---
phase: 03-event-write-back-pwa-install
plan: 08
subsystem: gate, live-verification, auth, broker, pwa
tags: [gate-2, live-verification, authelia, oidc, pangolin, ios-pwa, caldav, write-back]

# Dependency graph
requires:
  - phase: 03-event-write-back-pwa-install
    plan: 04
    provides: write endpoints (create/edit/delete) + outbox
  - phase: 03-event-write-back-pwa-install
    plan: 06
    provides: EventDetailPopover + DeleteConfirmationDialog + SyncStateToast
  - phase: 03-event-write-back-pwa-install
    plan: 07
    provides: PWA manifest + service worker + InstallPrompt

provides:
  - Gate 2 live-verification results against the real Authelia + Pangolin deploy
  - Confirmed end-to-end write path (create/all-day/recurring/edit/delete/conflict) to Fastmail
  - Confirmed iOS standalone install + OIDC login (load-bearing)

affects: [phase-04]

# Tech tracking
tech-stack:
  added: []
  patterns:
    - "Live Mode-A topology: local origin + Newt connector + Authelia OIDC through Pangolin"
    - "Operator-driven verification (playwright-cli unavailable in WSL2); evidence via DB/outbox + browser"

key-files:
  created:
    - .planning/phases/03-event-write-back-pwa-install/03-08-SUMMARY.md
  modified:
    - .planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md
---

# Phase 03 Plan 08: Gate 2 Live Verification — Summary

**One-liner:** Took FamilySync live (real Authelia OIDC over Pangolin/Newt) and verified the full event write-back path end-to-end to Fastmail on desktop and iOS, fixing a long string of blocker bugs found only under live conditions.

## Outcome

Gate 2 is **complete for Phase 03 scope**. See `03-GATE2-RESULTS.md` for the per-row record. Summary:

- **A — Auth/session/colors:** A1 (OIDC login → app) ✅, A2 (session — transparent via Authelia SSO) ✅, A3 (distinct member colors) ✅ after fixing a color-collision bug.
- **B — iOS standalone (load-bearing):** B1–B4 ✅ — install to Home Screen, full-screen standalone launch, and **OIDC login completed from standalone without dropping to Safari**. B5 (Android install) deferred.
- **C — SSE smoke:** deferred by design — this is the Phase 4 *entry* gate (D-14), verified at the start of Phase 4.
- **D — write round-trips:** D1–D6 ✅ — create (timed), all-day, weekly recurring, edit, delete, 412-conflict, plus recurring-series delete, all round-tripping to caldav.fastmail.com.

## Blocker bugs found + fixed live (all committed + deployed)

Live bring-up surfaced bugs the dev-bypass build could not:

- **Tunnel:** newt MTU 1280→1200 (operator) — encrypted WireGuard packets exceeded the underlay MTU, blackholing the JS bundle (the original "spinner"). API now serves the full `./public` tree.
- **Auth:** `/api/login` route + `fetchMe` `redirect:'manual'`; OIDC scopes/client_id; and the OIDC **state-cookie churn** (events query racing the login flow → `OAUTH_INVALID_RESPONSE`) — fixed by gating the events query on auth.
- **Write path:** event timezone (UTC serialization), per-user calendar identity (unique(userId,url) + per-user predicates), missing `calendars` join in edit/delete (503), delete **cache reconciliation** (deletes lingered as ghosts), and the post-write **refetch race** (resync now precedes marking the outbox row done).
- **UI:** calendar **remount flash** (nested component rendered as `<CalendarContent/>`), all-day **display off-by-one** (exclusive DTEND vs Schedule-X inclusive), member **color collision** and member-vs-shared **color clash**.
- **Identity:** displayName now derived from OIDC claims with self-heal (Authelia ID-token `claims_policy` documented as the operator step for full names).

## Deferred / carried forward

- **B5** — Android install walkthrough (device check).
- **C** — SSE 5-min smoke (Phase 4 entry gate, D-14).
- **Backlog 999.3–999.9** — session-timeout sign-in redirect; event reminder/VALARM options; first-login Fastmail app-password provider setup; all-day visual distinction; event-form end-tracking + all-day edit off-by-one; recurrence repeat-until/count bound; edit recurring series.

## Verification method

Operator-driven browser testing (desktop + the wife's iPhone) + backend evidence (`calendar_outbox` rows reaching `done`, `calendar_events` cache, stored VEVENTs). `playwright-cli` is unavailable in this WSL2 env, so desktop rows were operator-driven rather than automated.

## Self-Check

- [x] Gate 2 results recorded in `03-GATE2-RESULTS.md`
- [x] Write path (create/all-day/recurring/edit/delete/conflict) verified live to Fastmail
- [x] iOS standalone install + login (load-bearing) verified
- [x] All live blocker bugs fixed, committed, and deployed
- [x] UX gaps captured as backlog (999.3–999.9); B5/C deferred by design