familysync/.planning/milestones/v1.0-phases/03-event-write-back-pwa-install/03-08-SUMMARY.md

phase, plan, subsystem, tags, requires, provides, affects, tech-stack, key-files

phase	plan	subsystem	tags	requires	provides	affects	tech-stack	key-files
03-event-write-back-pwa-install	08	gate, live-verification, auth, broker, pwa	gate-2 live-verification authelia oidc pangolin ios-pwa caldav write-back	phase plan provides 03-event-write-back-pwa-install 04 write endpoints (create/edit/delete) + outbox phase plan provides 03-event-write-back-pwa-install 06 EventDetailPopover + DeleteConfirmationDialog + SyncStateToast phase plan provides 03-event-write-back-pwa-install 07 PWA manifest + service worker + InstallPrompt	Gate 2 live-verification results against the real Authelia + Pangolin deploy Confirmed end-to-end write path (create/all-day/recurring/edit/delete/conflict) to Fastmail Confirmed iOS standalone install + OIDC login (load-bearing)	phase-04	added patterns Live Mode-A topology: local origin + Newt connector + Authelia OIDC through Pangolin Operator-driven verification (playwright-cli unavailable in WSL2); evidence via DB/outbox + browser	created modified .planning/phases/03-event-write-back-pwa-install/03-08-SUMMARY.md .planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md

Phase 03 Plan 08: Gate 2 Live Verification — Summary

One-liner: Took FamilySync live (real Authelia OIDC over Pangolin/Newt) and verified the full event write-back path end-to-end to Fastmail on desktop and iOS, fixing a long string of blocker bugs found only under live conditions.

Outcome

Gate 2 is complete for Phase 03 scope. See 03-GATE2-RESULTS.md for the per-row record. Summary:

• A — Auth/session/colors: A1 (OIDC login → app) ✅, A2 (session — transparent via Authelia SSO) ✅, A3 (distinct member colors) ✅ after fixing a color-collision bug.
• B — iOS standalone (load-bearing): B1–B4 ✅ — install to Home Screen, full-screen standalone launch, and OIDC login completed from standalone without dropping to Safari. B5 (Android install) deferred.
• C — SSE smoke: deferred by design — this is the Phase 4 entry gate (D-14), verified at the start of Phase 4.
• D — write round-trips: D1–D6 ✅ — create (timed), all-day, weekly recurring, edit, delete, 412-conflict, plus recurring-series delete, all round-tripping to caldav.fastmail.com.

Blocker bugs found + fixed live (all committed + deployed)

Live bring-up surfaced bugs the dev-bypass build could not:

• Tunnel: newt MTU 1280→1200 (operator) — encrypted WireGuard packets exceeded the underlay MTU, blackholing the JS bundle (the original "spinner"). API now serves the full ./public tree.
• Auth: /api/login route + fetchMe redirect:'manual'; OIDC scopes/client_id; and the OIDC state-cookie churn (events query racing the login flow → OAUTH_INVALID_RESPONSE) — fixed by gating the events query on auth.
• Write path: event timezone (UTC serialization), per-user calendar identity (unique(userId,url) + per-user predicates), missing calendars join in edit/delete (503), delete cache reconciliation (deletes lingered as ghosts), and the post-write refetch race (resync now precedes marking the outbox row done).
• UI: calendar remount flash (nested component rendered as <CalendarContent/>), all-day display off-by-one (exclusive DTEND vs Schedule-X inclusive), member color collision and member-vs-shared color clash.
• Identity: displayName now derived from OIDC claims with self-heal (Authelia ID-token claims_policy documented as the operator step for full names).

Deferred / carried forward

• B5 — Android install walkthrough (device check).
• C — SSE 5-min smoke (Phase 4 entry gate, D-14).
• Backlog 999.3–999.9 — session-timeout sign-in redirect; event reminder/VALARM options; first-login Fastmail app-password provider setup; all-day visual distinction; event-form end-tracking + all-day edit off-by-one; recurrence repeat-until/count bound; edit recurring series.

Verification method

Operator-driven browser testing (desktop + the wife's iPhone) + backend evidence (calendar_outbox rows reaching done, calendar_events cache, stored VEVENTs). playwright-cli is unavailable in this WSL2 env, so desktop rows were operator-driven rather than automated.

Self-Check

• Gate 2 results recorded in 03-GATE2-RESULTS.md
• Write path (create/all-day/recurring/edit/delete/conflict) verified live to Fastmail
• iOS standalone install + login (load-bearing) verified
• All live blocker bugs fixed, committed, and deployed
• UX gaps captured as backlog (999.3–999.9); B5/C deferred by design