the fields it covers: those
-*  are Google's to own. */
-function mergeIntoExisting(existing, projected) {
-	return {
-		...existing ?? {},
-		...projected
-	};
-}
 //#endregion
 //#region src/google/pushPlan.ts
 /** The event fields Google lets a caller write. `htmlLink` and `status` are
@@ -1393,15 +1632,23 @@ function buildPatch(ctx, record, changed, shadow) {
 		}
 	};
 }
+/** Google has dropped the event this record mirrors.
+*
+*  The advice used to be "sync first, then re-create it", which sent people
+*  nowhere: Google never resends a cancellation, so a sync sees nothing to do —
+*  and before #2688 the sync that DID see it deleted the record along with the
+*  edit. Deliberately silent on whether Google will hand the id back; that is
+*  unverified. */
+var goneFromGoogle = (eventId) => ({
+	kind: "skipped",
+	message: `${eventId}: Google no longer has this event, and your local edit was kept. Delete this record, or copy it into a new one.`
+});
 async function updateFromRecord(ctx, eventId, record, changed, shadow) {
 	const fetched = await getCalendarEvent(ctx.accessToken, {
 		calendarId: ctx.calendarId,
 		eventId
 	});
-	if (fetched === null || fetched.event.status === "cancelled") return {
-		kind: "skipped",
-		message: `${eventId}: the event no longer exists in Google — sync first, then re-create it`
-	};
+	if (fetched === null || fetched.event.status === "cancelled") return goneFromGoogle(eventId);
 	if (conflictingFields(shadow, toShadowEvent(fetched.event), changed).length > 0) return { kind: "conflict" };
 	const built = buildPatch(ctx, record, changed, shadow);
 	if (!built.ok) return {
@@ -1629,7 +1876,42 @@ function classifyDelete(eventId, kind) {
 		message: `delete ${eventId}: ${kind}`
 	};
 }
-async function applyEvent(collection, event, workspaceRoot) {
+/** Whether this record still says what the workspace last saw Google say.
+*
+*  Compared against the baseline as it stood when this run STARTED READING, not
+*  as it stands now: a full re-walk clears the baseline before writing a new one
+*  (`restartFullSync`), so reading it live would answer "no baseline" for every
+*  event and protect nothing exactly when the window is widest (#2684).
+*
+*  A record with no baseline at all is NOT withheld — that is an event this
+*  workspace has never held, so there is no local edit to lose. */
+function unsentEditGuard(schema, baseline) {
+	const map = pushableMap(schema.googleCalendar?.map ?? {});
+	return (existing, eventId) => {
+		const shadow = baseline[eventId];
+		if (shadow === void 0) return false;
+		return locallyChangedFields(existing, baselineRecord(eventId, shadow, map, schema.primaryKey, schema.fields), map).length > 0;
+	};
+}
+/** What the pull may do to the record behind one event.
+*
+*  The guard runs BEFORE the status is consulted, and that order is the whole
+*  fix: "is there something local to lose here?" outranks "what did Google do
+*  to it?". Asking about the status first is how a cancellation kept deleting
+*  records that held an edit Google had never seen (#2688), long after the
+*  same guard had been put in front of the overwrite (#2684). */
+function applyPlanFor(existing, event, hasUnsentEdit) {
+	if (existing !== null && hasUnsentEdit(existing, event.id)) return "withhold";
+	return event.status === "cancelled" ? "delete" : "write";
+}
+/** Lay Google's mapped values over whatever the record already holds. Split out
+*  so `applyEvent` reads as read → decide → act rather than carrying the write
+*  itself (CodeRabbit review #2689). */
+async function writeProjected(write, event, schema, existing) {
+	const record = toCollectionRecord(event, schema.googleCalendar?.map ?? {}, schema.primaryKey, schema.fields);
+	return classifyWrite(event.id, (await write(event.id, require_project.mergeIntoExisting(existing, record))).kind);
+}
+async function applyEvent(collection, event, workspaceRoot, hasUnsentEdit) {
 	const { schema } = collection;
 	try {
 		const store = require_discovery.storeFor(collection, { workspaceRoot });
@@ -1637,13 +1919,11 @@ async function applyEvent(collection, event, workspaceRoot) {
 			kind: "unwritable",
