@rubytech/create-maxy-code 0.1.475 → 0.1.477

package/payload/platform/plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js

@@ -1,11 +1,13 @@
 /**
  * Dispatcher script: reconcile-bookings
  *
- * Self-contained, like check-due-events. Pulls accepted booking rows from each
+ * Self-contained, like check-due-events. Pulls eligible booking rows from each
  * account's Cloudflare D1 `bookings` table (written by the booking site's Pages
- * Function), writes each into Neo4j as a :Meeting so it appears on the admin
- * calendar, links the booker as a :Person, and notifies the admin. Marks each
- * row swept so it reconciles exactly once. Ends with the standing audit.
+ * Function), claims the ones with no :Meeting in the graph, writes each into
+ * Neo4j as a :Meeting so it appears on the admin calendar, links the booker as
+ * a :Person, and notifies the admin. A row is claimed on the absence of its
+ * meeting, not on a flag, so a meeting that later goes missing self-heals.
+ * Ends with the standing audit over that same population.
  *
  * Task 1654 — for each booking-site account it also create-only provisions the
  * recurring connector-sync :Event (the admin turn that reads the calendar connector
@@ -22,13 +24,14 @@
  *   PLATFORM_ROOT=... NEO4J_URI=... node dist/scripts/reconcile-bookings.js
  */
 import neo4j from "neo4j-driver";
-import { spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { readFileSync, writeFileSync, existsSync, unlinkSync, mkdirSync, readdirSync } from "node:fs";
 import { resolve, join } from "node:path";
 import { homedir } from "node:os";
-import { reconcileOne, auditCounts, ensureConnectorSyncEvent, countPublishedConflicts } from "../lib/booking-reconcile.js";
+import { reconcileOne, auditCounts, ensureConnectorSyncEvent, classifyPublishedDrift, fetchBookingMeetingUids, selectUnreconciled, ELIGIBLE_BOOKING_SELECT, BOOKING_SCHEMA_MIGRATION, isMissingColumnError, isDuplicateColumnError, planBlockWrites, BLOCK_ROWS_SELECT, BLOCK_ROW_INSERT, BLOCK_ROW_DELETE, blockInsertParams, } from "../lib/booking-reconcile.js";
+import { detectCalendarConnectors, resolveDispatchDestination, shouldEmitProvisionLine, provisionSignature, emitLabel, readProvisionState, writeProvisionState, } from "../lib/connector-sync-provision.js";
 import { notifyBooking } from "../lib/booking-notify.js";
-import { buildD1Command } from "../lib/d1-command.js";
+import { createD1Client } from "../lib/d1-command.js";
 import { resolveHouseScopedToken } from "../lib/house-scoped-token.js";
 function resolveConfigDir() {
     const platformRoot = process.env.PLATFORM_ROOT;
@@ -44,6 +47,39 @@ function resolveConfigDir() {
 }
 const CONFIG_DIR = resolve(homedir(), resolveConfigDir());
 const LOCK_FILE = resolve(CONFIG_DIR, "reconcile-bookings.lock");
+// Task 1809 — the per-account connector-sync provisioning outcome, persisted so
+// a permanent condition is reported on change plus this heartbeat rather than
+// once per tick. Six hours over a 120 s tick turns 2,880 lines a day per
+// account into four.
+const PROVISION_STATE_FILE = resolve(CONFIG_DIR, "cal-sync-provision-state.json");
+const PROVISION_HEARTBEAT_MS = 6 * 60 * 60 * 1000;
+// Task 1806/1807 — which accounts have completed the bookings schema migration.
+// Written only after all three statements succeed, so a partial migration is
+// retried on the next tick. Gating on the read failing instead would not retry:
+// once the ALTERs land the read succeeds, the missing-column trigger never fires
+// again, and a backfill that failed leaves every block row eligible — which the
+// sweep would then reconcile into a meeting.
