@plinth-music/cli 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 Notable changes to `@plinth-music/cli`. Grouped by what a user notices, not by PR.
 
+## 0.18.0 - 2026-09-04
+
+Three code PRs since `0.17.0` (`v0.17.0..3ece28b`, #170, #171, #173; #169 and #172 docs).
+A minor because every member session is now told something different, and the generated
+deny list refuses 32 tool names it did not refuse before.
+
+⚠️ **Your sessions are no longer told that writing a calendar date is impossible.** Plinth's
+MCP server gained `preview_` / `create_` / `update_calendar_entry` on 3 September, and 0.17.0
+shipped injected grounding and command files that denied any such route existed — a false
+denial an agent acts on by giving up and leaving the date wrong. The grounding block and both
+`/plinth:start` and `/plinth:close` now name the route and the order it runs in: propose with
+`preview_calendar_entry`, put the proposal to a person, and only once they agree pass the
+token it minted to the writer. Agreement comes before the token in every one of those
+sentences, deliberately — nothing outside the desktop cockpit asks a human anything, so on a
+plain install that instruction is the whole gate.
+
+⚠️ **Calendar deletion and cancellation are refused again, on every MCP server: the deny list
+goes 91 to 123 patterns.** The rename that opened the sanctioned write path also retired a
+guarantee, because the old patterns were anchored on the noun `event` — so
+`delete_calendar_entry` on anyone's server was refused by nothing. Thirty-two patterns
+anchored on `calendar` and `entry` restore it. Two consequences worth knowing: this refuses a
+Plinth `delete_calendar_entry` too (none exists and none is planned, so if one ever ships it
+arrives denied rather than surprising somebody), and `delete` matches inside `deleted`, so a
+`get_deleted_calendar_entry` would be refused as well.
+
+- The injected grounding block grows 215 bytes (12,699 to 12,914). The injection budget is
+  fixed, so on a workspace already at it those bytes come out of the memory facts that ride
+  into the session head. The facts themselves are untouched on disk and still readable.
+
+The desktop app pins `@plinth-music/cli` exact (0.17.0 as of v1.10.0) and picks none of this
+up until its own release repins.
+
 ## 0.17.0 - 2026-09-03
 
 One code PR since `0.16.0` (`v0.16.0..a6209c8`, #165; #167 is tests and comments,

package/README.md

@@ -29,7 +29,7 @@ plinth start                      # run the daemon: continuous pull + watch + pu
 - `plinth confirm` — review and release destructive batches the daemon has quarantined (apply, or `--discard`).
 - `plinth refresh-context [--workspace <slug>]` — force-regenerate the workspace-root `CLAUDE.md` **and the two generated commands** from the current Plinth schema + workspace. The user-customisable block between the `<!-- BEGIN: user-customisable -->` / `<!-- END -->` markers is always preserved verbatim in every generated file; `CLAUDE.local.md` is never touched.
 - `plinth grounding` — print the session-start grounding block (current date, **who the member is**, entity resolution, write confirmation, workspace rules, workspace memory, user memory). It opens by naming the member: display name, email, role, workspace and machine timezone, and that tasks the agent creates are assigned to them unless told otherwise. That renders from a principal **persisted at login**, not a call at render time — this command runs on every session start, so a round trip would tax all of them and fail offline. An existing login self-heals on the next sync, so no re-login is needed, and a server that does not yet carry `role` renders a shorter true line rather than a dangling clause. Invoked by the generated Claude Code SessionStart hook. **Bounded at 20,000 bytes total.** Only the two memory indexes give: a generated safety primitive is never cut, and if the generated block alone exceeded the budget the indexes collapse to a pointer and the block goes over rather than losing a rule. An index that does not fit whole keeps the **most recently banked** facts, by the date each line carries rather than by position — `workspace-memory.md` supersedes in place, so an updated line keeps its original slot and position does not track age — and renders them in the file's own order, with a note saying how many of how many are shown. **A fact that does not fit whole is named by its title** — its own first sentence, a boundary the member already wrote, with its `[[pointer]]` kept — so the agent knows the fact exists and where to read it. ⚠️ **Naming is preferred over carrying, and that trades depth for breadth:** the naming pass runs first and packs, and whole facts compete for what is left, so on a full index no fact may ride whole at all. A title pays in proportion to how well the hook was written; a fact whose first sentence runs long compresses barely at all, which is why *shorten each fact's first sentence* buys room where *trim the file* does not. `voice.md` is a **pointer, not a payload**: it is read on demand when drafting, never injected, which is what took a live workspace's block from 43,578 bytes to 19,911.