 			message: `collection '${collection.slug}' is read-only`
 		};
-		if (event.status === "cancelled") {
-			const deleted = await store.delete(event.id);
-			return classifyDelete(event.id, deleted.kind);
-		}
-		const record = toCollectionRecord(event, schema.googleCalendar?.map ?? {}, schema.primaryKey, schema.fields);
-		const written = await store.write(event.id, mergeIntoExisting(await store.read(event.id), record));
-		return classifyWrite(event.id, written.kind);
+		const existing = await store.read(event.id);
+		const plan = applyPlanFor(existing, event, hasUnsentEdit);
+		if (plan === "withhold") return { kind: "withheld" };
+		if (plan === "delete") return classifyDelete(event.id, (await store.delete(event.id)).kind);
+		return await writeProjected(store.write, event, schema, existing);
 	} catch (error) {
 		return {
 			kind: "error",
@@ -1694,15 +1974,15 @@ var NOTHING_UNPUSHED = /* @__PURE__ */ new Set();
 *  protection — would overwrite the very edits this exists to protect; the read
 *  that failed is no evidence that the pull's own writes would fail too, so they
 *  would land (CodeRabbit review #2666). */
-var PROTECTION_UNKNOWN = "could not work out which records to protect after a failed push";
-/** What ONE collection's pull must leave alone: only what ITS OWN push failed to
+var PROTECTION_UNKNOWN = "could not work out which records to protect from the pull";
+/** What ONE collection's pull must leave alone: only what ITS OWN push did not
 *  send.
 *
-*  Scoped per collection because a calendar can back several of them, and a
-*  conflict in one says nothing about the others. Sharing one set across the
-*  group starved a collection that never even declares `autoPush`: it cannot
-*  conflict, yet a neighbour's conflict froze its records — and the sync token
-*  still advanced, so Google never resent them (Codex review #2666). */
+*  Scoped per collection because a calendar can back several of them, and one
+*  collection's unsent edit says nothing about the others. Sharing one set across
+*  the group starved a collection that never even declares `autoPush`: a
+*  neighbour's conflict froze its records — and the sync token still advanced, so
+*  Google never resent them (Codex review #2666). */
 var unpushedFor = (unpushed, slug) => {
 	const protection = unpushed.get(slug);
 	return protection === void 0 ? NOTHING_UNPUSHED : protection;
@@ -1727,16 +2007,19 @@ var allUnpushed = (unpushed) => new Set([...unpushed.values()].flatMap((ids) =>
 *  feature exists to prevent: a calendar whose role degrades to reader refuses
 *  the whole push, yet the pull still runs — reading needs no write access — and
 *  overwrote every unsent local edit while advancing its baseline past it, so the
-*  next push could not even report the conflict (CodeRabbit review #2666).
+*  next push could not even report the conflict (CodeRabbit review #2666). A
+*  collection that never declares `autoPush` is in that same state on every
+*  single run, which is how the loss reappeared without a failure in sight
+*  (#2683).
 *
 *  Protects the edited records rather than all of them, so an unchanged record
 *  keeps syncing normally. `null` when even that could not be worked out — the
 *  caller then refuses to pull the collection at all, because failing open here
 *  destroys exactly what this protects. */
-async function protectUnsentEdits(collection, workspaceRoot) {
+async function protectUnsentEdits(collection, workspaceRoot, deps) {
 	try {
-		const edited = await unsentLocalEdits(collection, workspaceRoot);
-		if (edited.length > 0) log.warn("google", "protecting local edits a failed push could not send", {
+		const edited = await deps.unsentEdits(collection, workspaceRoot);
+		if (edited.length > 0) log.warn("google", "protecting local edits that have not reached Google", {
 			slug: collection.slug,
 			edited
 		});
@@ -1749,8 +2032,18 @@ async function protectUnsentEdits(collection, workspaceRoot) {
 		return null;
 	}
 }
-/** Push every `autoPush` collection in this group, and answer with the records
-*  whose local edit did not reach Google, keyed by collection.
