…ncy key derivation

…endency

…ow parsing

…es go 1.25)

…sed join

…overy

… resolution

Add Engine.Reconcile covering the daily self-healing cycle: FullResync
for every watched calendar, resolution of mappings left pending across
a crash, adoption/cleanup of tagged orphan blockers via ListBlockers,
and re-evaluation of suppressed mappings whose duplicate real event has
since disappeared. Per-calendar/account errors are joined so one
account's failure does not block the rest.

Also adds a regression test verifying that a failed CreateBlocker during
pending resolution leaves the mapping pending (not active) and that it
recovers cleanly on the next Reconcile once the failure clears.

Prevent FullResync's own upsertBlockers retry from pre-resolving the
pending mapping under test, so the CreateBlocker-failure assertions
exercise resolvePending exclusively rather than a mix of both paths.

…truncation

…mapping and normalization

Implements internal/provider/google.Client.Changes: full sync
(timeMin/timeMax/singleEvents) vs incremental sync (syncToken only),
full-page-completion-only nextSyncToken handling, 410 GONE ->
provider.ErrCursorInvalid, 403/429 usageLimits exponential
backoff+jitter retry (max 5), and event normalization (cancelled,
transparency, self-declined attendee, extendedProperties.private
calsync-origin, UTC dateTime, all-day date).

Promotes google.golang.org/api to a direct dependency (it was already
present as indirect). Doing so pulls in the transitive deps its
calendar/v3, googleapi and option subpackages require, and forces the
go directive from 1.25.0 to 1.25.8 because google.golang.org/api
v0.287.0's own go.mod declares `go 1.25.8`; this is a hard MVS
requirement with no `go get`/toolchain-directive workaround at the
pinned version, so the go directive bump could not be avoided.

Google provider only mapped 410 to ErrCursorInvalid; invalid_grant /
interaction_required (RFC6749 token errors, arriving wrapped in
*url.Error via oauth2.Transport) and googleapi 401 never surfaced as
provider.ErrAuthExpired, so the engine's reauth_required transition
(spec 9.3) never triggered on real token revocation.

Add provider.NormalizeAuthErr as a provider-agnostic helper (usable by
the future microsoft provider) that unwraps oauth2.RetrieveError via
errors.As and wraps invalid_grant/interaction_required in
ErrAuthExpired, preserving the original error via %w. google-specific
401 detection stays in the google package and delegates the rest to
NormalizeAuthErr, keeping googleapi out of provider/autherr.go.

…ne lookup

Implements CreateBlocker/UpdateBlocker/DeleteBlocker/ListBlockers/
GetCalendarTimezone, completing provider.Provider for the google
package. CreateBlocker uses a client-generated idempotent event ID
and reconciles 409 conflicts by fetching the existing event.
DeleteBlocker treats 404/410 as success. All error paths through
doWithRetry are normalized via normalizeAuthErr so 401/invalid_grant
map to provider.ErrAuthExpired, consistent with Changes (Task 14).

…andling

Implements internal/provider/microsoft: client base (microsoft.go) with
Prefer: IdType="ImmutableId" headers, 429/5xx retry with injectable sleep,
and Changes (delta.go) covering calendarView delta paging, @removed/
isCancelled -> Deleted, syncStateNotFound/410 -> ErrCursorInvalid, and a
50-page/identical-page circuit breaker.

Also normalizes Graph HTTP 401 and oauth2.RetrieveError
(invalid_grant/interaction_required) to provider.ErrAuthExpired via the
shared doRead path, per Task 14 review follow-up.

… and tag listing

url.Values.Encode() encodes spaces as "+", but Microsoft Graph's OData
parser rejects "+" as a space substitute inside $filter/$expand (known
Graph behavior). The extended-property id contains spaces, so
findBlockerByOriginTag, ListBlockers and getBlockerRecord could fail
against the real API even though httptest-based tests passed (Go's
net/url symmetrically decodes "+" back to space via Query()).

Add encodeQuery() to rewrite the encoded "+" to "%20" and use it at
all three call sites. Add RawQuery-based tests (Query() cannot detect
the bug) confirming no literal "+" reaches the wire.

…ired isolation

… scheduler

…nd --force

…ivacy notes

The 409 conflict path in CreateBlocker unconditionally returned the ID
found by events.get, even when that event was cancelled. Google keeps
deleted events around in cancelled state and returns 409 again for the
same deterministic idempotent ID, so a busy->free->busy delete+recreate
cycle would adopt an invisible cancelled event into the active mapping
and the blocker would never reappear.

