slotlock 0.1.1 → 0.3.0

package/sync.js

@@ -1,13 +1,15 @@
 import { createHash } from 'node:crypto';
 import ICAL from 'ical.js';
-import { zonedDateTimeToUtc } from './timezone.js';
+import { canonicalTimeZoneName, createTimeZoneConverter, utcFrame, wallFrameToInstant, ZONE_OFFSET_REACH_MS, zonedDateTimeFields, zonedDateTimeToUtc, zonedOffsetMinutes, zoneOffsetChangeReads, zoneOffsetDay, zoneTransitions, } from './timezone.js';
 /** The most text one feed may be, in UTF-8 bytes. */
 export const MAX_ICAL_INPUT_BYTES = 2_000_000;
 const MAX_ICAL_OCCURRENCES = 2_000;
 const MAX_ICAL_COMPONENTS = 2_000;
 const MAX_ICAL_EXCEPTIONS_PER_SERIES = 1_000;
 const MAX_ICAL_WORK = 4_000;
-const MAX_ICAL_WINDOW_MS = 367 * 24 * 60 * 60 * 1000;
+// The store materializes a recurring series for up to 369 days (SLOTLOCK_MATERIALIZATION_WINDOW_DAYS:
+// a 367-day search from any moment of the day, plus the day before it).
+const MAX_ICAL_WINDOW_MS = 369 * 24 * 60 * 60 * 1000;
 /**
  * A feed's own time zones (VTIMEZONE), their STANDARD and DAYLIGHT observances, and the RDATE values
  * those list. A real feed carries one zone per zone its events use, each a few observances (a zone's
@@ -28,47 +30,42 @@ const MAX_ICAL_PROPERTY_PARAMETERS = 100;
 const MAX_ICAL_TIMEZONE_OBSERVANCES = 1_000;
 const MAX_ICAL_TIMEZONE_DATES = 2_000;
 /**
- * Steps ical.js may take, in one parse, looking for occurrences. RecurIterator.next() searches for a
- * SECONDLY to WEEKLY rule's next occurrence one step (second, minute, hour, day or week) at a time
- * with no limit, and gives up on a MONTHLY or YEARLY one only when whole months or years fail (not
- * when one matches a part the rule then rules out), so a rule that never occurs
- * (`FREQ=DAILY;BYMONTH=2;BYMONTHDAY=30`, `FREQ=DAILY;INTERVAL=7;BYDAY=TU` from a Monday, or
- * `FREQ=YEARLY;BYMONTH=2;BYMONTHDAY=30;BYDAY=MO`) held the whole process, and one that almost never
- * does held it for minutes. A real rule takes one to five steps an occurrence (a yearly date written
- * as a daily rule, 365), and MAX_ICAL_WORK bounds the occurrences.
- */
-const MAX_ICAL_STEPS = 50_000;
-/**
- * And the time a whole parse may take, from before ical.js reads the text to the last occurrence: a
- * step costs from a microsecond (a daily rule) to a millisecond (a WEEKLY rule with a huge INTERVAL,
- * which ical.js walks a day at a time), so a count alone does not bound it, and ical.js does work no
- * step is charged for (relating an exception for every later occurrence reads its time, and so its
- * zone, as the event is built). A busy feed within MAX_ICAL_WORK takes about a fifth of a second
- * (thirty fifth-Monday series since 2000); one stored series' window, a few tens of milliseconds.
- */
-const MAX_ICAL_EXPANSION_MS = 1_000;
+ * Work ical.js may do, in one parse, looking for occurrences, in steps of about a microsecond each.
+ * RecurIterator.next() searches for a SECONDLY to WEEKLY rule's next occurrence one step (second,
+ * minute, hour, day or week) at a time with no limit, and gives up on a MONTHLY or YEARLY one only
+ * when whole months or years fail (not when one matches a part the rule then rules out), so a rule
+ * that never occurs (`FREQ=DAILY;BYMONTH=2;BYMONTHDAY=30`, `FREQ=DAILY;INTERVAL=7;BYDAY=TU` from a
+ * Monday) held the whole process, and one that almost never does held it for minutes. Only this
+ * count decides, never a clock, so a calendar is read or refused the same way however loaded the
+ * machine (ICAL_STEP_CHARGES says what each piece of work costs).
+ *
+ * A feed, and a stored series as maintenance rolls it, may take half a million: thirty series on the
+ * fifth Monday of the month since 2000 take about 350,000.
+ */
+const MAX_ICAL_STEPS = 500_000;
 /** A feed, and a stored series as maintenance rolls it. */
-const FEED_LIMITS = { steps: MAX_ICAL_STEPS, ms: MAX_ICAL_EXPANSION_MS };
+const FEED_LIMITS = { steps: MAX_ICAL_STEPS };
 /**
- * One event as it is written or asked about (expandCalendarEventOccurrences): half of a feed's, so
- * a DAILY or rarer series written today still fits when the roll searches it again from its start
- * for decades (that search grows about a step a day as the window moves; the roll resumes from a
- * cursor instead whenever it has one), and an ordinary series, a few milliseconds, stays far from
- * the time limit however loaded the machine.
+ * One event as it is written or asked about (expandCalendarEventOccurrences): a tenth of a feed's,
+ * so a write is refused within a tenth of a second whatever its rule or zone (fifty writes of one
+ * that walks 9,999 days a step held a hosted server for 23 seconds when a write could search for
+ * half of one), and a series written today still fits when the roll searches it again from its
+ * start for decades (that search grows as the window moves; the roll resumes from a cursor instead
+ * whenever it has one). A yearly date written as a daily rule fits from 1990, and from 1950 does
+ * not, but rolls.
  */
-const EVENT_LIMITS = {
-    steps: MAX_ICAL_STEPS / 2,
-    ms: MAX_ICAL_EXPANSION_MS / 2,
-};
+const EVENT_LIMITS = { steps: 50_000 };
 /** RDATE and EXDATE values one event may list: ical.js sorts them in as it reads them. */
 const MAX_ICAL_DATES_PER_EVENT = MAX_ICAL_EXCEPTIONS_PER_SERIES;
+/** RRULEs one event may list: every step of its expansion compares each one's next time. */
+const MAX_ICAL_RULES_PER_EVENT = 8;
 /** And a whole feed: each value is a time ical.js resolves, its zone looked up among the feed's. */
 const MAX_ICAL_DATES_PER_FEED = 20 * MAX_ICAL_DATES_PER_EVENT;
 /**
  * The furthest one step of a SECONDLY to WEEKLY rule may move, in days: about a century. ical.js
- * moves it a day at a time (RecurIterator#increment_monthday) inside one step, which is charged
- * once: `FREQ=DAILY;INTERVAL=1000000000` spent 97 seconds in its second step. A century is 36,600
- * days, about 4 ms.
+ * moves it a day at a time (RecurIterator#increment_monthday) inside one step:
+ * `FREQ=DAILY;INTERVAL=1000000000` spent 97 seconds in its second step. The days are charged
+ * (ICAL_STEP_CHARGES), and a century is 36,600 days, about 7 ms.
  */
 const MAX_ICAL_STEP_DAYS = 36_600;
 const MAX_ICAL_INTERVAL = {
@@ -79,12 +76,62 @@ const MAX_ICAL_INTERVAL = {
     WEEKLY: Math.floor(MAX_ICAL_STEP_DAYS / 7),
 };
 /**
- * The RecurIterator methods a step is charged on. Every step of a search, whatever the frequency,
- * ends in exactly one `next_second` (`next_year`, `next_month`, `next_week` and `next_day` each call
- * `next_hour`, which calls `next_minute`, which calls `next_second`); `expand_year_days` is a YEARLY
- * rule's scan of one year for matching days, which the constructor repeats as far as the year 20000.
+ * The RecurIterator methods work is charged on, and what each call costs, in steps of about a
+ * microsecond (measured on ical.js 2.2.1 under Node 26, with the costliest rule shapes each method
+ * serves). Every step of a search, whatever the frequency, ends in exactly one `next_second`
+ * (`next_year`, `next_month`, `next_week` and `next_day` each call `next_hour`, which calls
+ * `next_minute`, which calls `next_second`), and is followed by a check of the rule's parts: about
+ * three microseconds for a DAILY rule with BYMONTH and BYMONTHDAY. `ruleDayOfWeek` reads one BYDAY value, which the
+ * searches of a month and a week and the checks of a day do for every day and every value they
+ * compare. `increment_monthday` walks its days one at a time, about a fifth of a microsecond each on a
+ * 4-vCPU Linux runner under Node 22 (a tenth on the machine the rest was measured on).
+ * `expand_year_days` lists the days of one year a YEARLY rule names, which the constructor repeats
+ * as far as the year 20000: about three microseconds, and an eighth of one for each day it lists
+ * and sorts (`BYMONTH` with 28 `BYMONTHDAY` values, 336 days, about 42). The days of the week
+ * through a whole year, which it filters by month and day of the month, it gets from
+ * `expand_by_day`: about half a microsecond for each day that lists (all seven weekdays filtered
+ * to the 13th, 365 days, about 150). A scan of every day of a month for `BYSETPOS` is charged
+ * through `ruleDayOfWeek`, as a day's check is. Outlook writes every zone's observances from 1601
+ * as `BYMONTH` with one numbered `BYDAY`, so one zone's 430 years cost about 6,000 steps.
+ */
+const ICAL_STEP_CHARGES = {
+    next_second: { before: () => 3 },
+    ruleDayOfWeek: { before: () => 1 },
+    increment_monthday: {
+        before: (days) => (typeof days === 'number' && days > 0 ? days / 5 : 1),
+    },
+    expand_year_days: {
+        before: () => 3,
+        after: (iterator) => listedDays(iterator.days) / 8,
+    },
+    expand_by_day: { before: () => 0, after: (_iterator, days) => listedDays(days) / 2 },
+};
+/**
+ * What Slotlock's own work on what ical.js finds costs, in the same steps: each occurrence an
+ * expansion passes (its instant, exceptions and change); each conversion of a time between a zone's
+ * wall clock and its instants, half a step in an IANA zone (a few lookups in the offsets timezone.ts
+ * keeps a day at a time) and one and a half in a zone only the feed defines (ical.js's list of its
+ * changes, searched at each lookup, as ical.js itself searches it at each step); and each instant
+ * Intl is asked for to read a day of an IANA zone's offsets (two and a half microseconds on the
+ * machine the rest was measured on, and with reading its parts as long again on a 4-vCPU Linux
+ * runner, five steps), the first time a budget reads that day. Before these were charged, a series in a named zone ran
+ * twenty times as long as the same series in UTC within the same budget.
+ */
+const OCCURRENCE_STEPS = 1;
+/** Each further RRULE whose next time an expansion step compares, choosing among them. */
+const RULE_SCAN_STEPS = 1;
+const ZONE_READ_STEPS = { conversion: 0.5, ownZone: 1.5, intl: 5 };
+/**
+ * Each change ical.js lists when it expands one of the feed's own zones (Timezone#_ensureCoverage):
+ * it adjusts and sorts every one, about four tenths of a microsecond each, and the steps of the
+ * zone's rules are charged besides. Uncharged, a zone at every cap read again for 1,000 later years
+ * listed 3 million changes in one call, two seconds on a 4-vCPU Linux runner within the budget.
  */
-const ICAL_STEP_METHODS = ['next_second', 'expand_year_days'];
+const ZONE_CHANGE_STEPS = 0.4;
+/** How many days a list holds, or a whole year's when ical.js no longer gives one. */
+function listedDays(days) {
+    return Array.isArray(days) ? days.length : 366;
+}
 /**
  * The ical.js release a series cursor holds the iterator state of. A cursor is ical.js's own
  * RecurIterator and RecurExpansion state, which only that release is known to continue exactly, so
@@ -143,7 +190,9 @@ function expansionLimit() {
 }
 function requiredIdentity(value) {
     const normalized = value.trim();
-    if (!normalized || Buffer.byteLength(normalized, 'utf8') > 1024) {
+    if (!normalized ||
+        Buffer.byteLength(normalized, 'utf8') > 1024 ||
+        /[\u0000-\u001f\u007f]/.test(normalized)) {
         throw new CalendarContractError('invalid_external_identity');
     }
     return normalized;
@@ -155,30 +204,43 @@ function optionalIdentity(value) {
 }
 function instant(value) {
     const parsed = value instanceof Date ? new Date(value.getTime()) : new Date(value);
-    if (!Number.isFinite(parsed.getTime())) {
+    // Years 1-9999: what an RFC 3339 date-time, as the events are returned, can write.
+    const year = parsed.getUTCFullYear();
+    if (!Number.isFinite(parsed.getTime()) || year < 1 || year > 9999) {
         throw new CalendarContractError('invalid_external_interval');
     }
     return parsed;
 }
+/**
+ * Text as an event keeps it: trimmed, its line breaks LF. A tab or LF is kept (ical.js escapes LF in
+ * a value and a parameter), and any other control character refused: ical.js leaves a bare CR as it
+ * is, and a reader that ends lines at one would read what follows it as a property of its own.
+ */
 function boundedText(value, maxBytes, required) {
-    const normalized = value.trim();
-    if ((required && !normalized) || Buffer.byteLength(normalized, 'utf8') > maxBytes) {
+    const normalized = value.replace(/\r\n/g, '\n').trim();
+    if ((required && !normalized) ||
+        Buffer.byteLength(normalized, 'utf8') > maxBytes ||
+        /[\u0000-\u0008\u000b-\u001f\u007f]/.test(normalized)) {
         throw new CalendarContractError('invalid_icalendar');
     }
     return normalized || undefined;
 }
+/**
+ * An event's zone as Slotlock keeps it: an IANA name in one spelling (canonicalTimeZoneName). A UTC
+ * offset such as `+05:00` is no zone a calendar can name (RFC 5545 §3.2.19 wants a VTIMEZONE for
+ * each TZID, and an offset has no rules), and is refused.
+ */
 function validTimezone(timezone) {
     const normalized = timezone.trim();
     if (!normalized || Buffer.byteLength(normalized, 'utf8') > 255) {
         throw new CalendarContractError('invalid_icalendar');
     }
     try {
-        new Intl.DateTimeFormat('en-GB', { timeZone: normalized }).format(0);
+        return canonicalTimeZoneName(normalized);
     }
     catch {
         throw new CalendarContractError('invalid_icalendar');
     }
-    return normalized;
 }
 function normalizeEmail(value) {
     const normalized = value.trim().toLowerCase();
@@ -318,13 +380,147 @@ const RECUR_RULE_PARTS = new Map([
 ]);
 /** The longest each month can be, February in a leap year. */
 const MONTH_DAYS = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+/** The shortest each month can be, February in a common year. */
+const MIN_MONTH_DAYS = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+/** The numeric BY parts, which RFC 5545 §3.3.10 reads as sets and ical.js walks in written order. */
+const NUMERIC_BY_PARTS = [
+    'BYSECOND',
+    'BYMINUTE',
+    'BYHOUR',
+    'BYMONTHDAY',
+    'BYYEARDAY',
+    'BYWEEKNO',
+    'BYMONTH',
+    'BYSETPOS',
+];
+/**
+ * Put a rule's numeric BY lists in ascending order, once each. RFC 5545 §3.3.10 reads each as a set,
+ * but ical.js 2.2.1 walks BYHOUR, BYMINUTE, BYSECOND and BYMONTH in the order written:
+ * `FREQ=DAILY;BYHOUR=17,8` gave 17:00 and then 08:00 the same day, an hour before it.
+ */
+function sortRuleParts(recur) {
+    const parts = recur.parts;
+    for (const name of NUMERIC_BY_PARTS) {
+        const values = parts[name];
+        if (!Array.isArray(values))
+            continue;
+        parts[name] = [...new Set(values)].sort((a, b) => Number(a) - Number(b));
+    }
+}
+/**
+ * Why ical.js 2.2.1 would expand `recur` other than RFC 5545 §3.3.10 says, or null for a rule it
+ * expands correctly. Each refusal is a shape the readiness audit or a check against a brute-force
+ * reading of the RFC (the tests' rrule-oracle) found it gets wrong:
+ * - BYWEEKNO: unimplemented on its own, and with BYDAY it kept every week but the one named;
+ * - a BYDAY ordinal of two digits: read by its last digit (`20MO` as every Monday);
+ * - BYSETPOS other than with FREQ=MONTHLY and BYDAY alone: WEEKLY ignored it, others picked wrongly;
+ * - BYMONTH with FREQ=MONTHLY: it walked BYMONTH from its first value whatever DTSTART's month,
+ *   dropping whole months or repeating them;
+ * - a negative BYMONTHDAY except with FREQ=MONTHLY and no BYDAY: compared as written with each day;
+ * - BYMONTHDAY with FREQ=YEARLY but no BYMONTH (only DTSTART's month was expanded), naming only
+ *   days none of its BYMONTH months has (it searched every year to 20000 for one), or a day one of
+ *   them can lack with COUNT (31 April became 1 May, and was counted: yearlyDays filters it out
+ *   otherwise) or with BYDAY (BYMONTH=4,5;BYMONTHDAY=30,31;BYDAY=WE missed 31 May 2034);
+ * - with FREQ=YEARLY, BYYEARDAY with BYMONTH or BYMONTHDAY (it found no day at all), and a numbered
+ *   BYDAY with BYMONTHDAY (counted in the year, not the month);
+ * - BYHOUR with FREQ=HOURLY, BYMINUTE or BYSECOND with FREQ=MINUTELY, and any of the three with
+ *   FREQ=MONTHLY or YEARLY: it repeated or dropped occurrences (it expands them correctly with
+ *   DAILY and WEEKLY, and HOURLY's BYMINUTE and BYSECOND and MINUTELY's BYHOUR);
+ * - FREQ=SECONDLY, which nothing Slotlock reads needs.