+var livePullProtectionDeps = {
+	pushNow: pushCollectionNow,
+	unsentEdits: unsentLocalEdits
+};
+/** What ONE collection's pull must leave alone, pushing it first if it asked to
+*  be pushed.
+*
+*  A collection WITHOUT `autoPush` never pushes, so its local edits are unsent by
+*  definition — the same state a failed push leaves behind, and it needs the same
+*  protection. Pulling over them destroys the edit AND advances the baseline past
+*  it, after which no conflict can be detected any more (#2683). "The push did not
+*  run" is the condition that matters here; why it did not run is not.
 *
 *  MUST run inside the calendar lock the caller already holds — hence
 *  `pushCollectionNow` rather than `pushCalendarForCollection`, which would take
@@ -1758,27 +2051,31 @@ async function protectUnsentEdits(collection, workspaceRoot) {
 *
 *  A failed push must not stop the pull: the pull is what keeps the collection
 *  fresh, and a revoked write grant is no reason to freeze reading. */
-async function pushAutoCollections(collections, workspaceRoot) {
-	const unpushed = /* @__PURE__ */ new Map();
-	for (const collection of collections.filter((entry) => entry.schema.googleCalendar?.autoPush)) try {
-		const outcome = await pushCollectionNow(collection, workspaceRoot);
+async function pullProtectionFor(collection, workspaceRoot, deps = livePullProtectionDeps) {
+	if (!collection.schema.googleCalendar?.autoPush) return await protectUnsentEdits(collection, workspaceRoot, deps);
+	try {
+		const outcome = await deps.pushNow(collection, workspaceRoot);
 		if (outcome.kind === "pushed") {
 			reportAutoPush(collection.slug, outcome.result);
-			unpushed.set(collection.slug, new Set(outcome.result.unpushedIds));
-			continue;
+			return new Set(outcome.result.unpushedIds);
 		}
 		log.warn("google", "auto push did not run", {
 			slug: collection.slug,
 			reason: outcome.kind
 		});
-		unpushed.set(collection.slug, await protectUnsentEdits(collection, workspaceRoot));
 	} catch (error) {
 		log.warn("google", "auto push failed — pulling anyway", {
 			slug: collection.slug,
 			error: String(error)
 		});
-		unpushed.set(collection.slug, await protectUnsentEdits(collection, workspaceRoot));
 	}
+	return await protectUnsentEdits(collection, workspaceRoot, deps);
+}
+/** Push the `autoPush` collections in this group, and answer with what every
+*  collection's pull must leave alone, keyed by collection. */
+async function pushAndProtect(collections, workspaceRoot, deps = livePullProtectionDeps) {
+	const unpushed = /* @__PURE__ */ new Map();
+	for (const collection of collections) unpushed.set(collection.slug, await pullProtectionFor(collection, workspaceRoot, deps));
 	return unpushed;
 }
 async function restartFullSync(accessToken, calendarId, workspaceRoot) {
@@ -1786,6 +2083,7 @@ async function restartFullSync(accessToken, calendarId, workspaceRoot) {
 	await clearCalendarShadow(calendarId, workspaceRoot);
 	return await syncCalendarEvents(accessToken, { calendarId });
 }
+var ALWAYS_CLAIM = () => true;
 /** Sync ONE calendar and fan its events out to every collection bound to it.
 *
 *  The fan-out is not an optimisation, it is correctness: the sync token is
@@ -1800,21 +2098,80 @@ async function restartFullSync(accessToken, calendarId, workspaceRoot) {
 *  load the SAME stored token and walk the same window. That is idempotent —
 *  writes are upserts by event id — but it is a wasted full walk. Queued, the
 *  second pass resumes from the token the first just stored and fetches only
-*  what is genuinely new. */
-async function syncCalendarGroup(calendarId, collections, workspaceRoot) {
-	return await withCalendarLock(calendarId, () => syncCalendarGroupNow(calendarId, collections, workspaceRoot));
+*  what is genuinely new. That queue is module state, so it orders the doors
+*  into THIS process only; `claimThenSync` is what other hosts can see. */
+async function syncCalendarGroup(calendarId, collections, workspaceRoot, mayClaim = ALWAYS_CLAIM) {
+	return await withCalendarLock(calendarId, () => claimThenSync(calendarId, collections, workspaceRoot, mayClaim));
+}
+/** Take the workspace-shared marker BEFORE the calendar is touched, sync only if
+*  this run got it, and drop it again if the run could not happen at all.