-- `plinth voice-gate` — gate agent-originated copy against the workspace voice rubric. **No longer mounted by the mirror generator** (20 Aug 2026): a generated mirror carries no PreToolUse hook, voice is carried as an instruction by `workspace-rules.md`, and the outbound boundary is a `permissions.deny` list in the generated `.claude/settings.json` that refuses the **send, reply, forward, calendar-write and mail-deletion verbs on any mounted MCP**, not seven tool names — each verb anchored at a word boundary in four positions (start, after `_`, after `-`, and at a camel hump), which is what catches `outlook_send_message` and `send-mail` while leaving `resend_verification` and `list_sent` alone. Spam is the one family that is *not* anchored, and deliberately: no English word contains `spam` as a substring, so the unanchored form has nothing to over-reach into and catches `reportSpam` and `move_to_spam` as well as `mark_message_spam`. Deletion joined on 30 Aug 2026, taking the list from 61 patterns to 91: `trash` bare (nothing reads by *starting* with it, and `empty_trash` falls out for free), `delete` against the `message` / `thread` / `mail` nouns (bare, it would refuse every `mcp__plinth__delete_*` tool), and spam-marking, which Gmail purges after thirty days and is therefore deletion on a fuse. **Drafting, filing, labelling and reading are untouched** — `outlook_send_draft` is denied while `outlook_create_draft` is not, because the discriminator is the verb, never the noun, and archiving a message is a move rather than a deletion. **Two costs are disclosed rather than discovered:** a few reads are caught by name (`getForwardingSettings`, a `list_trash`), and the bare `trash` family also refuses Google Drive's `trash_file` and the only route the live Gmail mount has for discarding a staged draft — that connector exposes no `delete_draft`, so a wrong draft is repaired with `update_draft` instead. Ten holes are recorded as assertions in `tests/context-session-hook.test.ts` rather than as prose — deletion-by-move and Gmail's own label route among them, the latter being the widest, since Gmail expresses TRASH and SPAM as labels and labelling stays allowed. The list is an enumeration and the tests say so out loud. The command still ships and still works, for a hand-wired mount: `--hook` runs it as a PreToolUse hook that blocks non-compliant Gmail drafts; direct mode takes `--file <path>` or stdin and prints the verdict (`--json` for the raw response).
+- `plinth voice-gate` — gate agent-originated copy against the workspace voice rubric. **No longer mounted by the mirror generator** (20 Aug 2026): a generated mirror carries no PreToolUse hook, voice is carried as an instruction by `workspace-rules.md`, and the outbound boundary is a `permissions.deny` list in the generated `.claude/settings.json` that refuses the **send, reply, forward, calendar and mail-deletion verbs on any mounted MCP**, not seven tool names — each verb anchored at a word boundary in four positions (start, after `_`, after `-`, and at a camel hump), which is what catches `outlook_send_message` and `send-mail` while leaving `resend_verification` and `list_sent` alone. Spam is the one family that is *not* anchored, and deliberately: no English word contains `spam` as a substring, so the unanchored form has nothing to over-reach into and catches `reportSpam` and `move_to_spam` as well as `mark_message_spam`. Deletion joined on 30 Aug 2026, taking the list from 61 patterns to 91: `trash` bare (nothing reads by *starting* with it, and `empty_trash` falls out for free), `delete` against the `message` / `thread` / `mail` nouns (bare, it would refuse every `mcp__plinth__delete_*` tool), and spam-marking, which Gmail purges after thirty days and is therefore deletion on a fuse. **Plinth's own calendar-write route is deliberately outside the list** (4 Sept 2026). The server renamed those tools to `preview_` / `create_` / `update_calendar_entry` on 3 September, and because the deny dialect has no negation an exception cannot be written as a rule — the carve-out *is* the name. The same rename retired a guarantee, since the calendar families were anchored on the noun `event` and `delete_calendar_entry` on anyone's server was then refused by nothing, so the list went from 91 patterns to **123**: `delete` and `cancel` anchored on `calendar` and `entry`, which refuses calendar deletion on every server again, Plinth's own included. **Drafting, filing, labelling and reading are untouched** — `outlook_send_draft` is denied while `outlook_create_draft` is not, because the discriminator is the verb, never the noun, and archiving a message is a move rather than a deletion. **Two costs are disclosed rather than discovered:** a few reads are caught by name (`getForwardingSettings`, a `list_trash`), and the bare `trash` family also refuses Google Drive's `trash_file` and the only route the live Gmail mount has for discarding a staged draft — that connector exposes no `delete_draft`, so a wrong draft is repaired with `update_draft` instead. Ten holes are recorded as assertions in `tests/context-session-hook.test.ts` rather than as prose — deletion-by-move and Gmail's own label route among them, the latter being the widest, since Gmail expresses TRASH and SPAM as labels and labelling stays allowed. The list is an enumeration and the tests say so out loud. The command still ships and still works, for a hand-wired mount: `--hook` runs it as a PreToolUse hook that blocks non-compliant Gmail drafts; direct mode takes `--file <path>` or stdin and prints the verdict (`--json` for the raw response).
 - `plinth backlinks <target>` — report what points at a target, by reading the local mirror rather than making a network call. `<target>` can be a mirror path (`projects/breadcrumb-trail.md` — including a mirror-root file like `CLAUDE.md`), a bare name (`breadcrumb-trail`), or a wikilink target as written (`Aligned Timeline - 4 June 2026`). Output is file paths with line numbers and the link as written; `--paths-only` emits deduped paths for piping, and stdout carries the answer ALONE — withheld rows never reach the pipe, whatever the display flags say. **Every narrowing is disclosed, and the counts print even when they are zero**, because a filter the caller cannot see is indistinguishable from an empty corpus, and a disclosure that only appears when it bites gives a reader no baseline to judge it against. Two footers carry them: links withheld from the answer (daemon-rendered marker blocks, code spans / HTML comments, and links to a bare name several files answer to), and the corpus line — which workspace was searched, how much of the mirror was read against its full size, and what went unread: `this-fiction · 859 of 880 files scanned (21 non-markdown, 0 unreadable) in 34ms`. `--unfiltered` shows the withheld rows, each tagged with the narrowing that hid it. Non-markdown files are not scanned for links but **do** count as existing, so asking about a PDF in `files/` answers rather than denying it. Exit codes: `0` results found or the target file exists, `1` no such target and nothing links to that name, `2` a bare name several files answer to (it lists them rather than guessing — and every candidate it prints resolves when pasted back), `3` no active workspace, an unknown or malformed workspace slug, or a mirror with nothing to search.
 - `plinth declare <path> --scratchpad <dir> [--label=<text>]` — declare a file in the session scratchpad as a work product, so it appears in the cockpit's work-products panel instead of being lost with the session. Appends one line to an append-only `.plinth-deliverables.jsonl` manifest inside `<dir>`; the manifest records the **path, never the content**, so the panel always points at the live file rather than a snapshot that can go stale. Grounding primitive (j) instructs the agent to run this the moment it writes a deliverable whose only home is the scratchpad. **The scratchpad directory is required and never inferred** (`--scratchpad`, or `PLINTH_SCRATCHPAD_DIR`): this repo learns it from neither the app that spawns the terminal nor the harness that told the agent, so a guessed root would silently widen the containment check every refusal rests on. Refuses, with exit 1, anything outside that directory — including a symlink whose target is outside it — plus a directory, a file that does not exist yet, and a missing root.
