== A. the route opens the calendar the reference names == PASS a valid one-off reference opens its public calendar (200) PASS the page shows the public calendar name PASS the document title names the calendar, not "Embedded Calendar" PASS the page renders the calendar's events PASS the page is marked standalone, not embedded PASS the calendar name is the standalone page's

PASS the standalone page has exactly one

, and no heading level is skipped PASS a timed one-off reference opens the same public calendar PASS a timed one-off reference renders the same events PASS a recurring occurrence reference opens the same public calendar PASS a recurring occurrence reference renders the same events PASS a detached override reference opens the same public calendar PASS a detached override reference renders the same events PASS another calendar's reference opens its OWN calendar PASS no navigation URL on the page exposes a raw ICS URL PASS the calendar viewer is never entered through calendar-embed.php?ics= from here PASS the standalone page is noindex/nofollow/noarchive PASS the standalone page sends Referrer-Policy: no-referrer PASS the standalone page repeats robots/referrer in PASS every external link still carries rel="noopener noreferrer" PASS the calendar page publishes no LOCATION from the source PASS the calendar page publishes no DESCRIPTION from the source == B. focus month, and navigation stays in signed-reference mode == PASS a supplied focus date selects the shared occurrence's month PASS the shared occurrence itself is visible in that month PASS other events of the calendar provide context in that month PASS an explicit year/month moves the view PASS ...without changing the calendar PASS the page renders both Prev and Next PASS Prev and Next stay on /calendar/ PASS Prev and Next carry presentation parameters only PASS the download link stays on /calendar/ PASS following Prev renders the previous month, still in reference mode PASS ...on the same calendar PASS ...and its own Prev/Next are STILL /calendar/ PASS ...and never fall back to a raw ?ics= URL PASS download in reference mode returns the calendar PASS ...as a calendar attachment PASS Back to event is offered PASS Back to event is the EXACT /e/ PASS Back to event is a real , not a scripted navigation PASS event rows still carry canonical Event Links PASS a detached override still shares its ORIGINAL recurrence identity PASS the standalone page still loads the shared sharing asset == C. the calendar outlives the event the reference names == PASS a reference whose event no longer exists still opens the calendar PASS ...and still renders that calendar's events PASS a valid reference to a REVOKED calendar fails cleanly (410) PASS ...with a generic message PASS ...naming no base, token or upstream host PASS ...and leaking no PHP diagnostics PASS ...and offering no calendar actions == D. Follow this calendar reuses the existing follow path == PASS the standalone calendar-level CTA says Follow this calendar PASS the standalone page never says "Add this calendar" PASS the follow modal is titled Follow this calendar PASS the follow modal carries the agreed standalone copy PASS Open in Calee app points at the existing /follow page FAIL the follow link carries a signed calendar intent token FAIL the intent is a calendar subscription FAIL the intent names the CANONICAL rebuilt public ICS source, from the verified reference PASS the intent never names the other calendar FAIL the intent uses the current public calendar name as its title FAIL the intent expires PASS the existing app launcher attributes are still rendered PASS the manual subscription link field is still offered PASS Apple, Google, Outlook and the full guide are all still offered PASS the install-recovery line is still offered PASS the modal starts hidden and needs a click to open PASS nothing on the page follows automatically PASS no account, login or signup is required to browse or follow PASS the copy fallback never claims a copy it did not make PASS with NO intent secret the calendar still renders (200) PASS ...showing the same calendar and events PASS ...still offering Follow this calendar PASS ...still navigable in reference mode PASS ...with no blank page and no PHP diagnostics PASS ...and the existing development fallback, not a new follow protocol == E. security: nothing but the verified reference selects the source == PASS a tampered payload is refused (404) PASS a tampered payload displays no calendar at all PASS a tampered payload leaks no source, token or PHP diagnostics PASS a tampered signature is refused (404) PASS a tampered signature displays no calendar at all PASS a tampered signature leaks no source, token or PHP diagnostics PASS an unsupported version is refused (404) PASS an unsupported version displays no calendar at all PASS an unsupported version leaks no source, token or PHP diagnostics PASS an arbitrary string is refused (404) PASS an arbitrary string displays no calendar at all PASS an arbitrary string leaks no source, token or PHP diagnostics PASS a reference with a missing segment is refused (404) PASS a reference with a missing segment displays no calendar at all PASS a reference with a missing segment leaks no source, token or PHP diagnostics PASS a reference signed with another secret is refused (404) PASS a reference signed with another secret displays no calendar at all PASS a reference signed with another secret leaks no source, token or PHP diagnostics PASS a conflicting ics URL never switches the calendar being displayed PASS a conflicting ics URL fails closed rather than rendering anything PASS a conflicting ics URL never fetches an arbitrary upstream URL PASS an off-registry ics URL never switches the calendar being displayed