Redacted excerpt; full evidence withheld. Demo script defect: it calls create_contact on a server granted only calendar read methods.