+*
+*  Claiming first is the whole point: hosts tick in the same minute (interval
+*  schedules align to wall-clock boundaries), so a marker written on completion
+*  would leave the entire run — minutes, for a first full walk — open for a
+*  second host to start alongside this one and lose the push baseline it writes.
+*
+*  Released only when the sync could not run at all. A run that finished with
+*  retryable per-collection errors KEEPS the marker: it already held the token
+*  and the baseline back, so it replays on the next tick either way, and
+*  releasing would hand a permanently-failing calendar back to both hosts at
+*  once — the very overlap this guards (observed during Claude review). */
+async function claimThenSync(calendarId, collections, workspaceRoot, mayClaim) {
+	if (!await claimCalendarSync(calendarId, workspaceRoot, mayClaim)) {
+		log.info("google", "skipping a calendar this workspace synced recently — another host may be on it", { calendarId });
+		return [];
+	}
+	try {
+		return await syncCalendarGroupNow(calendarId, collections, workspaceRoot);
+	} catch (error) {
+		await releaseCalendarSyncClaim(calendarId, workspaceRoot);
+		throw error;
+	}
+}
+/** Never throws, and fails OPEN: the marker guards against duplicate work, it is
+*  not a precondition for syncing correctly. A workspace that cannot store it
+*  syncs the way it did before #2678. */
+async function claimCalendarSync(calendarId, workspaceRoot, mayClaim) {
+	try {
+		return await claimCalendarSyncIfDue(calendarId, (/* @__PURE__ */ new Date()).toISOString(), mayClaim, workspaceRoot);
+	} catch (error) {
+		log.warn("google", "could not stamp the calendar sync marker — another host may sync this calendar in parallel", {
+			calendarId,
+			error: String(error)
+		});
+		return true;
+	}
+}
+async function releaseCalendarSyncClaim(calendarId, workspaceRoot) {
+	try {
+		await clearCalendarLastSyncedAt(calendarId, workspaceRoot);
+	} catch (error) {
+		log.warn("google", "could not release the calendar sync marker after a failed run", {
+			calendarId,
+			error: String(error)
+		});
+	}
 }
+/** Every event whose baseline must NOT advance: what the push could not send,
+*  plus what the apply refused to overwrite.
+*
+*  The two must agree exactly. The apply's refusals only became visible after it
+*  ran, so they join the union here rather than at push time — leaving them out
+*  would advance the baseline past a record the pull deliberately left holding a
+*  local edit, which is the silent overwrite this whole path exists to stop. */
+var heldBack = (unpushed, results) => /* @__PURE__ */ new Set([...allUnpushed(unpushed), ...results.flatMap((result) => result.withheld)]);
 async function syncCalendarGroupNow(calendarId, collections, workspaceRoot) {
-	const unpushed = await pushAutoCollections(collections, workspaceRoot);
+	const unpushed = await pushAndProtect(collections, workspaceRoot);
+	const baseline = await loadCalendarShadow(calendarId, workspaceRoot);
 	const accessToken = await getGoogleAccessToken();
 	const first = await syncCalendarEvents(accessToken, {
 		calendarId,
 		syncToken: await loadCalendarSyncToken(calendarId, workspaceRoot) ?? void 0
 	});
 	const result = first.fullResyncRequired ? await restartFullSync(accessToken, calendarId, workspaceRoot) : first;
-	const results = await applyWindowToGroup(collections, result.events, workspaceRoot, unpushed);
+	const results = await applyWindowToGroup(collections, result.events, workspaceRoot, unpushed, baseline);
 	if (windowFullyLanded(calendarId, results)) {
-		await saveCalendarShadow(calendarId, shadowUpdates(result.events, allUnpushed(unpushed)), workspaceRoot);
