@mulmoclaude/core 1.12.0 → 1.14.0

package/dist/google/index.js

@@ -1,13 +1,14 @@
-import { t as errorMessage } from "../dist-Cwk0e12G.js";
+import { i as hasStringProp, t as errorMessage } from "../dist-D8zokgGo.js";
 import { t as truncate } from "../text-CjDbP2O1.js";
 import { t as writeFileAtomic } from "../atomic-DPpdrJzO.js";
 import { fetchWithTimeout } from "../utils/fetch.js";
-import { l as parseIsoDate, u as parseIsoDateTime } from "../calendarGrid-CrGxeCOG.js";
-import { J as getWorkspaceRoot, d as storeFor, et as createForwardingLogger, n as discoverCollections, tt as createHostSlot } from "../discovery-B4CZvrXR.js";
+import { l as parseIsoDate, u as parseIsoDateTime } from "../calendarGrid-DivcNKkX.js";
+import { t as mergeIntoExisting } from "../project-B0j_Vf_Q.js";
+import { J as getWorkspaceRoot, d as storeFor, et as createForwardingLogger, n as discoverCollections, tt as createHostSlot } from "../discovery-D6p4ITNR.js";
 import { promises } from "node:fs";
 import path, { join } from "node:path";
-import { randomBytes } from "node:crypto";
-import { constants, copyFile, mkdir, readFile, readdir, rm, stat } from "node:fs/promises";
+import { randomBytes, randomUUID } from "node:crypto";
+import { constants, copyFile, mkdir, open, readFile, readdir, rm, stat, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { MISSED_RUN_POLICIES, SCHEDULE_TYPES } from "@receptron/task-scheduler";
 import http from "node:http";
@@ -588,6 +589,7 @@ var CALENDAR_LIST_PAGE_SIZE = 250;
 var MAX_CALENDAR_LIST_PAGES = 40;
 var EVENT_SYNC_PAGE_SIZE = 2500;
 var MAX_EVENT_SYNC_PAGES = 200;
+var CALENDAR_META_PAGE_SIZE = 1;
 var HTTP_GONE = 410;
 var EVENT_ABSENT_STATUSES = [404, HTTP_GONE];
 /** An `If-Match` write whose etag no longer matches — someone else changed the
@@ -799,20 +801,34 @@ async function collectCalendarPages(fetchPage, maxPages = MAX_CALENDAR_LIST_PAGE
 	}
 	return calendars;
 }
-/** The calendars the user has added/subscribed to (primary + secondary +
-*  shared), each with its id, name and colour, following pagination. Needs the
-*  calendar-list read scope (GOOGLE_CALENDARLIST_SCOPE). */
-/** One calendar's own resource, addressed by id rather than looked up in the
-*  user's list.
+var toCalendarMeta = (value) => {
+	const record = asRecord(value);
+	return {
+		timeZone: stringField(record, "timeZone"),
+		accessRole: stringField(record, "accessRole")
+	};
+};
+/** One calendar's zone and the caller's role on it, read by id rather than
+*  looked up in the user's list.
 *
 *  `calendarList` only holds calendars the user has ADDED; a calendar shared
-*  with them can be readable and writable by id without appearing there. This is
-*  how a push learns such a calendar's `timeZone`. Note the resource carries no
-*  `accessRole` — that is a calendarList property — so reachability here says
-*  nothing about writability. */
-async function getCalendar(accessToken, calendarId) {
-	return toCalendarSummary(await googleRequest(CALENDAR_API_LABEL, accessToken, `${CALENDAR_BASE_URL}/calendars/${encodeURIComponent(canonicalCalendarId(calendarId))}`));
+*  with them can be readable and writable by id without appearing there, and a
+*  push still needs its zone to send an offset-less `dateTime`.
+*
+*  Deliberately `events.list` and NOT `calendars.get`: the latter takes only
+*  full-calendar scopes (`calendar`, `calendar.readonly`, `calendar.calendars*`)
+*  and this app asks for none of them, so it answers 403 for every account it
+*  links (#2735). The events list carries the same `timeZone` — plus the
+*  `accessRole` the calendar resource does not have — under `calendar.events`,
+*  which the push already holds because it writes with it. Only the envelope is
+*  read; the one event asked for is the smallest page Google will serve. */
+async function getCalendarMeta(accessToken, calendarId) {
+	const params = new URLSearchParams({ maxResults: String(CALENDAR_META_PAGE_SIZE) });
+	return toCalendarMeta(await googleRequest(CALENDAR_API_LABEL, accessToken, `${eventsUrl(calendarId)}?${params.toString()}`));
 }
+/** The calendars the user has added/subscribed to (primary + secondary +
+*  shared), each with its id, name and colour, following pagination. Needs the
+*  calendar-list read scope (GOOGLE_CALENDARLIST_SCOPE). */
 async function listCalendars(accessToken) {
 	return collectCalendarPages(async (pageToken) => {
 		const params = new URLSearchParams({ maxResults: String(CALENDAR_LIST_PAGE_SIZE) });
@@ -834,6 +850,159 @@ async function getCalendarColors(accessToken) {
 	};
 }
 //#endregion
+//#region src/google/calendarStateLock.ts
+var LOCK_MODE = 384;
+/** How long a lock may sit untouched before another process may reclaim it.
