# Top Rule: No Placeholders or Mock Data

- Use only actual values. Do not introduce sample, placeholder, or mock data anywhere (code, docs, examples, commands).
- If a placeholder seems unavoidable, stop and ask for explicit approval and the real values before proceeding.
- Documentation should reference required variables without fake values or example tokens.

# Global Copilot Instructions – No-Interaction Policy

## Lessons Learned (Excel/PocketBase sync)
- Normalize Notes before comparing/merging: convert `\r\n`→`\n`, trim, and compare full strings (no substring containment checks).
- When Notes differ, keep both by concatenating with `\n\n`; never drop content or rely on substring containment.
- Only write the Notes cell via table column `dataBodyRange/cell` to avoid overwriting formula columns.
- Run a fresh audit before any apply/write; do not rely on stale deltas or cached data.
- In poller, skip updates when `notesMergeNeeded` is false; do not rewrite every row.

## User Interaction Policy
- Default to zero user interaction. Do not prompt users unless absolutely necessary.
- Prefer agent/service account credentials for backend operations.
- When delegated access is required, accept a token supplied by the system (env var, API payload, or CLI arg). Do not initiate interactive login flows.
- Do not use device-code prompts or browser-based consent screens in backend processes.
- Show UI elements for login only when strictly required (e.g., delegated token missing or expired and cannot be refreshed). Otherwise, keep any auth UI hidden.

## Token Handling
- Delegated tokens are provided to backend processes via environment, secure API endpoint, or arguments.
- No file persistence for tokens. Keep tokens in memory only.
- Use lightweight in-memory caching; reuse token until expiry.
- If available, respect an explicit expiry (`GRAPH_TOKEN_EXPIRES_AT` as unix ms). Warn when <5 minutes remain; do not auto-prompt.

## Authentication Preferences
- PocketBase: use agent/service account for system operations; accept user token from frontend only for attribution.
- Microsoft Graph: prefer app-only or delegated token supplied programmatically; avoid interactive flows.

## Implementation Notes
- Pollers and servers should start and run without any interactive steps.
- Accept token updates via a secure API if refresh is needed; avoid storing tokens on disk.
- UI should only appear when a user must explicitly log in to obtain a delegated token and no alternative is feasible.