+ */
+function recurShapeProblem(recur) {
+    const parts = recur.parts;
+    const freq = recur.freq;
+    if (freq === 'SECONDLY')
+        return 'FREQ=SECONDLY';
+    if (parts.BYWEEKNO)
+        return 'BYWEEKNO';
+    if (parts.BYDAY?.some((day) => /\d\d/.test(String(day))))
+        return 'a BYDAY ordinal of two digits';
+    if (parts.BYSETPOS && !(freq === 'MONTHLY' && parts.BYDAY && !parts.BYMONTHDAY)) {
+        return 'BYSETPOS other than with FREQ=MONTHLY and BYDAY';
+    }
+    if (freq === 'MONTHLY' && parts.BYMONTH)
+        return 'BYMONTH with FREQ=MONTHLY';
+    const monthDays = parts.BYMONTHDAY?.map(Number);
+    if (monthDays?.some((day) => day < 0) && !(freq === 'MONTHLY' && !parts.BYDAY)) {
+        return 'a negative BYMONTHDAY other than with FREQ=MONTHLY and no BYDAY';
+    }
+    if (freq === 'YEARLY' && parts.BYYEARDAY && (parts.BYMONTH || monthDays)) {
+        return 'BYYEARDAY with BYMONTH or BYMONTHDAY and FREQ=YEARLY';
+    }
+    if (freq === 'YEARLY' && monthDays && parts.BYDAY?.some((day) => /\d/.test(String(day)))) {
+        return 'a numbered BYDAY with BYMONTHDAY and FREQ=YEARLY';
+    }
+    if (freq === 'YEARLY' && monthDays) {
+        const months = parts.BYMONTH?.map(Number);
+        if (!months)
+            return 'BYMONTHDAY with FREQ=YEARLY and no BYMONTH';
+        if (!months.some((month) => monthDays.some((day) => day <= (MONTH_DAYS[month - 1] ?? 0)))) {
+            return 'a BYMONTHDAY none of its BYMONTH months has';
+        }
+        if ((recur.count != null || parts.BYDAY) &&
+            months.some((month) => monthDays.some((day) => day > (MIN_MONTH_DAYS[month - 1] ?? 0)))) {
+            return 'COUNT or BYDAY with a BYMONTHDAY one of its BYMONTH months can lack';
+        }
+    }
+    if (freq === 'HOURLY' && parts.BYHOUR)
+        return 'BYHOUR with FREQ=HOURLY';
+    if (freq === 'MINUTELY' && (parts.BYMINUTE || parts.BYSECOND)) {
+        return 'BYMINUTE or BYSECOND with FREQ=MINUTELY';
+    }
+    if ((freq === 'MONTHLY' || freq === 'YEARLY') &&
+        (parts.BYHOUR || parts.BYMINUTE || parts.BYSECOND)) {
+        return `BYHOUR, BYMINUTE or BYSECOND with FREQ=${freq}`;
+    }
+    return null;
+}
+/**
+ * Why a rule cannot be expanded from this DTSTART, or null. FREQ=YEARLY with no BYMONTHDAY, BYDAY or
+ * BYYEARDAY takes its day from DTSTART, and ical.js put a day its month lacks into the next month
+ * (29 February 2024 recurred on 1 March 2025) instead of skipping that year (RFC 5545 §3.3.10).
+ * yearlyDays filters those out, but COUNT has already counted them.
+ */
+function seriesShapeProblem(recur, start) {
+    return recur.count != null && yearlyDays(recur, start) !== null
+        ? 'COUNT with a yearly DTSTART on a day one of its months can lack'
+        : null;
+}
+/**
+ * The months and days a FREQ=YEARLY rule's occurrences fall on, when it names a day one of its
+ * months can lack (29 February, or a 31st with April), or null. ical.js 2.2.1 moves such a day into
+ * the next month (29 February 2025 became 1 March) where RFC 5545 §3.3.10 ignores it, so an
+ * occurrence on any other day is not one. With BYYEARDAY it picks real dates already; with BYDAY
+ * such a rule is refused (recurShapeProblem).
+ */
+function yearlyDays(recur, start) {
+    const parts = recur.parts;
+    if (recur.freq !== 'YEARLY' || parts.BYDAY || parts.BYYEARDAY)
+        return null;
+    const days = parts.BYMONTHDAY?.map(Number) ?? [start.day];
+    const months = parts.BYMONTH?.map(Number) ?? [start.month];
+    return months.some((month) => days.some((day) => day > (MIN_MONTH_DAYS[month - 1] ?? 0)))
+        ? { months: new Set(months), days: new Set(days) }
+        : null;
+}
+/**
+ * Why Slotlock refuses `rule`, in words, or null when it expands it: not RFC 5545 §3.3.10 as
+ * canonicalRecurrenceRule reads it, or a shape ical.js expands wrongly (recurShapeProblem).
+ */
+export function recurrenceRuleProblem(rule) {
+    const canonical = canonicalRecurrenceRule(rule);
+    if (canonical === null)
+        return 'not a recurrence rule as RFC 5545 writes it';
+    return recurShapeProblem(ICAL.Recur.fromString(canonical));
+}
 /**
  * A recurrence rule as RFC 5545 §3.3.10 writes it, in ical.js's canonical spelling, or `null`.
  * ical.js accepts more than it should: it drops unknown parts, lets a repeated part replace the
  * first, reads `COUNT=3X` as 3 and `COUNT=0` as no count at all. So every part must be one RFC 5545
  * names, appear once and match its grammar, with FREQ present and never UNTIL and COUNT together,
  * and the parts RFC 5545 forbids for a frequency (BYWEEKNO but YEARLY, BYYEARDAY with DAILY, WEEKLY
- * or MONTHLY, BYMONTHDAY with WEEKLY, a numbered BYDAY but MONTHLY or YEARLY) are refused.
+ * or MONTHLY, BYMONTHDAY with WEEKLY, a numbered BYDAY but MONTHLY or YEARLY) are refused. The
+ * numeric BY lists come back in ascending order (sortRuleParts).
  */
 export function canonicalRecurrenceRule(rule) {
     const text = rule.trim().toUpperCase();
@@ -353,7 +549,9 @@ export function canonicalRecurrenceRule(rule) {
     if (numberedDay && (!['MONTHLY', 'YEARLY'].includes(freq) || parts.has('BYWEEKNO')))
         return null;
     try {
-        return ICAL.Recur.fromString(text).toString();
+        const recur = ICAL.Recur.fromString(text);
+        sortRuleParts(recur);
+        return recur.toString();
     }
     catch {
         return null;
@@ -367,7 +565,7 @@ export function canonicalRecurrenceRule(rule) {
  */
 export function isBookableRecurrenceRule(rule) {
     const canonical = canonicalRecurrenceRule(rule);
-    if (canonical === null)
+    if (canonical === null || recurrenceRuleProblem(canonical) !== null)
         return false;
     const parts = new Map(canonical.split(';').map((part) => part.split('=')));
     const freq = parts.get('FREQ');
@@ -380,24 +578,40 @@ export function isBookableRecurrenceRule(rule) {
     const days = monthDays.split(',').map((day) => Math.abs(Number(day)));
     return months.some((month) => days.some((day) => day >= 1 && day <= (MONTH_DAYS[month - 1] ?? 0)));
 }
-function normalizeRecurrence(input) {
+/**
+ * A stored series' rule: one Slotlock books (isBookableRecurrenceRule: RFC 5545's grammar, daily or
+ * less often, able to occur, a shape ical.js expands correctly) for this start, in its canonical
+ * spelling. A DATE UNTIL becomes the UTC instant its day ends in the event's zone: RFC 5545
+ * §3.3.10 wants a zoned DTSTART's UNTIL in UTC and reads it inclusively, and read as midnight UTC
+ * it lost the last day in every zone east of UTC with a morning start.
+ */
+function normalizeRecurrence(input, start, timezone) {
     if (!input)
         return undefined;
-    const rrule = input.rrule.trim().toUpperCase();
-    if (!rrule ||
-        Buffer.byteLength(rrule, 'utf8') > 4_096 ||
-        /[\r\n]/.test(rrule) ||
-        !rrule.startsWith('FREQ=')) {
+    const written = input.rrule.trim().toUpperCase();
+    if (!written ||
+        Buffer.byteLength(written, 'utf8') > 4_096 ||
+        /[\r\n]/.test(written) ||
+        !written.startsWith('FREQ=') ||
+        !isBookableRecurrenceRule(written)) {
         throw new CalendarContractError('invalid_icalendar');
     }
-    try {
-        ICAL.Recur.fromString(rrule);
-    }
-    catch {
+    const recur = ICAL.Recur.fromString(canonicalRecurrenceRule(written));
+    if (seriesShapeProblem(recur, zonedDateTimeFields(start, timezone)) !== null) {
         throw new CalendarContractError('invalid_icalendar');
     }
+    if (recur.until?.isDate) {
+        const { year, month, day } = recur.until;
+        const nextDay = utcFrame(year, month, day + 1, 0, 0, 0, 0);
+        const end = zonedDateTimeToUtc({
+            year: nextDay.getUTCFullYear(),
+            month: nextDay.getUTCMonth() + 1,
+            day: nextDay.getUTCDate(),
+        }, timezone);
+        recur.until = ICAL.Time.fromJSDate(new Date(end.getTime() - 1000), true);
+    }
     const exceptions = normalizeExceptions(input.exceptions);
-    const recurrence = { rrule };
+    const recurrence = { rrule: recur.toString() };
     if (exceptions.length > 0)
         recurrence.exceptions = exceptions;
     return recurrence;
@@ -452,7 +666,7 @@ export function normalizeCalendarEventContent(input) {
     }
     if (reminders.length > 0)
         normalized.reminders = reminders;
-    const recurrence = normalizeRecurrence(input.recurrence);
+    const recurrence = normalizeRecurrence(input.recurrence, start, normalized.timezone);
     if (recurrence)
         normalized.recurrence = recurrence;
     return normalized;
@@ -488,7 +702,88 @@ export function normalizeExternalCalendarChange(input) {
         change.recurrenceId = recurrenceId;
     return change;
 }
-function calendarTimeValue(value, propertyTimezone, calendarTimezone) {
+const UTC_READER = { toInstant: (wall) => wall, toWall: (instant) => instant };
+const intlReaders = new Map();
+function intlReader(timezone) {
+    let reader = intlReaders.get(timezone);
+    if (reader)
+        return reader;
+    const converter = createTimeZoneConverter(timezone);
+    reader = {
+        zone: timezone,
+        toInstant: (wall, choice) => converter.wallFrameToUtc(wall, choice).getTime(),
+        toWall: (instant) => {
+            const fields = zonedDateTimeFields(new Date(instant), timezone);
+            return utcFrame(fields.year, fields.month, fields.day, fields.hour, fields.minute, fields.second, 0).getTime();
+        },
+    };
+    // A feed names at most MAX_ICAL_TIMEZONES zones it does not define; the readers of all feeds
+    // read are kept like the formatters behind them, emptied rather than grown without bound.
+    if (intlReaders.size >= 256)
+        intlReaders.clear();
+    intlReaders.set(timezone, reader);
+    return reader;
+}
+/**
+ * A zone only the calendar defines, read from its own observances. ical.js reads a wall time in
+ * such a zone with `want_daylight = false; // TODO` (timezone.js), so a time the clocks repeat named
+ * the later instant and one they skip moved back; here the offset in force at each instant comes
+ * from the changes ical.js expands (UTC instants, each with the offset before and after it), and a
+ * wall time is read from those as from any other zone (wallFrameToInstant).
+ */
+function vtimezoneReader(zone) {
+    const known = vtimezoneReaders.get(zone);
+    if (known)
+        return known;
+    const coverage = zone;
+    let changes;
+    let starts = [];
+    const offsetAt = (instant) => {
+        const year = new Date(instant).getUTCFullYear();
+        if (typeof coverage._ensureCoverage !== 'function') {
+            throw new CalendarContractError('invalid_icalendar');
+        }
+        coverage._ensureCoverage(year + 1);
+        if (coverage.changes !== changes) {
+            changes = coverage.changes;
+            starts = changes.map((change) => utcFrame(change.year, change.month, change.day, change.hour, change.minute, change.second, 0).getTime());
+        }
+        const list = changes;
+        if (list.length === 0)
+            return 0;
+        // The last change at or before the instant; before the first, the offset it changed from.
+        let low = 0;
+        let high = starts.length - 1;
+        let found = -1;
+        while (low <= high) {
+            const middle = (low + high) >> 1;
+            if (starts[middle] <= instant) {
+                found = middle;
+                low = middle + 1;
+            }
+            else {
+                high = middle - 1;
+            }
+        }
+        const change = list[found === -1 ? 0 : found];
+        return (found === -1 ? change.prevUtcOffset : change.utcOffset) * 1000;
+    };
+    const reader = {
+        toInstant: (wall, choice) => wallFrameToInstant(wall, offsetAt, choice),
+        toWall: (instant) => instant + offsetAt(instant),
+    };
+    vtimezoneReaders.set(zone, reader);
+    return reader;
+}
+/** One reader per zone a calendar defines, for as long as its parse holds the zone. */
+const vtimezoneReaders = new WeakMap();
+/**
+ * The zone a calendar time is read in: UTC; the IANA zone its TZID (or else the calendar's zone, for
+ * a floating time) names; or the calendar's own VTIMEZONE for a TZID Intl does not know. A floating
+ * time in a calendar without a zone, or a TZID neither Intl nor the calendar defines, is refused: a
+ * server process has no local zone of its own to read it in.
+ */
+function zoneReader(value, propertyTimezone, calendarTimezone) {
     if (!value || typeof value !== 'object' || !('toJSDate' in value)) {
         throw new CalendarContractError('invalid_icalendar');
     }
@@ -496,70 +791,161 @@ function calendarTimeValue(value, propertyTimezone, calendarTimezone) {
     const zone = typeof propertyTimezone === 'string' ? propertyTimezone.trim() : '';
     const valueZone = time.zone?.tzid?.trim() ?? '';
     if (zone === 'UTC' || valueZone === 'UTC')
-        return time.toJSDate();
-    // ical.js intentionally frames floating values as local JS dates. A server process has no
-    // legitimate local calendar zone, so resolve wall-clock fields against provider metadata.
-    const timezone = zone || calendarTimezone;
+        return UTC_READER;
+    const timezone = zone || calendarTimezone?.trim();
+    const own = time.zone instanceof ICAL.Timezone ? time.zone : undefined;
+    const defined = valueZone !== 'floating' && valueZone !== 'local' && own?.component;
     if (timezone) {
-        try {
-            return zonedDateTimeToUtc({
-                year: time.year,
-                month: time.month,
-                day: time.day,
-                hour: time.isDate ? 0 : time.hour,
-                minute: time.isDate ? 0 : time.minute,
-                second: time.isDate ? 0 : time.second,
-            }, timezone);
-        }
-        catch {
-            // A standards-compliant embedded VTIMEZONE may use a private TZID that Intl does not know.
-            // ical.js resolves that definition itself; an undeclared TZID remains `floating` and cannot
-            // reach this fallback.
-            if (zone && valueZone === zone && valueZone !== 'floating' && valueZone !== 'local') {
-                const resolved = time.toJSDate();
-                if (Number.isFinite(resolved.getTime()))
-                    return resolved;
-            }
-            throw new CalendarContractError('invalid_icalendar');
-        }
+        if (isKnownTimezone(timezone))
+            return intlReader(timezone);
+        // A standards-compliant embedded VTIMEZONE may use a private TZID that Intl does not know; an
+        // undeclared TZID Intl does not know either remains `floating` and cannot reach this.
+        if (zone && valueZone === zone && defined && own)
+            return vtimezoneReader(own);
+        throw new CalendarContractError('invalid_icalendar');
     }
-    if (valueZone && valueZone !== 'floating' && valueZone !== 'local')
-        return time.toJSDate();
+    if (own instanceof IntlTimezone)
+        return intlReader(own.tzid.trim());
+    if (defined && own)
+        return vtimezoneReader(own);
     throw new CalendarContractError('invalid_icalendar');
 }
+/** A calendar time's wall-clock fields (a date's midnight), framed as UTC. */
+function wallFrameOf(value) {
+    const time = value;
+    return utcFrame(time.year, time.month, time.day, time.isDate ? 0 : time.hour, time.isDate ? 0 : time.minute, time.isDate ? 0 : time.second, 0).getTime();
+}
+/**
+ * Where a DURATION from `start` (wall time `startWall`) ends exactly, RFC 5545 §3.3.6: its weeks and
+ * days on the calendar first (the same wall time that many days on), then its hours, minutes and
+ * seconds as elapsed time. PT48H is 48 hours however the clocks change; P2D may be 47 or 49.