 - `plinth review-tier [--repo <path>] [--base <ref>]` — print the code-review tier the current diff earns, `low` or `high`, for use as `/code-review $(plinth review-tier)`. Reads the diff against the merge base — committed, uncommitted **and untracked**, since a brand-new never-added file is invisible to `git diff` and would otherwise be classified as absent — and routes `high` on the risk classes the review rubric names: auth/RLS, optimistic concurrency/CAS, financial math, data-moving migrations, and large **and** multi-subsystem together. **It is a router, not a ceiling**: size alone never escalates, because a blanket cap would kill the concurrency reviews that earn their keep. **The output contract is the safety story.** It is invoked inside `$( )`, where an empty stdout or a non-zero exit would collapse the caller to an unqualified `/code-review` that silently inherits whatever global effort is configured — safe by accident, and indistinguishable from this working. So stdout carries **exactly one token and nothing else**, the exit code is **always 0**, and the reasoning goes **unconditionally to stderr** on both tiers. Anything it cannot classify — not a git repo, no merge base, no default branch, an empty diff — prints `high` and says why on stderr.

package/dist/build-stamp.json

@@ -1,5 +1,5 @@
 {
-  "sha": "bc49180c1d2e3f217f3eedda18bd075870cc36aa",
+  "sha": "d641e2f41a54942541eeddfa55776d42e226e011",
   "dirty": false,
-  "built_at": "2026-09-03T21:05:22.806Z"
+  "built_at": "2026-09-04T17:57:36.767Z"
 }

package/dist/cli.js

@@ -7584,7 +7584,7 @@ function _getBuiltinFlags(long, short, userNames, userAliases) {
 // package.json
 var package_default = {
   name: "@plinth-music/cli",
-  version: "0.17.0",
+  version: "0.18.0",
   description: "Plinth capstone sync daemon and CLI",
   type: "module",
   private: false,
@@ -27072,7 +27072,7 @@ function composeGroundingBlock(today, workspaceRules, workspaceMemory, userMemor
   add("grounding", `Plinth session grounding:`, ``, `Today's date: ${today}. You have no inherent sense of the current date and ` + `your training has a knowledge cutoff, so treat this injected date as ` + `authoritative for anything time-relative: deadlines, what counts as ` + `"recent" or "upcoming", and the age of any data or of your own knowledge.`);
   if (identity !== null)
     add("identity", ``, identity);
-  add("grounding", ``, `Resolve Plinth entities before answering about them. For any answer grounded ` + `in a specific artist, project, task, or other workspace entity, first look ` + `the name up in THIS workspace with the Plinth MCP tools ` + `(\`mcp__plinth__search_entities\`, \`mcp__plinth__list_artists\`, or ` + `\`mcp__plinth__list_projects\`) and ground your answer in what they return. ` + `Do not answer from name recognition alone: a globally famous name may not ` + `exist in this workspace, and an entity here may differ from the public ` + `figure of the same name. If the lookup returns nothing, say so instead of ` + `inventing details.`, ``, `Plan before you write. The first time you call any mutating Plinth MCP tool ` + `in a session (create_*, update_*, delete_*, mark_*: anything that changes ` + `workspace data), do not commit silently: state exactly what you would write, ` + `naming the tool, the entity, and the fields and values, and proceed only after ` + `the user confirms or amends.`, ``, `Write through the canonical surface. In this cockpit the file tree is your edit ` + `surface, so reach for it before the most direct tool. Change prose (document ` + `bodies, free-form notes, anything textual) by editing the mirror markdown ` + `file; the daemon syncs it up. An artist's master context is the clearest case: ` + `it lives in the body of that artist's \`artists/<slug>/_artist.md\` mirror file, ` + `the file the web context pane renders, and one of only two files under ` + `\`artists/<slug>/\` the daemon syncs both ways (\`memory.md\` is the other), ` + `so change it by editing that body, never by creating ` + `a separate document or context entity (e.g. \`create_document\`) the pane won't ` + `render. One carve-out inside that file: a block labelled as rendered from ` + `Plinth is regenerated on every sync and your edits to it are discarded, so ` + `write those through the tool the block names. Change structured fields (task ` + `status, priority, assignees, due dates, a project's category) through the ` + `Plinth MCP (\`mcp__plinth__*\`) or the task file's frontmatter, which is ` + `row-canonical but still written through the validated API. Make a bulk or ` + `destructive change (a mass delete, a gutting overwrite) by editing the file ` + `path, so the daemon's confirm-gate can quarantine it for \`plinth confirm\`. ` + `Never write the database directly, which rules out raw SQL and ` + `\`execute_sql\`, \`apply_migration\` and \`psql\`: those bypass the daemon, the ` + `mirror, the confirm-gate, canonicality, and API validation.