The Last Thing You Arm Is the Thing You Can't Take Back — A Reversible Away System for Mail and Calendar

What you'll do

A local command-line away system you own end to end: a written mutation contract that classifies every outward write as replaceable, removable, or emitted, and an arming sequence that honours that order; split OAuth credentials, where the token that reads your mail holds only `gmail.metadata` and is provably unable to fetch a message body, and the token that writes holds no mail-reading scope at all; a read-only scan that builds a delegation plan from headers alone, so a briefing document physically cannot contain a sentence from anyone's email; a coverage roster and an unowned-work gate that refuses to arm while a single open thread has no named owner or explicit decision to let it wait; correct instants for two APIs that want time in two different formats, tested across a daylight-saving transition; a capture-before-mutate receipt that records the exact prior vacation settings, filter list, and tagged calendar events before anything changes; a three-phase arm that sets the vacation responder, creates one idempotent out-of-office event with an auto-decline mode you chose deliberately, and only then, behind a confirmation that names them out loud, permits the effects that cannot be recalled; a one-command disarm that restores from the receipt, treats an already-deleted object as success, and prints an honest list of what it could not undo; an append-only ledger and an `explain` command that reconstructs any single decision months later; a re-entry brief that separates what your delegates actually handled from what merely aged; and four drills you have personally run — a twelve-minute rehearsal window, a second auto-reply that correctly never arrives, a hand-deleted event that disarm must survive, and a half-failed arm that leaves no orphan.