+ */
+function durationEnd(reader, startWall, start, duration) {
+    const days = duration.weeks * 7 + duration.days;
+    const ms = ((duration.hours * 60 + duration.minutes) * 60 + duration.seconds) * 1000;
+    return (days > 0 ? reader.toInstant(startWall + days * 24 * 60 * 60 * 1000) : start) + ms;
+}
 /**
- * What one parse may spend: steps searching for occurrences, and time from its start. The time is
- * checked at every step and after every piece of ical.js work the parse does, so work that takes no
- * steps is stopped at the next check.
+ * The value of every RRULE written inside a VEVENT of `input`, as written: what ical.js has read
+ * by then is no longer the text (it read `COUNT=0` as no count, `COUNT=3X` as 3, and the second of
+ * two FREQs). A time zone's own rules (inside VTIMEZONE) are not an event's and are left out.
+ */
+function veventRuleTexts(input) {
+    const rules = [];
+    const open = [];
+    for (const line of unfoldedLines(input)) {
+        const component = componentLine(line);
+        if (component?.kind === 'begin')
+            open.push(component.name);
+        else if (component?.kind === 'end')
+            open.pop();
+        else if (open.at(-1) === 'vevent' && /^rrule[;:]/i.test(line)) {
+            const { end } = icalendarPropertyHead(line, {});
+            rules.push(line.slice(end + 1));
+        }
+    }
+    return rules;
+}
+/**
+ * The instant a calendar time names (zoneReader), RFC 5545 §3.3.5's first instant of a repeated
+ * time and a skipped time moved forward, charged to `budget` when one is given. ical.js frames a
+ * floating value as a local JS date, which a server process has no business with.
+ */
+function calendarTimeValue(value, propertyTimezone, calendarTimezone, budget) {
+    const shared = zoneReader(value, propertyTimezone, calendarTimezone);
+    const reader = budget ? budget.zoneReader(shared) : shared;
+    const instant = reader.toInstant(wallFrameOf(value));
+    if (!Number.isFinite(instant))
+        throw new CalendarContractError('invalid_icalendar');
+    return new Date(instant);
+}
+/** The TZID of a time ical.js reads in a zone (a VTIMEZONE's, an IntlTimezone, UTC); else none. */
+function ownZone(value) {
+    if (!(value instanceof ICAL.Time))
+        return undefined;
+    const tzid = value.zone?.tzid;
+    return tzid && tzid !== 'floating' && tzid !== 'local' ? tzid : undefined;
+}
+/**
+ * What one parse may spend: steps searching for occurrences (ICAL_STEP_CHARGES), reading each one
+ * it finds, and reading times in their zones (ZONE_READ_STEPS).
  */
 class RecurrenceBudget {
-    limits;
     steps;
-    started = performance.now();
+    /** Each zone's readers as this budget charges them, so a parse's readers stay one per zone. */
+    readers = new Map();
+    /**
+     * What of each IANA zone's offsets this budget has paid for: the midnight that starts UTC day `d`
+     * as `2d`, the changes within day `d` as `2d + 1` (zoneOffsetDay).
+     */
+    read = new Map();
     constructor(limits) {
-        this.limits = limits;
         this.steps = limits.steps;
     }
-    /** Throw once the parse has run longer than its limit. */
-    check() {
-        if (performance.now() - this.started > this.limits.ms)
+    /** Charge `steps`, throwing once the parse has spent more than its limit. */
+    charge(steps) {
+        this.steps -= steps;
+        if (this.steps < 0)
             expansionLimit();
     }
+    /** `reader`, with every conversion it makes charged here (chargeZoneRead). */
+    zoneReader(reader) {
+        if (reader === UTC_READER)
+            return reader;
+        const known = this.readers.get(reader);
+        if (known)
+            return known;
+        const zone = reader.zone;
+        const charged = {
+            toInstant: (wall, choice) => {
+                this.chargeZoneRead(zone, wall - ZONE_OFFSET_REACH_MS, wall + ZONE_OFFSET_REACH_MS);
+                return reader.toInstant(wall, choice);
+            },
+            toWall: (instant) => {
+                this.chargeZoneRead(zone, instant, instant);
+                return reader.toWall(instant);
+            },
+        };
+        if (zone !== undefined)
+            charged.zone = zone;
+        this.readers.set(reader, charged);
+        return charged;
+    }
     /**
-     * Run one piece of ical.js work, then check the time: building an event's expansion, its next
-     * occurrence, or reading a time, which can expand a feed's own time zone.
+     * Charge one conversion of a time in `zone` that reads its offsets from `fromMs` to `toMs` (at
+     * most three UTC days), and what of those days this budget has not paid for: each midnight, and
+     * the search for each day's changes (zoneOffsetChangeReads), as Intl is asked for them with none
+     * kept. The process keeps them, but a parse is charged as if it read them now, so what it refuses
+     * never depends on what was read before it.
      */
-    search(work) {
-        const result = work();
-        this.check();
-        return result;
-    }
-    /** Charge one step, throwing past either limit. */
-    charge() {
-        this.steps -= 1;
-        if (this.steps < 0)
-            expansionLimit();
-        this.check();
+    chargeZoneRead(zone, fromMs, toMs) {
+        // Without an IANA zone, a reader reads one only the feed defines (UTC's is never charged).
+        if (zone === undefined) {
+            this.charge(ZONE_READ_STEPS.ownZone);
+            return;
+        }
+        this.charge(ZONE_READ_STEPS.conversion);
+        let paid = this.read.get(zone);
+        if (!paid) {
+            paid = new Set();
+            this.read.set(zone, paid);
+        }
+        const first = zoneOffsetDay(fromMs);
+        const last = zoneOffsetDay(toMs);
+        // Not a time: the conversion refuses it.
+        if (!Number.isFinite(first) || !Number.isFinite(last))
+            return;
+        const pay = (key, reads) => {
+            if (paid.has(key))
+                return;
+            paid.add(key);
+            this.charge(reads() * ZONE_READ_STEPS.intl);
+        };
+        for (let day = first; day <= last; day++) {
+            pay(2 * day, () => 1);
+            pay(2 * day + 2, () => 1);
+            pay(2 * day + 1, () => zoneOffsetChangeReads(zone, day));
+        }
     }
 }
 /**
@@ -574,13 +960,16 @@ function budgetedRecurIterator(budget) {
     }
     const inherited = ICAL.RecurIterator.prototype;
     const own = BudgetedRecurIterator.prototype;
-    for (const name of ICAL_STEP_METHODS) {
+    for (const [name, cost] of Object.entries(ICAL_STEP_CHARGES)) {
         const step = inherited[name];
         if (typeof step !== 'function')
             throw new CalendarContractError('invalid_icalendar');
         own[name] = function (...args) {
-            budget.charge();
-            return step.apply(this, args);
+            budget.charge(cost.before(...args));
+            const result = step.apply(this, args);
+            if (cost.after)
+                budget.charge(cost.after(this, result));
+            return result;
         };
     }
     return BudgetedRecurIterator;
@@ -603,15 +992,46 @@ function budgetRule(rule, Budgeted) {
  * values are changed before it is called: wrapping its iterators afterwards left that step, the
  * one most rules that never occur stop in, unbounded.
  */
-function budgetedExpansion(event, Budgeted) {
+function budgetedExpansion(event, Budgeted, budget, start) {
     for (const property of event.component.getAllProperties('rrule')) {
         budgetRule(property.getFirstValue(), Budgeted);
     }
-    const expansion = event.iterator();
+    const expansion = event.iterator(start);
     const iterators = expansion.ruleIterators;
     if (!Array.isArray(iterators) || !iterators.every((iterator) => iterator instanceof Budgeted)) {
         throw new CalendarContractError('invalid_icalendar');
     }
+    return withEveryRule(expansion, budget);
+}
+/**
+ * `expansion`, choosing among its RRULEs' iterators correctly. ical.js 2.2.1's own choice
+ * (RecurExpansion#_nextRecurrenceIter) drops one that has ended by index as it walks them: it
+ * skipped the iterator after an ended first one, and for any other removed the one before it,
+ * which had not ended, so a series with two RRULEs lost occurrences once either rule ended.
+ */
+function withEveryRule(expansion, budget) {
+    const state = expansion;
+    if (typeof state._nextRecurrenceIter !== 'function') {
+        throw new CalendarContractError('invalid_icalendar');
+    }
+    state._nextRecurrenceIter = () => {
+        const iterators = state.ruleIterators;
+        if (iterators.length > 1)
+            budget.charge((iterators.length - 1) * RULE_SCAN_STEPS);
+        let chosen = null;
+        for (let index = 0; index < iterators.length;) {
+            const iterator = iterators[index];
+            if (iterator.completed) {
+                iterators.splice(index, 1);
+                continue;
+            }
+            // The earliest next time; the first of equal ones, as ical.js chose.
+            if (chosen === null || chosen.last.compare(iterator.last) > 0)
+                chosen = iterator;
+            index += 1;
+        }
+        return chosen;
+    };
     return expansion;
 }
 /**
@@ -625,12 +1045,32 @@ function valueCount(property) {
 function fieldsMs(time) {
     return Date.UTC(time.year, time.month - 1, time.day, time.hour, time.minute, time.second);
 }
+/** The day a time's own fields name: how ical.js matches a DATE EXDATE with an occurrence. */
+function dayOf(time) {
+    return `${time.year}-${time.month}-${time.day}`;
+}
+/**
+ * Milliseconds since 1970 of a DATE or DATE-TIME property's first value as written, ignoring its
+ * zone, or undefined for anything else. Read from the raw form, so nothing resolves a zone yet.
+ */
+function writtenFieldsMs(property) {
+    const value = property?.jCal[3];
+    if (typeof value !== 'string')
+        return undefined;
+    const match = /^(\d{4})-(\d{2})-(\d{2})(?:T(\d{2}):(\d{2}):(\d{2})Z?)?$/.exec(value);
+    if (!match)
+        return undefined;
+    const [year, month, day, hour, minute, second] = match.slice(1).map((part) => Number(part ?? 0));
+    return utcFrame(year, month, day, hour, minute, second, 0).getTime();
+}
 /**
- * Refuse a VEVENT that ical.js would spend unbounded work reading, before anything reads its end:
+ * Refuse a VEVENT that ical.js would spend unbounded work reading, before anything reads its times:
  * a DURATION, or a DTEND after its DTSTART, longer than MAX_ICAL_STEP_DAYS (ical.js adds a span to
  * a time a month at a time, Time#adjust, and `DURATION:PT99999999999999999999S` held the process),
- * a negative DURATION, or more RDATE and EXDATE values than MAX_ICAL_DATES_PER_EVENT. Returns how
- * many it lists, for the feed's own limit.
+ * a negative DURATION, more RDATE and EXDATE values than MAX_ICAL_DATES_PER_EVENT, or more RRULEs
+ * than MAX_ICAL_RULES_PER_EVENT. Returns how
+ * many it lists, for the feed's own limit. It reads times only as written, so it runs before the
+ * times are framed: framing reads every date value, and 115,000 EXDATE values took 11 seconds.
  */
 function boundComponent(component) {
     const maxMs = MAX_ICAL_STEP_DAYS * 24 * 60 * 60 * 1000;
@@ -641,11 +1081,11 @@ function boundComponent(component) {
         if (duration.isNegative || duration.toSeconds() * 1000 > maxMs)
             expansionLimit();
     }
-    const start = component.getFirstPropertyValue('dtstart');
-    const end = component.getFirstPropertyValue('dtend');
-    if (start instanceof ICAL.Time && end instanceof ICAL.Time) {
+    const start = writtenFieldsMs(component.getFirstProperty('dtstart'));
+    const end = writtenFieldsMs(component.getFirstProperty('dtend'));
+    if (start !== undefined && end !== undefined) {
         // The fields ignore zones, so allow the day they can be out by.
-        if (Math.abs(fieldsMs(end) - fieldsMs(start)) > maxMs + 24 * 60 * 60 * 1000)
+        if (Math.abs(end - start) > maxMs + 24 * 60 * 60 * 1000)
             expansionLimit();
     }
     let dates = 0;
@@ -655,16 +1095,17 @@ function boundComponent(component) {
     }
     if (dates > MAX_ICAL_DATES_PER_EVENT)
         expansionLimit();
+    if (component.getAllProperties('rrule').length > MAX_ICAL_RULES_PER_EVENT)
+        expansionLimit();
     return dates;
 }
 /** Bound every VEVENT of a feed, and the date values of all of them together. */
-function boundComponents(components, budget) {
+function boundComponents(components) {
     let dates = 0;
     for (const component of components) {
         dates += boundComponent(component);
         if (dates > MAX_ICAL_DATES_PER_FEED)
             expansionLimit();
-        budget.check();
     }
 }
 /**
@@ -673,12 +1114,8 @@ function boundComponents(components, budget) {
  * local time, so one series' cancelled 09:00 cancelled every other series' 09:00 that day; the
  * parsers relate each series' own exceptions themselves.
  */
-function feedEvents(components, budget) {
-    return components.map((component) => {
-        const event = new ICAL.Event(component, { exceptions: [] });
-        budget.check();
-        return event;
-    });
+function feedEvents(components) {
+    return components.map((component) => new ICAL.Event(component, { exceptions: [] }));
 }
 /** Refuse a feed whose text alone shows it is past a limit, before ical.js parses it. */
 function boundInput(input) {
@@ -901,12 +1338,15 @@ function budgetTimezoneRules(root, Budgeted) {
     }
 }
 /**
- * Charge the time of each expansion of the feed's own zones, and keep one copy of their changes.
- * Whenever ical.js reads a year past what it has expanded a zone to, it expands every observance
+ * Keep one copy of the changes of each of the feed's own zones (their rules' steps are charged by
+ * budgetTimezoneRules). Whenever ical.js reads a year past what it has expanded a zone to, it expands every observance
  * again from its start and appends all of them to what it already had: 1,000 date values in years
  * six apart, sorted inside one call, expanded a zone of 3,000 changes 1,000 times into 3 million
  * (26 to 35 seconds, 650 MB). Each expansion starts again from DTSTART, so emptying the list first
- * leaves the same changes, once. If ical.js no longer expands zones this way, the feed is refused.
+ * leaves the same changes, once, and each expansion is charged for the changes it lists
+ * (ZONE_CHANGE_STEPS). If ical.js no longer expands zones this way, the feed is refused.
+ * And charge each offset ical.js looks up in such a zone to `budget`, as a conversion in it is: it
+ * compares a series' times at every step of its search.
  */
 function budgetTimezoneCoverage(root, budget) {
     for (const component of root.getAllSubcomponents('vtimezone')) {
@@ -917,14 +1357,20 @@ function budgetTimezoneCoverage(root, budget) {
         if (!zone)
             continue;
         const ensure = zone._ensureCoverage;
-        if (typeof ensure !== 'function')
+        const offset = zone.utcOffset;
+        if (typeof ensure !== 'function' || typeof offset !== 'function') {
             throw new CalendarContractError('invalid_icalendar');
+        }
         zone._ensureCoverage = function (year) {
             if (this.changes.length > 0 && this.expandedUntilYear >= year)
                 return;
-            budget.check();
             this.changes = [];
             ensure.call(this, year);
+            budget.charge(this.changes.length * ZONE_CHANGE_STEPS);
+        };
+        zone.utcOffset = function (time) {
+            budget.charge(ZONE_READ_STEPS.ownZone);
+            return offset.call(this, time);
         };
     }
 }
@@ -966,12 +1412,22 @@ function seriesKey(component) {
         component.hasProperty('exdate')) {
         return null;
     }
+    const start = starts[0];
+    const rule = rules[0];
+    // Slotlock 0.1 compared a zoned series' occurrences with its UTC UNTIL as if they were UTC, so a
+    // cursor it kept for one that ends may have ended an occurrence early or gone one past: such a
+    // series has a key of its own now, and those cursors are searched past from the start.
+    const zone = start.getParameter('tzid');
+    const zonedUntil = typeof zone === 'string' &&
+        zone.trim() !== 'UTC' &&
+        rule.jCal[3]?.until !== undefined;
     return createHash('sha256')
         .update(JSON.stringify([
         SERIES_CURSOR_FORMAT,
         ICAL_JS_VERSION,
-        starts[0].toICALString(),
-        rules[0].toICALString(),
+        start.toICALString(),
+        rule.toICALString(),
+        ...(zonedUntil ? ['zoned-until'] : []),
     ]))
         .digest('hex');
 }
@@ -1073,7 +1529,7 @@ function keptSeriesCursor(snapshot) {
  * rebuilt from their state (`initialized`, so the iterator does not search again from DTSTART) with
  * this parse's rule, start and zone, and its steps charged to this parse's budget.
