docs(03): Gate 2 substantially complete — A/B/D verified; only D3 quick confirm left

A2 (transparent SSO), B2/B3/B4 (iOS standalone + load-bearing standalone login),
D2 (all-day, after off-by-one fix) all PASS. Remaining: D3 weekly recurring
(quick). Deferred: B5 Android, C SSE (Phase 4 entry gate).

.planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md

@@ -128,7 +128,7 @@ Mark each row PASS or FAIL and add notes. On failure, apply the indicated remedy
 | # | Ref | Check | Result | Notes |
 |---|-----|-------|--------|-------|
 | A1 | AUTH-01 | Open `https://familysync-dev.DOMAIN` → redirects to Authelia → login completes → land on the app with name, color, and at least one cached event | ✅ PASS (2026-06-07) | Real Authelia OIDC login lands on the calendar; name (email claim), assigned color, and cached events render. Name self-heals to full name once Authelia emits name/preferred_username (see backlog/memory). |
-| A2 | AUTH-02 | Fully close + reopen browser → revisit the URL → no re-login prompted (session persists) | [ ] PENDING — operator | Refresh-token session wired (offline_access). Operator must confirm across a full browser restart within the session lifespan. |
+| A2 | AUTH-02 | Fully close + reopen browser → revisit the URL → no re-login prompted (session persists) | 🟡 PASS (transparent) | Confirmed (desktop + iPhone): cold open bounces through Authelia but its SSO carries the session, so NO credential prompt — user lands straight on the app. Note: the app's own oidc-auth cookie is session-scoped (dropped on browser close), so each cold open does a redirect round-trip. Acceptable for v1; making the app cookie persistent (skip the bounce) is a minor follow-up. |
 | A3 | AUTH-03 | Second member logs in on a separate device → distinct stable color assigned (different from first member's color) | ✅ PASS (2026-06-07) | Second member (amelia, id=3) logged in on her iPhone. Found + fixed a collision bug (both members were #E8734A — COUNT%palette reused a slot after a deletion); now luc=#E8734A, amelia=#4A90D9 (distinct, stable). Fix: first-unused-palette-color (commit f700182). |
 
 ### Part B — iOS PWA Standalone Login (Task 2) — LOAD-BEARING CHECK
@@ -144,9 +144,9 @@ Mark each row PASS or FAIL and add notes. On failure, apply the indicated remedy
 | # | Ref | Check | Result | Notes |
 |---|-----|-------|--------|-------|
 | B1 | iOS PWA | Open `https://familysync-dev.DOMAIN` in Safari on iPhone → in-app install walkthrough appears → tap "Add to Home Screen" | ✅ PASS (2026-06-07) | Wife added FamilySync to her iPhone Home Screen and logged in (user id=3 created). |
-| B2 | iOS PWA | Launch FamilySync from Home Screen → opens full-screen with no Safari browser chrome (standalone mode) | 🟡 LIKELY — confirm | Installed to Home Screen; operator to confirm it launches full-screen with no Safari chrome. |
+| B2 | iOS PWA | Launch FamilySync from Home Screen → opens full-screen with no Safari browser chrome (standalone mode) | ✅ PASS (2026-06-07) | Confirmed: launches full-screen standalone from Home Screen. |
-| B3 | iOS PWA (Pitfall 2) | Complete Authelia OIDC login from standalone mode → redirect does NOT break out of standalone (user stays in the app, not dropped to Safari) | 🟡 CONFIRM | She logged in successfully; confirm the login was completed *launched from the Home Screen icon* (standalone) and did not drop to Safari. **Load-bearing check.** |
+| B3 | iOS PWA (Pitfall 2) | Complete Authelia OIDC login from standalone mode → redirect does NOT break out of standalone (user stays in the app, not dropped to Safari) | ✅ PASS (2026-06-07) | Confirmed working — OIDC login from standalone stays in the app, no drop to Safari. **Load-bearing check cleared.** |
-| B4 | PWA-01 | Installed PWA on iOS opens full-screen with no browser chrome | 🟡 LIKELY — confirm | Same as B2. |
+| B4 | PWA-01 | Installed PWA on iOS opens full-screen with no browser chrome | ✅ PASS (2026-06-07) | Confirmed (same as B2). |
 | B5 | PWA-02 | Installed PWA on Android opens full-screen with no browser chrome | [ ] PENDING — device | Android install not yet exercised. |
 