+const SCHEMA_STATE_FILE = resolve(CONFIG_DIR, "booking-schema-migrated.json");
+function hasCompletedSchemaMigration(accountId) {
+    try {
+        const state = JSON.parse(readFileSync(SCHEMA_STATE_FILE, "utf-8"));
+        return typeof state[accountId] === "string";
+    }
+    catch {
+        return false; // absent or unreadable — migrate, which is safe to re-run
+    }
+}
+function markSchemaMigrated(accountId) {
+    let state = {};
+    try {
+        state = JSON.parse(readFileSync(SCHEMA_STATE_FILE, "utf-8"));
+    }
+    catch {
+        /* first account, or unreadable — start a fresh map */
+    }
+    state[accountId] = new Date().toISOString();
+    writeFileSync(SCHEMA_STATE_FILE, JSON.stringify(state, null, 2));
+}
 function acquireLock() {
     mkdirSync(CONFIG_DIR, { recursive: true });
     if (existsSync(LOCK_FILE)) {
@@ -91,7 +127,13 @@ function connectNeo4j() {
     return neo4j.driver(uri, neo4j.auth.basic(user, password));
 }
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/** Read `KEY=value` pairs from a secrets env file without polluting process.env. */
+/** Read `KEY=value` pairs from a secrets env file without polluting process.env.
+ *
+ *  Values are trimmed, matching the sibling reader in house-scoped-token.ts. The
+ *  split is on "\n", so a CRLF file leaves a trailing "\r" on every value; since
+ *  Task 1805 these values reach Cloudflare as a URL path segment and a Bearer
+ *  header rather than as a child process env, where a stray "\r" fails as an
+ *  opaque invalid-header error instead of anything nameable. */
 function readEnvFile(path) {
     const out = {};
     if (!existsSync(path))
@@ -99,41 +141,15 @@ function readEnvFile(path) {
     for (const line of readFileSync(path, "utf-8").split("\n")) {
         const m = line.match(/^([A-Z0-9_]+)=(.*)$/);
         if (m)
-            out[m[1]] = m[2];
+            out[m[1]] = m[2].trim();
     }
     return out;
 }
-/** First registered admin WhatsApp phone for this account, or null. Provisioning
- *  skips (observably) when no admin destination exists to dispatch the sync to. */
-function readAdminPhone(accountDir) {
-    try {
-        const cfg = JSON.parse(readFileSync(join(accountDir, "account.json"), "utf-8"));
-        const phones = Array.isArray(cfg.adminPhones) ? cfg.adminPhones : [];
-        return typeof phones[0] === "string" && phones[0].length > 0 ? phones[0] : null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Run a D1 SQL statement via wrangler with the per-scope token. Returns parsed rows. */
-function d1Query(dbName, sql, env) {
-    const { command, args } = buildD1Command(dbName, sql);
-    const res = spawnSync(command, args, {
-        env: { ...process.env, ...env },
-        encoding: "utf-8",
-        maxBuffer: 16 * 1024 * 1024,
-        // Bound each call so a stalled wrangler/network cannot wedge the whole
-        // run (which would hold the PID lock and silently stall reconcile).
-        timeout: 60_000,
-    });
-    if (res.status !== 0) {
-        throw new Error(`wrangler d1 execute failed (status ${res.status}${res.signal ? `, signal ${res.signal}` : ""})`);
-    }
-    // wrangler --json prints an array of result objects, each with a `results` array.
-    const parsed = JSON.parse(res.stdout || "[]");
-    const first = Array.isArray(parsed) ? parsed[0] : parsed;
-    return (first && Array.isArray(first.results) ? first.results : []);
-}
+// Task 1809 — `readAdminPhone` lived here. It read a top-level `account.json`
+// `adminPhones` key that exists on no account (the authoritative key is
+// `whatsapp.adminPhones`), and gated provisioning on the result, so every tick
+// on every brand logged `skipped` and nothing was ever provisioned. Both the
+// field path and the gate now live in connector-sync-provision.ts.
 /** Resolve an email sender from the sibling email plugin, defensively. */
 async function resolveEmailNotify(accountId) {
     const platformRoot = process.env.PLATFORM_ROOT;
@@ -163,7 +179,25 @@ async function resolveEmailNotify(accountId) {
         return {};
     }
 }
-async function reconcileAccount(driver, accountId, accountDir, houseToken, houseAccountId) {
+/**
+ * Bring an already-provisioned bookings table up to the schema the sweep needs.
+ * Each statement tolerates "duplicate column name" on its own, so a table that
+ * already has one of the two columns completes rather than aborting.