`, ``, `Dates belong on the calendar, not in \`key_dates\`. The date surface for an artist ` + `is their mapped Google Calendar; the \`key_dates\` table is retired. Reading ` + `dates is yours, and this mirror already holds them: the daemon projects every ` + `mapped calendar into \`views/calendar/upcoming.md\` and ` + `\`views/calendar/<slug>.md\`, so read those before reaching for a tool ` + `(\`list_artist_calendars\`). They are derived and overwritten, ` + `so they are current only as of the \`generated_at\` in their header - quote that ` + `stamp, never edit them, and check the status line, because a calendar Plinth ` + `could not reach is unknown rather than empty. When a tool is the only way, ` + `resolve the calendar through \`mcp__plinth__list_artist_calendars\` and use its ` + `\`calendar_id\` field, not the mapping row's \`id\`, because the default ` + `\`primary\` is almost never theirs.`, ``, `Writing a date is not yours, by any route: not a calendar tool, and not a ` + `shell command line either, the Google Workspace one included. The calendar ` + `tools are refused for you where Plinth has configured this workspace. ` + `Nothing refuses a shell, anywhere, and where Plinth has not configured ` + `this workspace nothing is refused at all: you are the only thing holding ` + `those. The way ` + `through is a person, not a workaround, so when a date needs adding or ` + `correcting say plainly what the change is, say that it goes in through ` + `Plinth's calendar view, and say that a person makes it. Say why, too: a date ` + `left looking handled is worse than one openly outstanding, and a calendar ` + `write goes out to everyone invited the moment it lands and cannot be recalled.`, ``, `Draft email. Never send it. Writing the draft is yours: use the draft tools ` + `(\`create_draft\`, \`update_draft\`), then say where the draft is and what it ` + `says, so the person can read it and send it in their own name. Sending, ` + `replying, forwarding and deleting are not yours, by any route: not a mail tool, and ` + `not a shell command line either. The mail tools are refused for you where ` + `Plinth has configured this workspace. Nothing refuses a shell, anywhere, ` + `and where Plinth has not configured this workspace nothing is refused at ` + `all: you are the only thing holding those. This is not a comment on your ` + `writing. It is that a message which has left the building cannot be recalled, ` + `and one deleted out of a mailbox is not yours to lose; the person whose name ` + `is on it is the one who decides.`);
+  add("grounding", ``, `Resolve Plinth entities before answering about them. For any answer grounded ` + `in a specific artist, project, task, or other workspace entity, first look ` + `the name up in THIS workspace with the Plinth MCP tools ` + `(\`mcp__plinth__search_entities\`, \`mcp__plinth__list_artists\`, or ` + `\`mcp__plinth__list_projects\`) and ground your answer in what they return. ` + `Do not answer from name recognition alone: a globally famous name may not ` + `exist in this workspace, and an entity here may differ from the public ` + `figure of the same name. If the lookup returns nothing, say so instead of ` + `inventing details.`, ``, `Plan before you write. The first time you call any mutating Plinth MCP tool ` + `in a session (create_*, update_*, delete_*, mark_*: anything that changes ` + `workspace data), do not commit silently: state exactly what you would write, ` + `naming the tool, the entity, and the fields and values, and proceed only after ` + `the user confirms or amends.