The whole suite, in the open.

Two concurrent commits for the same slot: exactly one wins, the other gets 409 SLOT_TAKEN — enforced by the real EXCLUDE constraint, not app-level locking.

Round-robin (union) and collective (intersection) slot maths, weighted/priority fairness ordering, and deadlock-free guard-row insert order across a team of hosts.

Team booking against a real database: round-robin UNION and collective INTERSECTION availability, first-free-host binding with fall-through to the next host, an exhausted pool raising 23P01 (SLOT_TAKEN), idempotent replay on the idempotency key, and every FK indexed with RLS FORCED.

Buffers before/after a meeting extend the exclusion range correctly, so back-to-back bookings can never encroach on padding.

Commit-time validation rejects malformed, out-of-window, and off-grid start instants before they reach the database.

Host-scoped booking reads and writes stay inside the row-level-security tenant boundary.

DST spring-forward gaps and fall-back overlaps resolve to the correct UTC instant across zones and transition dates.

The slot engine yields exactly the bookable instants for a host’s rules, overrides, and busy set — boundaries, horizon, and granularity included.

Availability rules, date overrides, and busy merges compose into the right open-time set for a host’s week.

The outbox worker drains write→read-back-verify→persist and only marks a job synced after the event is confirmed to exist.

The Google adapter’s write, idempotent retry, read-back verify, update-in-place, and delete all surface non-2xx as loud failures — never a false “synced”.

The Outlook / Microsoft Graph adapter holds the same contract as the Google one — token caching, busy/tentative/out-of-office mapping, idempotent create with a transactionId, read-back verify, update-in-place on a 404, and safe delete — surfacing every non-2xx as a loud failure, never a false “synced”.

Reschedule and cancel re-run the same exclusion and cap checks, so a changed booking is as safe as a new one.

Confirmation, reschedule, and cancel emails render with correct, timezone-accurate details.

Reminders fire once, on time, and are suppressed when a booking is already cancelled or moved (no stale sends).

The SMTP transport formats, retries, and reports delivery failures instead of dropping them silently.

Health evaluation flips to degraded/unhealthy on the right queue-depth and reachability thresholds — the signal behind the public status page.

The rate-limit policy admits and rejects at the configured thresholds and windows.

The durable rate-limit store enforces limits across processes against a real database.

Every document gets a per-request nonce and the header nonce matches the script nonce.

Environment parsing rejects missing/invalid configuration instead of booting into an unsafe state.

The OAuth start/callback flow signs state, checks CSRF, and refuses tampered callbacks.

Signed OAuth state round-trips and rejects forged or expired values.

Session tokens are signed, verified, and expire as specified.

Post-auth redirects are validated against open-redirect abuse.

Manage-links are unguessable, single-purpose, and verify before granting access.

Request schemas reject malformed public and host inputs at the edge.

Host provisioning creates a correctly-scoped tenant with RLS in force.