feat(03-10): wire buildVeventString into dispatch path + fix all-day DTEND+1 (CR-02, WR-04)

- outboxWorker: parse stored form JSON, build VCALENDAR via buildVeventString for create/update
- outboxWorker: return hardFail on payload parse error (corrupt payload never self-resolves)
- outboxWorker: import buildVeventString and RRULE_PRESETS from vevent.js
- vevent.ts: advance all-day DTEND by +1 calendar day (RFC-5545 exclusive end, WR-04 owning boundary)

apps/api/src/broker/outboxWorker.ts

@@ -31,6 +31,7 @@ import { createFastmailClient } from './client.js'
 import { decryptPassword } from './crypto.js'
 import { syncCalendar } from './sync.js'
 import { createCalendarEvent, updateCalendarEvent, deleteCalendarEvent } from './write.js'
+import { buildVeventString, RRULE_PRESETS } from './vevent.js'
 import type { FastmailClient } from './client.js'
 
 // ── Constants (D-07) ────────────────────────────────────────────────────────
@@ -165,10 +166,27 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
         error: 'update operation missing payload or calendarObjectUrl',
       }
     }
+    // CR-02: parse the stored form JSON and build a real VCALENDAR string
+    let fields: Record<string, unknown>
+    try {
+      fields = JSON.parse(row.payload) as Record<string, unknown>
+    } catch {
+      return { success: false, conflict: false, hardFail: true, transient: false, error: 'payload parse failed' }
+    }
+    const { icsString } = buildVeventString({
+      uid: row.uid,
+      summary: fields.title as string,
+      allDay: fields.allDay as boolean,
+      dtstart: fields.allDay ? (fields.start as string) : new Date(fields.start as string),
+      dtend: fields.allDay ? (fields.end as string) : new Date(fields.end as string),
+      location: fields.location as string | undefined,
+      description: fields.description as string | undefined,
+      rruleString: fields.recurrence && fields.recurrence !== 'none' ? RRULE_PRESETS[fields.recurrence as string] : undefined,
+    })
     response = await updateCalendarEvent(
       client,
       row.calendarObjectUrl,
-      row.payload,
+      icsString,
       row.etag ?? null,
     )
   } else {
@@ -182,9 +200,26 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
         error: 'create operation missing payload',
       }
     }
+    // CR-02: parse the stored form JSON and build a real VCALENDAR string
+    let fields: Record<string, unknown>
+    try {
+      fields = JSON.parse(row.payload) as Record<string, unknown>
+    } catch {
+      return { success: false, conflict: false, hardFail: true, transient: false, error: 'payload parse failed' }
+    }
+    const { icsString } = buildVeventString({
+      uid: row.uid,
+      summary: fields.title as string,
+      allDay: fields.allDay as boolean,
+      dtstart: fields.allDay ? (fields.start as string) : new Date(fields.start as string),
+      dtend: fields.allDay ? (fields.end as string) : new Date(fields.end as string),
+      location: fields.location as string | undefined,
+      description: fields.description as string | undefined,
+      rruleString: fields.recurrence && fields.recurrence !== 'none' ? RRULE_PRESETS[fields.recurrence as string] : undefined,
+    })
     // Build a minimal DAVCalendar for the write wrapper (only url is needed)
     const davCalendar = { url: row.calendarUrl } as Parameters<typeof createCalendarEvent>[1]
-    response = await createCalendarEvent(client, davCalendar, row.uid, row.payload)
+    response = await createCalendarEvent(client, davCalendar, row.uid, icsString)
   }
 
   const status = response.status

apps/api/src/broker/vevent.ts

@@ -80,10 +80,19 @@ export function buildVeventString(params: NewEventParams): { uid: string; icsStr
     const [sy, sm, sd] = startStr.split('-').map(Number) as [number, number, number]
     const [ey, em, ed] = endStr.split('-').map(Number) as [number, number, number]
 
+    // WR-04 (owning boundary): RFC-5545 §3.6.1 — DTEND for an all-day event is the
+    // EXCLUSIVE end date. Advance the user-entered inclusive end by one calendar day.
+    // Building a Date from UTC components ensures no DST ambiguity during the roll-over.
+    const endDate = new Date(Date.UTC(ey, em - 1, ed))
+    endDate.setUTCDate(endDate.getUTCDate() + 1)
+    const ey2 = endDate.getUTCFullYear()
+    const em2 = endDate.getUTCMonth() + 1
+    const ed2 = endDate.getUTCDate()
+
     // ICAL.Timezone.localTimezone is passed as the zone arg required by TS types.
     // isDate:true suppresses any time/TZID output regardless of zone. (D-13)
     const startTime = new ICAL.Time({ year: sy, month: sm, day: sd, isDate: true }, ICAL.Timezone.localTimezone)
-    const endTime = new ICAL.Time({ year: ey, month: em, day: ed, isDate: true }, ICAL.Timezone.localTimezone)
+    const endTime = new ICAL.Time({ year: ey2, month: em2, day: ed2, isDate: true }, ICAL.Timezone.localTimezone)
     vevent.addPropertyWithValue('dtstart', startTime)
     vevent.addPropertyWithValue('dtend', endTime)
   } else {