+ */
+async function migrateBookingSchema(d1, dbName, accountId) {
+    for (const sql of BOOKING_SCHEMA_MIGRATION) {
+        try {
+            await d1.query(dbName, sql);
+        }
+        catch (err) {
+            if (isDuplicateColumnError(err.message))
+                continue;
+            throw err;
+        }
+    }
+    console.error(`[calendar-reconcile] account=${accountId} op=schema-migrate result=applied`);
+}
+async function reconcileAccount(driver, accountId, accountDir, makeClient, provisionState) {
     const availPath = join(accountDir, "calendar-availability.json");
     if (!existsSync(availPath))
         return; // no booking site for this account
@@ -182,131 +216,350 @@ async function reconcileAccount(driver, accountId, accountDir, houseToken, house
     }
     // Task 1654 — provision the recurring connector-sync turn for this booking-site
     // account. Create-only; the admin session it spawns is the only seat that can
-    // read the calendar connector. Skips observably when no admin destination exists.
+    // read the calendar connector.
+    //
+    // Task 1809 — the gate is the presence of a CALENDAR CONNECTOR, the sync's own
+    // input, not the presence of a WhatsApp number (which is only where the turn
+    // reports an exception). The outcome distinguishes the four states an operator
+    // can act on differently, and is reported on change plus a heartbeat rather
+    // than once per 120 s tick.
+    const accountsDir = resolve(accountDir, "..");
     const syncSession = driver.session();
+    let outcome;
+    let connectors = [];
+    let dispatch = null;
+    let detail;
     try {
-        const adminPhone = readAdminPhone(accountDir);
-        if (!adminPhone) {
-            console.error(`[calendar-availability] op=cal-sync-provision account=${accountId} result=skipped reason=no-admin-destination`);
+        connectors = detectCalendarConnectors(accountDir);
+        if (connectors.length === 0) {
+            outcome = "not-applicable";
         }
         else {
-            const outcome = await ensureConnectorSyncEvent(syncSession, accountId, adminPhone);
-            console.error(`[calendar-availability] op=cal-sync-provision account=${accountId} result=${outcome}`);
+            const resolved = resolveDispatchDestination(accountsDir, accountId);
+            if (resolved.destination === null) {
+                // A sync that fails and cannot report is not a clean sync, so an
+                // account with no reachable destination is reported unconfigured
+                // rather than armed. Task 1812 adds the destination-free route. The
+                // refusal reason travels with it — `unconfigured` at an account whose
+                // account.json visibly holds a phone number is otherwise unexplainable.
+                outcome = "unconfigured";
+                detail = resolved.reason;
+            }
+            else {
+                dispatch = resolved.destination;
+                outcome = await ensureConnectorSyncEvent(syncSession, accountId, dispatch);
+            }
         }
     }
     catch (err) {
-        console.error(`[calendar-availability] op=cal-sync-provision account=${accountId} result=error reason=${JSON.stringify(err.message)}`);
+        outcome = "error";
+        detail = err.message;
     }
     finally {
-        await syncSession.close();
-    }
-    // Task 1631 — house code uses the house-only Cloudflare credential, never a
-    // per-account token. The account-wide token no longer lives in a sub-account
-    // secrets file; the booking DB is still targeted by its per-account name.
-    const wranglerEnv = {
-        CLOUDFLARE_API_TOKEN: houseToken,
-        ...(houseAccountId ? { CLOUDFLARE_ACCOUNT_ID: houseAccountId } : {}),
-    };
-    let pending;
-    try {
-        pending = d1Query(dbName, "SELECT bookingId, slotStart, slotEnd, name, email, note FROM bookings WHERE status='accepted' AND swept=0 ORDER BY id", wranglerEnv);
+        // A rejecting close must not carry a computed outcome out of the function
+        // unreported — the emit below is the only place this account's state is
+        // recorded. Mirrors the guard in agent-turn-dispatch.ts.
+        try {
+            await syncSession.close();
+        }
+        catch {
+            /* ignore */
+        }
     }
-    catch (err) {
-        console.error(`[calendar-reconcile] account=${accountId} d1-read-failed err="${err.message}"`);
-        return;
+    // Every outcome, `error` included, goes through one emit gate. Exempting
+    // errors would log a persistent Neo4j fault at tick rate forever — the same
+    // volume profile as the 7,868 lines this task removes — and would leave the
+    // state map holding the pre-error outcome, making the eventual recovery
+    // invisible because it would read as unchanged.
