docs(10): add validation strategy

.planning/phases/10-events/10-VALIDATION.md

@@ -0,0 +1,65 @@
+---
+phase: 10
+slug: events
+status: draft
+nyquist_compliant: true
+wave_0_complete: false
+created: 2026-05-16
+---
+
+# Phase 10 - Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Go `testing` with existing DB-backed web handler tests |
+| **Config file** | `backend/internal/web/*_test.go`, `backend/internal/db/queries/*.sql`, `backend/migrations/*.sql` |
+| **Quick run command** | `go test ./backend/internal/web ./backend/internal/db/sqlc` |
+| **Full suite command** | `go test ./...` |
+| **Estimated runtime** | ~20-60 seconds depending on database startup/state |
+
+## Sampling Rate
+
+- **After every task commit:** Run `go test ./backend/internal/web ./backend/internal/db/sqlc`
+- **After every plan wave:** