oficina / calendar Public

booking: a stranger holds a slot, a button confirms it, and the ICS is one click away

The public page is two POSTs and no script: a slot button posts an
instant, the page comes back with the details form beneath it, and the
details post makes the hold. The link in the mail opens a page with one
button, and the button is a POST — a link that confirmed on GET would
be confirmed by every link-scanning mail gateway on earth. A wrong
token, a wrong handle and an unknown route are byte-for-byte the same
404.

Public templates receive a publicBooking built by one function from a
BookingView, never the view or the event, so the host's notes, location
and other attendees cannot reach a stranger by accident; a test edits
all three after confirmation and reads the manage page, the ICS and the
cancelled mail. The ICS is its own writer: METHOD on the calendar,
ORGANIZER and ATTENDEE with no CN= (a parameter has quoting rules TEXT
escaping does not implement, and a name is not needed for the
invitation to work), no URL: (a management capability inside a file
that syncs everywhere is delegation, not disclosure).

Every send goes through one bounded sender: four in flight, a wait of
at most twenty seconds or what is left of the request, ErrMailBusy when
full — a deferral, never an attempt. Every public route passes a
per-IP token bucket bounded to ten thousand keys, and slot computation
sits behind a four-wide semaphore that answers 503 rather than a page
computed from less than the whole busy list. A hold whose mail is
refused stands: the sender's error is not proof the mail did not go.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>