Live spike against me@lucasberger.ca: one app password enumerated both account
calendars (PROPFIND), and a REPORT fetched + cached 503 real events into MariaDB
with correct D-13 timed/all-day handling (CAL-01). Per-member app-password model
(D-09) validated; no cross-account ACL needed; no fallback required. Gate 2 (live
Authelia/Pangolin login + SSE smoke test) remains pending operator action.
- 01-04-SUMMARY.md: code-complete; Task 1 committed (48f90ce); Tasks 2+3 are live-gate checkpoints with exact human-action steps
- CAL-08-DECISION.md: template for human to fill in after running apps/api/src/broker/spike.ts against real Fastmail credentials
Lucas Berger