+    const nowMs = Date.now();
+    const signature = provisionSignature(outcome, detail);
+    const prev = provisionState[accountId];
+    if (shouldEmitProvisionLine(prev, signature, nowMs, PROVISION_HEARTBEAT_MS)) {
+        console.error(`[calendar-availability] op=cal-sync-provision account=${accountId} result=${outcome} ` +
+            `connectors=${connectors.length > 0 ? connectors.join("+") : "none"} ` +
+            `destination=${dispatch ? dispatch.channel : "none"} ` +
+            `${detail ? `reason=${JSON.stringify(detail)} ` : ""}emit=${emitLabel(prev, signature)}`);
+        provisionState[accountId] = { outcome, signature, loggedAtMs: nowMs };
     }
-    const notifyDeps = pending.length > 0 ? await resolveEmailNotify(accountId) : {};
-    for (const row of pending) {
-        const bookingId = String(row.bookingId);
-        // bookingId is written by the Pages Function as crypto.randomUUID(); a row
-        // whose id is not a UUID was not written by us, so refuse to interpolate it
-        // into the sweep statement (defence in depth against a non-parameterized id).
-        if (!UUID_RE.test(bookingId)) {
-            console.error(`[calendar-reconcile] account=${accountId} skip-row reason=non-uuid-bookingId`);
-            continue;
+    // One client per account run: it holds this database's name -> uuid
+    // resolution for the whole tick, and carries the counters the op=d1 line
+    // reports. Task 1631's house-only credential reaches D1 as the Bearer token
+    // now rather than as a child process env.
+    const d1 = makeClient();
+    try {
+        // The kind/attempts columns cannot reach an already-provisioned database
+        // through the template, so this account's first run migrates it. Retried
+        // until it completes, because a half-migrated table (columns added, block
+        // rows unclassified) leaves every block row eligible and the sweep would
+        // reconcile each into a meeting.
+        if (!hasCompletedSchemaMigration(accountId)) {
+            try {
+                await migrateBookingSchema(d1, dbName, accountId);
+                markSchemaMigrated(accountId);
+            }
+            catch (err) {
+                console.error(`[calendar-reconcile] account=${accountId} op=schema-migrate result=failed err="${err.message}"`);
+                return; // never sweep against a table whose block rows may be unclassified
+            }
         }
-        const booking = {
-            bookingId,
-            slotStart: String(row.slotStart),
-            slotEnd: String(row.slotEnd),
-            name: String(row.name),
-            email: String(row.email),
-            note: row.note == null ? undefined : String(row.note),
-        };
-        const started = Date.now();
-        console.error(`[calendar-booking] op=reconcile-claim bookingId=${booking.bookingId} accountId=${accountId}`);
-        const session = driver.session();
+        // Task 1806 — one read serves both the sweep and the audit, so the two can
+        // never disagree about the population. Task 1807 — it is no longer filtered
+        // on swept; which rows are claimed is decided against the graph below.
+        let eligible;
         try {
-            const result = await reconcileOne(session, accountId, booking);
-            console.error(`[calendar-booking] op=meeting-write bookingId=${booking.bookingId} meetingId=${result.meetingId} created=${result.created}`);
-            // Notify only when the meeting was freshly created. An idempotent re-run
-            // (created=false, e.g. a prior pass wrote the meeting but the sweep
-            // failed) must not re-email the admin.
-            if (result.created) {
-                const notes = await notifyBooking(notifyDeps, booking);
-                for (const n of notes) {
-                    console.error(`[calendar-booking] op=notify bookingId=${booking.bookingId} channel=${n.channel} dispatched=${n.dispatched}`);
-                }
-            }
-            // Mark swept only after a successful meeting write, so a reconcile crash
-            // leaves the row for the next run rather than dropping it silently.