`, ``, `Write through the canonical surface. In this cockpit the file tree is your edit ` + `surface, so reach for it before the most direct tool. Change prose (document ` + `bodies, free-form notes, anything textual) by editing the mirror markdown ` + `file; the daemon syncs it up. An artist's master context is the clearest case: ` + `it lives in the body of that artist's \`artists/<slug>/_artist.md\` mirror file, ` + `the file the web context pane renders, and one of only two files under ` + `\`artists/<slug>/\` the daemon syncs both ways (\`memory.md\` is the other), ` + `so change it by editing that body, never by creating ` + `a separate document or context entity (e.g. \`create_document\`) the pane won't ` + `render. One carve-out inside that file: a block labelled as rendered from ` + `Plinth is regenerated on every sync and your edits to it are discarded, so ` + `write those through the tool the block names. Change structured fields (task ` + `status, priority, assignees, due dates, a project's category) through the ` + `Plinth MCP (\`mcp__plinth__*\`) or the task file's frontmatter, which is ` + `row-canonical but still written through the validated API. Make a bulk or ` + `destructive change (a mass delete, a gutting overwrite) by editing the file ` + `path, so the daemon's confirm-gate can quarantine it for \`plinth confirm\`. ` + `Never write the database directly, which rules out raw SQL and ` + `\`execute_sql\`, \`apply_migration\` and \`psql\`: those bypass the daemon, the ` + `mirror, the confirm-gate, canonicality, and API validation.`, ``, `Dates belong on the calendar, not in \`key_dates\`. The date surface for an artist ` + `is their mapped Google Calendar; the \`key_dates\` table is retired. Reading ` + `dates is yours, and this mirror already holds them: the daemon projects every ` + `mapped calendar into \`views/calendar/upcoming.md\` and ` + `\`views/calendar/<slug>.md\`, so read those before reaching for a tool ` + `(\`list_artist_calendars\`). They are derived and overwritten, ` + `so they are current only as of the \`generated_at\` in their header - quote that ` + `stamp, never edit them, and check the status line, because a calendar Plinth ` + `could not reach is unknown rather than empty. When a tool is the only way, ` + `resolve the calendar through \`mcp__plinth__list_artist_calendars\` and use its ` + `\`calendar_id\` field, not the mapping row's \`id\`, because the default ` + `\`primary\` is almost never theirs.`, ``, `Writing a date is not yours to do unasked, and the route is Plinth's own: ` + `propose it with \`preview_calendar_entry\`, put that proposal to the person, ` + `and only once they agree pass the token it minted for exactly that proposal ` + `to \`create_calendar_entry\` or \`update_calendar_entry\`. Nothing else writes ` + `one: ` + `no other calendar tool, and not a shell command line either, the ` + `Google Workspace one included. ` + `Nothing refuses a shell, anywhere, and where Plinth has not configured ` + `this workspace nothing is refused at all: you are the only thing holding ` + `those. Where no calendar is mapped, or a token is refused, that is not a ` + `wall. The way ` + `through is a person, not a workaround, so ` + `say plainly what the change is, say that it goes in through ` + `Plinth's calendar view, and say that a person makes it. Say why, too: a date ` + `left looking handled is worse than one openly outstanding, and a calendar ` + `write goes out to everyone invited the moment it lands and cannot be recalled.`, ``, `Draft email. Never send it. Writing the draft is yours: use the draft tools ` + `(\`create_draft\`, \`update_draft\`), then say where the draft is and what it ` + `says, so the person can read it and send it in their own name. Sending, ` + `replying, forwarding and deleting are not yours, by any route: not a mail tool, and ` + `not a shell command line either. The mail tools are refused for you where ` + `Plinth has configured this workspace. Nothing refuses a shell, anywhere, ` + `and where Plinth has not configured this workspace nothing is refused at ` + `all: you are the only thing holding those. This is not a comment on your ` + `writing. It is that a message which has left the building cannot be recalled, ` + `and one deleted out of a mailbox is not yours to lose; the person whose name ` + `is on it is the one who decides.`);
   if (workspaceRules === null && voiceProfile === null) {