+*
+*  Sized against the HOLD time, which is one read plus one atomic write — a few
+*  milliseconds. Generous by three orders of magnitude so a slow disk never
+*  looks like a crash, while a host that died mid-write blocks the others for
+*  at most this long. */
+var LOCK_STALE_MS = 1e4;
+/** How long a caller waits before giving up and proceeding unlocked. */
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MS = 20;
+var liveLockClock = {
+	now: () => Date.now(),
+	sleep: (delay_ms) => new Promise((resolve) => setTimeout(resolve, delay_ms))
+};
+var isEexist = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+/** The file's bytes, or null when it is not there. */
+async function readLockRaw(lockPath) {
+	try {
+		return await readFile(lockPath, "utf-8");
+	} catch {
+		return null;
+	}
+}
+/** Absent means unheld; UNREADABLE does not — see `stealIfStale`. */
+function parseLock(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		return hasStringProp(parsed, "holder") ? { holder: parsed.holder } : null;
+	} catch {
+		return null;
+	}
+}
+async function readLock(lockPath) {
+	const raw = await readLockRaw(lockPath);
+	return raw === null ? null : parseLock(raw);
+}
+/** Take the lock, or answer false because someone else holds a live one. */
+async function tryAcquire(lockPath, holder) {
+	try {
+		const handle = await open(lockPath, "wx", LOCK_MODE);
+		try {
+			await handle.writeFile(JSON.stringify({ holder }));
+		} finally {
+			await handle.close();
+		}
+		return true;
+	} catch (error) {
+		if (!isEexist(error)) throw error;
+		return false;
+	}
+}
+/** How long this lock has existed, per the filesystem that holds it.
+*
+*  From mtime rather than anything the holder wrote down, and for every lock
+*  rather than only the unreadable ones. A timestamp written by one host and
+*  compared against another host's clock is two wall clocks pretending to be
+*  one: skew either way reclaims a live lock or immortalises a dead one (Codex
+*  review #2690). Every host reading this workspace sees the SAME mtime.
+*
+*  This still assumes the reader's clock and the filesystem's are within a TTL
+*  of each other — true by construction on a local disk, and a sub-second NTP
+*  question on a network mount, against a window of ten seconds.
+*
+*  Reading mtime also covers the moment `open("wx")` has created the file but
+*  its payload has not landed yet: "unreadable" is a state every healthy lock
+*  passes through, and one being born reads as newborn rather than dead.
+*
+*  Null when the file is gone, which is not an age but an absence. */
+async function lockAgeMs(lockPath, clock) {
+	const stamped = await stat(lockPath).catch(() => null);
+	return stamped === null ? null : clock.now() - stamped.mtimeMs;
+}
+/** Drop a lock that has sat untouched past the TTL, whatever it says.
+*
+*  Readable or not, nothing is reclaimed until it is demonstrably stale. For a
+*  readable one the holder is re-read and compared before the unlink, so a
+*  holder that renewed in between is not evicted. That narrows the window
+*  rather than closing it — two processes can still both decide to clear the
+*  same corpse. The cost of losing that race is one lost update, which is what
+*  this file reduces rather than a new failure, and reaching it takes a host
+*  dying mid-write plus a full TTL of waiting. */
+async function stealIfStale(lockPath, clock) {
+	const raw = await readLockRaw(lockPath);
+	if (raw === null) return;
+	const held = parseLock(raw);
+	const age_ms = await lockAgeMs(lockPath, clock);
+	if (age_ms === null || age_ms < LOCK_STALE_MS) return;
+	if (held === null) {
+		log.warn("google", "reclaiming an unreadable calendar state lock", {
+			lockPath,
+			age_ms
+		});
+		await unlink(lockPath).catch(() => void 0);
+		return;
+	}
+	if ((await readLock(lockPath))?.holder !== held.holder) return;
+	log.warn("google", "reclaiming a calendar state lock whose holder went quiet", {
+		lockPath,
+		age_ms
+	});
+	await unlink(lockPath).catch(() => void 0);
+}
+async function release(lockPath, holder) {
+	if ((await readLock(lockPath))?.holder !== holder) return;
+	await unlink(lockPath).catch(() => void 0);
+}
+/** Run `mutate` with no other process mutating the same file.
+*
+*  Fails OPEN. A workspace that cannot create the lock file — a read-only
+*  mount, a missing directory, an exhausted disk — still syncs, the way it did
+*  before #2679; the lock removes a race, it is not a precondition for
+*  correctness. The same applies to waiting the timeout out: proceeding
+*  unlocked risks the lost update this exists to prevent, whereas refusing
+*  would stop the sync outright.