-            d1Query(dbName, `UPDATE bookings SET swept=1 WHERE bookingId='${booking.bookingId}'`, wranglerEnv);
-            console.error(`[calendar-booking] op=booked bookingId=${booking.bookingId} ms=${Date.now() - started}`);
+            eligible = await d1.query(dbName, ELIGIBLE_BOOKING_SELECT);
         }
         catch (err) {
-            console.error(`[calendar-booking] op=reconcile-failed bookingId=${booking.bookingId} err="${err.message}"`);
+            if (!isMissingColumnError(err.message)) {
+                console.error(`[calendar-reconcile] account=${accountId} d1-read-failed err="${err.message}"`);
+                return;
+            }
+            // The marker says migrated but the column is gone, so the database was
+            // replaced under us. Migrate again and retry the read once.
+            try {
+                await migrateBookingSchema(d1, dbName, accountId);
+                markSchemaMigrated(accountId);
+                eligible = await d1.query(dbName, ELIGIBLE_BOOKING_SELECT);
+            }
+            catch (migrateErr) {
+                console.error(`[calendar-reconcile] account=${accountId} op=schema-migrate result=failed err="${migrateErr.message}"`);
+                return;
+            }
+        }
+        // Task 1806 — a row whose bookingId is not a UUID was not written by our
+        // Pages Function, so the sweep does not act on it. Counting it as
+        // unreconciled would be this task's exact defect: an audit number naming
+        // rows nothing is able to reconcile. Dropped from both populations here,
+        // once, and reported under its own name rather than silently. Since Task
+        // 1805 the sweep binds its values, so this is a provenance filter, not a
+        // SQL-safety guard.
+        const malformed = eligible.filter((r) => !UUID_RE.test(String(r.bookingId)));
+        if (malformed.length > 0)
+            eligible = eligible.filter((r) => UUID_RE.test(String(r.bookingId)));
+        // Which rows still need a meeting is a question about the graph, not about
+        // a flag in D1. Task 1807 — swept records that a write was attempted; a row
+        // whose meeting is later absent must be reclaimed however that flag reads.
+        const claimSession = driver.session();
+        let pending;
+        try {
+            const uids = await fetchBookingMeetingUids(claimSession, accountId);
+            pending = selectUnreconciled(eligible, new Set(uids));
         }
         finally {
-            await session.close();
+            await claimSession.close();
         }
-    }
-    // Standing audit — covers the no-event failure no per-request line can reveal.
-    const auditSession = driver.session();
-    try {
-        let acceptedIds = [];
+        const notifyDeps = pending.length > 0 ? await resolveEmailNotify(accountId) : {};
+        for (const row of pending) {
+            // bookingId was UUID-checked above, before this row reached `pending`.
+            const bookingId = String(row.bookingId);
+            const booking = {
+                bookingId,
+                slotStart: String(row.slotStart),
+                slotEnd: String(row.slotEnd),
+                name: String(row.name),
+                email: String(row.email),
+                note: row.note == null ? undefined : String(row.note),
+            };
+            const started = Date.now();
+            const attempt = Number(row.attempts ?? 0) + 1;
+            console.error(`[calendar-booking] op=reconcile-claim bookingId=${booking.bookingId} accountId=${accountId} attempt=${attempt}`);
+            const session = driver.session();
+            try {
+                // Count the attempt before the write, so a crash mid-write still leaves
+                // durable evidence that this row was tried. Nothing gates on the count —
+                // a row is retried until it succeeds — but a row on attempt 47 is now
+                // distinguishable from one never attempted, which is the signal Task
+                // 1351 escalates on. Its own try/catch: this statement is observability,
+                // and failing to record a number must never stop the meeting write it
+                // describes. The op=reconcile-claim line above already carries the count.
+                try {
+                    await d1.query(dbName, "UPDATE bookings SET attempts = attempts + 1 WHERE bookingId=?1", [
+                        booking.bookingId,
+                    ]);
+                }
+                catch (err) {
+                    console.error(`[calendar-booking] op=attempt-count-failed bookingId=${booking.bookingId} attempt=${attempt} err="${err.message}"`);
+                }
+                const result = await reconcileOne(session, accountId, booking);
+                console.error(`[calendar-booking] op=meeting-write bookingId=${booking.bookingId} meetingId=${result.meetingId} created=${result.created}`);
+                // Notify only when the meeting was freshly created. An idempotent re-run
+                // (created=false, e.g. a prior pass wrote the meeting but the sweep
+                // failed) must not re-email the admin.