+		await saveCalendarShadow(calendarId, shadowUpdates(result.events, heldBack(unpushed, results), baseline), workspaceRoot);
 		if (result.nextSyncToken) await advanceToken(calendarId, result.nextSyncToken, collections, workspaceRoot);
 	}
 	return results;
@@ -1823,7 +2180,7 @@ async function syncCalendarGroupNow(calendarId, collections, workspaceRoot) {
 *  one's own push protected. A collection whose protection could not be worked
 *  out is not pulled at all — it reports a retryable error instead, which holds
 *  the token and the baseline back for the whole group. */
-async function applyWindowToGroup(collections, events, workspaceRoot, unpushed) {
+async function applyWindowToGroup(collections, events, workspaceRoot, unpushed, baseline) {
 	const results = [];
 	for (const collection of collections) {
 		const protection = unpushedFor(unpushed, collection.slug);
@@ -1832,8 +2189,9 @@ async function applyWindowToGroup(collections, events, workspaceRoot, unpushed)
 			written: 0,
 			removed: 0,
 			unwritable: [],
+			withheld: [],
 			errors: [PROTECTION_UNKNOWN]
-		} : await applyEventsToCollection(collection, events, workspaceRoot, protection));
+		} : await applyEventsToCollection(collection, events, workspaceRoot, protection, baseline));
 	}
 	return results;
 }
@@ -1850,6 +2208,11 @@ function windowFullyLanded(calendarId, results) {
 		slug: entry.slug,
 		unwritable: entry.unwritable
 	}));
+	results.filter((entry) => entry.withheld.length > 0).forEach((entry) => log.warn("google", "leaving calendar records alone — they hold edits Google has not seen", {
+		calendarId,
+		slug: entry.slug,
+		withheld: entry.withheld
+	}));
 	const failed = results.filter((entry) => entry.errors.length > 0);
 	failed.forEach((entry) => log.warn("google", "holding back calendar sync token after failed writes", {
 		calendarId,
@@ -1866,10 +2229,20 @@ function windowFullyLanded(calendarId, results) {
 *  keeps the local one would make the next push read a plain one-sided edit —
 *  no conflict to detect any more — and quietly overwrite Google. Held back, the
 *  baseline stays older than both sides, so the conflict keeps being reported
-*  until someone resolves it (#2620). */
-function shadowUpdates(events, unpushed = /* @__PURE__ */ new Set()) {
-	const carried = pullableEvents(events, unpushed);
-	return Object.fromEntries(carried.map((event) => [event.id, event.status === "cancelled" ? null : toShadowEvent(event)]));
+*  until someone resolves it (#2620).
+*
+*  `held` carries what those events must KEEP. Omitting them is enough on an
+*  incremental run, where the file is merged rather than replaced — but a full
+*  re-walk CLEARS the baseline first (`restartFullSync`), and there omission
+*  drops the entry for good. The next push would then read a conflicted record
+*  as a brand-new create, hit Google's duplicate-id 409 and refuse it, instead
+*  of reporting the conflict it actually is. Re-stating the pre-run value makes
+*  a held-back event behave the same either way (observed during Claude review;
+*  no bot flagged it). */
+function shadowUpdates(events, unpushed = /* @__PURE__ */ new Set(), held = {}) {
+	const advanced = pullableEvents(events, unpushed).map((event) => [event.id, event.status === "cancelled" ? null : toShadowEvent(event)]);
+	const kept = [...unpushed].flatMap((eventId) => held[eventId] === void 0 ? [] : [[eventId, held[eventId]]]);
+	return Object.fromEntries([...kept, ...advanced]);
 }
 /** Save the window's token unless every collection that consumed it was deleted
 *  while the sync was in flight.
