chore(03): close Phase 03 — transition to Phase 04

- 03-08-SUMMARY (Gate 2 record) written; phase marked complete (12/12)
- ROADMAP: Phase 3 [x] complete 2026-06-07; REQUIREMENTS updated
- STATE: advanced to Phase 4, focus + progress corrected (backlog 999.x were
  miscounted as milestone phases → reset total_phases to 5, 60%)
- PROJECT.md evolved: event CRUD / OIDC login / iOS PWA install moved to
  Validated (Phase 3); D-17 logged; Android install + onboarding-provider-setup
  kept Active
- removed stale .continue-here + one-shot HANDOFF.json

Carried forward: B5 (Android install), Phase 4 SSE entry gate (D-14), backlog 999.3-999.9.
This commit is contained in:
Lucas Berger
2026-06-07 19:24:33 -04:00
parent d71b15cd02
commit cca5205173
6 changed files with 110 additions and 148 deletions
@@ -0,0 +1,79 @@
---
phase: 03-event-write-back-pwa-install
plan: 08
subsystem: gate, live-verification, auth, broker, pwa
tags: [gate-2, live-verification, authelia, oidc, pangolin, ios-pwa, caldav, write-back]
# Dependency graph
requires:
- phase: 03-event-write-back-pwa-install
plan: 04
provides: write endpoints (create/edit/delete) + outbox
- phase: 03-event-write-back-pwa-install
plan: 06
provides: EventDetailPopover + DeleteConfirmationDialog + SyncStateToast
- phase: 03-event-write-back-pwa-install
plan: 07
provides: PWA manifest + service worker + InstallPrompt
provides:
- Gate 2 live-verification results against the real Authelia + Pangolin deploy
- Confirmed end-to-end write path (create/all-day/recurring/edit/delete/conflict) to Fastmail
- Confirmed iOS standalone install + OIDC login (load-bearing)
affects: [phase-04]
# Tech tracking
tech-stack:
added: []
patterns:
- "Live Mode-A topology: local origin + Newt connector + Authelia OIDC through Pangolin"
- "Operator-driven verification (playwright-cli unavailable in WSL2); evidence via DB/outbox + browser"
key-files:
created:
- .planning/phases/03-event-write-back-pwa-install/03-08-SUMMARY.md
modified:
- .planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md
---
# Phase 03 Plan 08: Gate 2 Live Verification — Summary
**One-liner:** Took FamilySync live (real Authelia OIDC over Pangolin/Newt) and verified the full event write-back path end-to-end to Fastmail on desktop and iOS, fixing a long string of blocker bugs found only under live conditions.
## Outcome
Gate 2 is **complete for Phase 03 scope**. See `03-GATE2-RESULTS.md` for the per-row record. Summary:
- **A — Auth/session/colors:** A1 (OIDC login → app) ✅, A2 (session — transparent via Authelia SSO) ✅, A3 (distinct member colors) ✅ after fixing a color-collision bug.
- **B — iOS standalone (load-bearing):** B1B4 ✅ — install to Home Screen, full-screen standalone launch, and **OIDC login completed from standalone without dropping to Safari**. B5 (Android install) deferred.
- **C — SSE smoke:** deferred by design — this is the Phase 4 *entry* gate (D-14), verified at the start of Phase 4.
- **D — write round-trips:** D1D6 ✅ — create (timed), all-day, weekly recurring, edit, delete, 412-conflict, plus recurring-series delete, all round-tripping to caldav.fastmail.com.
## Blocker bugs found + fixed live (all committed + deployed)
Live bring-up surfaced bugs the dev-bypass build could not:
- **Tunnel:** newt MTU 1280→1200 (operator) — encrypted WireGuard packets exceeded the underlay MTU, blackholing the JS bundle (the original "spinner"). API now serves the full `./public` tree.
- **Auth:** `/api/login` route + `fetchMe` `redirect:'manual'`; OIDC scopes/client_id; and the OIDC **state-cookie churn** (events query racing the login flow → `OAUTH_INVALID_RESPONSE`) — fixed by gating the events query on auth.
- **Write path:** event timezone (UTC serialization), per-user calendar identity (unique(userId,url) + per-user predicates), missing `calendars` join in edit/delete (503), delete **cache reconciliation** (deletes lingered as ghosts), and the post-write **refetch race** (resync now precedes marking the outbox row done).
- **UI:** calendar **remount flash** (nested component rendered as `<CalendarContent/>`), all-day **display off-by-one** (exclusive DTEND vs Schedule-X inclusive), member **color collision** and member-vs-shared **color clash**.
- **Identity:** displayName now derived from OIDC claims with self-heal (Authelia ID-token `claims_policy` documented as the operator step for full names).
## Deferred / carried forward
- **B5** — Android install walkthrough (device check).
- **C** — SSE 5-min smoke (Phase 4 entry gate, D-14).
- **Backlog 999.3999.9** — session-timeout sign-in redirect; event reminder/VALARM options; first-login Fastmail app-password provider setup; all-day visual distinction; event-form end-tracking + all-day edit off-by-one; recurrence repeat-until/count bound; edit recurring series.
## Verification method
Operator-driven browser testing (desktop + the wife's iPhone) + backend evidence (`calendar_outbox` rows reaching `done`, `calendar_events` cache, stored VEVENTs). `playwright-cli` is unavailable in this WSL2 env, so desktop rows were operator-driven rather than automated.
## Self-Check
- [x] Gate 2 results recorded in `03-GATE2-RESULTS.md`
- [x] Write path (create/all-day/recurring/edit/delete/conflict) verified live to Fastmail
- [x] iOS standalone install + login (load-bearing) verified
- [x] All live blocker bugs fixed, committed, and deployed
- [x] UX gaps captured as backlog (999.3999.9); B5/C deferred by design