+                if (result.created) {
+                    const notes = await notifyBooking(notifyDeps, booking);
+                    for (const n of notes) {
+                        console.error(`[calendar-booking] op=notify bookingId=${booking.bookingId} channel=${n.channel} dispatched=${n.dispatched}`);
+                    }
+                }
+                // swept keeps its existing meaning: a write was attempted and succeeded.
+                // It no longer decides whether the row is reclaimed, so failing to set
+                // it costs nothing but accuracy — and reporting it as reconcile-failed
+                // would be untrue, because the meeting exists by this point.
+                try {
+                    await d1.query(dbName, "UPDATE bookings SET swept=1 WHERE bookingId=?1", [
+                        booking.bookingId,
+                    ]);
+                }
+                catch (err) {
+                    console.error(`[calendar-booking] op=sweep-mark-failed bookingId=${booking.bookingId} err="${err.message}"`);
+                }
+                console.error(`[calendar-booking] op=booked bookingId=${booking.bookingId} attempt=${attempt} ms=${Date.now() - started}`);
+            }
+            catch (err) {
+                console.error(`[calendar-booking] op=reconcile-failed bookingId=${booking.bookingId} attempt=${attempt} err="${err.message}"`);
+            }
+            finally {
+                await session.close();
+            }
+        }
+        // Standing audit — covers the no-event failure no per-request line can reveal.
+        // Task 1806 — it counts the same eligible population the sweep just acted on,
+        // so the number can never again name rows nothing is able to reconcile, and
+        // the second D1 read this used to cost is gone. The meeting set is re-read so
+        // the line reports the state after this run's sweep.
+        const auditSession = driver.session();
         try {
-            const accepted = d1Query(dbName, "SELECT bookingId FROM bookings WHERE status='accepted'", wranglerEnv);
-            acceptedIds = accepted.map((r) => String(r.bookingId));
+            const eligibleIds = eligible.map((r) => String(r.bookingId));
+            const uids = await fetchBookingMeetingUids(auditSession, accountId);
+            const counts = auditCounts(eligibleIds, uids);
+            console.error(`[calendar-reconcile] account=${accountId} eligibleExamined=${counts.eligibleExamined} pendingUnreconciled=${counts.pendingUnreconciled} orphanMeetings=${counts.orphanMeetings} malformedIds=${malformed.length}`);
         }
-        catch {
-            /* audit degrades to graph-only when D1 is unreachable */
+        finally {
+            await auditSession.close();
         }
-        const counts = await auditCounts(auditSession, accountId, acceptedIds);
-        console.error(`[calendar-reconcile] account=${accountId} pendingUnreconciled=${counts.pendingUnreconciled} orphanMeetings=${counts.orphanMeetings}`);
-    }
-    finally {
-        await auditSession.close();
-    }
-    // Task 1654 — standing connector-drift audit. Independent of any booking: it
-    // reconciles the PUBLISHED open slots against the current connector-busy set,
-    // so a booking page offering a slot the connector shows busy is surfaced before
-    // a customer hits it. connector-busy read from the graph, published slots from D1.
-    const driftSession = driver.session();
-    try {
+        // Task 1654 — standing connector-drift audit. Independent of any booking: it
+        // reconciles the PUBLISHED open slots against the current connector-busy set,
+        // so a booking page offering a slot the connector shows busy is surfaced before
+        // a customer hits it. connector-busy read from the graph, published slots from D1.
+        // Task 1811 — these four are read by the drift audit and consumed by the
+        // blocking step below, which runs in its own try so its line is emitted
+        // whatever the drift step did.
         let publishedSlots = [];
+        // The published set could not be read at all: D1 unreachable (throws), or a
+        // snapshot row exists whose payload is not a usable slot list. Both are
+        // distinct from a D1 that answered and holds no snapshot row, which leaves
+        // publishedSlots empty without setting this — the booking site has genuinely
+        // never published.