@@ -1902,13 +2275,19 @@ async function pathExists(absPath) {
 async function anySyncedCollectionSurvives(collections, exists = pathExists) {
 	return (await Promise.all(collections.map((collection) => exists(collection.skillDir)))).some(Boolean);
 }
-async function applyEventsToCollection(collection, events, workspaceRoot, unpushed) {
-	const outcomes = [];
-	for (const event of pullableEvents(events, unpushed)) outcomes.push(await applyEvent(collection, event, workspaceRoot));
+async function applyEventsToCollection(collection, events, workspaceRoot, unpushed, baseline) {
+	const hasUnsentEdit = unsentEditGuard(collection.schema, baseline);
+	const attempts = [];
+	for (const event of pullableEvents(events, unpushed)) attempts.push({
+		eventId: event.id,
+		outcome: await applyEvent(collection, event, workspaceRoot, hasUnsentEdit)
+	});
+	const outcomes = attempts.map((attempt) => attempt.outcome);
 	return {
 		slug: collection.slug,
 		written: outcomes.filter((outcome) => outcome.kind === "written").length,
 		removed: outcomes.filter((outcome) => outcome.kind === "removed").length,
+		withheld: attempts.flatMap((attempt) => attempt.outcome.kind === "withheld" ? [attempt.eventId] : []),
 		unwritable: outcomes.flatMap((outcome) => outcome.kind === "unwritable" ? [outcome.message] : []),
 		errors: outcomes.flatMap((outcome) => outcome.kind === "error" ? [outcome.message] : [])
 	};
@@ -1963,6 +2342,7 @@ async function releaseOrphanedCalendarToken(deleted, workspaceRoot) {
 		if (orphaned === null) return null;
 		await clearCalendarSyncToken(orphaned, workspaceRoot);
 		await clearCalendarShadow(orphaned, workspaceRoot);
+		await clearCalendarLastSyncedAt(orphaned, workspaceRoot);
 		log.info("google", "cleared the sync token of a calendar no collection reads any more", { calendarId: orphaned });
 		return orphaned;
 	} catch (error) {
@@ -1979,19 +2359,27 @@ async function declaringGroups(workspaceRoot) {
 *  Authoring the collection before linking the account is an expected state,
 *  not a failure. Checking once here keeps it a quiet skip instead of an
 *  access-token throw per calendar, every hour, until the user links (#2188).
-*  A user-triggered sync answers differently — it says so out loud. */
+*  A user-triggered sync answers differently — it says so out loud.
+*
+*  Deliberately not phrased as a per-host state: the link lives in
+*  `~/.config/mulmo`, which carries no app name, so every host on the machine
+*  shares one answer. Reading it as "linked on this host only" is what made the
+*  calendar look implicitly exclusive when it never was (#2678). */
 async function backgroundSyncAllowed(groups) {
 	if (groups.size === 0) return false;
 	if (await isGoogleLinked()) return true;
-	log.info("google", "skipping calendar sync — no Google account linked on this host", { calendars: groups.size });
+	log.info("google", "skipping calendar sync — no Google account linked", { calendars: groups.size });
 	return false;
 }
 /** Run each group, isolating failures per calendar — one unreachable calendar
-*  (or a revoked grant) must not stop the others. */
-async function runCalendarGroups(groups, workspaceRoot) {
+*  (or a revoked grant) must not stop the others. `mayClaim` is evaluated per
+*  calendar as it comes up, never once for the whole map: an earlier calendar's
+*  full walk takes minutes, and a decision made before it started says nothing
+*  about who holds this one now. */
+async function runCalendarGroups(groups, workspaceRoot, mayClaim = ALWAYS_CLAIM) {
 	const results = [];
 	for (const [calendarId, collections] of groups) try {
-		results.push(...await syncCalendarGroup(calendarId, collections, workspaceRoot));
+		results.push(...await syncCalendarGroup(calendarId, collections, workspaceRoot, mayClaim));
 	} catch (error) {
 		log.warn("google", "calendar sync failed", {
 			calendarId,
@@ -2002,15 +2390,25 @@ async function runCalendarGroups(groups, workspaceRoot) {
 			written: 0,
 			removed: 0,
 			unwritable: [],
+			withheld: [],
 			errors: [String(error)]
 		})));
 	}
 	return results;
 }
-/** Sync every collection that declares `googleCalendar`. */
-async function syncDueCalendarCollections(workspaceRoot) {
+/** Sync every collection whose calendar is due — no host in this workspace has
+*  started one within `intervalMs` (#2678). Without that gate this walked every
+*  declaring group on every tick, so a second host registering the same task
+*  simply doubled the runs, concurrently.
