docs(roadmap): settle attendee-invitation behavior (record-only)

Decision (owner, 2026-06-22): attendee editing is record-only on any
writable calendar. Calendula has no INTERNET and never sends an
invitation itself — it only writes Attendees rows. Notification is
decided downstream (local: no one; CalDAV: server iMIP; Google: Google).
Mandatory backend-aware copy makes this honest. No fabricated ORGANIZER;
the optional "send .ics via email app" delegate is deferred.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.planning/ROADMAP.md

@@ -490,12 +490,23 @@ detail screen (since v0.6) but the form can't write them. Make guests editable.
   the existing `WRITE_CALENDAR`. A contact-picker entry (`ACTION_PICK` on emails,
   one-shot, no READ_CONTACTS) can follow as a convenience, reusing the address-
   picker mechanism above.
-- **Sync-adapter caveat — decide before building:** writing `Attendees` rows
+- **Invitation behavior — DECIDED 2026-06-22: record-only, all writable
-  triggers backend-specific *invitation* behavior. Google's provider may auto-mail
+  calendars.** Calendula has no INTERNET and never sends an invitation itself; it
-  invites; CalDAV/DAVx5 writes the `ATTENDEE` property and leaves delivery to the
+  only writes `Attendees` rows. Whether a guest is notified is decided downstream:
-  server. Calendula sends nothing itself (no INTERNET), so what actually reaches a
+  local calendars notify no one (no sync); CalDAV/DAVx5 PUTs the `ATTENDEE` lines
-  guest depends entirely on the sync adapter. Settle and document the honest
+  and the *server* decides iMIP delivery; Google's sync adapter pushes the change
-  promise (and any "your account may email this guest" copy) up front.
+  and Google decides (third-party attendee writes are historically unreliable
+  there). Editing is allowed on **any writable calendar** — not gated to local.
+  - **Honest, backend-aware copy is mandatory** (this is the whole point of the
+    decision): on a synced calendar show "Calendula doesn't send invitations —
+    your calendar account may email guests when it syncs"; on a local calendar
+    show "Stored on this device. No one is notified."
+  - Calendula must **not fabricate an ORGANIZER** or otherwise fake scheduling
+    state to coax a send — it writes the guest list faithfully and leaves
+    scheduling entirely to the backend.
+  - The optional "send an .ics invite via your email app" delegate (`ACTION_SEND`,
+    still no INTERNET) was considered and **deferred** — revisit only if users ask
+    to notify guests explicitly.
 - **Out of scope (for now):** RSVP/your-own-response editing, free/busy lookups,
   resource booking — all carry server round-trips or richer sync semantics.
 

.planning/STATE.md

@@ -167,9 +167,10 @@ release-cut.
    detail screen since v0.6; the gap is the write side — make guests editable
    in `EventEditScreen` / `EventForm` (add by typed email, role, remove),
    persisted by diffing `CalendarContract.Attendees`. No new permission for the
-   typed-email path. **Resolve first:** the backend-specific invitation/sync
+   typed-email path. **Invitation behavior DECIDED 2026-06-22: record-only on all
-   behavior (Google auto-mails invites, CalDAV writes `ATTENDEE`) — decide and
+   writable calendars** — Calendula never sends (no INTERNET); honest backend-aware
-   document the honest promise. Full sketch in `ROADMAP.md` → "Attendee editing".
+   copy ("your account may email guests when it syncs" on synced calendars, "no one
+   is notified" on local). Full sketch in `ROADMAP.md` → "Attendee editing".
 3. Then: the two INTERNET go/no-go calls (OSM autocomplete, remote calendar
    create/edit) and Tier 2/3 leftovers (quick-settings tile, now-line, week
    numbers in month, full-text search, accessibility pass). Drag-and-drop