+*
+*  Note what this cannot promise. `O_EXCL` is atomic on a local filesystem and
+*  on NFSv3+, but a workspace living in a consumer sync folder (Dropbox,
+*  iCloud, Drive) has no such guarantee — there the file is replicated after
+*  the fact and both hosts believe they hold it. */
+async function withCalendarStateLock(lockPath, mutate, clock = liveLockClock) {
+	const holder = randomUUID();
+	const deadline = clock.now() + LOCK_WAIT_MS;
+	let holding = false;
+	try {
+		holding = await acquireBefore(lockPath, holder, deadline, clock);
+		if (!holding) log.warn("google", "proceeding without the calendar state lock — another host is holding it", { lockPath });
+		return await mutate();
+	} finally {
+		if (holding) await release(lockPath, holder);
+	}
+}
+/** Poll until the lock is ours or the deadline passes. */
+async function acquireBefore(lockPath, holder, deadline, clock) {
+	for (;;) {
+		try {
+			if (await tryAcquire(lockPath, holder)) return true;
+			await stealIfStale(lockPath, clock);
+		} catch (error) {
+			log.warn("google", "could not take the calendar state lock — mutating without it", {
+				lockPath,
+				error: String(error)
+			});
+			return false;
+		}
+		if (clock.now() >= deadline) return false;
+		await clock.sleep(LOCK_RETRY_MS);
+	}
+}
+/** `<state file>.lock`, so each state file is serialised on its own. */
+var stateLockPath = (statePath) => `${statePath}.lock`;
+//#endregion
 //#region src/google/calendarSyncStore.ts
 var SYNC_STATE_MODE = 384;
 /** `<workspace>/data/calendar/.sync-state.json` */
@@ -861,11 +1030,12 @@ var writeQueue$1 = { tail: Promise.resolve() };
 *  nothing in this process can read between the two. A `null` state skips the
 *  write; `result` is what the caller learns about the decision. */
 async function updateStateWith(decide, workspaceRoot) {
-	const run = writeQueue$1.tail.then(async () => {
+	const statePath = calendarSyncStatePath(workspaceRoot);
+	const run = writeQueue$1.tail.then(async () => await withCalendarStateLock(stateLockPath(statePath), async () => {
 		const { state, result } = decide(await readState$1(workspaceRoot));
-		if (state) await writeJsonAtomicWithMode(calendarSyncStatePath(workspaceRoot), state, SYNC_STATE_MODE);
+		if (state) await writeJsonAtomicWithMode(statePath, state, SYNC_STATE_MODE);
 		return result;
-	});
+	}));
 	writeQueue$1.tail = run.catch(() => void 0);
 	return await run;
 }
@@ -985,10 +1155,11 @@ async function readState(workspaceRoot) {
 }
 var writeQueue = { tail: Promise.resolve() };
 async function updateState(mutate, workspaceRoot) {
-	const run = writeQueue.tail.then(async () => {
+	const statePath = calendarPushStatePath(workspaceRoot);
+	const run = writeQueue.tail.then(async () => await withCalendarStateLock(stateLockPath(statePath), async () => {
 		const state = await readState(workspaceRoot);
-		await writeJsonAtomicWithMode(calendarPushStatePath(workspaceRoot), { events: mutate(state.events) }, PUSH_STATE_MODE);
-	});
+		await writeJsonAtomicWithMode(statePath, { events: mutate(state.events) }, PUSH_STATE_MODE);
+	}));
 	writeQueue.tail = run.catch(() => void 0);
 	return await run;
 }
@@ -1193,19 +1364,6 @@ function toCollectionRecord(event, map, primaryKey, fields) {
 		[primaryKey]: event.id
 	};
 }
-/** Google's mapped values laid over whatever the record already holds.
-*
-*  A record file is written whole (`writeItem`), so projecting alone would drop
-*  every column the map does not name — a collection cannot then carry a local
-*  note next to a mirrored event, because the next pull that touches that event
-*  silently deletes it. The projection still wins on the fields it covers: those
-*  are Google's to own. */
-function mergeIntoExisting(existing, projected) {
-	return {
-		...existing ?? {},
-		...projected
-	};
-}
 //#endregion
 //#region src/google/pushPlan.ts
 /** The event fields Google lets a caller write. `htmlLink` and `status` are
@@ -1220,7 +1378,7 @@ var PUSHABLE_SOURCE_FIELDS = [
 	"description",
 	"location"
 ];
-var isPushableSource = (source) => PUSHABLE_SOURCE_FIELDS.includes(source);
+var isPushableSource = (source) => PUSHABLE_SOURCE_FIELDS.some((field) => field === source);
 /** The subset of a schema's `map` a push can act on: collection field → event field. */
 function pushableMap(map) {
 	return Object.fromEntries(Object.entries(map).filter((entry) => isPushableSource(entry[1])));
@@ -1342,21 +1500,28 @@ function locallyDeletedIds(shadow, presentIds) {
 var WRITABLE_ACCESS_ROLES = ["owner", "writer"];
 /** Whether to refuse the whole push before touching a single event.
 *
-*  Only on POSITIVE evidence of a non-writable role. An unlisted calendar is
-*  unknown and must fall through: hard-denying it would block the feature
-*  outright for a calendar the user can in fact write to. Those attempts surface
-*  Google's own 403 per record if the write really is not allowed. */
+*  Only on POSITIVE evidence of a non-writable role. A calendar whose role
+*  neither source reported is unknown and must fall through: hard-denying it
+*  would block the feature outright for a calendar the user can in fact write
+*  to. Those attempts surface Google's own 403 per record if the write really is
+*  not allowed. */
 var isDeniedAccessRole = (accessRole) => accessRole !== null && !WRITABLE_ACCESS_ROLES.includes(accessRole);
+/** A role Google left blank is UNKNOWN, not a denial. `isDeniedAccessRole`
+*  refuses every role it does not recognise — `""` included — so passing an
+*  unreported one straight through would refuse a calendar Google simply said
+*  nothing about. */
+var reportedAccessRole = (accessRole) => accessRole || null;
 /** Resolve the calendar a schema names, for its writability and its timezone.
 *
-*  The list is consulted first because only it reports `accessRole`, which is
-*  what lets a read-only calendar be refused with the real reason instead of an
-*  opaque per-event 403. `"primary"` is matched on the `primary` flag, not the
-*  id — the primary calendar's own id is the account's email address, which never
-*  equals the literal the schema declares.
+*  The list is consulted first because it answers for every added calendar in
+*  one call the push already makes. `"primary"` is matched on the `primary`
+*  flag, not the id — the primary calendar's own id is the account's email
+*  address, which never equals the literal the schema declares.