+        let snapshotUnreadable = false;
+        let busy = [];
+        let drift = null;
+        const driftSession = driver.session();
         try {
-            const rows = d1Query(dbName, "SELECT payload FROM availability_snapshot WHERE id=1", wranglerEnv);
-            const payload = rows[0]?.payload;
-            if (typeof payload === "string") {
-                const parsed = JSON.parse(payload);
-                if (Array.isArray(parsed.slots))
-                    publishedSlots = parsed.slots;
+            try {
+                const rows = await d1.query(dbName, "SELECT payload FROM availability_snapshot WHERE id=1");
+                if (rows.length > 0) {
+                    const payload = rows[0]?.payload;
+                    const parsed = typeof payload === "string" ? JSON.parse(payload) : null;
+                    if (parsed && Array.isArray(parsed.slots))
+                        publishedSlots = parsed.slots;
+                    else
+                        snapshotUnreadable = true;
+                }
+            }
+            catch {
+                snapshotUnreadable = true;
             }
+            const busyRes = await driftSession.run(`MATCH (b:ConnectorBusy {accountId: $accountId})
+         RETURN toString(b.startsAt) AS start, toString(b.endsAt) AS end`, { accountId });
+            busy = busyRes.records.map((r) => ({ start: r.get("start"), end: r.get("end") }));
+            // The busy read runs whatever the snapshot read did, so busy=<n> is the
+            // standing per-account :ConnectorBusy census on every tick.
+            drift = classifyPublishedDrift(publishedSlots, busy);
+            const outcome = snapshotUnreadable ? "snapshot-unreadable" : drift.outcome;
+            // When the published set was never read, its size and the conflict count are
+            // not measurements — reporting them as 0 would be the same unqualified
+            // number this audit exists to eliminate.
+            const published = snapshotUnreadable ? "unknown" : String(drift.published);
+            const conflicts = snapshotUnreadable ? "unknown" : String(drift.conflicts);
+            console.error(`[calendar-availability] op=cal-drift account=${accountId} outcome=${outcome} published=${published} busy=${drift.busy} conflicts=${conflicts}`);
         }
-        catch {
-            /* no snapshot yet (booking site never published) — audit degrades to 0 */
+        catch (err) {
+            const outcome = "error";
+            console.error(`[calendar-availability] op=cal-drift account=${accountId} outcome=${outcome} reason=${JSON.stringify(err.message)}`);
         }
-        const busyRes = await driftSession.run(`MATCH (b:ConnectorBusy {accountId: $accountId})
-       RETURN toString(b.startsAt) AS start, toString(b.endsAt) AS end`, { accountId });
-        const busy = busyRes.records.map((r) => ({ start: r.get("start"), end: r.get("end") }));
-        const conflicts = countPublishedConflicts(publishedSlots, busy);
-        console.error(`[calendar-availability] op=cal-drift account=${accountId} conflicts=${conflicts}`);
-    }
-    catch (err) {
-        console.error(`[calendar-availability] op=cal-drift account=${accountId} result=error reason=${JSON.stringify(err.message)}`);
+        finally {
+            await driftSession.close();
+        }
+        // Task 1811 — act on the conflicts the audit above just measured. The
+        // published set, the busy set and the D1 client are all already in hand,
+        // so this adds one read and writes only when the set changes.
+        //
+        // Which writes are safe is decided by planBlockWrites, not here: the rule
+        // that an absent or unreadable busy set must never delete is the highest
+        // consequence line in this feature, and a bare `if` at this call site is
+        // unreachable by any test, since reconcileAccount resolves its config dir
+        // at module load and cannot be imported.
+        let blockOutcome = "error";
+        let held = "unknown";
+        let added = "unknown";
+        let removed = "unknown";
+        let blockReason = null;
+        try {
+            const current = (await d1.query(dbName, BLOCK_ROWS_SELECT)).map((r) => ({
+                bookingId: String(r.bookingId),
+                slotStart: String(r.slotStart),
+            }));
+            held = current.length;
+            const plan = planBlockWrites({
+                publishedReadable: !snapshotUnreadable,
+                // `drift` is null only when the drift try threw, which means the graph
+                // read did not complete and `busy` is absence of a measurement rather
+                // than a measured empty set.
+                busyReadable: drift !== null,
+                published: publishedSlots,
+                busy,
+                // Built from the eligible rows AND the malformed ones: the edge
+                // subtracts every accepted row regardless of whether its bookingId is
+                // a UUID, so a non-UUID real booking still holds its slot and must not
+                // be blocked a second time.
+                taken: new Set([...eligible, ...malformed].map((r) => String(r.slotStart))),
+                current,
+                nowMs: Date.now(),
+            });
+            blockOutcome = plan.outcome;
+            if (plan.outcome === "verified") {
+                // Counted as the writes land, not from the plan, so a failure part way
+                // through still reports what actually happened rather than the intent.
