oficina / calendar Public

Verdict: APPROVE for source and preview. No public launch claim. Reviewer model: claude-fable-5-1 (Claude Fable 5.1), read-only, no commands run.

Caveats on scope. The prior refusal at ../reconciliation/review.json is not present on this filesystem, so I could not diff against it. Without git access I reviewed the files the delta names plus the cherry-picked areas, not a machine-generated file list.

Feed export (store_feed_rows.go) is correct on the points that matter:

• One scoped master per series, RRULE and EXDATE verbatim, overrides emitted with RECURRENCE-ID keyed to the original local time. Matches the RFC shape and the export test.
• Overrides are loaded without a deleted_at filter, so a soft-deleted override exports as STATUS:CANCELLED and the original occurrence cannot resurrect. This is the right call because deleting an override never writes an EXDATE.
• A moved-out override is still exported because its master is a range candidate. A moved-in override whose master finished before the window volunteers the master via its series id. Grant scoping holds through both Calendar and the joins.

Key sentinel (key_check.go) is sound for consistency, restore and rollback:

• Legacy path verifies against calendar names, which are always non-empty ("Team", "My calendar") and exist whenever a person does. A wrong key cannot install the sentinel on a populated database.
• Runs after migrations, before auth and any store or NextDue work. Rolling the binary back leaves an ignored Meta row. Restoring a pre-sentinel backup re-verifies and installs. No migration needed since meta shipped in 0002.

Non-blocking findings, in priority order:

1. Cancelled override carries stale SEQUENCE and DTSTAMP. DeleteEvent on an unbooked override writes only deleted_at. A client that dedupes on SEQUENCE may keep the live version. Full-replace subscribers (Apple, Google) are unaffected. Consider bumping sequence and updated_at on override deletion.
2. Concurrent first boot on a legacy database. Two new processes can both reach the Create; the loser fails with a duplicate-key error and refuses boot with a non-key message. Treat gorm.ErrDuplicatedKey as "re-read and verify" to make it idempotent.
3. No operator documentation of the refusal or its recovery. Nothing in any .md names the sentinel. Add a line to AGENTS.md so nobody "fixes" a wrong-key refusal by deleting the Meta row.
4. N+1 reads in the feed. feedEventRows calls Event per candidate although rangeRows already returned every column. A busy calendar polled every fifteen minutes will feel it. Perf only.
5. Nits. keyCheckPurpose sits outside the seal package's purpose block, and keyCheckMeta sits outside the Meta key consts.

Pre-existing, outside this delta: SplitSeries reassigns overrides by their moved start_utc and leaves them carrying the head's UID, so an exported tail override attaches to the head series in a client. Worth a follow-up ticket, not this branch.

Finished checking both deltas against the frozen source. Writing up the verdicts now.

Reviewer: Claude Fable 5.1, model ID claude-fable-5-1. Read-only, no commands or writes. Bindings reviewed: Home eab0719de7d0fe727145f90a00f533aa7aeb9374, Calendar 10212c522c1876786383c2742fc0a089f6df6afb.

Verdicts

| App | Source | Preview | Public | |---|---|---|---| | Home | APPROVE | APPROVE | not approved, not requested | | Calendar | APPROVE | APPROVE | not approved, not requested |

Both approvals are conditional on exact green CI at the bound SHAs and on the live preview reporting those same SHAs before merge. Local gates were reported passing but CI at the final SHAs is still pending, so neither is merge-ready yet.

Home

The delta is documentation only, and it records what the frozen source already does. The registry in internal/home/directory_runtime.go has exactly six entries, all integrated true and provisionable false. The catalog loop turns Meet's default "Coming soon" into the team chooser link, and the preview origin map still wins. No grid, New button or public cutover appears in code or docs. The four documents named in the previous APPROVE are the four updated. The two evidence files the runtime doc cites exist on this filesystem. Discussion 53 and SHA dbccdae could not be checked without git or network.

Calendar

Sequence change is correct and increments exactly once. The single event update carries deletedat, updatedat and one sequence expression. The host-cancel helper in store_booking_cancel.go deliberately does not touch the event, and queues the cancellation mail at the current sequence plus one, which is the revision the delete then produces. Booked path behaviour is unchanged. The existing host test still expects sequence 2 after confirm plus delete, and the held-booking path still expires with no mail. The only behavioural change is that unbooked deletes now also bump, which matches spec section 5.5 as written.

Test pin is load-bearing. The override is created at master sequence plus one, so the assertion fails only if the delete bump is missing.

Flaky test fix is sound. It picks the last free slot whose host-local hour is 10 or later, using the same zone the slot windows are built in. A 9:30 slot is correctly excluded since it lies inside 9 to 10. Three days of a 9 to 5 page always yield such a slot, so the sentinel fatal cannot fire spuriously.

AGENTS.md line matches code. The sentinel key name and the legacy calendar-name check match key_check.go.

Carried advisories, non-blocking

• Calendar: deleting a series master soft-deletes its overrides without a sequence or updated_at bump. Same class as the advisory just fixed, narrower exposure.
• Calendar: concurrent first boot on a legacy database can fail with a duplicate-key error rather than re-verifying.
• Calendar: N+1 reads in the feed export. Perf only.
• Calendar: SplitSeries tail overrides keep the head UID. Pre-existing.
• Calendar: a de-allowlisted Home person gets 404 per request but the Home session row is never revoked.
• Calendar: the new AGENTS.md paragraph sits under the Authorship heading. Cosmetic.
• Calendar public promotion: the reconciliation review's REQUEST CHANGES stands. The frozen source now has a DEK boot check, one-master feed export, and exhaustion-aware expansion, but I did not re-verify the DST gap and reminder reschedule fix in this bounded review.
• Home: constructor error string still says Docs, the docs field duplicates the first chooser, and the registry slice is allocated per request in the path guard.
• Home: operator deployment path and restore drill remain required before any public cutover.

10212c5 exact CI passed. Local gate passed after correcting a clock-dependent existing test: the final slot in a rolling three-day window could still be inside 9-10. Test now selects a slot by the actual host-local hour >=10. Fable bounded final APPROVE recorded. Candidate preview deployment underway; source merge waits live body and edge version match. Remaining split-series UID issue is task13. No public promotion approval claimed.

Preview verified live 2026-09-11: https://overnight-calendar.bds.oncarlos.com/api/version body and X-Carlos-Version both10212c522c1876786383c2742fc0a089f6df6afb; unsigned signin303. Existing preview configuration, admission and database retained. Final Fable source/preview approval and exact CI recorded above. Merging this bounded repair branch; public promotion remains separate.