[Task] Implement destructive synchronized-calendar remote move saga #19

New Issue

2026-07-20T14:42:13+02:00

zemion commented

2026-07-20 14:42:13 +02:00

Implemented Contract

Destructive synchronized-to-synchronized CalDAV moves are implemented as durable administrator-authorized migration sagas. The source calendar is retired only after every destination resource is copied or reconciled and every source resource is conditionally deleted.

Safety Guarantees

Exact MOVE REMOTE EVENTS confirmation plus retained authorization evidence.
Active two-way CalDAV sources only; ordinary calendar, source, event, and sync mutations are locked during migration.
UID preservation with target collision rejection before mutation.
Global destination barrier before any source DELETE is leased.
Destination conditional-create semantics and source DELETEs protected by captured ETags.
Durable operation idempotency, crash reconciliation, phase/progress/conflict visibility, actor evidence, and bounded cancellation.
Cancellation is permitted only before source deletion starts; it keeps both remote copies and restores source synchronization.

Acceptance Criteria

Migration batches expose phase, progress, conflicts, evidence, and durable idempotency.
Destination success is a dependency of source deletion; retries and crashes cannot lose the only remote copy.
Conditional ETags protect source deletes and destination creation.
Tests cover duplicates, destination/source crash points, partial destination failure, UID collision, cancellation, concurrent local/remote edits, and reconciliation.
Admin WebUI exposes destructive confirmation, lock state, polling progress, per-resource outcomes, conflicts, and safe cancellation.

Implemented by a125b66.

## Implemented Contract Destructive synchronized-to-synchronized CalDAV moves are implemented as durable administrator-authorized migration sagas. The source calendar is retired only after every destination resource is copied or reconciled and every source resource is conditionally deleted. ## Safety Guarantees - Exact `MOVE REMOTE EVENTS` confirmation plus retained authorization evidence. - Active two-way CalDAV sources only; ordinary calendar, source, event, and sync mutations are locked during migration. - UID preservation with target collision rejection before mutation. - Global destination barrier before any source DELETE is leased. - Destination conditional-create semantics and source DELETEs protected by captured ETags. - Durable operation idempotency, crash reconciliation, phase/progress/conflict visibility, actor evidence, and bounded cancellation. - Cancellation is permitted only before source deletion starts; it keeps both remote copies and restores source synchronization. ## Acceptance Criteria - [x] Migration batches expose phase, progress, conflicts, evidence, and durable idempotency. - [x] Destination success is a dependency of source deletion; retries and crashes cannot lose the only remote copy. - [x] Conditional ETags protect source deletes and destination creation. - [x] Tests cover duplicates, destination/source crash points, partial destination failure, UID collision, cancellation, concurrent local/remote edits, and reconciliation. - [x] Admin WebUI exposes destructive confirmation, lock state, polling progress, per-resource outcomes, conflicts, and safe cancellation. Implemented by `a125b66`.

zemion referenced this issue

2026-07-20 14:43:37 +02:00

[Task] Allow deleting/removing calendars with event move options #6

zemion commented

2026-07-20 15:30:15 +02:00

Implemented the decision-free, non-destructive part locally:

synchronized -> local requires detach_keep_remote; projections move, sync metadata is cleared, the source is retired locally, undelivered outbox work is cancelled, and no remote DELETE is issued
local -> enabled two-way CalDAV requires copy_to_remote; the local move and durable destination PUT desired states commit atomically
local -> local remains compatible
mismatched actions, inbound-only targets, synchronized -> synchronized, and remote_move are explicitly rejected; the UI offers only supported targets and explains the consequence

Validation: full Calendar suite 81 tests, Ruff, structural i18n audit, translation-key verification, production WebUI build (5,634 modules), and diff check passed. This issue remains needs-info only for the destructive remote_move saga: collision policy, concurrent-edit policy, authority/confirmation/evidence, and whether it ships at all.

Implemented the decision-free, non-destructive part locally: - synchronized -> local requires `detach_keep_remote`; projections move, sync metadata is cleared, the source is retired locally, undelivered outbox work is cancelled, and no remote DELETE is issued - local -> enabled two-way CalDAV requires `copy_to_remote`; the local move and durable destination PUT desired states commit atomically - local -> local remains compatible - mismatched actions, inbound-only targets, synchronized -> synchronized, and `remote_move` are explicitly rejected; the UI offers only supported targets and explains the consequence Validation: full Calendar suite 81 tests, Ruff, structural i18n audit, translation-key verification, production WebUI build (5,634 modules), and diff check passed. This issue remains needs-info only for the destructive `remote_move` saga: collision policy, concurrent-edit policy, authority/confirmation/evidence, and whether it ships at all.

zemion changed title from ~~[Decision] Define loss-safe bulk moves involving synchronized calendars~~ to [Task] Implement destructive synchronized-calendar remote move saga (deferred)

2026-07-20 16:42:35 +02:00

zemion commented

2026-07-20 16:42:35 +02:00

Product decision (2026-07-20): accept the safe green baseline (detach_keep_remote and copy_to_remote) and defer destructive synchronized-to-synchronized moves. The open issue now tracks only that later saga; the current API must keep rejecting it.

Product decision (2026-07-20): accept the safe green baseline (`detach_keep_remote` and `copy_to_remote`) and defer destructive synchronized-to-synchronized moves. The open issue now tracks only that later saga; the current API must keep rejecting it.

zemion added the area/api codex/ready module/calendar

labels 2026-07-29 14:15:03 +02:00

zemion changed title from ~~[Task] Implement destructive synchronized-calendar remote move saga (deferred)~~ to [Task] Implement destructive synchronized-calendar remote move saga

2026-08-02 17:31:24 +02:00

zemion closed this issue

2026-08-02 17:31:24 +02:00

zemion commented

2026-08-02 17:31:25 +02:00

Implemented and pushed in a125b66.

Validation:

Calendar backend: 136 tests passed.
Focused saga/outbox/service suite: 62 tests passed.
Fresh Alembic migration reached d24e5f607182 and created both migration tables.
Calendar WebUI interaction/decomposition tests passed.
Core WebUI TypeScript and structural i18n checks passed.
Workspace focused dependency, manifest, architecture, and module-permutation checks passed.

Implemented and pushed in `a125b66`. Validation: - Calendar backend: 136 tests passed. - Focused saga/outbox/service suite: 62 tests passed. - Fresh Alembic migration reached `d24e5f607182` and created both migration tables. - Calendar WebUI interaction/decomposition tests passed. - Core WebUI TypeScript and structural i18n checks passed. - Workspace focused dependency, manifest, architecture, and module-permutation checks passed.

zemion removed the codex/ready

status

ready

labels 2026-08-02 17:31:25 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-calendar#19