---
phase: 10
slug: events
status: complete
nyquist_compliant: true
wave_0_complete: true
created: 2026-05-16
---

# Phase 10 - Validation Strategy

> Per-phase validation contract for feedback sampling during execution.

## Test Infrastructure

| Property | Value |
|----------|-------|
| **Framework** | Go `testing` with existing DB-backed web handler tests |
| **Config file** | `backend/internal/web/*_test.go`, `backend/internal/db/queries/*.sql`, `backend/migrations/*.sql` |
| **Quick run command** | `cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEvent|TestEvents|TestListUserEventsRange|TestTabloDetailEventsTabFullPageFallback' -count=1` |
| **Full suite command** | `cd backend && just generate && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./... -count=1` |
| **Estimated runtime** | ~20-60 seconds depending on database startup/state |

## Sampling Rate

- **After every task commit:** Run `cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEvent|TestEvents|TestListUserEventsRange|TestTabloDetailEventsTabFullPageFallback' -count=1`
- **After every plan wave:** Run `cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./... -count=1`
- **Before `$gsd-verify-work`:** Full suite must be green
- **Max feedback latency:** 60 seconds

## Per-Task Verification Map

| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
| 10-01-01 | 01 | 0 | EVENT-01, EVENT-05 | T-10-01 / T-10-02 | Event data is scoped through owned tablos and user-scoped aggregation filters by `tablos.user_id` | DB/integration | `cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEventCreateRendersTitleInCalendar|TestEventsTabRendersMonthGrid|TestListUserEventsRangeReturnsOnlyOwnedTablos' -count=1` | Yes | covered |
| 10-01-02 | 01 | 0 | EVENT-01, EVENT-04 | T-10-04 | Invalid end times are rejected before persistence and by DB constraint | handler/DB | `cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEventCreateRejectsEndTimeBeforeOrEqualStart|TestEventUpdateRejectsInvalidEndTime' -count=1` | Yes | covered |
| 10-02-01 | 02 | 1 | EVENT-01, EVENT-02, EVENT-03, EVENT-05 | T-10-01 / T-10-03 | Create/edit/delete forms require CSRF and ownership checks | handler | `cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEventEditRendersInlineForm|TestEventUpdateChangesCalendarPlacement|TestEventDeleteRemovesFromCalendarAndDatabase|TestEventMutationOwnershipReturns404' -count=1` | Yes | covered |
| 10-02-02 | 02 | 1 | EVENT-02, EVENT-03 | T-10-05 | Calendar output is escaped and HTMX fragments remain scoped to the Events tab | handler/template | `cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEventContentIsEscaped|TestTabloDetailEventsTabFullPageFallback|TestEventsTabRendersMonthGrid' -count=1` | Yes | covered |
| 10-03-01 | 03 | 2 | EVENT-04, EVENT-05 | T-10-02 | Planning query returns only accessible events and includes tablo metadata | DB/integration | `cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestListUserEventsRangeReturnsOnlyOwnedTablos|TestEventsMonthNavigationPushesMonthParam|TestEventNewFromDayPrefillsDate|TestEventCreateSubmittedDateOverridesQueryDefault|TestEventsCalendarShowsMoreIndicator' -count=1` | Yes | covered |

*Status: audited after execution; all automated checks map to current tests in `backend/internal/web/handlers_events_test.go`.*

## Wave 0 Requirements

- [x] Add focused SQLC/query coverage for create/list/update/delete and user-scoped date-range aggregation.
- [x] Add focused handler coverage for Events tab rendering, create validation, update, delete, and cross-user 404 behavior.
- [x] Add helper coverage indirectly through handler tests for month parsing, date prefill, and submitted-value precedence.

## Manual-Only Verifications

| Behavior | Requirement | Why Manual | Test Instructions |
|----------|-------------|------------|-------------------|
| Month calendar scanability and HTMX interactions | EVENT-02, EVENT-03 | Layout and perceived interaction quality are browser-sensitive | Open a tablo, switch to Events, navigate months, create from New event, create from a day cell, edit an event title, delete it, and confirm the tab refreshes without leaving stale content. |

## Validation Sign-Off

- [x] All tasks have automated verify or Wave 0 dependencies
- [x] Sampling continuity: no 3 consecutive tasks without automated verify
- [x] Wave 0 covers all missing references
- [x] No watch-mode flags
- [x] Feedback latency < 60s
- [x] `nyquist_compliant: true` set in frontmatter

**Approval:** audited 2026-05-16

## Validation Audit 2026-05-16

| Metric | Count |
|--------|-------|
| Gaps found | 0 |
| Resolved | 0 |
| Escalated | 0 |

### Coverage Confirmed

- EVENT-01 is covered by creation, form submission, submitted-date precedence, no-end-time display, and ordering tests.
- EVENT-02 is covered by inline edit, update calendar refresh, hard delete, and mutation ownership tests.
- EVENT-03 is covered by the Events tab month grid, full-page fallback, HTMX month navigation, day prefill, overflow indicator, escaping, and ordering tests.
- EVENT-04 is covered by create and update invalid end-time tests plus the `events_end_after_start` database constraint.
- EVENT-05 is covered by tab ownership, mutation ownership, and user-scoped date-range aggregation tests.

### Final Verification

Passed:

```bash
cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEvent|TestEvents|TestListUserEventsRange|TestTabloDetailEventsTabFullPageFallback' -count=1
```

Previously recorded as passed in `10-VERIFICATION.md`:

```bash
cd backend && just generate && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./... -count=1 && git diff --check
```