 ### Part C — SSE Smoke Test (Gate before Phase 4)
@@ -167,8 +167,8 @@ curl -N -H "Cookie: oidc-auth=<value>" https://familysync-dev.DOMAIN/api/sse/hea
 | # | Ref | Check | Result | Notes |
 |---|-----|-------|--------|-------|
 | D1 | CAL-04 | Create a timed event → "Syncing…" toast → "Saved" toast → event appears in native Fastmail app on next sync | ✅ PASS (2026-06-07) | Timed create round-trips to caldav.fastmail.com (outbox rows reach `done`); appears in the app. Timezone fix applied (was 4h off). |
-| D2 | CAL-07 | Create an all-day event → same Syncing→Saved flow → appears in Fastmail | [ ] PENDING — operator | Timed create path verified; all-day not yet exercised live. Quick confirm. |
+| D2 | CAL-07 | Create an all-day event → same Syncing→Saved flow → appears in Fastmail | ✅ PASS (2026-06-07) | All-day create round-trips to Fastmail (verified VEVENT: DTSTART/DTEND VALUE=DATE, exclusive end). Found + fixed a display off-by-one (single-day showed across 2 days — Schedule-X inclusive vs iCal exclusive end; commit d4d5327). Reload to confirm 1-day rendering. |
-| D3 | CAL-04 | Create a weekly recurring event → appears in Fastmail | [ ] PENDING — operator | Not yet exercised live. Quick confirm. |
+| D3 | CAL-04 | Create a weekly recurring event → appears in Fastmail | [ ] PENDING — operator | Not yet exercised live. Quick confirm (create one weekly recurring event). |
 | D4 | CAL-05 | Edit an existing event's title and time → Syncing→Saved → change persists in Fastmail | ✅ PASS (2026-06-07) | Edit/move confirmed working; update outbox rows reach `done`; post-write refetch race fixed so the change shows without manual refresh. |
 | D5 | CAL-06 | Delete an event via the two-tap confirmation dialog → Syncing→Saved → event disappears from all views on next sync | ✅ PASS (2026-06-07) | Delete confirmed working; delete cache-reconciliation fix means the event leaves the cache/UI (was lingering as a ghost). |
 | D6 | D-08 | (Optional) Trigger a 412 conflict by editing the same event in Fastmail first → conflict toast appears in the app → calendar re-fetches | ✅ PASS (2026-06-07) | Observed live: a stale-etag update produced `412 conflict` (outbox id=7) and the "This event changed elsewhere" conflict toast; calendar re-syncs. |
@@ -193,15 +193,16 @@ Response body: {"ok":true,"db":"up"}
 |---------|--------|
 | Production builds (PWA + API) | ✅ CLEAN (2026-06-07; 102 API + 140 PWA tests) |
 | Operator infra setup | ✅ DONE (Authelia client + Pangolin/Newt live; OIDC login working) |
-| A — Auth / session / colors | 🟡 A1 + A3 PASS; A2 (session persist) PENDING quick confirm |
+| A — Auth / session / colors | ✅ A1, A2 (transparent SSO), A3 all PASS |
-| B — iOS standalone login (load-bearing) | 🟡 B1 PASS (installed + logged in on iPhone); B2/B3/B4 confirm; B5 (Android) pending |
+| B — iOS standalone login (load-bearing) | ✅ B1–B4 PASS (install + standalone launch + standalone login); B5 (Android) deferred |
-| C — SSE smoke test | ⏳ PENDING — operator; this is the Phase 4 ENTRY gate (D-14), not a Phase 3 deliverable |
+| C — SSE smoke test | ⏳ DEFERRED — Phase 4 ENTRY gate (D-14), not a Phase 3 deliverable |
-| D — Fastmail write round-trips | 🟡 D1/D4/D5/D6 PASS; D2 (all-day) + D3 (recurring) PENDING quick confirm |
+| D — Fastmail write round-trips | ✅ D1/D2/D4/D5/D6 PASS; D3 (weekly recurring) — one quick confirm remaining |
 
 Gate 2 is complete when all rows are PASS. Record final status here:
 
-**Gate 2 outcome:** 🟡 NEARLY COMPLETE — core auth, distinct member colors, iOS install+login, and
+**Gate 2 outcome:** ✅ SUBSTANTIALLY COMPLETE (2026-06-07) — auth, session, distinct member colors,
-create/edit/delete/conflict round-trips all verified live (2026-06-07). Remaining quick operator
+iOS install + standalone login (load-bearing), and create/all-day/edit/delete/conflict round-trips
-confirms: A2 (session persists across restart), B2/B3/B4 (launch-from-Home-Screen standalone +
+all verified live. Multiple blocker bugs found + fixed this session (see git log). Only one quick
-standalone login), D2 (all-day), D3 (recurring). Optional/deferred: B5 (Android install),
+functional confirm remains: D3 (create a weekly recurring event). Deferred by design: B5 (Android
-C (SSE — Phase 4 entry gate, carried per D-14). Phase 03 code is complete and live-verified.
+install) and C (SSE smoke — Phase 4 entry gate per D-14). Phase 03 is code-complete and
+live-verified; safe to close with D3 as a fast confirm and B5/C carried forward.