+                added = 0;
+                removed = 0;
+                const nowIso = new Date().toISOString();
+                for (const id of plan.diff.toDelete) {
+                    await d1.query(dbName, BLOCK_ROW_DELETE, [id]);
+                    removed++;
+                    held--;
+                }
+                for (const s of plan.diff.toInsert) {
+                    await d1.query(dbName, BLOCK_ROW_INSERT, blockInsertParams(s, randomUUID(), nowIso));
+                    added++;
+                    held++;
+                }
+            }
+        }
+        catch (err) {
+            blockOutcome = "error";
+            blockReason = err.message;
+        }
+        // ONE emit point, always reached. An earlier revision logged the error case
+        // separately and suppressed this line for it, which meant a tick whose
+        // drift step threw reported no cal-block line at all — the standing check
+        // silently absent, which is this task family's own defect class.
+        //
+        // On any outcome but `verified` no desired set was computed, so added and
+        // removed are not measurements — reporting them as 0 would be the same
+        // unqualified number Task 1808 removed. `held` is a real read whenever the
+        // D1 read succeeded, so `no-busy-data blocked=3` says "no input, three
+        // stale blocks retained" and `verified blocked=0` says "calendar clear".
+        console.error(`[calendar-availability] op=cal-block account=${accountId} outcome=${blockOutcome} ` +
+            `blocked=${held} added=${added} removed=${removed}` +
+            `${blockReason ? ` reason=${JSON.stringify(blockReason)}` : ""}`);
     }
     finally {
-        await driftSession.close();
+        // Task 1805 — the transport's own footprint, which no line reported
+        // before. Post-condition, not intent: `statements` is what was actually
+        // issued (the name lookup is not a statement and is not counted), `ms` is
+        // total elapsed in the transport including that lookup. A tick that failed
+        // its first read still reports, showing statements=0.
+        console.error(`[calendar-reconcile] op=d1 account=${accountId} statements=${d1.statements} ms=${d1.elapsedMs}`);
     }
 }
 async function main() {
@@ -332,9 +585,17 @@ async function main() {
             return;
         }
         const houseAccountId = houseCred.CLOUDFLARE_ACCOUNT_ID;
+        // Task 1805 — the D1 endpoint is addressed per Cloudflare account, so the id
+        // is required rather than inferred. cf-token.sh already refuses to resolve any
+        // scope without it, so no install that reconciles today can reach here
+        // lacking one; an absent id is reported rather than guessed.
+        if (!houseAccountId) {
+            console.error("[calendar-reconcile] skip reason=no-house-cloudflare-account-id");
+            return;
+        }
         // Task 1670 — the house credential is a minter; mint (then reuse) a D1-only
-        // scoped token from it via cf-token.sh and run wrangler on THAT, never the
-        // minter directly (a minter returns 10000 on wrangler d1).
+        // scoped token from it via cf-token.sh and authenticate on THAT, never the
+        // minter directly (a minter returns 10000 against the D1 surface).
         const cfTokenSh = join(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
         let scopedToken;
         try {
@@ -345,14 +606,23 @@ async function main() {
             return;
         }
         driver = connectNeo4j();
+        // Task 1809 — read once, mutate per account, write once. A crash mid-run
+        // costs redundant lines on the next run, never suppressed ones.
+        const provisionState = readProvisionState(PROVISION_STATE_FILE);
         for (const accountId of accountIds) {
             try {
-                await reconcileAccount(driver, accountId, join(accountsDir, accountId), scopedToken, houseAccountId);
+                await reconcileAccount(driver, accountId, join(accountsDir, accountId), () => createD1Client({ accountId: houseAccountId, token: scopedToken }), provisionState);
             }
             catch (err) {
                 console.error(`[calendar-reconcile] account=${accountId} run-failed err="${err.message}"`);
             }
         }
+        // Drop accounts that no longer exist so the file cannot grow without bound.
+        for (const known of Object.keys(provisionState)) {
+            if (!accountIds.includes(known))
+                delete provisionState[known];
+        }
+        writeProvisionState(PROVISION_STATE_FILE, provisionState);
     }
     finally {
         if (driver)