feat: sync Notion AI Meeting Notes

[salmonumbrella]

What changed

Adds native, read-only Notion AI Meeting Notes sync to msgvault.

• Adds [[notion_meetings]] configuration plus add-notion-meetings and sync-notion-meetings commands.
• Imports the title, time, attendees, summary, notes, and transcript into the canonical meeting archive used by Granola and Circleback.
• Tracks visible meetings incrementally, retries pending transcripts, and reports Notion's partial 50-meeting discovery window.
• Wires the source into daemon scheduling, account removal, meeting views, search, and embedding paths.

Why

Notion AI Meeting Notes were only available through manual export. This makes them a first-class meeting source without introducing a separate archive shape or a dependency on the Notion CLI.

Usage

[[notion_meetings]]
identifier = "notion-personal"
account_email = "you@example.com"
token = "ntn_..."
enabled = true
# schedule = "15 */6 * * *"

msgvault add-notion-meetings notion-personal
msgvault sync-notion-meetings notion-personal

Use sync-notion-meetings notion-personal --probe to check API capabilities without printing meeting content.

Closes #615

[roborev-ci]

roborev: Combined Review (da2faae)

Verdict: No Medium, High, or Critical findings were identified.

Reviewers found no actionable issues at the required severity threshold.

---

Reviewers: 2 done | Synthesis: codex, 5s | Total: 10m16s

[roborev-ci]

roborev: Combined Review (5c062a6)

Verdict: One medium-severity issue requires attention.

Medium

• internal/config/edit.go:654-675 — NotionMeetingsSource.Schedule is omitted from editable schedule validation, allowing malformed Notion cron expressions that later prevent daemon sync-job registration. Add Notion Meetings schedules to validateEditableCandidate and cover the config-edit path with tests.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 7m37s

[roborev-ci]

roborev: Combined Review (67915ce)

Verdict: One medium-severity synchronization issue found; no security vulnerabilities identified.

Medium

• internal/notionmeetings/importer.go:262-266 — Changed-meeting detection relies only on the discovery block’s LastEditedTime. Updates to hydrated child blocks or page Markdown may be skipped, leaving archived summaries, notes, or transcripts stale. The stored SnapshotSHA256 is unused for change detection. Track revision indicators for all content-bearing data or rehydrate visible meetings and compare snapshot checksums.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 11m36s

[roborev-ci]

roborev: Combined Review (43845b2)

Verdict: Three medium-severity issues require attention before merge.

Medium

• Incomplete transcripts may be archived permanently
  internal/notionmeetings/hydrate.go:126-130
  Truncated or incomplete Markdown is treated as a complete transcript when structured content is empty, clearing retry state and preventing later retries. Only use Markdown as definitive fallback when Truncated is false and no unknown block IDs exist.

• Optional user enrichment failures abort syncs
  internal/notionmeetings/hydrate.go:228-235, cmd/msgvault/cmd/notion_meetings.go:118-121
  Non-permission errors such as rate limits, transient provider failures, or network errors are treated as fatal despite user information being optional. Handle enrichment as best effort, record a warning, and continue with unresolved attendee labels.

• Unverified attendee names are excluded from checksums
  internal/notionmeetings/hydrate.go:262-280, internal/notionmeetings/format.go:84-90
  Display names appear in archived content but are omitted from ResolvedUsers, allowing name changes to produce the same checksum and leave stale archives unchanged. Include all user-derived display labels in checksum evidence while excluding unverified emails from participant rows.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 14m40s

[roborev-ci]

roborev: Combined Review (a4e641c)

Verdict: One medium-severity issue requires attention; no material security vulnerabilities were found.

Medium

• internal/notionmeetings/client.go:200-204 — Any valid JSON 2xx response, including {} or null, is accepted as a successful query. The importer may treat this as an empty result and silently evict known meetings from the sync cursor. Validate the response shape and require expected fields such as results and has_more; otherwise return ErrMalformedResponse.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 16m3s

[roborev-ci]

roborev: Combined Review (fa6fd32)

Verdict: Two medium-severity issues require attention.

Medium

• internal/notionmeetings/hydrate.go:109-113 — A temporarily unavailable transcript block causes hydration to fail before Markdown fallback or pending-retry state is recorded. Available notes may not be archived, and the meeting could be lost after leaving the visible 50-item window. Treat transcript-not-ready errors separately, retain available content, and schedule the transcript retry.

• internal/notionmeetings/hydrate.go:328-337 — Markdown transcript fallback consumes every line after the Transcript heading, causing subsequent sections to be archived and indexed as transcript content. Stop extraction at the next section heading at the same or higher level.

---

Reviewers: 2 done | Synthesis: codex, 7s | Total: 11m49s

[roborev-ci]

roborev: Combined Review (6fb95b1)

Verdict: One medium-severity data-loss risk identified; otherwise no issues found.

Medium

• Attendee data may be cleared on transient user lookup failure
  Location: internal/notionmeetings/hydrate.go:236-290; internal/meetingarchive/archive.go:178-180
  A transient User Information failure can clear attendee mappings. The next sync may persist an empty attendee set, replacing previously verified recipients and conversation participants and losing display names and attendee-based search relationships. Preserve last-known verified attendee data, or avoid replacing attendee relationships unless resolution succeeds. Add a regression test for a successful sync followed by a transient user-list failure.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 13m56s

[roborev-ci]

roborev: Combined Review (feaac6b)

Verdict: One medium-severity retry scheduling issue was identified.

• Medium — internal/notionmeetings/importer.go:226-229, internal/notionmeetings/importer.go:565-578: Meetings lacking a usable end time receive a 48-hour retry deadline, but expired pending entries are deleted before visible-set processing. If the meeting remains visible without a transcript, a new 48-hour window is created indefinitely. Persist the original deadline or retain an expired marker to prevent resetting the retry window.

---

Reviewers: 2 done | Synthesis: codex, 7s | Total: 15m38s

[roborev-ci]

roborev: Combined Review (bd4a69f)

Verdict: No medium-or-higher severity issues found; the only reported issue is low severity.

The implementation is clean with respect to the requested severity threshold.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 19m10s

[roborev-ci]

roborev: Combined Review (6d1c616)

Verdict: No Medium, High, or Critical findings.

Reviewers found no material issues requiring action.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 18m11s