  */
-function resumedExpansion(event, Budgeted, cursor) {
+function resumedExpansion(event, Budgeted, budget, cursor) {
     const rule = event.component.getFirstPropertyValue('rrule');
     budgetRule(rule, Budgeted);
     const dtstart = event.startDate;
@@ -1106,7 +1562,7 @@ function resumedExpansion(event, Budgeted, cursor) {
     if (iterators.length !== 1 || !(iterators[0] instanceof Budgeted)) {
         throw new CalendarContractError('invalid_icalendar');
     }
-    return expansion;
+    return withEveryRule(expansion, budget);
 }
 /**
  * Whether a cursor's iterator state agrees with `reference`, an iterator ical.js built for the same
@@ -1151,23 +1607,374 @@ function cursorFitsRule(state, reference, rule) {
         return false;
     return true;
 }
-/** Parse VEVENTs with the standards library; event content is deliberately discarded. */
+/**
+ * An IANA zone ical.js reads through Intl, for a TZID a calendar names without a VTIMEZONE (RFC
+ * 5545 wants one for each; real feeds, and the series Slotlock stores, name IANA zones bare). Left
+ * alone, ical.js reads such a time as floating and compares it with UTC values (an UNTIL, EXDATE,
+ * RDATE or RECURRENCE-ID) as if it were UTC: a 09:00 Berlin series lost the occurrence its UNTIL
+ * named, and a moved or excluded occurrence was not found. Offsets come from the converter the rest
+ * of Slotlock reads wall times with: a gap moves forward, a fold takes its first instant.
+ */
+class IntlTimezone extends ICAL.Timezone {
+    zone;
+    converter;
+    /** The parse's budget, which each offset found is charged to as any conversion is. */
+    budget;
+    /** Offsets already found, by wall time: ical.js asks again at every comparison. */
+    offsets = new Map();
+    constructor(tzid, budget) {
+        super({ tzid });
+        // A TZID is matched as written (" Europe/Berlin" is that TZID); Slotlock reads its zone trimmed.
+        this.zone = tzid.trim();
+        this.converter = createTimeZoneConverter(this.zone);
+        this.budget = budget;
+    }
+    utcOffset(time) {
+        const wall = utcFrame(time.year, time.month, time.day, time.hour, time.minute, time.second, 0);
+        const wallMs = wall.getTime();
+        let offset = this.offsets.get(wallMs);
+        if (offset === undefined) {
+            // ical.js compares a series' times at every step of its search, each in this zone.
+            this.budget.chargeZoneRead(this.zone, wallMs - ZONE_OFFSET_REACH_MS, wallMs + ZONE_OFFSET_REACH_MS);
+            offset = Math.round((wallMs - this.converter.wallFrameToUtc(wallMs).getTime()) / 1000);
+            if (this.offsets.size >= 4_096)
+                this.offsets.clear();
+            this.offsets.set(wallMs, offset);
+        }
+        return offset;
+    }
+}
+/** VEVENT properties whose times ical.js compares with one another. */
+const COMPARED_TIME_PROPERTIES = ['dtstart', 'dtend', 'recurrence-id', 'rdate', 'exdate'];
+const knownTimezones = new Map();
+/**
+ * Whether Intl reads `timezone` (trimmed) as a zone: how a feed's TZID is read, leniently. Asking
+ * builds a formatter (about 30 microseconds), and every occurrence of a series asks again, so each
+ * name's answer is kept: Intl gives one name the same answer for the life of a process. The map is
+ * emptied when it fills, like the formatters (a feed names at most MAX_ICAL_TIMEZONES zones).
+ */
+function isKnownTimezone(timezone) {
+    const name = timezone.trim();
+    if (!name || Buffer.byteLength(name, 'utf8') > 255)
+        return false;
+    const known = knownTimezones.get(name);
+    if (known !== undefined)
+        return known;
+    let answer;
+    try {
+        new Intl.DateTimeFormat('en-GB', { timeZone: name }).format(0);
+        answer = true;
+    }
+    catch {
+        answer = false;
+    }
+    if (knownTimezones.size >= 256)
+        knownTimezones.clear();
+    knownTimezones.set(name, answer);
+    return answer;
+}
+/** Wall-clock fields as a jCal DATE-TIME, `2027-01-04T09:00:00`, with a `Z` when they are UTC's. */
+function jCalDateTime(fields, utc = false) {
+    const pad = (value, width = 2) => String(value).padStart(width, '0');
+    const date = `${pad(fields.year, 4)}-${pad(fields.month)}-${pad(fields.day)}`;
+    const time = `${pad(fields.hour)}:${pad(fields.minute)}:${pad(fields.second)}`;
+    return `${date}T${time}${utc ? 'Z' : ''}`;
+}
+/** The instant an ical.js time names, read in its own zone; undefined when it has none. */
+function zonedInstant(time) {
+    return ownZone(time) === undefined ? undefined : new Date(time.toUnixTime() * 1000);
+}
+/** `value` (a jCal date-time) as the date it falls on in `timezone`; undefined if it cannot say. */
+function localDateOf(value, tzid, timezone) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(Z?)$/.exec(value);
+    if (!match)
+        return undefined;
+    const [year, month, day, hour, minute, second] = match.slice(1, 7).map(Number);
+    const fields = { year, month, day, hour, minute, second };
+    let instant;
+    if (match[7] === 'Z') {
+        instant = utcFrame(year, month, day, hour, minute, second, 0);
+    }
+    else if (typeof tzid === 'string' && isKnownTimezone(tzid)) {
+        instant = zonedDateTimeToUtc(fields, tzid.trim());
+    }
+    else {
+        // Floating: the wall time is the calendar's own, and so is its date.
+        return value.slice(0, 10);
+    }
+    return jCalDateTime(zonedDateTimeFields(instant, timezone)).slice(0, 10);
+}
+/**
+ * Prepare a calendar's events before anything reads their times, so ical.js compares them at their
+ * real instants:
+ * - a floating time is framed in the calendar's zone, the zone Slotlock reads it in;
+ * - each zone the events name that Intl knows becomes an IntlTimezone, whether or not the feed
+ *   defines it; a feed names no more zones it does not define than it may define
+ *   (MAX_ICAL_TIMEZONES): 50,000 spellings of one zone, each a zone of its own to ical.js, took
+ *   3.4 seconds;
+ * - an all-day series' UTC or zoned UNTIL, EXDATE and RECURRENCE-ID become the local dates they
+ *   fall on (RFC 5545 wants them as dates; a local midnight east of UTC is the day before in UTC);
+ * - a PERIOD RDATE becomes its start, its end kept in the map returned, by event: ical.js orders a
+ *   period among times by whether a time falls inside it, and hands back the period itself;
+ * - then, every zone resolving, a timed series' own times are aligned (alignSeriesTimes).
+ * Every DATE and DATE-TIME value this reads is one boundComponents has counted.
+ */
+function frameEventTimes(root, components, calendarTimezone, budget) {
+    const timezone = calendarTimezone !== undefined && isKnownTimezone(calendarTimezone)
+        ? calendarTimezone
+        : undefined;
+    const declared = new Set(root.getAllSubcomponents('vtimezone').map((zone) => zone.getFirstPropertyValue('tzid')));
+    const named = new Set();
+    let undeclared = 0;
+    const nameZone = (tzid) => {
+        if (named.has(tzid))
+            return;
+        named.add(tzid);
+        if (!declared.has(tzid) && ++undeclared > MAX_ICAL_TIMEZONES)
+            expansionLimit();
+    };
+    const periods = new Map();
+    const allDayMasters = new Set();
+    for (const component of components) {
+        for (const name of COMPARED_TIME_PROPERTIES) {
+            for (const property of component.getAllProperties(name)) {
+                const values = property.jCal.slice(3);
+                const starts = values.map((value) => (Array.isArray(value) ? value[0] : value));
+                const tzid = property.getParameter('tzid');
+                if (typeof tzid === 'string') {
+                    nameZone(tzid);
+                }
+                else if (timezone &&
+                    (property.type === 'date-time' || property.type === 'period') &&
+                    starts.some((start) => typeof start === 'string' && !start.endsWith('Z'))) {
+                    property.setParameter('tzid', timezone);
+                    nameZone(timezone);
+                }
+                if (name === 'rdate' && property.type === 'period') {
+                    const kept = periods.get(component) ?? [];
+                    for (const value of values) {
+                        const [start, end] = Array.isArray(value) ? value : [];
+                        if (typeof start !== 'string' || typeof end !== 'string') {
+                            throw new CalendarContractError('invalid_icalendar');
+                        }
+                        kept.push({ property, start, end });
+                    }
+                    periods.set(component, kept);
+                    property.resetType('date-time');
+                    for (const value of values)
+                        property.jCal.push(value[0]);
+                }
+            }
+        }
+        if (!component.hasProperty('recurrence-id') &&
+            component.getFirstProperty('dtstart')?.type === 'date') {
+            const uid = component.getFirstPropertyValue('uid');
+            if (typeof uid === 'string')
+                allDayMasters.add(uid);
+        }
+    }
+    if (timezone) {
+        const toDate = (property) => {
+            if (property.type !== 'date-time')
+                return;
+            const tzid = property.getParameter('tzid');
+            const dates = property.jCal.slice(3).map((value) => typeof value === 'string' ? localDateOf(value, tzid, timezone) : undefined);
+            if (dates.some((date) => date === undefined))
+                return;
+            property.resetType('date');
+            property.removeParameter('tzid');
+            for (const date of dates)
+                property.jCal.push(date);
+        };
+        for (const component of components) {
+            const uid = component.getFirstPropertyValue('uid');
+            if (typeof uid !== 'string' || !allDayMasters.has(uid))
+                continue;
+            if (component.hasProperty('recurrence-id')) {
+                for (const property of component.getAllProperties('recurrence-id'))
+                    toDate(property);
+                continue;
+            }
+            for (const property of component.getAllProperties('exdate'))
+                toDate(property);
+            for (const property of component.getAllProperties('rrule')) {
+                const rule = property.jCal[3];
+                if (typeof rule?.until === 'string' && rule.until.length > 10) {
+                    const date = localDateOf(rule.until, undefined, timezone);
+                    if (date !== undefined)
+                        rule.until = date;
+                }
+            }
+        }
+    }
+    const cache = root._timezoneCache;
+    for (const tzid of named) {
+        // A zone Intl knows by this name is read through Intl, as calendarTimeValue reads it, even when
+        // the feed defines it: ical.js read a stale VTIMEZONE's rules (standard time only) while
+        // Slotlock read Intl's, so the two placed one time an hour apart and a moved occurrence was
+        // found in a feed but not in the series stored from it.
+        if (ICAL.TimezoneService.has(tzid) || !isKnownTimezone(tzid))
+            continue;
+        // ical.js keeps a calendar's zones here; without it, it could not use one of these.
+        if (!(cache instanceof Map))
+            throw new CalendarContractError('invalid_icalendar');
+        cache.set(tzid, new IntlTimezone(tzid, budget));
+    }
+    alignSeriesTimes(components);
+    return periods;
+}
+/**
+ * With every zone resolving, put what ical.js compares with a timed series' own times in the terms
+ * it compares them in:
+ * - a floating UNTIL becomes the UTC instant it names on the series' clock: RFC 5545 §3.3.10 reads
+ *   it as DTSTART is read, and ical.js read it as UTC, so a New York series lost its last day;
+ * - a RECURRENCE-ID named in another zone becomes the same instant in UTC, which ical.js matches
+ *   with an occurrence (it matched one in New York time with none); one for this and every later
+ *   occurrence (RANGE=THISANDFUTURE) becomes the series' own wall time instead, since ical.js moves
+ *   those by the wall-clock distance from it to the exception's start, read in the start's zone.
+ * A DATE EXDATE of a timed series becomes the series' start time that day: ical.js excluded every
+ * occurrence that day, and a series stored from the feed, whose exceptions are instants, excluded
+ * none (most series occur once a day; one that occurs more keeps the others). And a series of
+ * RDATEs with no RRULE gets its DTSTART as one: it is the first instance (RFC 5545 §3.8.2.4), which
+ * ical.js left out.
+ */
+function alignSeriesTimes(components) {
+    const seriesStarts = new Map();
+    for (const component of components) {
+        if (component.hasProperty('recurrence-id'))
+            continue;
+        const uid = component.getFirstPropertyValue('uid');
+        const start = component.getFirstProperty('dtstart');
+        const value = start?.jCal[3];
+        if (typeof uid !== 'string' || !start || typeof value !== 'string')
+            continue;
+        if (component.hasProperty('rdate') && !component.hasProperty('rrule')) {
+            const parameters = { ...start.jCal[1] };
+            component.addProperty(new ICAL.Property(['rdate', parameters, start.type, value]));
+        }
+        if (start.type !== 'date-time')
+            continue;
+        const time = ICAL.Time.fromDateTimeString(value, start);
+        if (zonedInstant(time) === undefined)
+            continue;
+        seriesStarts.set(uid, { time, tzid: start.getParameter('tzid') });
+        for (const property of component.getAllProperties('exdate')) {
+            const days = property.jCal.slice(3);
+            if (property.type !== 'date' || !days.every((day) => typeof day === 'string'))
+                continue;
+            property.resetType('date-time');
+            const zone = start.getParameter('tzid');
+            if (typeof zone === 'string')
+                property.setParameter('tzid', zone);
+            for (const day of days)
+                property.jCal.push(`${day}${value.slice(10)}`);
+        }
+        for (const property of component.getAllProperties('rrule')) {
+            const rule = property.jCal[3];
+            const until = rule?.until;
+            if (typeof until === 'string' && until.length === 10 && rule) {
+                // A DATE UNTIL on a timed series (RFC 5545 §3.3.10 wants DTSTART's value type, and UTC for
+                // a zoned one) names its whole day on the series' clock: up to the instant before the
+                // next day begins there. Read as midnight UTC, it lost that day in most zones.
+                const next = utcFrame(Number(until.slice(0, 4)), Number(until.slice(5, 7)), Number(until.slice(8, 10)) + 1, 0, 0, 0, 0);
+                // A DTSTART in UTC keeps the series' clock in UTC.
+                const midnight = value.endsWith('Z')
+                    ? next
+                    : zonedInstant(ICAL.Time.fromDateTimeString(jCalDateTime(zonedDateTimeFields(next, 'UTC')), start));
+                if (midnight !== undefined) {
+                    rule.until = jCalDateTime(zonedDateTimeFields(new Date(midnight.getTime() - 1000), 'UTC'), true);
+                }
+                continue;
+            }
+            if (typeof until !== 'string' || until.length <= 10 || until.endsWith('Z'))
+                continue;
+            const instant = zonedInstant(ICAL.Time.fromDateTimeString(until, start));
+            if (instant !== undefined && rule) {
+                rule.until = jCalDateTime(zonedDateTimeFields(instant, 'UTC'), true);
+            }
+        }
+    }
+    for (const component of components) {
+        const uid = component.getFirstPropertyValue('uid');
+        const series = typeof uid === 'string' ? seriesStarts.get(uid) : undefined;
+        if (series === undefined)
+            continue;
+        for (const property of component.getAllProperties('recurrence-id')) {
+            const value = property.jCal[3];
+            if (property.type !== 'date-time' || typeof value !== 'string')
+                continue;
+            // Named in the series' own zone, it is matched by its wall time as it stands.
+            if (typeof series.tzid === 'string' && property.getParameter('tzid') === series.tzid)
+                continue;
+            const time = ICAL.Time.fromDateTimeString(value, property);
+            const instant = zonedInstant(time);
+            if (instant === undefined)
+                continue;
+            const seriesZone = series.time.zone;
+            const zone = property.getParameter('range') === undefined ? ICAL.Timezone.utcTimezone : seriesZone;
+            if (time.zone?.tzid === zone.tzid)
+                continue;
+            let written;
+            if (zone.tzid === 'UTC') {
+                written = jCalDateTime(zonedDateTimeFields(instant, 'UTC'), true);
+            }
+            else if (zone instanceof IntlTimezone) {
+                written = jCalDateTime(zonedDateTimeFields(instant, zone.tzid.trim()));
+            }
+            else {
+                // A zone the calendar defines is ical.js's to read.
+                written = time.convertToZone(zone).toString();
+            }
+            property.resetType('date-time');
+            if (zone.tzid === 'UTC')
+                property.removeParameter('tzid');
+            else
+                property.setParameter('tzid', series.tzid);
+            property.jCal.push(written);
+        }
+    }
+}
+/**
+ * Parse VEVENTs with the standards library; event content is deliberately discarded. All or
+ * nothing: a series Slotlock cannot read refuses the whole calendar, so a caller that reads the
+ * result as the calendar's busy time never takes a refused series' time as free. To keep the rest
+ * of a calendar when one series is refused, use parseICalendarFeed.
+ */
 export function parseICalendarChanges(input, calendarTimezone, expansionWindow) {
     return parseCalendarChanges(input, calendarTimezone, expansionWindow, FEED_LIMITS);
 }
-function parseCalendarChanges(input, calendarTimezone, expansionWindow, limits, series) {
+/**
+ * parseICalendarChanges, refusing one series at a time: a series Slotlock cannot read (a rule
+ * shape ical.js expands wrongly, an event whose end the clocks move before its start, DTEND with
+ * DURATION, or one that needs more than its budget) is named in `refused` and the rest of the
+ * calendar is read. A calendar that is not one (its size, its time zones, a missing UID, a window
+ * past 367 days) is still refused whole, with CalendarContractError.