 *
-*  A calendar absent from the list is NOT denied: it is fetched by id for its
-*  timezone and its role left unknown. A 404 there means the calendar really is
+*  A calendar absent from the list is NOT denied: `calendarList` holds only the
+*  calendars the user has added, so one shared with write access can be missing
+*  from it (Codex review). It is asked about itself instead, which reports the
+*  same zone AND the real role. A 404 there means the calendar is genuinely
 *  unreachable, and propagates as a `failed` outcome. */
 async function liveCalendarMeta(accessToken, calendarId) {
 	const key = canonicalCalendarId(calendarId);
@@ -1366,10 +1531,13 @@ async function liveCalendarMeta(accessToken, calendarId) {
 		accessRole: listed.accessRole,
 		timeZone: listed.timeZone
 	};
-	const direct = await getCalendar(accessToken, calendarId);
-	log.info("google", "calendar is not in the user's list — pushing without an up-front role check", { calendarId: key });
+	const direct = await getCalendarMeta(accessToken, calendarId);
+	log.info("google", "calendar is not in the user's list — role read from the calendar itself", {
+		calendarId: key,
+		accessRole: direct.accessRole
+	});
 	return {
-		accessRole: null,
+		accessRole: reportedAccessRole(direct.accessRole),
 		timeZone: direct.timeZone
 	};
 }
@@ -1483,15 +1651,23 @@ function buildPatch(ctx, record, changed, shadow) {
 		}
 	};
 }
+/** Google has dropped the event this record mirrors.
+*
+*  The advice used to be "sync first, then re-create it", which sent people
+*  nowhere: Google never resends a cancellation, so a sync sees nothing to do —
+*  and before #2688 the sync that DID see it deleted the record along with the
+*  edit. Deliberately silent on whether Google will hand the id back; that is
+*  unverified. */
+var goneFromGoogle = (eventId) => ({
+	kind: "skipped",
+	message: `${eventId}: Google no longer has this event, and your local edit was kept. Delete this record, or copy it into a new one.`
+});
 async function updateFromRecord(ctx, eventId, record, changed, shadow) {
 	const fetched = await getCalendarEvent(ctx.accessToken, {
 		calendarId: ctx.calendarId,
 		eventId
 	});
-	if (fetched === null || fetched.event.status === "cancelled") return {
-		kind: "skipped",
-		message: `${eventId}: the event no longer exists in Google — sync first, then re-create it`
-	};
+	if (fetched === null || fetched.event.status === "cancelled") return goneFromGoogle(eventId);
 	if (conflictingFields(shadow, toShadowEvent(fetched.event), changed).length > 0) return { kind: "conflict" };
 	const built = buildPatch(ctx, record, changed, shadow);
 	if (!built.ok) return {
@@ -1546,9 +1722,9 @@ async function createOrAdopt(ctx, eventId, record) {
 }
 /** A 403 on a write is a permissions answer, but `googleApiError` appends the
 *  "is the API enabled for the Cloud project?" hint to every 403 — true for a
-*  disabled API, misleading here. Reached when the up-front role check could not
-*  run because the calendar is not in the user's list, which is exactly when the
-*  user needs the real reason. */
+*  disabled API, misleading here. Reached when the up-front gate let the push
+*  through on an unknown role, which is exactly when the user needs the real
+*  reason. */
 function writeFailure(eventId, error) {
 	if (isGoogleApiError(error) && error.status === 403) return {
 		kind: "skipped",
@@ -1719,7 +1895,42 @@ function classifyDelete(eventId, kind) {
 		message: `delete ${eventId}: ${kind}`
 	};
 }
-async function applyEvent(collection, event, workspaceRoot) {
+/** Whether this record still says what the workspace last saw Google say.
+*
+*  Compared against the baseline as it stood when this run STARTED READING, not
+*  as it stands now: a full re-walk clears the baseline before writing a new one
+*  (`restartFullSync`), so reading it live would answer "no baseline" for every
+*  event and protect nothing exactly when the window is widest (#2684).
+*
+*  A record with no baseline at all is NOT withheld — that is an event this
+*  workspace has never held, so there is no local edit to lose. */
+function unsentEditGuard(schema, baseline) {
+	const map = pushableMap(schema.googleCalendar?.map ?? {});
+	return (existing, eventId) => {
+		const shadow = baseline[eventId];
+		if (shadow === void 0) return false;
+		return locallyChangedFields(existing, baselineRecord(eventId, shadow, map, schema.primaryKey, schema.fields), map).length > 0;
+	};
+}
+/** What the pull may do to the record behind one event.