+*
+*  Dueness is not decided here, only described: the guard is handed down and
+*  evaluated where the marker is written, so the answer cannot go stale between
+*  deciding and claiming (Codex review #2680). */
+async function syncDueCalendarCollections(workspaceRoot, intervalMs = DEFAULT_SYNC_INTERVAL_MS) {
 	const groups = await declaringGroups(workspaceRoot);
-	return await backgroundSyncAllowed(groups) ? await runCalendarGroups(groups, workspaceRoot) : [];
+	if (!await backgroundSyncAllowed(groups)) return [];
+	const windowMs = calendarSyncDueWindowMs(intervalMs);
+	return await runCalendarGroups(groups, workspaceRoot, (lastSyncedAt) => isCalendarSyncDue(lastSyncedAt, windowMs));
 }
 /** The groups whose calendar has never synced. A missing token IS the "created
 *  since the last sync" signal — nothing else distinguishes a new collection
@@ -2056,10 +2454,21 @@ async function syncCalendarForCollection(slug, workspaceRoot, deps = liveManualS
 		results: await deps.runGroups(new Map(owning), workspaceRoot)
 	};
 }
+/** The interval this task is scheduled on right now. A non-interval schedule
+*  cannot be reached — the factory below builds an interval one — but the type
+*  allows it, so it falls back rather than asserting. */
+function scheduledIntervalMs(task) {
+	return task.schedule.type === _receptron_task_scheduler.SCHEDULE_TYPES.interval ? task.schedule.intervalMs : DEFAULT_SYNC_INTERVAL_MS;
+}
 /** Scheduler registration, shaped like `feedRefreshTaskDef` so hosts wire it
-*  with a single line. */
+*  with a single line.
+*
+*  `run` reads the interval back off the definition instead of closing over the
+*  option: a host rewrites `schedule` from its own overrides file AFTER this
+*  returns, and the due window has to follow it. Frozen at the default, a
+*  shortened interval would tick often and skip nearly every tick. */
 function googleCalendarSyncTaskDef(opts) {
-	return {
+	const def = {
 		id: GOOGLE_CALENDAR_SYNC_TASK_ID,
 		name: "Google Calendar sync",
 		description: "Pulls changed Google Calendar events into any collection declaring `googleCalendar`, without invoking the LLM.",
@@ -2068,8 +2477,9 @@ function googleCalendarSyncTaskDef(opts) {
 			intervalMs: opts?.intervalMs ?? DEFAULT_SYNC_INTERVAL_MS
 		},
 		missedRunPolicy: _receptron_task_scheduler.MISSED_RUN_POLICIES.runOnce,
-		run: () => syncDueCalendarCollections(opts?.workspaceRoot ?? require_discovery.getWorkspaceRoot()).then(() => {})
+		run: () => syncDueCalendarCollections(opts?.workspaceRoot ?? require_discovery.getWorkspaceRoot(), scheduledIntervalMs(def)).then(() => {})
 	};
+	return def;
 }
 //#endregion
 //#region src/google/tasks.ts
@@ -2284,6 +2694,7 @@ exports.PROTECTION_UNKNOWN = PROTECTION_UNKNOWN;
 exports.PUSHABLE_SOURCE_FIELDS = PUSHABLE_SOURCE_FIELDS;
 exports.allUnpushed = allUnpushed;
 exports.anySyncedCollectionSurvives = anySyncedCollectionSurvives;
+exports.applyPlanFor = applyPlanFor;
 exports.assertSafeMimeType = assertSafeMimeType;
 exports.authorizeGoogle = authorizeGoogle;
 exports.baselineRecord = baselineRecord;
@@ -2297,11 +2708,14 @@ exports.buildTaskPatch = buildTaskPatch;
 exports.bySourceField = bySourceField;
 exports.calendarApiError = calendarApiError;
 exports.calendarPushStatePath = calendarPushStatePath;
