# Structure Cal changelog

## 2026-10-04 — Delegated-policy toggle persistence feedback

- The Travel & booking rules permission checkbox now saves immediately and verifies both settings and booking-policy before showing Saved. Failed or mismatched saves show an inline error and require a reload. Calendar choices include provider and local ID.
- Tests cover enable/disable, reload persistence, failed saves, and Google owner settings agreeing with Editor access. Permission changes do not advance policy content revision.

## 2026-10-04 — Reviewed delegated policy and all-day availability

- Added owner-controlled delegated policy edits, off by default. All policy, trip and type-rule writes now require dry-run review, confirm/plan_hash, a global policy If-Match and an idempotency key. Working hours are readable/editable through the policy API; the dashboard shows concrete changes and guarded owner undo with actor/history evidence.
- Added the calendar all-day blocking default (off), explicit event Free/Busy create/PATCH, and consistent complete-event availability across busy, bookings, free-slots and brief gaps. No existing provider events are relabeled. Google may omit externally chosen default Busy; Structure-authored choices preserve private intent (see API limits).
- Guest-night candidates (any overlap with 21:00–08:00 guest local) always rank below daytime candidates and expose guest_late_hour. Brief overlaps include titles and event bounds. Missing requests and subscription delivery resources carry specific 404 codes.
- Compatibility: direct policy writes now require the reviewed protocol; trip DELETE returns 200 JSON. Google availability requires event-detail access and complete bounded reads; failures never imply free time. Tests use fictional data, including mocked Google writes and isolated staging fixtures. Real calendar 2 events and booking 15 remain untouched.


## 2026-10-04 — Travel-aware bookings and guest collaboration

- Clarified conflict warnings for non-applicable diagnostics; booking/calendar 404s have codes and cancelled bookings never advertise override permission.
- Added owner-managed trips and host-wide booking policy, with dashboard controls, guarded API writes, travel timezone availability and in-person home-city restrictions. No sample trips or live preferences are installed.
- Added online/in-person formats, preferred and request-only hours, and selected-guest-timezone late-hour hints. Online remains the default; meeting links are not auto-created.
- Guest confirmation links can submit pending reschedule requests. Delegated approval uses the existing preview/hash/idempotency/notification safety workflow with durable recovery. Requests do not reserve slots or send email.
- Ranked free-slot search checks complete Google/native availability, travel, buffers and booking rules. Results are advisory and bounded; the daily cap counts Structure Cal bookings, not arbitrary calendar events.
- Optional agenda briefs group morning solo reminders and report overlaps, adjacent meetings, afternoon gaps and the first meeting tomorrow. Gaps describe selected calendar events, not booking availability.
- Added owner before/after buffers, daily booking caps and no-meeting windows; reviewed one-booking overrides list the exact added checks.
- Added explicit booking lifecycle feeds/signed webhooks, bounded retries and private delivery logs. Delivery remains at-least-once and requires configured flags/worker and member opt-in.
- Added private Editor-readable/writable booking prep notes and links with ETags; prep stays out of guest/provider/notification data.
- Added fictional-data provider-write, DST, policy, permission, concurrency/recovery and notification tests. Real calendar 2 events are excluded from development and staging checks.

## 2026-10-03 — Booking previews and personal audit access

- Editor/Admin slot previews now work with delegation off, clearly marked non-applicable with no plan hash. Apply stays permission-gated with `owner_permission_required`; previews recheck access after provider reads.
- Conflict-consent warnings appear only for actual unacknowledged conflicts. Reschedule notification details now use neutral `booking_email`, including older operation replays.
- Editors can page through their own completed booking changes and verify who/reason/checks, including ledger-proven owner recovery. Other members’ entries, event snapshots, undo ETags and history export remain restricted.
- Added guarded operator preview/apply for local booking status reconciliation against an exact, versioned Google cancellation. It never edits Google or sends notifications; inaccessible/missing/recurring events are not cancellation evidence.
- Added fictional-data regression coverage and staging acceptance for diagnostics, actual provider writes/retries, own-history filtering and local-only cancellation reconciliation.

