docs: MS Graph calendar commands/events + fix stale CalendarSource trait signature (T8.9, M4.4)

docs/03-data-model.md

@@ -339,6 +339,10 @@ segment (the M1 grounding invariant, asserted by the golden-transcript test).
     "expose_recordings": false, // never serve .wav unless explicitly true (FR-MCP-3)
   },
   "privacy": { "encrypt_at_rest": false },
+  // Optional MS Graph calendar source (M4.4, T8.9, FR-CAL-6). Opt-in, explicit consent via OAuth
+  // PKCE — OFF by default. `credential_ref` points into the OS credential store; the token itself
+  // is never written here (same invariant as sync credentials, FR-SYNC-6).
+  "calendar": { "graph_enabled": false, "graph_credential_ref": null },
 }
 ```
 

docs/04-api-contracts.md

@@ -87,6 +87,13 @@ import_pst(input: { path: string; password?: string }): number   // eventsImport
 list_calendar_events(input: { from?: number; to?: number }): CalendarEvent[]
 get_calendar_event(input: { eventId: string }): { event: CalendarEvent; participants: Participant[] }  // pre-meeting panel + naming dropdown (FR-CAL-3, FR-SPK-4)
 attach_meeting_to_event(input: { meetingId: MeetingId; eventId: string }): void
+// Optional MS Graph calendar source (M4.4, T8.9, FR-CAL-6): opt-in, explicit consent (OAuth PKCE
+// + Microsoft's own consent screen), metadata-only (subject/organizer/start/end/attendees, never
+// the event body). Not a SyncTarget — begin_graph_calendar_link stores its token separately from
+// sync_targets and never appears in list_sync_targets.
+begin_graph_calendar_link(): { authUrl: string }              // opens in browser; emits calendar://linked when done
+import_graph_calendar(input: { from?: number; to?: number }): number  // eventsImported; emits calendar://progress
+disconnect_graph_calendar(): void                              // best-effort credential cleanup + settings reset
 
 // ---- Sync / upload (ADR-0010) ----  secrets are passed to add/update but stored only in the OS
 // credential store; they are NEVER returned by list_sync_targets.
@@ -148,6 +155,8 @@ privacy_self_check(): {
 "llm://done"             { meetingId, summary: SummaryFile }                  // full summary.json contents, not just a pointer
 "model://progress"       { id, receivedBytes, totalBytes }
 "pst://progress"         { processed, total }
+"calendar://linked"      { ok: boolean, error?: string }                     // MS Graph OAuth handshake settled (M4.4)
+"calendar://progress"    { processed, total }                                // MS Graph import (M4.4)
 "hardware://changed"     { active: BackendId, reason: string }               // fallback occurred (FR-HW-4)
 "recording://retention"  { meetingId, record: boolean }                      // retention toggled (FR-REC-1/3)
 "sync://job"             { jobId, meetingId, targetId, artifact, status, bytesSent, bytesTotal }  // FR-SYNC-5
@@ -218,9 +227,12 @@ pub trait Diarizer: Send + Sync {
 }
 
 // calendar/mod.rs
+// `attendees()` (a second, separate trait method in the original design) was dropped — every
+// source (PstSource, GraphSource) lists attendees inline per-appointment, so import() returns
+// them together (see ADR-0008's update). CalImport gained `from`/`to` (M4.4) for a source that
+// fetches by date range (Graph's calendarView); PstSource ignores them.
 pub trait CalendarSource: Send + Sync {
-    fn import(&self, input: CalImport) -> Result<Vec<CalendarEvent>, CalError>; // pst|graph|ics
-    fn attendees(&self, event_id: &str) -> Result<Vec<Participant>, CalError>;
+    fn import(&self, input: CalImport) -> Result<Vec<ImportedEvent>, CalError>; // pst|graph|ics
 }
 
 // notes/mod.rs