+ */
+export function parseICalendarFeed(input, calendarTimezone, expansionWindow) {
+    const refused = [];
+    const changes = parseCalendarChanges(input, calendarTimezone, expansionWindow, FEED_LIMITS, undefined, refused);
+    return { changes, refused };
+}
+const DAY_MS = 24 * 60 * 60 * 1000;
+function parseCalendarChanges(input, calendarTimezone, expansionWindow, limits, series, refused) {
     try {
         // Bound work before ical.js allocates and normalizes the full component tree. The parsed-tree
         // checks below remain authoritative; these cheap standards-shaped counts are an early DoS guard.
         boundInput(input);
-        const budget = new RecurrenceBudget(limits);
+        const budget = limits instanceof RecurrenceBudget ? limits : new RecurrenceBudget(limits);
         const root = new ICAL.Component(ICAL.parse(input));
-        budget.check();
+        // A bare VEVENT (or anything else) would read as a calendar with no events.
+        if (root.name !== 'vcalendar')
+            throw new CalendarContractError('invalid_icalendar');
         let Budgeted;
         const budgeted = () => (Budgeted ??= budgetedRecurIterator(budget));
         budgetTimezoneRules(root, budgeted);
         budgetTimezoneCoverage(root, budget);
-        const timeValue = (value, zone, fallback) => budget.search(() => calendarTimeValue(value, zone, fallback));
+        // A time read in a zone of its own (a VTIMEZONE's, or an IntlTimezone) is read in that zone: an
+        // RDATE may name another zone than its series' DTSTART, and an occurrence keeps the RDATE's.
+        // Every time is read through the budget, which charges its conversions.
+        const timeValue = (value, zone, fallback) => calendarTimeValue(value, ownZone(value) ?? zone, fallback, budget);
+        const readerOf = (value, zone) => budget.zoneReader(zoneReader(value, ownZone(value) ?? zone, defaultTimezone));
         const embeddedTimezone = root.getFirstPropertyValue('x-wr-timezone');
         const defaultTimezone = calendarTimezone?.trim() ||
             (typeof embeddedTimezone === 'string' ? embeddedTimezone.trim() : '') ||
@@ -1176,65 +1983,282 @@ function parseCalendarChanges(input, calendarTimezone, expansionWindow, limits,
         if (components.length > MAX_ICAL_COMPONENTS) {
             throw new CalendarContractError('invalid_icalendar');
         }
-        boundComponents(components, budget);
-        const events = feedEvents(components, budget);
-        const masters = new Map();
-        const exceptionsByUid = new Map();
+        boundComponents(components);
+        const periods = frameEventTimes(root, components, defaultTimezone, budget);
+        const events = feedEvents(components);
+        // A series is a master and the overrides (RECURRENCE-ID components) that share its UID. Each is
+        // read on its own: with `refused`, a series Slotlock cannot read is named there and the rest of
+        // the calendar is read; without, it refuses the calendar.
+        const groups = new Map();
         for (const event of events) {
+            const uid = event.uid;
+            // An event without a UID cannot be named, so it refuses the calendar either way.
+            if (typeof uid !== 'string')
+                throw new CalendarContractError('invalid_icalendar');
+            const group = groups.get(uid) ?? { masters: [], overrides: [] };
             if (event.isRecurrenceException()) {
-                const exceptions = exceptionsByUid.get(event.uid) ?? [];
-                if (exceptions.length >= MAX_ICAL_EXCEPTIONS_PER_SERIES) {
+                if (group.overrides.length >= MAX_ICAL_EXCEPTIONS_PER_SERIES) {
                     throw new CalendarContractError('invalid_icalendar');
                 }
-                exceptions.push(event);
-                exceptionsByUid.set(event.uid, exceptions);
+                group.overrides.push(event);
             }
             else {
-                if (masters.has(event.uid))
-                    throw new CalendarContractError('invalid_icalendar');
-                masters.set(event.uid, event);
+                group.masters.push(event);
             }
+            groups.set(uid, group);
         }
-        for (const [uid, exceptions] of exceptionsByUid) {
-            const master = masters.get(uid);
-            if (!master)
-                continue;
-            for (const exception of exceptions) {
-                // An exception for this and every later occurrence (RANGE=THISANDFUTURE) is placed by its
-                // time, which reads its zone.
-                master.relateException(exception);
-                budget.check();
-            }
-        }
-        const normalizeEvent = (event, startValue, endValue, recurrenceValue) => {
-            const component = event.component;
-            const startProperty = component.getFirstProperty('dtstart');
-            const endProperty = component.getFirstProperty('dtend');
-            const recurrenceProperty = component.getFirstProperty('recurrence-id');
+        /**
+         * A change for `start` to `end`, with the status, transparency and sequence of `component`, or
+         * null when it has no length: RFC 5545 §3.6.1 ends a DATE-TIME DTSTART without DTEND or DURATION
+         * when it starts, so it occupies no time. A cancelled one still says so, with no time.
+         */
+        const makeChange = (component, uid, start, end, recurrenceId) => {
             const status = String(component.getFirstPropertyValue('status') ?? 'confirmed').toLowerCase();
             const transparency = String(component.getFirstPropertyValue('transp') ?? 'opaque').toLowerCase();
             const change = {
-                externalId: event.uid,
-                start: timeValue(startValue, startProperty?.getParameter('tzid'), defaultTimezone),
-                end: timeValue(endValue, endProperty?.getParameter('tzid') ?? startProperty?.getParameter('tzid'), defaultTimezone),
+                externalId: uid,
+                start: new Date(start),
+                end: new Date(end),
                 status,
                 transparent: transparency === 'transparent',
                 sequence: Number(component.getFirstPropertyValue('sequence') ?? 0),
             };
-            if (recurrenceValue) {
-                change.recurrenceId = timeValue(recurrenceValue, recurrenceProperty?.getParameter('tzid') ?? startProperty?.getParameter('tzid'), defaultTimezone).toISOString();
+            if (end === start) {
+                if (status !== 'cancelled')
+                    return null;
+                change.start = null;
+                change.end = null;
+            }
+            if (recurrenceId !== undefined)
+                change.recurrenceId = new Date(recurrenceId).toISOString();
+            try {
+                return normalizeExternalCalendarChange(change);
+            }
+            catch (error) {
+                if (error instanceof CalendarContractError) {
+                    throw new CalendarContractError('invalid_icalendar');
+                }
+                throw error;
+            }
+        };
+        /**
+         * How long an event's occurrences last (SPEC.md, "Daylight-saving time"). DTSTART is read as
+         * written (the store's own instant for a stored series), DTEND as an instant per RFC 5545 §3.3.5,
+         * and a DURATION per §3.3.6: its days on the calendar, its hours, minutes and seconds exact.
+         */
+        const lengthsOf = (event, anchor) => {
+            const component = event.component;
+            const startTime = event.startDate;
+            if (!(startTime instanceof ICAL.Time))
+                throw new CalendarContractError('invalid_icalendar');
+            const startZone = component.getFirstProperty('dtstart')?.getParameter('tzid');
+            const reader = readerOf(startTime, startZone);
+            const startWall = wallFrameOf(startTime);
+            const start = anchor ? anchor.start.getTime() : reader.toInstant(startWall);
+            const allDay = startTime.isDate;
+            const endProperty = component.getFirstProperty('dtend');
+            const duration = component.getFirstPropertyValue('duration');
+            const base = { allDay, reader, startWall, start };
+            if (endProperty) {
+                const endTime = endProperty.getFirstValue();
+                if (!(endTime instanceof ICAL.Time))
+                    throw new CalendarContractError('invalid_icalendar');
+                if (allDay) {
+                    const wall = wallFrameOf(endTime) - startWall;
+                    if (wall < 0)
+                        throw new CalendarContractError('invalid_icalendar');
+                    return { ...base, wall, ends: true };
+                }
+                const endZone = endProperty.getParameter('tzid') ?? startZone;
+                const end = anchor
+                    ? anchor.end.getTime()
+                    : readerOf(endTime, endZone).toInstant(wallFrameOf(endTime));
+                // An end the clocks moved onto its start (both in the hour they skip), or before it, is
+                // refused: the event as written cannot be read. An end written as its start is no length.
+                const sameZone = (ownZone(endTime) ?? endZone) === (ownZone(startTime) ?? startZone);
+                const writtenAsStart = wallFrameOf(endTime) === startWall && sameZone;
+                if (end < start || (end === start && !writtenAsStart)) {
+                    throw new CalendarContractError('invalid_icalendar');
+                }
+                // DTEND's wall time as written, when it is written in DTSTART's zone: one in the hour the
+                // clocks skip is carried to later days as written, though its own instant reads an hour
+                // later (RFC 5545 §3.3.5). In another zone, or for a stored series (instants), it is the
+                // wall time its instant reads in DTSTART's zone.
+                const endWall = !anchor && sameZone ? wallFrameOf(endTime) : reader.toWall(end);
+                return { ...base, exact: end - start, wall: endWall - startWall, ends: end > start };
+            }
+            if (duration instanceof ICAL.Duration) {
+                const days = duration.weeks * 7 + duration.days;
+                const ms = ((duration.hours * 60 + duration.minutes) * 60 + duration.seconds) * 1000;
+                if (allDay)
+                    return { ...base, wall: (days + (ms > 0 ? 1 : 0)) * DAY_MS, ends: true };
+                return {
+                    ...base,
+                    duration: { days, ms },
+                    wall: days * DAY_MS + ms,
+                    ends: days > 0 || ms > 0,
+                };
+            }
+            // No end: a DATE-TIME occupies no time (§3.6.1), a DATE its one day.
+            return allDay
+                ? { ...base, wall: DAY_MS, ends: true }
+                : { ...base, exact: 0, wall: 0, ends: false };
+        };
+        /** The exact end of an occurrence that starts at `start`, wall time `wall`: what a one-off takes. */
+        const exactEnd = (lengths, reader, wall, start) => {
+            if (lengths.allDay)
+                return reader.toInstant(wall + lengths.wall);
+            if (lengths.duration) {
+                const { days, ms } = lengths.duration;
+                return (days > 0 ? reader.toInstant(wall + days * DAY_MS) : start) + ms;
             }
-            return normalizeExternalCalendarChange(change);
+            return start + (lengths.exact ?? 0);
+        };
+        /**
+         * The end of a generated occurrence: the later of its exact end and its wall-clock end (DTEND's
+         * wall time carried to the occurrence's date, read at the later instant of an hour the clocks
+         * repeat). One reading or the other leaves time free that people mean as busy wherever the clocks
+         * change inside an occurrence; their union does not.
+         */
+        const occurrenceEnd = (lengths, reader, wall, start) => {
+            const exact = exactEnd(lengths, reader, wall, start);
+            if (lengths.allDay || !lengths.ends)
+                return exact;
+            return Math.max(exact, reader.toInstant(wall + lengths.wall, { fold: 'later' }));
+        };
+        /**
+         * An override as Slotlock reads it: the instant of the occurrence it replaces, and its own
+         * interval, exact as written. One without DTEND or DURATION lasts its series' length (RFC 5545
+         * §3.6.1 alone would end it as it starts, leaving the moved occurrence free).
+         */
+        const readOverride = (override, uid, seriesLengths, seriesZone) => {
+            const component = override.component;
+            const recurrence = component.getFirstProperty('recurrence-id');
+            const at = timeValue(override.recurrenceId, recurrence?.getParameter('tzid') ??
+                component.getFirstProperty('dtstart')?.getParameter('tzid') ??
+                seriesZone, defaultTimezone).getTime();
+            const own = lengthsOf(override);
+            const lengths = own.ends || !seriesLengths
+                ? own
+                : { ...seriesLengths, reader: own.reader, startWall: own.startWall, start: own.start };
+            const end = exactEnd(lengths, own.reader, own.startWall, own.start);
+            return {
+                at,
+                start: own.start,
+                end,
+                change: makeChange(component, uid, own.start, end, at),
+                component,
+                range: String(recurrence?.getParameter('range') ?? '').toUpperCase() === 'THISANDFUTURE',
+                lengths,
+                recurrenceWall: wallFrameOf(override.recurrenceId),
+            };
         };
         const changes = [];
-        let remainingWork = MAX_ICAL_WORK;
-        for (const event of events) {
-            if (event.isRecurrenceException() && masters.has(event.uid))
-                continue;
-            if (!event.isRecurring()) {
-                changes.push(normalizeEvent(event, event.startDate, event.endDate, event.recurrenceId ?? undefined));
-                continue;
+        const overlapsWindow = (start, end) => expansionWindow !== undefined &&
+            end > expansionWindow.start.getTime() &&
+            start < expansionWindow.end.getTime();
+        /** Each PERIOD RDATE of a series, by the instant it starts: the instant it ends, exactly. */
+        const periodEndsOf = (event) => {
+            const ends = new Map();
+            const maxMs = MAX_ICAL_STEP_DAYS * DAY_MS;
+            for (const period of periods.get(event.component) ?? []) {
+                const zone = period.property.getParameter('tzid');
+                const start = ICAL.Time.fromDateTimeString(period.start, period.property);
+                const reader = readerOf(start, zone);
+                const startWall = wallFrameOf(start);
+                const startMs = reader.toInstant(startWall);
+                let endMs;
+                if (/^[+-]?P/.test(period.end)) {
+                    // Bounded first, as boundComponent bounds a DURATION.
+                    const duration = ICAL.Duration.fromString(period.end);
+                    if (duration.isNegative || duration.toSeconds() * 1000 > maxMs)
+                        expansionLimit();
+                    const days = duration.weeks * 7 + duration.days;
+                    const ms = ((duration.hours * 60 + duration.minutes) * 60 + duration.seconds) * 1000;
+                    endMs = (days > 0 ? reader.toInstant(startWall + days * DAY_MS) : startMs) + ms;
+                }
+                else {
+                    const end = ICAL.Time.fromDateTimeString(period.end, period.property);
+                    if (Math.abs(fieldsMs(end) - fieldsMs(start)) > maxMs + DAY_MS)
+                        expansionLimit();
+                    endMs = timeValue(end, zone, defaultTimezone).getTime();
+                }
+                if (endMs < startMs)
+                    throw new CalendarContractError('invalid_icalendar');
+                ends.set(startMs, endMs);
+            }
+            return ends;
+        };
+        /**
+         * A series' EXDATEs: the instants its DATE-TIME values name, and the days its DATE values name
+         * (one excludes every occurrence that day, as ical.js reads it). ical.js passes them one at a
+         * time as it goes, so an occurrence after two EXDATEs it had not passed, or the second of an
+         * instant both RRULE and RDATE name, escaped its EXDATE; RFC 5545 §3.8.5.1 has every EXDATE win.
+         */
+        const exclusionsOf = (event) => {
+            const instants = new Set();
+            const days = new Set();
+            const startZone = event.component.getFirstProperty('dtstart')?.getParameter('tzid');
+            for (const property of event.component.getAllProperties('exdate')) {
+                const zone = property.getParameter('tzid') ?? startZone;
+                for (const value of property.getValues()) {
+                    if (!(value instanceof ICAL.Time))
+                        throw new CalendarContractError('invalid_icalendar');
+                    if (value.isDate)
+                        days.add(dayOf(value));
+                    else
+                        instants.add(timeValue(value, zone, defaultTimezone).getTime());
+                }
+            }
+            return { instants, days };
+        };
+        /** A one-off event and its overrides: each occupies exactly what it says, window or not. */
+        const readOneOff = (uid, event, overrides) => {
+            const lengths = lengthsOf(event);
+            const replaced = overrides.some((override) => override.at === lengths.start);
+            if (!replaced) {
+                const end = exactEnd(lengths, lengths.reader, lengths.startWall, lengths.start);
+                const recurrenceId = event.recurrenceId ? lengths.start : undefined;
+                const change = makeChange(event.component, uid, lengths.start, end, recurrenceId);
+                if (change)
+                    changes.push(change);
+            }
+            // A server-expanded CalDAV series may send its first instance without a RECURRENCE-ID, and
+            // must send every other one with one (RFC 4791 §9.6.5): each is an override of this one-off,
+            // and occupies its own time.
+            for (const override of overrides)
+                if (override.change)
+                    changes.push(override.change);
+        };
+        const readSeries = (uid, group) => {
+            if (group.masters.length > 1)
+                throw new CalendarContractError('invalid_icalendar');
+            for (const event of [...group.masters, ...group.overrides]) {
+                // RFC 5545 §3.6.1: 'dtend' and 'duration' MUST NOT occur in the same eventprop.
+                if (event.component.hasProperty('dtend') && event.component.hasProperty('duration')) {
+                    throw new CalendarContractError('invalid_icalendar');
+                }
+            }
+            const master = group.masters[0];
+            if (!master) {
+                // Overrides of a series this calendar does not hold: each occupies its own interval.