+*
+*  The guard runs BEFORE the status is consulted, and that order is the whole
+*  fix: "is there something local to lose here?" outranks "what did Google do
+*  to it?". Asking about the status first is how a cancellation kept deleting
+*  records that held an edit Google had never seen (#2688), long after the
+*  same guard had been put in front of the overwrite (#2684). */
+function applyPlanFor(existing, event, hasUnsentEdit) {
+	if (existing !== null && hasUnsentEdit(existing, event.id)) return "withhold";
+	return event.status === "cancelled" ? "delete" : "write";
+}
+/** Lay Google's mapped values over whatever the record already holds. Split out
+*  so `applyEvent` reads as read → decide → act rather than carrying the write
+*  itself (CodeRabbit review #2689). */
+async function writeProjected(write, event, schema, existing) {
+	const record = toCollectionRecord(event, schema.googleCalendar?.map ?? {}, schema.primaryKey, schema.fields);
+	return classifyWrite(event.id, (await write(event.id, mergeIntoExisting(existing, record))).kind);
+}
+async function applyEvent(collection, event, workspaceRoot, hasUnsentEdit) {
 	const { schema } = collection;
 	try {
 		const store = storeFor(collection, { workspaceRoot });
@@ -1727,13 +1938,11 @@ async function applyEvent(collection, event, workspaceRoot) {
 			kind: "unwritable",
 			message: `collection '${collection.slug}' is read-only`
 		};
-		if (event.status === "cancelled") {
-			const deleted = await store.delete(event.id);
-			return classifyDelete(event.id, deleted.kind);
-		}
-		const record = toCollectionRecord(event, schema.googleCalendar?.map ?? {}, schema.primaryKey, schema.fields);
-		const written = await store.write(event.id, mergeIntoExisting(await store.read(event.id), record));
-		return classifyWrite(event.id, written.kind);
+		const existing = await store.read(event.id);
+		const plan = applyPlanFor(existing, event, hasUnsentEdit);
+		if (plan === "withhold") return { kind: "withheld" };
+		if (plan === "delete") return classifyDelete(event.id, (await store.delete(event.id)).kind);
+		return await writeProjected(store.write, event, schema, existing);
 	} catch (error) {
 		return {
 			kind: "error",
@@ -1784,15 +1993,15 @@ var NOTHING_UNPUSHED = /* @__PURE__ */ new Set();
 *  protection — would overwrite the very edits this exists to protect; the read
 *  that failed is no evidence that the pull's own writes would fail too, so they
 *  would land (CodeRabbit review #2666). */
-var PROTECTION_UNKNOWN = "could not work out which records to protect after a failed push";
-/** What ONE collection's pull must leave alone: only what ITS OWN push failed to
+var PROTECTION_UNKNOWN = "could not work out which records to protect from the pull";
+/** What ONE collection's pull must leave alone: only what ITS OWN push did not
 *  send.
 *
-*  Scoped per collection because a calendar can back several of them, and a
-*  conflict in one says nothing about the others. Sharing one set across the
-*  group starved a collection that never even declares `autoPush`: it cannot
-*  conflict, yet a neighbour's conflict froze its records — and the sync token
-*  still advanced, so Google never resent them (Codex review #2666). */
+*  Scoped per collection because a calendar can back several of them, and one
+*  collection's unsent edit says nothing about the others. Sharing one set across
+*  the group starved a collection that never even declares `autoPush`: a
+*  neighbour's conflict froze its records — and the sync token still advanced, so
+*  Google never resent them (Codex review #2666). */
 var unpushedFor = (unpushed, slug) => {
 	const protection = unpushed.get(slug);
 	return protection === void 0 ? NOTHING_UNPUSHED : protection;
@@ -1817,16 +2026,19 @@ var allUnpushed = (unpushed) => new Set([...unpushed.values()].flatMap((ids) =>
 *  feature exists to prevent: a calendar whose role degrades to reader refuses
 *  the whole push, yet the pull still runs — reading needs no write access — and
 *  overwrote every unsent local edit while advancing its baseline past it, so the
-*  next push could not even report the conflict (CodeRabbit review #2666).
+*  next push could not even report the conflict (CodeRabbit review #2666). A
+*  collection that never declares `autoPush` is in that same state on every
+*  single run, which is how the loss reappeared without a failure in sight
+*  (#2683).
 *
 *  Protects the edited records rather than all of them, so an unchanged record
 *  keeps syncing normally. `null` when even that could not be worked out — the
 *  caller then refuses to pull the collection at all, because failing open here
 *  destroys exactly what this protects. */
-async function protectUnsentEdits(collection, workspaceRoot) {
+async function protectUnsentEdits(collection, workspaceRoot, deps) {
 	try {
-		const edited = await unsentLocalEdits(collection, workspaceRoot);
-		if (edited.length > 0) log.warn("google", "protecting local edits a failed push could not send", {
+		const edited = await deps.unsentEdits(collection, workspaceRoot);
+		if (edited.length > 0) log.warn("google", "protecting local edits that have not reached Google", {
 			slug: collection.slug,
 			edited
 		});
@@ -1839,8 +2051,18 @@ async function protectUnsentEdits(collection, workspaceRoot) {
 		return null;
 	}
 }
-/** Push every `autoPush` collection in this group, and answer with the records
-*  whose local edit did not reach Google, keyed by collection.
+var livePullProtectionDeps = {
+	pushNow: pushCollectionNow,
+	unsentEdits: unsentLocalEdits
+};
+/** What ONE collection's pull must leave alone, pushing it first if it asked to
+*  be pushed.
+*
+*  A collection WITHOUT `autoPush` never pushes, so its local edits are unsent by
+*  definition — the same state a failed push leaves behind, and it needs the same
+*  protection. Pulling over them destroys the edit AND advances the baseline past
+*  it, after which no conflict can be detected any more (#2683). "The push did not
+*  run" is the condition that matters here; why it did not run is not.