PASS an off-registry ics URL fails closed rather than rendering anything PASS an off-registry ics URL never fetches an arbitrary upstream URL PASS an arbitrary calendarUrl never switches the calendar being displayed PASS an arbitrary calendarUrl fails closed rather than rendering anything PASS an arbitrary calendarUrl never fetches an arbitrary upstream URL PASS a raw url parameter never switches the calendar being displayed PASS a raw url parameter fails closed rather than rendering anything PASS a raw url parameter never fetches an arbitrary upstream URL PASS a base + token pair never switches the calendar being displayed PASS a base + token pair fails closed rather than rendering anything PASS a base + token pair never fetches an arbitrary upstream URL PASS a second eventref never switches the calendar being displayed PASS a second eventref fails closed rather than rendering anything PASS a second eventref never fetches an arbitrary upstream URL PASS a ref parameter never switches the calendar being displayed PASS a ref parameter fails closed rather than rendering anything PASS a ref parameter never fetches an arbitrary upstream URL PASS a uid parameter never switches the calendar being displayed PASS a uid parameter fails closed rather than rendering anything PASS a uid parameter never fetches an arbitrary upstream URL PASS an occurrenceId parameter never switches the calendar being displayed PASS an occurrenceId parameter fails closed rather than rendering anything PASS an occurrenceId parameter never fetches an arbitrary upstream URL PASS a conflicting ics BEFORE the date never switches the calendar being displayed PASS a conflicting ics BEFORE the date fails closed rather than rendering anything PASS a conflicting ics BEFORE the date never fetches an arbitrary upstream URL PASS a percent-encoded second eventref never switches the calendar being displayed PASS a percent-encoded second eventref fails closed rather than rendering anything PASS a percent-encoded second eventref never fetches an arbitrary upstream URL PASS a percent-encoded ics never switches the calendar being displayed PASS a percent-encoded ics fails closed rather than rendering anything PASS a percent-encoded ics never fetches an arbitrary upstream URL PASS an emptied eventref beside a valid ics does NOT fall back into legacy ?ics= mode PASS an emptied eventref beside a valid ics does not render the signed-reference calendar either PASS an emptied eventref beside a valid ics renders no calendar at all PASS an emptied eventref beside a valid ics fails closed with 404 PASS an emptied eventref beside a valid ics stays in standalone mode (its response headers prove it) PASS an emptied eventref beside a valid ics fetched no source and leaked no token or DAV URL PASS an emptied eventref beside a valid ics leaked no PHP diagnostics PASS an array eventref beside a valid ics does NOT fall back into legacy ?ics= mode PASS an array eventref beside a valid ics does not render the signed-reference calendar either PASS an array eventref beside a valid ics renders no calendar at all PASS an array eventref beside a valid ics fails closed with 404 PASS an array eventref beside a valid ics stays in standalone mode (its response headers prove it) PASS an array eventref beside a valid ics fetched no source and leaked no token or DAV URL PASS an array eventref beside a valid ics leaked no PHP diagnostics PASS a keyed-array eventref beside a valid ics does NOT fall back into legacy ?ics= mode PASS a keyed-array eventref beside a valid ics does not render the signed-reference calendar either PASS a keyed-array eventref beside a valid ics renders no calendar at all PASS a keyed-array eventref beside a valid ics fails closed with 404 PASS a keyed-array eventref beside a valid ics stays in standalone mode (its response headers prove it) PASS a keyed-array eventref beside a valid ics fetched no source and leaked no token or DAV URL PASS a keyed-array eventref beside a valid ics leaked no PHP diagnostics PASS a %5B%5D-encoded array eventref beside a valid ics does NOT fall back into legacy ?ics= mode PASS a %5B%5D-encoded array eventref beside a valid ics does not render the signed-reference calendar either PASS a %5B%5D-encoded array eventref beside a valid ics renders no calendar at all PASS a %5B%5D-encoded array eventref beside a valid ics fails closed with 404 PASS a %5B%5D-encoded array eventref beside a valid ics stays in standalone mode (its response headers prove it) PASS a %5B%5D-encoded array eventref beside a valid ics fetched no source and leaked no token or DAV URL PASS a %5B%5D-encoded array eventref beside a valid ics leaked no PHP diagnostics PASS a %5Bfoo%5D-encoded array eventref beside a valid ics does NOT fall back into legacy ?ics= mode PASS a %5Bfoo%5D-encoded array eventref beside a valid ics does not render the signed-reference calendar either PASS a %5Bfoo%5D-encoded array eventref beside a valid ics renders no calendar at all PASS a %5Bfoo%5D-encoded array eventref beside a valid ics fails closed with 404 PASS a %5Bfoo%5D-encoded array eventref beside a valid ics stays in standalone mode (its response headers prove it) PASS a %5Bfoo%5D-encoded array eventref beside a valid ics fetched no source and leaked no token or DAV URL PASS a %5Bfoo%5D-encoded array eventref beside a valid ics leaked no PHP diagnostics PASS a percent-encoded emptied eventref beside a valid ics does NOT fall back into legacy ?ics= mode PASS a percent-encoded emptied eventref beside a valid ics does not render the signed-reference calendar either PASS a percent-encoded emptied eventref beside a valid ics renders no calendar at all PASS a percent-encoded emptied eventref beside a valid ics fails closed with 404 PASS a percent-encoded