+                for (const override of group.overrides) {
+                    const read = readOverride(override, uid, undefined, undefined);
+                    if (read.change)
+                        changes.push(read.change);
+                }
+                return;
+            }
+            const startZone = master.component.getFirstProperty('dtstart')?.getParameter('tzid');
+            if (!master.isRecurring()) {
+                const lengths = lengthsOf(master);
+                const overrides = group.overrides.map((override) => readOverride(override, uid, lengths, startZone));
+                readOneOff(uid, master, overrides);
+                return;
             }
+            readRecurring(uid, master, group.overrides, startZone);
+        };
+        const readRecurring = (uid, event, overrideEvents, startZone) => {
             if (!expansionWindow ||
                 !Number.isFinite(expansionWindow.start.getTime()) ||
                 !Number.isFinite(expansionWindow.end.getTime()) ||
@@ -1242,39 +2266,112 @@ function parseCalendarChanges(input, calendarTimezone, expansionWindow, limits,
                 expansionWindow.end.getTime() - expansionWindow.start.getTime() > MAX_ICAL_WINDOW_MS) {
                 throw new CalendarContractError('invalid_icalendar');
             }
+            const startTime = event.startDate;
+            for (const property of event.component.getAllProperties('rrule')) {
+                const recur = property.getFirstValue();
+                if (!(recur instanceof ICAL.Recur))
+                    throw new CalendarContractError('invalid_icalendar');
+                if (recurShapeProblem(recur) !== null ||
+                    (startTime instanceof ICAL.Time && seriesShapeProblem(recur, startTime) !== null)) {
+                    throw new CalendarContractError('invalid_icalendar');
+                }
+                sortRuleParts(recur);
+            }
+            // A yearly day some years lack is kept to the days the rule names (yearlyDays), which needs
+            // the rule to be the series' only source: ical.js mixes RDATEs and other rules in, and one of
+            // those on another day could not be told from a day it moved.
+            const ruleValues = event.component.getAllProperties('rrule');
+            const lacking = startTime instanceof ICAL.Time
+                ? ruleValues.map((rule) => yearlyDays(rule.getFirstValue(), startTime))
+                : [];
+            const onDays = lacking[0] ?? null;
+            if (lacking.some((days) => days !== null) &&
+                (ruleValues.length > 1 || event.component.hasProperty('rdate'))) {
+                throw new CalendarContractError('invalid_icalendar');
+            }
+            const stored = series?.stored;
+            const lengths = lengthsOf(event, stored);
+            const overrides = stored
+                ? stored.exceptions.map((exception) => storedOverride(uid, event, lengths, exception))
+                : overrideEvents.map((override) => readOverride(override, uid, lengths, startZone));
+            // What one series may pass from its start, so that one series' age never refuses another's.
+            let remainingWork = MAX_ICAL_WORK;
             let maxBackwardExceptionShiftMs = 0;
-            for (const exception of exceptionsByUid.get(event.uid) ?? []) {
+            let lastOverrideAt = Number.NEGATIVE_INFINITY;
+            for (const override of overrides) {
                 remainingWork -= 1;
                 if (remainingWork < 0)
                     expansionLimit();
-                const recurrenceProperty = exception.component.getFirstProperty('recurrence-id');
-                const startProperty = exception.component.getFirstProperty('dtstart');
-                const originalStart = timeValue(exception.recurrenceId, recurrenceProperty?.getParameter('tzid'), defaultTimezone);
-                const movedStart = timeValue(exception.startDate, startProperty?.getParameter('tzid'), defaultTimezone);
-                const backwardShiftMs = originalStart.getTime() - movedStart.getTime();
+                const backwardShiftMs = override.at - override.start;
                 if (backwardShiftMs > MAX_EXCEPTION_BACKWARD_SHIFT_MS) {
                     throw new CalendarContractError('invalid_icalendar');
                 }
-                // ical.js moves the occurrence by the shift a month at a time (Time#adjust).
-                if (-backwardShiftMs > MAX_ICAL_STEP_DAYS * 24 * 60 * 60 * 1000)
+                // ical.js moved an occurrence by the shift a month at a time (Time#adjust); a range
+                // override still moves every later one by it.
+                if (-backwardShiftMs > MAX_ICAL_STEP_DAYS * DAY_MS)
                     expansionLimit();
                 maxBackwardExceptionShiftMs = Math.max(maxBackwardExceptionShiftMs, backwardShiftMs);
+                lastOverrideAt = Math.max(lastOverrideAt, override.at);
             }
             const recurrenceScanEndMs = expansionWindow.end.getTime() + maxBackwardExceptionShiftMs;
+            // A direct override replaces the occurrence it names; a RANGE=THISANDFUTURE one also moves
+            // every later occurrence by its own shift, with its own length.
+            const byInstant = new Map(overrides.map((override) => [override.at, override]));
+            const ranges = overrides
+                .filter((override) => override.range)
+                .sort((left, right) => left.at - right.at);
+            const rangeBefore = (instant) => {
+                let found;
+                for (const range of ranges) {
+                    if (range.at < instant)
+                        found = range;
+                    else
+                        break;
+                }
+                return found;
+            };
             // A stored series (the only master) resumes from its cursor when the cursor is this series'
             // and stands where the window needs nothing before it, and leaves one for the next window.
-            const key = series && masters.size === 1 ? seriesKey(event.component) : null;
+            const key = series && groups.size === 1 ? seriesKey(event.component) : null;
             const kept = key === null ? null : readSeriesCursor(series?.cursor, key);
             const usable = kept !== null && series !== undefined && kept.position <= series.resumeLimitMs
                 ? kept
                 : null;
-            const startZone = event.component.getFirstProperty('dtstart')?.getParameter('tzid');
+            let periodEnds;
+            let exclusions;
+            // A feed's series that repeats every so many days (one RRULE, DAILY or WEEKLY, with no
+            // COUNT, RDATE or RANGE=THISANDFUTURE override) repeats the same way from DTSTART moved a
+            // whole number of its periods on the wall clock: a WEEKLY rule's weeks stay in step, a DAILY
+            // rule's BY parts only limit its days. So its search starts at the last such time from which
+            // no occurrence before it could reach the window (it lasts at most its wall-clock or exact
+            // length and a day more), and a daily standup since 2014 is read like one from this year.
+            let from;
+            const rules = event.component.getAllProperties('rrule');
+            const only = rules.length === 1 ? rules[0]?.getFirstValue() : undefined;
+            if (!series &&
+                ranges.length === 0 &&
+                !event.component.hasProperty('rdate') &&
+                startTime instanceof ICAL.Time &&
+                only instanceof ICAL.Recur &&
+                only.count == null &&
+                (only.freq === 'DAILY' || only.freq === 'WEEKLY')) {
+                const periodMs = only.interval * (only.freq === 'WEEKLY' ? 7 : 1) * DAY_MS;
+                const reachMs = Math.max(lengths.exact ?? 0, lengths.wall) + OCCURRENCE_END_SLACK_MS + periodMs;
+                const periods = Math.floor((expansionWindow.start.getTime() - reachMs - lengths.start) / periodMs);
+                if (periods > 0) {
+                    const day = new Date(lengths.startWall + periods * periodMs);
+                    from = startTime.clone();
+                    from.year = day.getUTCFullYear();
+                    from.month = day.getUTCMonth() + 1;
+                    from.day = day.getUTCDate();
+                }
+            }
             // The occurrences in the window from `resume` (or the start), and the cursor to keep; null
             // when `resume` does not fit this series.
             const expand = (resume) => {
-                const iterator = budget.search(() => resume
-                    ? resumedExpansion(event, budgeted(), resume)
-                    : budgetedExpansion(event, budgeted()));
+                const iterator = resume
+                    ? resumedExpansion(event, budgeted(), budget, resume)
+                    : budgetedExpansion(event, budgeted(), budget, from);
                 if (iterator === null)
                     return null;
                 // The cursor stands on the occurrence it last passed: the same time, read the same way.
@@ -1282,40 +2379,142 @@ function parseCalendarChanges(input, calendarTimezone, expansionWindow, limits,
                     timeValue(iterator.last, startZone, defaultTimezone).getTime() !== resume.position) {
                     return null;
                 }
+                // A stored series' exceptions are checked against every occurrence up to the last of them
+                // when it is searched from its start, so one that names no occurrence is refused.
+                const scanEndMs = stored && !resume
+                    ? Math.max(recurrenceScanEndMs, lastOverrideAt + 1)
+                    : recurrenceScanEndMs;
                 const found = [];
+                const matched = new Set();
                 let position = resume?.position;
+                const seen = new Set();
                 let snapshot = resume;
                 let leaving = key !== null;
+                // Every occurrence starting before this instant has been seen (all of them once the series
+                // has ended).
+                let scannedTo = Number.NEGATIVE_INFINITY;
+                // DTSTART is the first instance (RFC 5545 §3.8.5.3), whether or not the rule gives it.
+                let first = resume === null && from === undefined && startTime instanceof ICAL.Time
+                    ? startTime
+                    : null;
+                const firstAt = first ? timeValue(first, startZone, defaultTimezone).getTime() : 0;
+                // Each zone the series' times are in is read with one reader for the whole series: an
+                // RRULE's occurrences are in DTSTART's zone, an RDATE's in its own.
+                const readers = new Map();
+                const readerFor = (time) => {
+                    let reader = readers.get(time.zone);
+                    if (!reader) {
+                        reader = readerOf(time, startZone);
+                        readers.set(time.zone, reader);
+                    }
+                    return reader;
+                };
+                let held;
                 while (true) {
                     remainingWork -= 1;
                     if (remainingWork < 0)
                         expansionLimit();
+                    budget.charge(OCCURRENCE_STEPS);
                     // Before the next step, everything the iterator has passed may end before the window:
                     // then this is where the next expansion can start.
-                    if (leaving && key !== null && series && position !== undefined) {
+                    if (leaving && key !== null && series && position !== undefined && held === undefined) {
                         if (position <= series.resumeLimitMs)
                             snapshot = snapshotSeries(iterator, key, position);
                         else
                             leaving = false;
                     }
-                    const occurrence = budget.search(() => iterator.next());
-                    if (!occurrence)
+                    let occurrence;
+                    let isFirst = false;
+                    if (held !== undefined) {
+                        occurrence = held;
+                        held = undefined;
+                    }
+                    else {
+                        occurrence = iterator.next() ?? null;
+                        if (first) {
+                            const at = occurrence
+                                ? timeValue(occurrence, startZone, defaultTimezone).getTime()
+                                : 0;
+                            if (occurrence && at === firstAt) {
+                                isFirst = true;
+                                first = null;
+                            }
+                            else if (!occurrence || at > firstAt) {
+                                held = occurrence;
+                                occurrence = first;
+                                isFirst = true;
+                                first = null;
+                            }
+                        }
+                    }
+                    if (!occurrence) {
+                        scannedTo = Number.POSITIVE_INFINITY;
                         break;
-                    const occurrenceStart = timeValue(occurrence, startZone, defaultTimezone);
-                    position = occurrenceStart.getTime();
-                    if (occurrenceStart.getTime() >= recurrenceScanEndMs)
+                    }
+                    const reader = readerFor(occurrence);
+                    const wall = wallFrameOf(occurrence);
+                    position = reader.toInstant(wall);
+                    if (!Number.isFinite(position))
+                        throw new CalendarContractError('invalid_icalendar');
+                    if (position >= scanEndMs) {
+                        scannedTo = position;
                         break;
-                    const details = event.getOccurrenceDetails(occurrence);
-                    const start = timeValue(details.startDate, details.item.component.getFirstProperty('dtstart')?.getParameter('tzid'), defaultTimezone);
-                    const end = timeValue(details.endDate, details.item.component.getFirstProperty('dtend')?.getParameter('tzid') ??
-                        details.item.component.getFirstProperty('dtstart')?.getParameter('tzid'), defaultTimezone);
-                    if (end > expansionWindow.start && start < expansionWindow.end) {
-                        found.push(normalizeEvent(details.item, details.startDate, details.endDate, occurrence));
+                    }
+                    if (onDays &&
+                        !isFirst &&
+                        !(onDays.months.has(occurrence.month) && onDays.days.has(occurrence.day))) {
+                        continue;
+                    }
+                    // The first instance is DTSTART's own instant: for a stored series, the instant stored.
+                    const at = isFirst ? lengths.start : position;
+                    // An instant is one occurrence however many RRULEs and RDATEs name it (RFC 5545
+                    // §3.8.5.3; ical.js yields it again, and a spring-forward can move a wall time onto one
+                    // the rule names later), and none where an EXDATE names it.
+                    if (seen.has(at))
+                        continue;
+                    seen.add(at);
+                    if (event.component.hasProperty('exdate')) {
+                        exclusions ??= exclusionsOf(event);
+                        if (exclusions.instants.has(at) || exclusions.days.has(dayOf(occurrence)))
+                            continue;
+                    }
+                    const override = byInstant.get(at);
+                    if (override) {
+                        matched.add(override);
+                        if (override.change && overlapsWindow(override.start, override.end)) {
+                            found.push(override.change);
+                        }
+                        continue;
+                    }
+                    // A PERIOD RDATE's occurrence ends where its period does.
+                    const periodEnd = (periodEnds ??= periodEndsOf(event)).get(position);
+                    const range = periodEnd === undefined ? rangeBefore(at) : undefined;
+                    let start = at;
+                    let end;
+                    let component = event.component;
+                    if (periodEnd !== undefined) {
+                        end = periodEnd;
+                    }
+                    else if (range) {
+                        // Moved by the range override's own shift on the wall clock, in its zone (as ical.js
+                        // moves it), lasting the override's length.
+                        const shifted = wall + (range.lengths.startWall - range.recurrenceWall);
+                        start = range.lengths.reader.toInstant(shifted);
+                        end = occurrenceEnd(range.lengths, range.lengths.reader, shifted, start);
+                        component = range.component;
+                    }
+                    else {
+                        end = occurrenceEnd(lengths, reader, wall, start);
+                    }
+                    if (overlapsWindow(start, end)) {
+                        const change = makeChange(component, uid, start, end, at);
+                        if (change)
+                            found.push(change);
                         if (changes.length + found.length > MAX_ICAL_OCCURRENCES)
                             expansionLimit();
                     }
                 }
-                return { found, snapshot };
+                return { found, snapshot, matched, scannedTo };
             };
             let expanded = null;
             if (usable !== null) {
@@ -1338,10 +2537,70 @@ function parseCalendarChanges(input, calendarTimezone, expansionWindow, limits,
             if (expanded === null)
                 throw new CalendarContractError('invalid_icalendar');
             changes.push(...expanded.found);
+            for (const override of overrides) {
+                if (expanded.matched.has(override))
+                    continue;
+                // An override whose occurrence an EXDATE removes, or that names none, still occupies its
+                // own interval, as the provider shows it. A stored exception that names no occurrence is
+                // refused wherever this expansion could tell (before the series starts, or before the first
+                // occurrence it did not reach), or collected in `series.unmatched` when that is given.
+                const passed = resumed ? override.at <= (usable?.position ?? 0) : false;
+                if (stored &&
+                    !passed &&
+                    (override.at < lengths.start || override.at < expanded.scannedTo)) {
+                    if (!series?.unmatched)
+                        throw new CalendarContractError('invalid_icalendar');
+                    series.unmatched.add(override.at);
+                    continue;
+                }
+                if (override.change && overlapsWindow(override.start, override.end)) {
+                    changes.push(override.change);
+                }
+            }
             if (series && key !== null) {
                 series.resumed = resumed;
                 series.left = keptSeriesCursor(expanded.snapshot);
             }
+        };
+        /** A stored series' exception, read from its instants: they are what the store holds. */
+        const storedOverride = (uid, event, lengths, exception) => {
+            const at = exception.recurrenceId.getTime();
+            const start = exception.start?.getTime() ?? at;
+            const end = exception.end?.getTime() ?? at + (lengths.exact ?? 0);
+            // A cancelled exception is a cancellation with no time, whatever the series' status.
+            const change = exception.cancelled
+                ? normalizeExternalCalendarChange({
+                    externalId: uid,
+                    recurrenceId: new Date(at).toISOString(),
+                    status: 'cancelled',
+                })
+                : makeChange(event.component, uid, start, end, at);
+            return {
+                at,
+                start,
+                end,
+                change,
+                component: event.component,
+                range: false,
+                lengths,
+                recurrenceWall: 0,
+            };
+        };
+        for (const [uid, group] of groups) {
+            const before = changes.length;
+            try {
+                readSeries(uid, group);
+                separateOccurrences(changes, before, expansionWindow);
+            }
+            catch (error) {
+                if (!refused || !(error instanceof CalendarContractError))
+                    throw error;
+                changes.length = before;
+                const refusal = { uid, code: error.code };
+                if (error instanceof CalendarExpansionLimitError)
+                    refusal.limit = true;
+                refused.push(refusal);
+            }
         }
         return changes;
     }
@@ -1351,6 +2610,41 @@ function parseCalendarChanges(input, calendarTimezone, expansionWindow, limits,
         throw new CalendarContractError('invalid_icalendar');
     }
 }
+/**
+ * Make one series' busy occurrences, `changes` from `from` on, disjoint without freeing a minute of
+ * them: where one ends after the next starts, it ends where the next starts, and the next ends at
+ * the later of the two ends. The union rule makes an occurrence of about a day or longer reach
+ * into the next one where the clocks go forward (24 exact hours from midnight end at 01:00 the
+ * next day), and the store holds each occurrence as a reservation under one EXCLUDE constraint,
+ * which refuses two that overlap. Two that start at the same instant are left as they are. An
+ * occurrence cut to end before the window is dropped: the next one holds its time there.