 *
 *  MUST run inside the calendar lock the caller already holds — hence
 *  `pushCollectionNow` rather than `pushCalendarForCollection`, which would take
@@ -1848,27 +2070,31 @@ async function protectUnsentEdits(collection, workspaceRoot) {
 *
 *  A failed push must not stop the pull: the pull is what keeps the collection
 *  fresh, and a revoked write grant is no reason to freeze reading. */
-async function pushAutoCollections(collections, workspaceRoot) {
-	const unpushed = /* @__PURE__ */ new Map();
-	for (const collection of collections.filter((entry) => entry.schema.googleCalendar?.autoPush)) try {
-		const outcome = await pushCollectionNow(collection, workspaceRoot);
+async function pullProtectionFor(collection, workspaceRoot, deps = livePullProtectionDeps) {
+	if (!collection.schema.googleCalendar?.autoPush) return await protectUnsentEdits(collection, workspaceRoot, deps);
+	try {
+		const outcome = await deps.pushNow(collection, workspaceRoot);
 		if (outcome.kind === "pushed") {
 			reportAutoPush(collection.slug, outcome.result);
-			unpushed.set(collection.slug, new Set(outcome.result.unpushedIds));
-			continue;
+			return new Set(outcome.result.unpushedIds);
 		}
 		log.warn("google", "auto push did not run", {
 			slug: collection.slug,
 			reason: outcome.kind
 		});
-		unpushed.set(collection.slug, await protectUnsentEdits(collection, workspaceRoot));
 	} catch (error) {
 		log.warn("google", "auto push failed — pulling anyway", {
 			slug: collection.slug,
 			error: String(error)
 		});
-		unpushed.set(collection.slug, await protectUnsentEdits(collection, workspaceRoot));
 	}
+	return await protectUnsentEdits(collection, workspaceRoot, deps);
+}
+/** Push the `autoPush` collections in this group, and answer with what every
+*  collection's pull must leave alone, keyed by collection. */
+async function pushAndProtect(collections, workspaceRoot, deps = livePullProtectionDeps) {
+	const unpushed = /* @__PURE__ */ new Map();
+	for (const collection of collections) unpushed.set(collection.slug, await pullProtectionFor(collection, workspaceRoot, deps));
 	return unpushed;
 }
 async function restartFullSync(accessToken, calendarId, workspaceRoot) {
@@ -1945,17 +2171,26 @@ async function releaseCalendarSyncClaim(calendarId, workspaceRoot) {
 		});
 	}
 }
+/** Every event whose baseline must NOT advance: what the push could not send,
+*  plus what the apply refused to overwrite.
+*
+*  The two must agree exactly. The apply's refusals only became visible after it
+*  ran, so they join the union here rather than at push time — leaving them out
+*  would advance the baseline past a record the pull deliberately left holding a
+*  local edit, which is the silent overwrite this whole path exists to stop. */
+var heldBack = (unpushed, results) => /* @__PURE__ */ new Set([...allUnpushed(unpushed), ...results.flatMap((result) => result.withheld)]);
 async function syncCalendarGroupNow(calendarId, collections, workspaceRoot) {
-	const unpushed = await pushAutoCollections(collections, workspaceRoot);
+	const unpushed = await pushAndProtect(collections, workspaceRoot);
+	const baseline = await loadCalendarShadow(calendarId, workspaceRoot);
 	const accessToken = await getGoogleAccessToken();
 	const first = await syncCalendarEvents(accessToken, {
 		calendarId,
 		syncToken: await loadCalendarSyncToken(calendarId, workspaceRoot) ?? void 0
 	});
 	const result = first.fullResyncRequired ? await restartFullSync(accessToken, calendarId, workspaceRoot) : first;
-	const results = await applyWindowToGroup(collections, result.events, workspaceRoot, unpushed);
+	const results = await applyWindowToGroup(collections, result.events, workspaceRoot, unpushed, baseline);
 	if (windowFullyLanded(calendarId, results)) {
-		await saveCalendarShadow(calendarId, shadowUpdates(result.events, allUnpushed(unpushed)), workspaceRoot);
+		await saveCalendarShadow(calendarId, shadowUpdates(result.events, heldBack(unpushed, results), baseline), workspaceRoot);
 		if (result.nextSyncToken) await advanceToken(calendarId, result.nextSyncToken, collections, workspaceRoot);
 	}
 	return results;
@@ -1964,7 +2199,7 @@ async function syncCalendarGroupNow(calendarId, collections, workspaceRoot) {
 *  one's own push protected. A collection whose protection could not be worked
 *  out is not pulled at all — it reports a retryable error instead, which holds
 *  the token and the baseline back for the whole group. */
-async function applyWindowToGroup(collections, events, workspaceRoot, unpushed) {
+async function applyWindowToGroup(collections, events, workspaceRoot, unpushed, baseline) {
 	const results = [];
 	for (const collection of collections) {
 		const protection = unpushedFor(unpushed, collection.slug);
@@ -1973,8 +2208,9 @@ async function applyWindowToGroup(collections, events, workspaceRoot, unpushed)
 			written: 0,
 			removed: 0,
 			unwritable: [],
+			withheld: [],
 			errors: [PROTECTION_UNKNOWN]
-		} : await applyEventsToCollection(collection, events, workspaceRoot, protection));
+		} : await applyEventsToCollection(collection, events, workspaceRoot, protection, baseline));
 	}
 	return results;
 }
@@ -1991,6 +2227,11 @@ function windowFullyLanded(calendarId, results) {
 		slug: entry.slug,
 		unwritable: entry.unwritable
 	}));
+	results.filter((entry) => entry.withheld.length > 0).forEach((entry) => log.warn("google", "leaving calendar records alone — they hold edits Google has not seen", {
+		calendarId,
+		slug: entry.slug,
+		withheld: entry.withheld
+	}));
 	const failed = results.filter((entry) => entry.errors.length > 0);
 	failed.forEach((entry) => log.warn("google", "holding back calendar sync token after failed writes", {
 		calendarId,
@@ -2007,10 +2248,20 @@ function windowFullyLanded(calendarId, results) {
 *  keeps the local one would make the next push read a plain one-sided edit —
 *  no conflict to detect any more — and quietly overwrite Google. Held back, the
 *  baseline stays older than both sides, so the conflict keeps being reported
-*  until someone resolves it (#2620). */
-function shadowUpdates(events, unpushed = /* @__PURE__ */ new Set()) {
-	const carried = pullableEvents(events, unpushed);
-	return Object.fromEntries(carried.map((event) => [event.id, event.status === "cancelled" ? null : toShadowEvent(event)]));
+*  until someone resolves it (#2620).