## 2026-10-03 — Delegated booking availability overrides

- Added a separate owner preference for Editor/Admin availability overrides, off by default. Both booking delegation flags must be enabled; every override requires a reason and an exact preview of bypassed checks. Public booking availability stays unchanged.
- Busy conflicts remain blocked for everyone unless the reviewed request explicitly includes `allow_conflict: true`. Calendar-scoped booking 403/409 responses include short refusal codes. Changed availability checks require renewed review.
- Audit history records the requester, completing actor, reason, exact overridden checks and conflict choice, including interrupted-request recovery. Existing PR #9 operation hashes and recovery remain supported.
- Added migration, permission, conflict, policy-change and recovery regression tests plus a fictional Google early-slot write/retry smoke test on staging. Deployment itself changes no bookings or owner preferences.

## 2026-10-03 — Booking reschedules and Editor previews

- Added calendar-scoped booking list/detail and reviewed reschedule endpoints with booking versions, plan hashes, idempotency keys and an explicit guest-notification choice. Reschedules preserve the Google event ID, attendees and conference details, update local booking time and reset reminder bookkeeping.
- Owner preferences now include delegated booking rescheduling, off by default. Enabled Editors/Admins follow normal availability; only the owner may make a reasoned one-booking availability override.
- Durable operations record partial outcomes, reserve target times and guard legacy booking changes/reminders. Retries inspect Google before repeating a write; owner reconciliation can finish proven local state without another notification. Unknown writes remain locked for review. Successful moves enter existing opted-in metadata change feeds and event audit history.
- Editors can preview undo for a known audit ID and ETag. Applying undo and browsing/exporting history remain Admin/Owner-only.
- Invalid page tokens now include `code: "invalid_page_token"`; conversion previews explicitly return `provider_written: false`.
- Historical ICS regression tests cover native and fictional Google exports before 2025 and across spring/fall DST transitions. Timezone coverage already derives from exported event dates; no fixed-2025 behavior remains.

No production bookings are migrated, moved or delegated automatically by this release.

## 2026-10-03 — Live verification fixes

- ICS exports include definitions for referenced timezones so clients can interpret local event and recurrence times.
- Invalid Google list page tokens return 400 with restart instructions; provider outages retain their outage status.
- Calendar RSVP reads explicitly report applicability and the reason when unavailable. Booking-managed events and missing invitations have no response target; attempted replies are refused without writing.
- The event-list endpoint table includes `complete`. Conversion instructions explicitly require a caller-supplied recurrence rule, and previews list originals chronologically.
- Undo accepts a read-only `dry_run` preview using the same live version and safety checks as apply. Preview never claims an undo or changes events/audits; apply rechecks current state.

## 2026-10-03 — Agent reliability follow-up

- Legacy booking timezone repair: explicit preview/apply, host-primary-calendar verification, current ETags, unchanged instants and no attendee notifications. Nothing runs automatically on deployment.
- Google single-to-series conversion: reviewed exact occurrence equivalence, preview hash, confirmed successor before deleting originals, and durable recovery for partial provider writes.
- Event reminders: Google/native create and PATCH accept explicit popup/email overrides. Native delivery uses opt-in authenticated feeds or owner-only email; change webhooks remain available.
- Attendees and RSVP: Google append/replace choices preserve retained guests' responses; delegated calendar RSVP distinguishes Google self/native owner from the authenticated member.
- Pagination: every event page includes explicit final `next_page_token: null` and terminal `complete`; group reads expose missing members without claiming complete event data.
- Audit and undo: per-event history filtering and authenticated GFAVIP attribution; guarded series create/update inverses and retained-tombstone Google standalone restoration where supported. No blind inverse for multi-event conversions/splits.
- ICS: bounded range snapshots and duplicate-checked native import previews with apply-time revalidation. Google remains an export/copy source; reminders omitted from exports and disabled on import are explicitly disclosed.

Read [API details](https://cal.structure.info/docs/api.md) and the updated
[agent skill](https://cal.structure.info/skill.md) before using the new writes.
Acceptance uses fictional Google data and staging PostgreSQL, not personal events.