+ */
+function separateOccurrences(changes, from, window) {
+    const busy = changes
+        .slice(from)
+        .filter((change) => change.busy && change.start !== null && change.end !== null)
+        .sort((left, right) => left.start.getTime() - right.start.getTime());
+    const cut = new Set();
+    for (let index = 1; index < busy.length; index++) {
+        const before = busy[index - 1];
+        const change = busy[index];
+        const start = change.start.getTime();
+        const reach = before.end.getTime();
+        if (reach <= start || before.start.getTime() === start)
+            continue;
+        if (reach > change.end.getTime())
+            change.end = new Date(reach);
+        before.end = new Date(start);
+        cut.add(before);
+    }
+    if (!window || cut.size === 0)
+        return;
+    for (let index = changes.length - 1; index >= from; index--) {
+        const change = changes[index];
+        if (cut.has(change) && change.end <= window.start)
+            changes.splice(index, 1);
+    }
+}
 function requiredEventText(value, code) {
     const normalized = value.trim();
     if (!normalized || Buffer.byteLength(normalized, 'utf8') > MAX_TRUSTED_SUMMARY_BYTES) {
@@ -1358,31 +2652,6 @@ function requiredEventText(value, code) {
     }
     return normalized;
 }
-function partsInZone(value, timezone) {
-    const formatter = new Intl.DateTimeFormat('en-GB', {
-        timeZone: timezone,
-        hourCycle: 'h23',
-        year: 'numeric',
-        month: '2-digit',
-        day: '2-digit',
-        hour: '2-digit',
-        minute: '2-digit',
-        second: '2-digit',
-    });
-    const values = {};
-    for (const part of formatter.formatToParts(value)) {
-        if (part.type !== 'literal')
-            values[part.type] = Number(part.value);
-    }
-    return {
-        year: values.year ?? 0,
-        month: values.month ?? 0,
-        day: values.day ?? 0,
-        hour: (values.hour ?? 0) % 24,
-        minute: values.minute ?? 0,
-        second: values.second ?? 0,
-    };
-}
 function addDateTimeProperty(component, name, value, timezone) {
     const property = new ICAL.Property(name);
     if (timezone === 'UTC') {
@@ -1390,10 +2659,20 @@ function addDateTimeProperty(component, name, value, timezone) {
     }
     else {
         property.setParameter('tzid', timezone);
-        property.setValue(ICAL.Time.fromData({ ...partsInZone(value, timezone), isDate: false }));
+        property.setValue(ICAL.Time.fromData({ ...zonedDateTimeFields(value, timezone), isDate: false }));
     }
     component.addProperty(property);
 }
+/**
+ * Whether `instant`'s wall time in `timezone` names it again as RFC 5545 §3.3.5 reads a wall time:
+ * not for the second pass of an hour the clocks repeat, which reads as the first.
+ */
+function wallTimeNames(instant, timezone) {
+    if (timezone === 'UTC')
+        return true;
+    const named = zonedDateTimeToUtc(zonedDateTimeFields(instant, timezone), timezone);
+    return named.getTime() === instant.getTime();
+}
 function attendeeRoleValue(role) {
     switch (role) {
         case 'chair':
@@ -1453,10 +2732,23 @@ function eventComponent(params) {
     component.updatePropertyWithValue('uid', params.uid);
     component.updatePropertyWithValue('dtstamp', ICAL.Time.fromJSDate(params.updatedAt, true));
     component.updatePropertyWithValue('last-modified', ICAL.Time.fromJSDate(params.updatedAt, true));
-    addDateTimeProperty(component, 'dtstart', params.event.start, params.event.timezone);
-    addDateTimeProperty(component, 'dtend', params.event.end, params.event.timezone);
+    const { start, end, timezone } = params.event;
+    const recurring = params.includeRecurrence === true && params.event.recurrence !== undefined;
+    // A series recurs at DTSTART's wall time, so its DTSTART is written in its zone. Any other time
+    // is written in its zone only where that wall time names it (wallTimeNames), else in UTC: the
+    // second 01:30 of the night the clocks go back reads, in its zone, as the first.
+    addDateTimeProperty(component, 'dtstart', start, recurring || wallTimeNames(start, timezone) ? timezone : 'UTC');
+    if (recurring && !wallTimeNames(start, timezone)) {
+        // Its length as a DURATION, exact (RFC 5545 §3.3.6), since its DTSTART reads an hour early:
+        // emitITipCalendar adds an override that puts the first instance at its own instants.
+        component.updatePropertyWithValue('duration', ICAL.Duration.fromSeconds((end.getTime() - start.getTime()) / 1000));
+    }
+    else {
+        addDateTimeProperty(component, 'dtend', end, wallTimeNames(end, timezone) ? timezone : 'UTC');
+    }
     if (params.recurrenceId) {
-        addDateTimeProperty(component, 'recurrence-id', params.recurrenceId, params.event.timezone);
+        // In UTC: the instant the occurrence starts names it, wherever the clocks change.
+        addDateTimeProperty(component, 'recurrence-id', params.recurrenceId, 'UTC');
     }
     component.updatePropertyWithValue('summary', params.event.summary);
     if (params.event.description) {
@@ -1476,6 +2768,98 @@ function eventComponent(params) {
     }
     return component;
 }
+const WEEKDAYS = ['SU', 'MO', 'TU', 'WE', 'TH', 'FR', 'SA'];
+/** How many years past its last stored time a series' VTIMEZONE lists, before its rules go on. */
+const VTIMEZONE_SERIES_YEARS = 30;
+/** And at most, from its first year: a longer series is left to the rules. */
+const MAX_VTIMEZONE_YEARS = 60;
+/** Changes of a zone already found, by zone and years: Intl answers the same for a process. */
+const zoneChanges = new Map();
+/**
+ * A VTIMEZONE (RFC 5545 §3.6.5) for `timezone` as Intl reads it from `fromYear` to `toYear`: the
+ * offset at the start of `fromYear`, then every change (zoneTransitions). Changes in consecutive
+ * years on the same weekday of the same month, at the same local time and between the same
+ * offsets, are one observance with a yearly rule (`BYMONTH=3;BYDAY=-1SU`), with an UNTIL where they
+ * stop; one still running at `toYear` after three years at least is left open, so a reader carries
+ * the zone on past `toYear` as the IANA rules do. Any other change is an observance of its own. An
+ * observance starts at the local time before the change, as §3.6.5 has it, and offsets are written
+ * in whole minutes: ical.js 2.2.1 reads no seconds in one (UtcOffset.fromString).
+ */
+function vtimezoneComponent(timezone, fromYear, toYear) {
+    const from = Date.UTC(fromYear, 0, 1);
+    const key = `${timezone}|${fromYear}|${toYear}`;
+    let changes = zoneChanges.get(key);
+    if (!changes) {
+        changes = zoneTransitions(timezone, from, Date.UTC(toYear + 1, 0, 1));
+        if (zoneChanges.size >= 64)
+            zoneChanges.clear();
+        zoneChanges.set(key, changes);
+    }
+    const zone = new ICAL.Component('vtimezone');
+    zone.updatePropertyWithValue('tzid', timezone);
+    const offset = (ms) => ICAL.UtcOffset.fromSeconds(Math.round(ms / 60_000) * 60);
+    const observance = (at, before, after) => {
+        const component = new ICAL.Component(after > before ? 'daylight' : 'standard');
+        const wall = new Date(at + before);
+        component.updatePropertyWithValue('dtstart', ICAL.Time.fromData({
+            year: wall.getUTCFullYear(),
+            month: wall.getUTCMonth() + 1,
+            day: wall.getUTCDate(),
+            hour: wall.getUTCHours(),
+            minute: wall.getUTCMinutes(),
+            second: wall.getUTCSeconds(),
+            isDate: false,
+        }));
+        component.updatePropertyWithValue('tzoffsetfrom', offset(before));
+        component.updatePropertyWithValue('tzoffsetto', offset(after));
+        zone.addSubcomponent(component);
+        return component;
+    };
+    const initial = changes[0]?.before ?? zonedOffsetMinutes(new Date(from), timezone) * 60_000;
+    observance(from - initial, initial, initial);
+    const open = new Map();
+    const runs = [];
+    for (const change of changes) {
+        const wall = new Date(change.at + change.before);
+        const year = wall.getUTCFullYear();
+        const month = wall.getUTCMonth() + 1;
+        const day = wall.getUTCDate();
+        const weekday = WEEKDAYS[wall.getUTCDay()];
+        const days = [`${Math.ceil(day / 7)}${weekday}`];
+        if (day > new Date(Date.UTC(year, month, 0)).getUTCDate() - 7)
+            days.push(`-1${weekday}`);
+        const kind = `${change.before}|${change.after}|${month}|${wall.getTime() % DAY_MS}`;
+        const run = open.get(kind);
+        const shared = run?.days.filter((value) => days.includes(value)) ?? [];
+        if (run && run.lastYear === year - 1 && shared.length > 0) {
+            run.changes.push(change);
+            run.days = shared;
+            run.lastYear = year;
+        }
+        else {
+            const started = { changes: [change], days, lastYear: year };
+            open.set(kind, started);
+            runs.push(started);
+        }
+    }
+    for (const run of runs) {
+        const first = run.changes[0];
+        const last = run.changes[run.changes.length - 1];
+        const running = run.lastYear >= toYear;
+        if (run.changes.length >= 3 || (run.changes.length === 2 && !running)) {
+            const month = new Date(first.at + first.before).getUTCMonth() + 1;
+            const until = running
+                ? ''
+                : `;UNTIL=${ICAL.Time.fromJSDate(new Date(last.at), true).toICALString()}`;
+            observance(first.at, first.before, first.after).updatePropertyWithValue('rrule', ICAL.Recur.fromString(`FREQ=YEARLY;BYMONTH=${month};BYDAY=${run.days[0]}${until}`));
+        }
+        else {
+            for (const change of run.changes)
+                observance(change.at, change.before, change.after);
+        }
+    }
+    return zone;
+}
 /** Deterministic RFC 5545 + iTIP payload, validated by the installed ical.js implementation. */
 export function emitITipCalendar(input, method) {
     try {
@@ -1539,8 +2923,19 @@ export function emitITipCalendar(input, method) {
         };
         if (status !== undefined)
             masterParams.status = status;
-        calendar.addSubcomponent(eventComponent(masterParams));
-        for (const exception of event.recurrence?.exceptions ?? []) {
+        const events = [eventComponent(masterParams)];
+        // A series whose first instance starts in the second pass of an hour the clocks repeat has a
+        // DTSTART that reads as the first pass: an override (keyed by that first pass) puts the
+        // instance at its own instants, unless an exception already says where it is.
+        const firstInstance = event.recurrence && !wallTimeNames(event.start, event.timezone)
+            ? zonedDateTimeToUtc(zonedDateTimeFields(event.start, event.timezone), event.timezone)
+            : undefined;
+        const exceptions = [...(event.recurrence?.exceptions ?? [])];
+        if (firstInstance &&
+            !exceptions.some((exception) => exception.recurrenceId.getTime() === event.start.getTime())) {
+            exceptions.push({ recurrenceId: event.start, start: event.start, end: event.end });
+        }
+        for (const exception of exceptions) {
             const exceptionEvent = { ...event };
             delete exceptionEvent.recurrence;
             if (exception.start && exception.end) {
@@ -1556,13 +2951,39 @@ export function emitITipCalendar(input, method) {
                 uid,
                 sequence,
                 updatedAt,
-                recurrenceId: exception.recurrenceId,
+                recurrenceId: firstInstance && exception.recurrenceId.getTime() === event.start.getTime()
+                    ? firstInstance
+                    : exception.recurrenceId,
             };
             const exceptionStatus = exception.cancelled ? 'cancelled' : status;
             if (exceptionStatus !== undefined)
                 exceptionParams.status = exceptionStatus;
-            calendar.addSubcomponent(eventComponent(exceptionParams));
+            events.push(eventComponent(exceptionParams));
         }
+        // RFC 5545 §3.6.5: a VTIMEZONE for the zone a time names, over every year the event's times
+        // fall in, and a series' rule's (to its UNTIL, else thirty years on, where its rules go on).
+        const zoned = events.some((component) => component.getAllProperties().some((property) => property.getParameter('tzid')));
+        if (zoned) {
+            const times = [event.start, event.end];
+            for (const exception of exceptions) {
+                times.push(exception.recurrenceId);
+                if (exception.start)
+                    times.push(exception.start);
+                if (exception.end)
+                    times.push(exception.end);
+            }
+            const years = times.map((time) => time.getUTCFullYear());
+            const fromYear = Math.min(...years) - 1;
+            let toYear = Math.max(...years) + 1;
+            if (event.recurrence) {
+                const until = ICAL.Recur.fromString(event.recurrence.rrule).until;
+                toYear = until ? Math.max(toYear, until.year + 1) : toYear + VTIMEZONE_SERIES_YEARS;
+            }
+            const lastYear = Math.min(toYear, fromYear + MAX_VTIMEZONE_YEARS);
+            calendar.addSubcomponent(vtimezoneComponent(event.timezone, fromYear, lastYear));
+        }
+        for (const component of events)
+            calendar.addSubcomponent(component);
         const output = `${calendar
             .toString()
             .replace(/\r?\n/g, '\r\n')
@@ -1705,11 +3126,12 @@ export function parseTrustedICalendarEvents(input, calendarTimezone) {
         boundInput(input);
         const budget = new RecurrenceBudget(FEED_LIMITS);
         const root = new ICAL.Component(ICAL.parse(input));
-        budget.check();
+        if (root.name !== 'vcalendar')
+            throw new CalendarContractError('invalid_icalendar');
         let Budgeted;
         budgetTimezoneRules(root, () => (Budgeted ??= budgetedRecurIterator(budget)));
         budgetTimezoneCoverage(root, budget);
-        const timeValue = (value, zone, fallback) => budget.search(() => calendarTimeValue(value, zone, fallback));
+        const timeValue = (value, zone, fallback) => calendarTimeValue(value, zone, fallback);
         const embeddedTimezone = root.getFirstPropertyValue('x-wr-timezone');
         const defaultTimezone = calendarTimezone?.trim() ||
             (typeof embeddedTimezone === 'string' ? embeddedTimezone.trim() : '') ||
@@ -1718,10 +3140,13 @@ export function parseTrustedICalendarEvents(input, calendarTimezone) {
         if (components.length > MAX_ICAL_COMPONENTS) {
             throw new CalendarContractError('invalid_icalendar');
         }
-        boundComponents(components, budget);
+        boundComponents(components);
+        // Times are read as a feed's are, so a stored series occupies what the feed reports: zones it
+        // names without defining them, floating times in the calendar's zone, all-day EXDATEs as days.
+        frameEventTimes(root, components, defaultTimezone, budget);
         const masters = new Map();
         const exceptionsByUid = new Map();
-        for (const event of feedEvents(components, budget)) {
+        for (const event of feedEvents(components)) {
             if (event.isRecurrenceException()) {
                 const exceptions = exceptionsByUid.get(event.uid) ?? [];
                 if (exceptions.length >= MAX_ICAL_EXCEPTIONS_PER_SERIES) {
@@ -1740,11 +3165,47 @@ export function parseTrustedICalendarEvents(input, calendarTimezone) {
             if (!masters.has(uid))
                 throw new CalendarContractError('invalid_icalendar');
         }
+        // Every VEVENT's rule as written must be one RFC 5545 §3.3.10 allows: ical.js has already read
+        // `COUNT=0` as no count, `COUNT=3X` as 3 and the last of two FREQs, so the text is read again.
+        for (const rule of veventRuleTexts(input)) {
+            if (canonicalRecurrenceRule(rule) === null) {
+                throw new CalendarContractError('invalid_icalendar');
+            }
+        }
+        for (const component of components) {
+            // RFC 5545 §3.6.1: 'dtend' and 'duration' MUST NOT occur in the same eventprop.
+            if (component.hasProperty('dtend') && component.hasProperty('duration')) {
+                throw new CalendarContractError('invalid_icalendar');
+            }
+        }
+        /** An event's start and end as instants: DTEND as RFC 5545 §3.3.5 reads it, DURATION §3.3.6. */
+        const interval = (event, fallbackLengthMs) => {
+            const component = event.component;
+            const startZone = component.getFirstProperty('dtstart')?.getParameter('tzid');
+            const reader = zoneReader(event.startDate, startZone, defaultTimezone);
+            const startWall = wallFrameOf(event.startDate);
+            const start = reader.toInstant(startWall);
+            const endProperty = component.getFirstProperty('dtend');
+            const duration = component.getFirstPropertyValue('duration');
+            let end;
+            if (endProperty) {
+                end = timeValue(endProperty.getFirstValue(), endProperty.getParameter('tzid') ?? startZone, defaultTimezone).getTime();
+            }
+            else if (duration instanceof ICAL.Duration && !event.startDate.isDate) {
+                end = durationEnd(reader, startWall, start, duration);
+            }
+            else if (fallbackLengthMs !== undefined && !duration) {
+                end = start + fallbackLengthMs;
+            }
+            else {
+                end = timeValue(event.endDate, startZone, defaultTimezone).getTime();
+            }
+            return { reader, startWall, start, end };
+        };
         const trusted = [];
         for (const [uid, event] of masters) {
             const component = event.component;
             const startProperty = component.getFirstProperty('dtstart');
-            const endProperty = component.getFirstProperty('dtend');
             // An all-day event (DATE-valued DTSTART) covers whole local days of the calendar's zone. Its
             // end must be a DATE too (RFC 5545 §3.6.1), and a DURATION may only count days or weeks.
             const allDay = event.startDate.isDate;
@@ -1771,9 +3232,10 @@ export function parseTrustedICalendarEvents(input, calendarTimezone) {
             if (transparencyValue !== 'opaque' && transparencyValue !== 'transparent') {
                 throw new CalendarContractError('invalid_icalendar');
             }
+            const own = interval(event);
             const contentInput = {
-                start: timeValue(event.startDate, startProperty?.getParameter('tzid'), defaultTimezone),
-                end: timeValue(event.endDate, endProperty?.getParameter('tzid') ?? startProperty?.getParameter('tzid'), defaultTimezone),
+                start: new Date(own.start),
+                end: new Date(own.end),
                 timezone: validTimezone(timezone),
                 summary: String(component.getFirstPropertyValue('summary') ?? ''),
                 transparency: transparencyValue,
@@ -1804,53 +3266,104 @@ export function parseTrustedICalendarEvents(input, calendarTimezone) {
             }
             const rrule = rrules[0]?.getFirstValue();
             if (rrule) {
-                const exceptions = [];
+                // A series is stored as an instant and a zone, and recurs at that instant's wall time. A
+                // DTSTART the clocks skip (02:30 the night 02:00 becomes 03:00, or an all-day series'
+                // midnight where the clocks go forward at midnight, as in Santiago and Havana) has no
+                // instant that reads as it, so storing it would move every occurrence an hour: it is
+                // refused.