     add("voice", ``, `Check the voice yourself, because nothing else checks it now. Two files carry ` + `it: \`workspace-rules.md\` at the mirror root holds this workspace's house ` + `style, and \`${VOICE_FILENAME}\` beside it holds your own voice profile, the ` + `sign-off and the habits that belong to one member rather than the team. Read ` + `them before you write and follow them as written, rather than drafting in ` + `your own register and correcting after. Nothing inspects a draft between you ` + `and the person reading it, so the rules in those files are the whole of it.`);
   }
@@ -29346,8 +29346,10 @@ var MANAGED_COMMENT = [
   "or in .claude/settings.local.json.",
   "The permissions.deny entries below are managed the same way. They stop an agent",
   "in this workspace sending, replying to or forwarding mail, deleting or trashing",
-  "it, marking it spam, and writing a calendar; drafting, filing, labelling and",
-  "reading stay allowed. The refusal covers a draft the agent staged itself: on a",
+  "it, marking it spam, and writing a calendar - create, update, delete and cancel",
+  "wherever the name also carries event, plus delete and cancel wherever it carries",
+  "calendar entry; drafting, filing, labelling and reading stay allowed.",
+  "The refusal covers a draft the agent staged itself: on a",
   "Gmail mount there is no delete-draft tool, so trashing was the only way to",
   "discard one and it is now refused. Fix a wrong draft with update_draft, which",
   "keeps its thread. They match by VERB FAMILY rather than by",
@@ -29355,6 +29357,8 @@ var MANAGED_COMMENT = [
   "rule set, not four - and the matcher cannot express an alternation, so each",
   "spelling needs its own line. That width also catches a few reads whose name",
   "merely begins with a send verb - getForwardingSettings is the live example -",
+  "and a few whose name merely CONTAINS one - a calendar read called",
+  "get_deleted_calendar_entry is refused, because delete sits inside deleted -",
   "and it stops an agent trashing any file, not only mail: nothing here can tell",
   "a mailbox's trash from a drive's.",
   "You cannot re-open one of these here: a deny beats an allow, including yours,",
@@ -29363,6 +29367,10 @@ var MANAGED_COMMENT = [
   "message that has gone cannot be recalled. Nor is a deleted one yours to lose:",
   "it is somebody else's mailbox, spam-marking is deletion on a thirty-day fuse,",
   "and neither is undone by noticing afterwards.",
+  "One thing is deliberately NOT on this list, and it is the only exception:",
+  "Plinth's own create_calendar_entry and update_calendar_entry, the sanctioned",
+  "calendar write path, which take a two-step preview-and-confirm of their own",
+  "before anything reaches a calendar.",
   "One more entry stops an agent EDITING voice.md, the",
   "voice profile it is judged against: that file is yours to write and theirs to read.",
   "Your own allow list is untouched, and your own",
@@ -29441,6 +29449,38 @@ var MANAGED_DENY = [
   "mcp__*__*_cancel*Event*",
   "mcp__*__*-cancel*Event*",
   "mcp__*__*Cancel*Event*",
+  "mcp__*__delete*calendar*entry*",
+  "mcp__*__*_delete*calendar*entry*",
+  "mcp__*__*-delete*calendar*entry*",
+  "mcp__*__*Delete*calendar*entry*",
+  "mcp__*__delete*calendar*Entry*",
+  "mcp__*__*_delete*calendar*Entry*",
+  "mcp__*__*-delete*calendar*Entry*",
+  "mcp__*__*Delete*calendar*Entry*",
+  "mcp__*__delete*Calendar*entry*",
+  "mcp__*__*_delete*Calendar*entry*",
+  "mcp__*__*-delete*Calendar*entry*",
+  "mcp__*__*Delete*Calendar*entry*",
+  "mcp__*__delete*Calendar*Entry*",
+  "mcp__*__*_delete*Calendar*Entry*",
+  "mcp__*__*-delete*Calendar*Entry*",
+  "mcp__*__*Delete*Calendar*Entry*",
+  "mcp__*__cancel*calendar*entry*",
+  "mcp__*__*_cancel*calendar*entry*",
+  "mcp__*__*-cancel*calendar*entry*",
+  "mcp__*__*Cancel*calendar*entry*",
+  "mcp__*__cancel*calendar*Entry*",
+  "mcp__*__*_cancel*calendar*Entry*",
+  "mcp__*__*-cancel*calendar*Entry*",
+  "mcp__*__*Cancel*calendar*Entry*",
+  "mcp__*__cancel*Calendar*entry*",
+  "mcp__*__*_cancel*Calendar*entry*",
+  "mcp__*__*-cancel*Calendar*entry*",
+  "mcp__*__*Cancel*Calendar*entry*",
+  "mcp__*__cancel*Calendar*Entry*",
+  "mcp__*__*_cancel*Calendar*Entry*",
+  "mcp__*__*-cancel*Calendar*Entry*",
+  "mcp__*__*Cancel*Calendar*Entry*",
   "mcp__*__trash*",
   "mcp__*__*_trash*",
   "mcp__*__*-trash*",