+*
+*  `held` carries what those events must KEEP. Omitting them is enough on an
+*  incremental run, where the file is merged rather than replaced — but a full
+*  re-walk CLEARS the baseline first (`restartFullSync`), and there omission
+*  drops the entry for good. The next push would then read a conflicted record
+*  as a brand-new create, hit Google's duplicate-id 409 and refuse it, instead
+*  of reporting the conflict it actually is. Re-stating the pre-run value makes
+*  a held-back event behave the same either way (observed during Claude review;
+*  no bot flagged it). */
+function shadowUpdates(events, unpushed = /* @__PURE__ */ new Set(), held = {}) {
+	const advanced = pullableEvents(events, unpushed).map((event) => [event.id, event.status === "cancelled" ? null : toShadowEvent(event)]);
+	const kept = [...unpushed].flatMap((eventId) => held[eventId] === void 0 ? [] : [[eventId, held[eventId]]]);
+	return Object.fromEntries([...kept, ...advanced]);
 }
 /** Save the window's token unless every collection that consumed it was deleted
 *  while the sync was in flight.
@@ -2043,13 +2294,19 @@ async function pathExists(absPath) {
 async function anySyncedCollectionSurvives(collections, exists = pathExists) {
 	return (await Promise.all(collections.map((collection) => exists(collection.skillDir)))).some(Boolean);
 }
-async function applyEventsToCollection(collection, events, workspaceRoot, unpushed) {
-	const outcomes = [];
-	for (const event of pullableEvents(events, unpushed)) outcomes.push(await applyEvent(collection, event, workspaceRoot));
+async function applyEventsToCollection(collection, events, workspaceRoot, unpushed, baseline) {
+	const hasUnsentEdit = unsentEditGuard(collection.schema, baseline);
+	const attempts = [];
+	for (const event of pullableEvents(events, unpushed)) attempts.push({
+		eventId: event.id,
+		outcome: await applyEvent(collection, event, workspaceRoot, hasUnsentEdit)
+	});
+	const outcomes = attempts.map((attempt) => attempt.outcome);
 	return {
 		slug: collection.slug,
 		written: outcomes.filter((outcome) => outcome.kind === "written").length,
 		removed: outcomes.filter((outcome) => outcome.kind === "removed").length,
+		withheld: attempts.flatMap((attempt) => attempt.outcome.kind === "withheld" ? [attempt.eventId] : []),
 		unwritable: outcomes.flatMap((outcome) => outcome.kind === "unwritable" ? [outcome.message] : []),
 		errors: outcomes.flatMap((outcome) => outcome.kind === "error" ? [outcome.message] : [])
 	};
@@ -2152,6 +2409,7 @@ async function runCalendarGroups(groups, workspaceRoot, mayClaim = ALWAYS_CLAIM)
 			written: 0,
 			removed: 0,
 			unwritable: [],
+			withheld: [],
 			errors: [String(error)]
 		})));
 	}
@@ -2437,6 +2695,6 @@ async function deleteDriveFile(accessToken, input) {
 	await googleRequest(DRIVE_API_LABEL, accessToken, `${DRIVE_FILES_URL}/${encodeURIComponent(input.fileId)}`, { method: "DELETE" });
 }
 //#endregion
-export { CANCELLED_EVENT_STATUS, DEFAULT_LIST_MAX_RESULTS, GOOGLE_AUTH_CANCELLED, GOOGLE_CALENDARLIST_SCOPE, GOOGLE_CALENDAR_SCOPE, GOOGLE_CALENDAR_SYNC_TASK_ID, GOOGLE_DRIVE_FILE_SCOPE, GOOGLE_SCOPES, GOOGLE_TASKS_SCOPE, GoogleApiError, HTTP_CONFLICT, HTTP_FORBIDDEN, HTTP_PRECONDITION_FAILED, MAX_LIST_RESULTS, PROTECTION_UNKNOWN, PUSHABLE_SOURCE_FIELDS, allUnpushed, anySyncedCollectionSurvives, assertSafeMimeType, authorizeGoogle, baselineRecord, brokerBaseUrl, brokerExchange, brokerRefresh, brokerStart, buildEventPatch, buildMultipartBody, buildTaskPatch, bySourceField, calendarApiError, calendarPushStatePath, calendarSyncDueWindowMs, calendarSyncStatePath, canonicalCalendarId, canonicalTaskListId, claimCalendarSyncIfDue, classifyDelete, classifyWrite, clearCalendarLastSyncedAt, clearCalendarShadow, clearCalendarSyncToken, clientSecretPresence, collectCalendarPages, commitLinkedTokens, completeTask, configureGoogleHost, conflictingFields, createCalendarEvent, createDriveFile, createGoogleAuthFlow, createTask, deleteCalendarEvent, deleteDriveFile, deleteGoogleTokens, deleteTask, fieldText, findClientSecretPath, getCalendar, getCalendarColors, getCalendarEvent, getGoogleAccessToken, googleApiError, googleAuthFlow, googleCalendarSyncTaskDef, googleConfigDir, googleSecretsDir, googleTokenPath, groupByCalendar, isCalendarSyncDue, isClientSettableEventId, isDeniedAccessRole, isGoogleApiError, isIsoDateTimeWithOffset, isTextMimeType, isUnpushed, legacyGoogleTokenPath, listCalendarEvents, listCalendars, listDriveFiles, listTaskLists, listTasks, loadCalendarLastSyncedAt, loadCalendarShadow, loadCalendarSyncToken, loadClientSecret, loadGoogleTokens, locallyChangedFields, locallyDeletedIds, locallyEditedIds, mayAdoptExisting, mergeGoogleTokens, mergeIntoExisting, mergeShadow, orphanedCalendarId, pickBoundary, planRecord, pullableEvents, pushCalendarForCollection, pushCollectionNow, pushableMap, readDriveFile, releaseOrphanedCalendarToken, resolveEventSpan, saveCalendarShadow, saveCalendarSyncToken, saveGoogleTokens, shadowUpdates, syncCalendarEvents, syncCalendarForCollection, syncCalendarGroup, syncDueCalendarCollections, syncNewCalendarCollections, toCalendarSummary, toCollectionDateTime, toCollectionRecord, toDriveFileSummary, toEventSummary, toGoogleEventTime, toShadowEvent, toTaskListSummary, toTaskSummary, uncompleteTask, unlinkGoogle, unpushedFor, unsentLocalEdits, unsyncedGroups, updateCalendarEvent, updateTask, waitForAuthCode, withCalendarLock, withKeyedLock, zoneSuffixOf };
+export { CANCELLED_EVENT_STATUS, DEFAULT_LIST_MAX_RESULTS, GOOGLE_AUTH_CANCELLED, GOOGLE_CALENDARLIST_SCOPE, GOOGLE_CALENDAR_SCOPE, GOOGLE_CALENDAR_SYNC_TASK_ID, GOOGLE_DRIVE_FILE_SCOPE, GOOGLE_SCOPES, GOOGLE_TASKS_SCOPE, GoogleApiError, HTTP_CONFLICT, HTTP_FORBIDDEN, HTTP_PRECONDITION_FAILED, MAX_LIST_RESULTS, PROTECTION_UNKNOWN, PUSHABLE_SOURCE_FIELDS, allUnpushed, anySyncedCollectionSurvives, applyPlanFor, assertSafeMimeType, authorizeGoogle, baselineRecord, brokerBaseUrl, brokerExchange, brokerRefresh, brokerStart, buildEventPatch, buildMultipartBody, buildTaskPatch, bySourceField, calendarApiError, calendarPushStatePath, calendarSyncDueWindowMs, calendarSyncStatePath, canonicalCalendarId, canonicalTaskListId, claimCalendarSyncIfDue, classifyDelete, classifyWrite, clearCalendarLastSyncedAt, clearCalendarShadow, clearCalendarSyncToken, clientSecretPresence, collectCalendarPages, commitLinkedTokens, completeTask, configureGoogleHost, conflictingFields, createCalendarEvent, createDriveFile, createGoogleAuthFlow, createTask, deleteCalendarEvent, deleteDriveFile, deleteGoogleTokens, deleteTask, fieldText, findClientSecretPath, getCalendarColors, getCalendarEvent, getCalendarMeta, getGoogleAccessToken, googleApiError, googleAuthFlow, googleCalendarSyncTaskDef, googleConfigDir, googleSecretsDir, googleTokenPath, groupByCalendar, heldBack, isCalendarSyncDue, isClientSettableEventId, isDeniedAccessRole, isGoogleApiError, isIsoDateTimeWithOffset, isTextMimeType, isUnpushed, legacyGoogleTokenPath, listCalendarEvents, listCalendars, listDriveFiles, listTaskLists, listTasks, liveLockClock, loadCalendarLastSyncedAt, loadCalendarShadow, loadCalendarSyncToken, loadClientSecret, loadGoogleTokens, locallyChangedFields, locallyDeletedIds, locallyEditedIds, mayAdoptExisting, mergeGoogleTokens, mergeIntoExisting, mergeShadow, orphanedCalendarId, pickBoundary, planRecord, pullProtectionFor, pullableEvents, pushAndProtect, pushCalendarForCollection, pushCollectionNow, pushableMap, readDriveFile, releaseOrphanedCalendarToken, reportedAccessRole, resolveEventSpan, saveCalendarShadow, saveCalendarSyncToken, saveGoogleTokens, shadowUpdates, stateLockPath, syncCalendarEvents, syncCalendarForCollection, syncCalendarGroup, syncDueCalendarCollections, syncNewCalendarCollections, toCalendarMeta, toCalendarSummary, toCollectionDateTime, toCollectionRecord, toDriveFileSummary, toEventSummary, toGoogleEventTime, toShadowEvent, toTaskListSummary, toTaskSummary, uncompleteTask, unlinkGoogle, unpushedFor, unsentEditGuard, unsentLocalEdits, unsyncedGroups, updateCalendarEvent, updateTask, waitForAuthCode, withCalendarLock, withCalendarStateLock, withKeyedLock, zoneSuffixOf };
 
 //# sourceMappingURL=index.js.map