+                if (own.reader.toWall(own.start) !== own.startWall) {
+                    throw new CalendarContractError('invalid_icalendar');
+                }
+                // Its later occurrences end on the wall clock where its first one's end instant reads, and
+                // last at least as long. A DTEND the clocks skip reads an hour later than written, and a
+                // DURATION that counts days lasts a day on the calendar, 23 or 25 hours across a change,
+                // where the first one's instants say 24: either would hold an hour the feed does not. They
+                // are refused (days only outside UTC, where every day is 24 hours).
+                if (!allDay) {
+                    const endProperty = component.getFirstProperty('dtend');
+                    const endTime = endProperty?.getFirstValue();
+                    const startTime = event.startDate;
+                    const sameZone = endTime instanceof ICAL.Time &&
+                        (ownZone(endTime) ?? endProperty?.getParameter('tzid') ?? timezoneParameter) ===
+                            (ownZone(startTime) ?? timezoneParameter);
+                    if (sameZone && own.reader.toWall(own.end) !== wallFrameOf(endTime)) {
+                        throw new CalendarContractError('invalid_icalendar');
+                    }
+                    const duration = component.getFirstPropertyValue('duration');
+                    if (duration instanceof ICAL.Duration &&
+                        duration.weeks * 7 + duration.days > 0 &&
+                        own.reader !== UTC_READER) {
+                        throw new CalendarContractError('invalid_icalendar');
+                    }
+                }
+                const lengthMs = own.end - own.start;
+                const exceptions = new Map();
                 for (const exdateProperty of component.getAllProperties('exdate')) {
                     for (const exdate of exdateProperty.getValues()) {
-                        if (exceptions.length >= MAX_ICAL_EXCEPTIONS_PER_SERIES) {
+                        if (exceptions.size >= MAX_ICAL_EXCEPTIONS_PER_SERIES) {
                             throw new CalendarContractError('invalid_icalendar');
                         }
-                        exceptions.push({
-                            recurrenceId: timeValue(exdate, exdateProperty.getParameter('tzid') ?? startProperty?.getParameter('tzid'), defaultTimezone),
-                            cancelled: true,
-                        });
+                        const recurrenceId = timeValue(exdate, exdateProperty.getParameter('tzid') ?? startProperty?.getParameter('tzid'), defaultTimezone);
+                        exceptions.set(recurrenceId.getTime(), { recurrenceId, cancelled: true });
                     }
                 }
                 for (const exception of exceptionsByUid.get(uid) ?? []) {
-                    if (exceptions.length >= MAX_ICAL_EXCEPTIONS_PER_SERIES) {
-                        throw new CalendarContractError('invalid_icalendar');
-                    }
                     const recurrenceProperty = exception.component.getFirstProperty('recurrence-id');
                     const range = recurrenceProperty?.getFirstParameter('range');
                     if (range)
                         throw new CalendarContractError('invalid_icalendar');
+                    // A stored series has one transparency; an instance that differs (an opaque instance
+                    // of a free series, a free one of a busy series) cannot be stored as it is.
+                    const transparency = String(exception.component.getFirstPropertyValue('transp') ?? 'opaque').toLowerCase();
+                    if (transparency !== transparencyValue) {
+                        throw new CalendarContractError('invalid_icalendar');
+                    }
                     const recurrenceId = timeValue(exception.recurrenceId, recurrenceProperty?.getParameter('tzid') ?? startProperty?.getParameter('tzid'), defaultTimezone);
                     const cancelled = String(exception.component.getFirstPropertyValue('status') ?? '').toLowerCase() ===
                         'cancelled';
+                    // An instance an EXDATE removes but an override still describes is the override, as
+                    // the provider shows it. One that keeps its time (a new title, a reply) is still kept,
+                    // and one with no end lasts its series' length.
                     const parsedException = { recurrenceId };
-                    if (cancelled)
+                    if (cancelled) {
                         parsedException.cancelled = true;
-                    const replacementStart = timeValue(exception.startDate, exception.component.getFirstProperty('dtstart')?.getParameter('tzid'), defaultTimezone);
-                    const replacementEnd = timeValue(exception.endDate, exception.component.getFirstProperty('dtend')?.getParameter('tzid') ??
-                        exception.component.getFirstProperty('dtstart')?.getParameter('tzid'), defaultTimezone);
-                    if (replacementStart.getTime() !== recurrenceId.getTime() ||
-                        replacementEnd.getTime() - replacementStart.getTime() !==
-                            contentInput.end.getTime() - contentInput.start.getTime()) {
-                        parsedException.start = replacementStart;
-                        parsedException.end = replacementEnd;
                     }
-                    exceptions.push(parsedException);
+                    else {
+                        const replacement = interval(exception, lengthMs);
+                        parsedException.start = new Date(replacement.start);
+                        parsedException.end = new Date(replacement.end);
+                    }
+                    exceptions.set(recurrenceId.getTime(), parsedException);
+                    if (exceptions.size > MAX_ICAL_EXCEPTIONS_PER_SERIES) {
+                        throw new CalendarContractError('invalid_icalendar');
+                    }
                 }
                 contentInput.recurrence = {
                     rrule: allDay ? allDayRecurrenceRule(rrule.toString(), timezone) : rrule.toString(),
-                    exceptions,
+                    exceptions: [...exceptions.values()],
                 };
             }
             else if (component.getAllProperties('exdate').length > 0 ||
                 (exceptionsByUid.get(uid)?.length ?? 0) > 0) {
                 throw new CalendarContractError('invalid_icalendar');
             }
-            const content = normalizeCalendarEventContent(contentInput);
+            let content = normalizeCalendarEventContent(contentInput);
+            // An EXDATE or a cancelled instance that names no occurrence frees nothing in the feed (RFC
+            // 5545 §3.8.5.1), so it is dropped rather than stored, which the store refuses. A moved one
+            // that names none is busy in the feed at its own time, which a stored series cannot hold.
+            const recurrence = content.recurrence;
+            if (recurrence?.exceptions && recurrence.exceptions.length > 0) {
+                const unmatched = unmatchedExceptions(content, budget);
+                const named = (exception) => !unmatched.has(exception.recurrenceId.getTime());
+                if (recurrence.exceptions.some((exception) => !exception.cancelled && !named(exception))) {
+                    throw new CalendarContractError('invalid_icalendar');
+                }
+                const kept = recurrence.exceptions.filter(named);
+                content = {
+                    ...content,
+                    recurrence: kept.length > 0 ? { ...recurrence, exceptions: kept } : { rrule: recurrence.rrule },
+                };
+            }
             const sequence = Number(component.getFirstPropertyValue('sequence') ?? 0);
             if (!Number.isSafeInteger(sequence) || sequence < 0) {
                 throw new CalendarContractError('invalid_icalendar');
@@ -1867,7 +3380,8 @@ export function parseTrustedICalendarEvents(input, calendarTimezone) {
         return trusted;
     }
     catch (error) {
-        if (error instanceof CalendarContractError)
+        // An event the calendar gives no length or no UID is the calendar's fault, as in a feed.
+        if (error instanceof CalendarContractError && error.code === 'invalid_icalendar')
             throw error;
         throw new CalendarContractError('invalid_icalendar');
     }
@@ -1897,6 +3411,160 @@ export function expandCalendarEventSeries(input, window, options) {
     return expandOccurrences(input, window, options.stored ? FEED_LIMITS : EVENT_LIMITS, options.cursor, options.resumeOnly === true);
 }
 function expandOccurrences(input, window, limits, cursor, resumeOnly = false) {
+    try {
+        return expandEventOccurrences(input, window, limits, cursor, resumeOnly);
+    }
+    catch (error) {
+        // A series stored by an earlier Slotlock that this one refuses (a rule shape it no longer
+        // expands, an exception that names no occurrence, a zone written as a UTC offset) is refused as
+        // maintenance rolls it, so the roll counts it and the series keeps its old coverage, rather than
+        // stopping every series after it. One no Slotlock stored is an error, as it always was.
+        if (limits === FEED_LIMITS &&
+            error instanceof CalendarContractError &&
+            !(error instanceof CalendarExpansionLimitError) &&
+            storedByAnEarlierRelease(input)) {
+            throw new CalendarExpansionLimitError();
+        }
+        throw error;
+    }
+}
+/**
+ * Whether a Slotlock before this one could have stored `event`. Slotlock 0.2.0 kept any rule
+ * ical.js reads that starts with FREQ= (`FREQ=DAILY;COUNT=0`, `FREQ=HOURLY`), in any zone Intl
+ * knows (`+05:00` included), and checked the rest of an event as this release does; a rule such as
+ * `FREQ=NEVERLY`, which ical.js cannot read, it refused.
+ */
+function storedByAnEarlierRelease(event) {
+    const rule = event.recurrence?.rrule;
+    if (rule !== undefined) {
+        if (typeof rule !== 'string')
+            return false;
+        const written = rule.trim().toUpperCase();
+        if (!written.startsWith('FREQ=') ||
+            Buffer.byteLength(written, 'utf8') > 4_096 ||
+            /[\r\n]/.test(written)) {
+            return false;
+        }
+        try {
+            ICAL.Recur.fromString(written);
+        }
+        catch {
+            return false;
+        }
+    }
+    if (typeof event.timezone !== 'string' || !isKnownTimezone(event.timezone))
+        return false;
+    const { recurrence: _rule, ...rest } = event;
+    try {
+        normalizeCalendarEventContent({ ...rest, timezone: 'UTC' });
+        normalizeExceptions(event.recurrence?.exceptions);
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+/** The UID a stored series is expanded under: the store's series carry none of their own. */
+function seriesUid(event) {
+    return `event-${createHash('sha256')
+        .update(`${event.start.toISOString()}|${event.summary}`)
+        .digest('hex')}@slotlock.local`;
+}
+/**
+ * The instants of a normalized series' exceptions that name none of its occurrences, searched from
+ * its start to the last of them within `budget`, as the store searches them when the series is
+ * written.
+ */
+function unmatchedExceptions(event, budget) {
+    const unmatched = new Set();
+    parseCalendarChanges(seriesCalendar(event, seriesUid(event)), event.timezone, { start: event.start, end: new Date(event.start.getTime() + DAY_MS) }, budget, {
+        cursor: null,
+        resumeLimitMs: Number.NEGATIVE_INFINITY,
+        left: null,
+        resumed: false,
+        resumeOnly: false,
+        stored: {
+            start: event.start,
+            end: event.end,
+            exceptions: event.recurrence?.exceptions ?? [],
+        },
+        unmatched,
+    });
+    return unmatched;
+}
+/**
+ * Why this Slotlock refuses an event an earlier one stored, in words, or null when it expands it.
+ * Maintenance counts such a series as refused on every roll and leaves it its old coverage: a rule
+ * shape ical.js expands wrongly (recurrenceRuleProblem), COUNT with a yearly day some years lack, a
+ * rule it no longer stores at all, or exceptions that name no occurrence (searched from the series'
+ * start to the last of them, within a roll's budget). It writes nothing, so it can be run over
+ * stored events before an upgrade.
+ */
+export function storedCalendarEventProblem(event) {
+    const rule = event.recurrence?.rrule;
+    const shape = rule === undefined ? null : recurrenceRuleProblem(rule);
+    if (shape !== null)
+        return shape;
+    let content;
+    try {
+        if (rule !== undefined) {
+            const recur = ICAL.Recur.fromString(canonicalRecurrenceRule(rule));
+            const start = zonedDateTimeFields(event.start, validTimezone(event.timezone));
+            const series = seriesShapeProblem(recur, start);
+            if (series !== null)
+                return series;
+        }
+        content = normalizeCalendarEventContent(event);
+    }
+    catch (error) {
+        if (!(error instanceof CalendarContractError))
+            throw error;
+        return rule === undefined
+            ? 'not an event Slotlock stores'
+            : 'not a rule Slotlock stores: daily or less often, able to occur, in an IANA time zone';
+    }
+    if (!content.recurrence?.exceptions?.length)
+        return null;
+    let unmatched;
+    try {
+        unmatched = unmatchedExceptions(content, new RecurrenceBudget(FEED_LIMITS));
+    }
+    catch (error) {
+        if (error instanceof CalendarExpansionLimitError) {
+            return 'its exceptions take more work to check than a roll may spend';
+        }
+        if (error instanceof CalendarContractError)
+            return 'a series Slotlock cannot expand';
+        throw error;
+    }
+    if (unmatched.size === 0)
+        return null;
+    const named = [...unmatched].sort((a, b) => a - b).map((at) => new Date(at).toISOString());
+    const which = named.length === 1 ? 'an exception that names' : `${named.length} exceptions that name`;
+    return `${which} no occurrence: ${named.join(', ')}`;
+}
+/**
+ * The text a stored series is expanded from: its DTSTART's wall time in its zone and its rule, for
+ * the iterator. Its first occurrence and its exceptions are not read back from text: a wall time
+ * in an hour the clocks repeat names its first instant (RFC 5545 §3.3.5) whichever one was stored,
+ * so they go to the expansion as the instants they are (SeriesResume.stored).
+ */
+function seriesCalendar(event, uid) {
+    const calendar = new ICAL.Component(['vcalendar', [], []]);
+    calendar.updatePropertyWithValue('prodid', '-//Slotlock Project//Agent Calendar//EN');
+    calendar.updatePropertyWithValue('version', '2.0');
+    const component = new ICAL.Component('vevent');
+    component.updatePropertyWithValue('uid', uid);
+    component.updatePropertyWithValue('dtstamp', ICAL.Time.fromJSDate(event.start, true));
+    addDateTimeProperty(component, 'dtstart', event.start, event.timezone);
+    addDateTimeProperty(component, 'dtend', event.end, 'UTC');
+    component.updatePropertyWithValue('status', (event.status ?? 'confirmed').toUpperCase());
+    component.updatePropertyWithValue('transp', event.transparency === 'transparent' ? 'TRANSPARENT' : 'OPAQUE');
+    component.updatePropertyWithValue('rrule', ICAL.Recur.fromString(event.recurrence.rrule));
+    calendar.addSubcomponent(component);
+    return `${calendar.toString().replace(/\r?\n/g, '\r\n')}\r\n`;
+}
+function expandEventOccurrences(input, window, limits, cursor, resumeOnly) {
     const event = normalizeCalendarEventContent(input);
     if (!Number.isFinite(window.start.getTime()) ||
         !Number.isFinite(window.end.getTime()) ||
@@ -1914,9 +3582,7 @@ function expandOccurrences(input, window, limits, cursor, resumeOnly = false) {
     if (window.end.getTime() - window.start.getTime() > MAX_ICAL_WINDOW_MS) {
         throw new CalendarContractError('invalid_icalendar');
     }
-    const uid = `event-${createHash('sha256')
-        .update(`${event.start.toISOString()}|${event.summary}`)
-        .digest('hex')}@slotlock.local`;
+    const uid = seriesUid(event);
     // A cursor may stand after an occurrence only if that occurrence ends before the window: unmoved,
     // within the series' length (and a clock change) of its start; moved, where its exception says.
     let resumeLimitMs = window.start.getTime() -
@@ -1927,8 +3593,15 @@ function expandOccurrences(input, window, limits, cursor, resumeOnly = false) {
             resumeLimitMs = Math.min(resumeLimitMs, exception.recurrenceId.getTime() - 1000);
         }
     }
-    const series = { cursor, resumeLimitMs, left: null, resumed: false, resumeOnly };
-    const parsed = parseCalendarChanges(emitITipCalendar({ ...event, uid, sequence: 0 }, 'PUBLISH'), event.timezone, window, limits, series);
+    const series = {
+        cursor,
+        resumeLimitMs,
+        left: null,
+        resumed: false,
+        resumeOnly,
+        stored: { start: event.start, end: event.end, exceptions: event.recurrence.exceptions ?? [] },
+    };
+    const parsed = parseCalendarChanges(seriesCalendar(event, uid), event.timezone, window, limits, series);
     const occurrences = parsed
         .filter((change) => !change.deleted && change.start && change.end)
         .map((change) => ({