emptied eventref beside a valid ics stays in standalone mode (its response headers prove it) PASS a percent-encoded emptied eventref beside a valid ics fetched no source and leaked no token or DAV URL PASS a percent-encoded emptied eventref beside a valid ics leaked no PHP diagnostics PASS an emptied eventref alone does NOT fall back into legacy ?ics= mode PASS an emptied eventref alone does not render the signed-reference calendar either PASS an emptied eventref alone renders no calendar at all PASS an emptied eventref alone fails closed with 404 PASS an emptied eventref alone stays in standalone mode (its response headers prove it) PASS an emptied eventref alone fetched no source and leaked no token or DAV URL PASS an emptied eventref alone leaked no PHP diagnostics PASS an array eventref alone does NOT fall back into legacy ?ics= mode PASS an array eventref alone does not render the signed-reference calendar either PASS an array eventref alone renders no calendar at all PASS an array eventref alone fails closed with 404 PASS an array eventref alone stays in standalone mode (its response headers prove it) PASS an array eventref alone fetched no source and leaked no token or DAV URL PASS an array eventref alone leaked no PHP diagnostics PASS a keyed-array eventref alone does NOT fall back into legacy ?ics= mode PASS a keyed-array eventref alone does not render the signed-reference calendar either PASS a keyed-array eventref alone renders no calendar at all PASS a keyed-array eventref alone fails closed with 404 PASS a keyed-array eventref alone stays in standalone mode (its response headers prove it) PASS a keyed-array eventref alone fetched no source and leaked no token or DAV URL PASS a keyed-array eventref alone leaked no PHP diagnostics PASS an emptied eventref with a focus date does NOT fall back into legacy ?ics= mode PASS an emptied eventref with a focus date does not render the signed-reference calendar either PASS an emptied eventref with a focus date renders no calendar at all PASS an emptied eventref with a focus date fails closed with 404 PASS an emptied eventref with a focus date stays in standalone mode (its response headers prove it) PASS an emptied eventref with a focus date fetched no source and leaked no token or DAV URL PASS an emptied eventref with a focus date leaked no PHP diagnostics PASS the ics= used above really is a renderable legacy source PASS a plain focus date still renders the reference's own calendar PASS a year/month pair still renders the reference's own calendar PASS an unrelated tracking parameter still renders the reference's own calendar PASS a hostile Host still renders the correct calendar PASS a hostile Host appears NOWHERE in the response PASS every ABSOLUTE URL is still on a configured, registered origin PASS Back to event still points at the CONFIGURED origin under a hostile Host PASS an extra route segment never renders a calendar PASS an extra route segment exposes no filesystem or PHP diagnostics PASS a nested route segment never renders a calendar PASS a nested route segment exposes no filesystem or PHP diagnostics PASS an encoded traversal never renders a calendar PASS an encoded traversal exposes no filesystem or PHP diagnostics PASS a bare route never renders a calendar PASS a bare route exposes no filesystem or PHP diagnostics PASS a route with no reference never renders a calendar PASS a route with no reference exposes no filesystem or PHP diagnostics PASS with NO Event Link secret the route fails closed (503) PASS ...showing no calendar PASS ...and no PHP diagnostics PASS the viewer verifies the reference before resolving any source PASS standalone source URLs come from the canonical registry helper PASS the viewer never concatenates an upstream host by hand PASS the viewer never decodes an Event Link payload itself PASS the viewer builds no URL from a request header == F. the legacy embed keeps working exactly as before == PASS a legacy ?ics= URL still renders (200) PASS ...the same calendar and the same events PASS ...with its original document title PASS ...and no standalone chrome at all PASS ...keeping the calendar name as an

, with no

introduced PASS ...keeping "Add this calendar", not the standalone Follow label PASS ...and its original modal copy PASS ...and its original ?ics= month navigation PASS ...and gains NO new response headers PASS ...and still shares canonical Event Links PASS a legacy off-registry ?ics= is still forbidden PASS a legacy request with no ?ics= still says so PASS no second calendar renderer file was added PASS the standalone route enters the EXISTING viewer PASS no ICS parsing, recurrence or Event Link minting was duplicated PASS lib/calendar_event_link.php is unchanged by this feature PASS lib/calendar_sources.php is unchanged by this feature PASS lib/calendar_intent_token.php is unchanged by this feature PASS lib/event_link_preview_renderer.php is unchanged by this feature PASS event-link-mint.php is unchanged by this feature PASS event-link-preview.php is unchanged by this feature PASS calendar-intent.php is unchanged by this feature PASS assets/calendar-event-share.js is unchanged by this feature PASS assets/calendar-app-launch.js is unchanged by this feature PASS calendar-follow.php only GAINED lines (nothing was removed or rewritten) PASS nothing calendar-follow.php gained touches intent, launch, source or URL semantics PASS no second workflow was added PASS the workflow still declares exactly one job PASS CI runs this suite PASS the step greps for this suite's marker PASS CI still runs every pre-existing suite PASS README documents the standalone calendar route PASS README documents this suite PASS README no longer claims /e/ carries a direct Follow CTA 5 self-test(s) FAILED.