@@ -29945,7 +29985,7 @@ function buildStartCommandMd(rosterIsEmpty2, offerTrim = false, stores = BLOB_ME
     "",
     "Then the calendar. It is Plinth's projection of every artist's calendar.",
     "",
-    "**This is a FILE READ, not a calendar call, and the rule in Step 2 stands unchanged: you still never open a calendar tool.** The file is here so that you do not have to.",
+    "**This is a FILE READ, not a calendar call, and Step 2's budget stands unchanged: no calendar call in this brief.** The file is here so that you do not have to make one. **That is a cost rule about the opener, not a closed door** - Plinth has a calendar-write route of its own, named below. Opening a session is not when you take it.",
     "",
     '**Brief it as of its own `generated_at` stamp, and say the stamp.** A projection is a cache. It is exactly as current as the header says it is and no more, so "nothing on this week" is only ever true as of that moment.',
     "",
@@ -29953,7 +29993,7 @@ function buildStartCommandMd(rosterIsEmpty2, offerTrim = false, stores = BLOB_ME
     "",
     "If the file carries `fetch_state: stale`, the last refresh failed: say how old the dates are rather than reporting them as current. If the file is absent altogether, say the projection has not run yet and carry on without it.",
     "",
-    "**Dates are read here and changed by a person, in Plinth's calendar view.** If something needs moving, say what the change is and hand it over.",
+    "**Dates are read here, and changing one is not part of this brief.** If something needs moving, say plainly what the change is. After this session's brief it goes one of two ways: propose it with `preview_calendar_entry`, put that proposal to the person, and only once they agree pass the token it minted to `create_calendar_entry` or `update_calendar_entry` - or hand the change to a person to make in Plinth's calendar view.",
     "",
     "## Step 4: brief, in three lines",
     "",
@@ -30062,7 +30102,7 @@ function buildCloseCommandMd(workspaceSlug, stores = BLOB_MEMORY_STORES) {
     "- **A note, brief or bio that is a piece of writing in its own right** is a document under `documents/`. That means standalone material somebody would open and read on its own, not a fact you are recording because you learned it - a fact is a memory line, and Step 4b routes it.",
     "- **A stable attribute of an artist** - their website, a handle, their bio - is that artist's own field, or the body of `artists/<slug>/_artist.md`.",
     "- **A contract, statement or attachment** is a file under `files/`.",
-    "- **A date is live state and belongs in no memory file.** A deadline rides its task as a due date. Every other date is a calendar matter: say plainly what the date is, say that a person adds it in Plinth's calendar view, and name it in the closing summary so it is not quietly dropped.",
+    "- **A date is live state and belongs in no memory file.** A deadline rides its task as a due date. Every other date is a calendar matter: say plainly what the date is, and either propose it with `preview_calendar_entry`, put that proposal to the member, and only once they agree pass the token it minted to `create_calendar_entry` or `update_calendar_entry` - or hand it to a person to add in Plinth's calendar view. Name it in the closing summary either way, so it is not quietly dropped.",
     "",
     '**A typed fact with no home today is named in the closing summary as "no home yet", and written nowhere.** The case that actually occurs is a contact who belongs to several artists or to none - a publisher who routes writers across the whole roster. Do not pick one artist arbitrarily and do not flatten it into a memory line. **You cannot write it with no artist either: `create_artist_contact` requires `artist_id` or `artist_name` and errors with `Either artist_id or artist_name is required`.** So this is a real gap with no surface behind it today, not a shortcut you are declining to take. Name it in the summary and leave it unwritten; a named gap is useful, and a contact filed under an artist it does not belong to is worse than nothing.',
     "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plinth-music/cli",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Plinth capstone sync daemon and CLI",
   "type": "module",
   "private": false,