Now the 409 path checks events.get's status: if cancelled, it revives
the event via events.update using the same body events.insert would
have sent (minus the ID), sharing that body construction between the
two call sites.

Spec section 8.4 requires that a blocker be recreated whenever its
origin event is still alive, even if someone deleted the blocker by
hand. No reconcile phase implemented this: upsertBlockers' time_hash
match case never calls the provider, so a manually deleted blocker
whose origin is unchanged was never detected by normal sync.

Add a restoreMissingBlockers phase, run after adoptOrphans and before
reevaluateSuppressed. For each account it lists real blockers to build
the set of live IDs, then re-creates via the existing
createFromMapping helper any active mapping whose BlockerEventID is
missing from that set, using the cached origin event. If the origin
isn't cached, it's skipped and left for the next FullResync.

OriginTag encodes as "<account_id>:<event_id>", and parseOriginTag
splits on the first colon. An account id containing a colon would make
adoption misparse the tag and could cause it to delete a legitimate
blocker it mistakes for an orphan. Reject such ids at config load time.

…zily

The calendar.events OAuth scope cannot call calendars.get (403 in real
environments), so GetCalendarTimezone now reads the timeZone field of
the events.list response envelope (maxResults=1), which the events
scope can access. Microsoft's /me/mailboxSettings/timeZone requires
MailboxSettings.Read, so that delegated scope is added to the OAuth
config and documented in the Entra setup steps in the README.

The engine also only fetches the target timezone for all-day blockers
now: timed blockers are written in fixed UTC on both providers, so
fetching a timezone for every event was a wasted API call and an
unnecessary scope dependency.

Map HTTP 404 from events.patch (Google) and PATCH /me/events (Graph)
to provider.ErrNotFound. When the engine's time-hash-mismatch branch
receives ErrNotFound, the blocker was deleted out-of-band (e.g. by
hand), so upsertBlockers now falls back to createFromMapping, which
re-creates it through the usual pending -> CreateBlocker -> active
flow instead of failing the whole sync cycle.

Complements the restoreMissingBlockers reconcile phase (0efba52): that
phase covers unchanged origins once a day, this fallback covers the
update path immediately.

A target account's expired token used to surface as a bare
ErrAuthExpired from the origin account's sync, so scheduler.tick
blamed the origin, marked it reauth_required and stopped its polling
entirely (spec 9.3 violation: an expired account must only stop
itself).

Introduce TargetAuthError{AccountID, Err}. Blocker writes to a target
(upsertBlockers, deleteBlockersForOrigin, createFromMapping) wrap
ErrAuthExpired in it, skip just that target, keep distributing to the
remaining targets and return the collected errors via errors.Join.
SyncCalendar and FullResync treat events whose failures consist only
of TargetAuthErrors as non-fatal: processing continues and the cursor
still advances (the pending mapping plus reconcile backfill the
expired target after reauth).

scheduler.tick walks the error tree, records reauth_required on every
calendar of each expired *target* account and skips it on later ticks;
the origin's own expiry (ErrAuthExpired outside any TargetAuthError)
is still attributed to the origin as before.

…g blocker

The 409 fallback resurrection (58edfac) updated the cancelled event
without a status field, relying on events.update resetting omitted
fields to their defaults. Send status: "confirmed" explicitly so the
revival does not depend on that behavior.

…rification

The all-day date extraction assumes Graph delta returns the local
calendar date; whether the real API converts it to UTC (shifting the
date) must be verified against the spike list in spec chapter 15.

resolvePending, adoptOrphans, restoreMissingBlockers and
reevaluateSuppressed returned on the first error, so a single failing
account or mapping aborted the whole phase for every other account
(spec 10: one calendar's failure must not stop the cycle). They now
collect errors per account/row with errors.Join and keep going, the
same pattern Reconcile already uses for the FullResync loop. The
adoptOrphans loop body moves into an adoptOrphan helper so one
blocker's failure skips just that record.

busy_show_as now only accepts the Graph freeBusyStatus enum (free,
tentative, busy, oof, workingElsewhere, unknown); a typo used to be
silently treated as "never busy". sync --once records a successful
per-calendar sync via SetCalendarError(ref, "") so calsync status
reflects one-shot syncs the same way the daemon tick does.