+exports.calendarSyncDueWindowMs = calendarSyncDueWindowMs;
 exports.calendarSyncStatePath = calendarSyncStatePath;
 exports.canonicalCalendarId = canonicalCalendarId;
 exports.canonicalTaskListId = canonicalTaskListId;
+exports.claimCalendarSyncIfDue = claimCalendarSyncIfDue;
 exports.classifyDelete = classifyDelete;
 exports.classifyWrite = classifyWrite;
+exports.clearCalendarLastSyncedAt = clearCalendarLastSyncedAt;
 exports.clearCalendarShadow = clearCalendarShadow;
 exports.clearCalendarSyncToken = clearCalendarSyncToken;
 exports.clientSecretPresence = clientSecretPresence;
@@ -2331,6 +2745,8 @@ exports.googleConfigDir = googleConfigDir;
 exports.googleSecretsDir = googleSecretsDir;
 exports.googleTokenPath = googleTokenPath;
 exports.groupByCalendar = groupByCalendar;
+exports.heldBack = heldBack;
+exports.isCalendarSyncDue = isCalendarSyncDue;
 exports.isClientSettableEventId = isClientSettableEventId;
 exports.isDeniedAccessRole = isDeniedAccessRole;
 exports.isGoogleApiError = isGoogleApiError;
@@ -2343,6 +2759,8 @@ exports.listCalendars = listCalendars;
 exports.listDriveFiles = listDriveFiles;
 exports.listTaskLists = listTaskLists;
 exports.listTasks = listTasks;
+exports.liveLockClock = liveLockClock;
+exports.loadCalendarLastSyncedAt = loadCalendarLastSyncedAt;
 exports.loadCalendarShadow = loadCalendarShadow;
 exports.loadCalendarSyncToken = loadCalendarSyncToken;
 exports.loadClientSecret = loadClientSecret;
@@ -2352,12 +2770,14 @@ exports.locallyDeletedIds = locallyDeletedIds;
 exports.locallyEditedIds = locallyEditedIds;
 exports.mayAdoptExisting = mayAdoptExisting;
 exports.mergeGoogleTokens = mergeGoogleTokens;
-exports.mergeIntoExisting = mergeIntoExisting;
+exports.mergeIntoExisting = require_project.mergeIntoExisting;
 exports.mergeShadow = mergeShadow;
 exports.orphanedCalendarId = orphanedCalendarId;
 exports.pickBoundary = pickBoundary;
 exports.planRecord = planRecord;
+exports.pullProtectionFor = pullProtectionFor;
 exports.pullableEvents = pullableEvents;
+exports.pushAndProtect = pushAndProtect;
 exports.pushCalendarForCollection = pushCalendarForCollection;
 exports.pushCollectionNow = pushCollectionNow;
 exports.pushableMap = pushableMap;
@@ -2368,6 +2788,7 @@ exports.saveCalendarShadow = saveCalendarShadow;
 exports.saveCalendarSyncToken = saveCalendarSyncToken;
 exports.saveGoogleTokens = saveGoogleTokens;
 exports.shadowUpdates = shadowUpdates;
+exports.stateLockPath = stateLockPath;
 exports.syncCalendarEvents = syncCalendarEvents;
 exports.syncCalendarForCollection = syncCalendarForCollection;
 exports.syncCalendarGroup = syncCalendarGroup;
@@ -2385,12 +2806,14 @@ exports.toTaskSummary = toTaskSummary;
 exports.uncompleteTask = uncompleteTask;
 exports.unlinkGoogle = unlinkGoogle;
 exports.unpushedFor = unpushedFor;
+exports.unsentEditGuard = unsentEditGuard;
 exports.unsentLocalEdits = unsentLocalEdits;
 exports.unsyncedGroups = unsyncedGroups;
 exports.updateCalendarEvent = updateCalendarEvent;
 exports.updateTask = updateTask;
 exports.waitForAuthCode = waitForAuthCode;
 exports.withCalendarLock = withCalendarLock;
+exports.withCalendarStateLock = withCalendarStateLock;
 exports.withKeyedLock = withKeyedLock;
 exports.zoneSuffixOf = zoneSuffixOf;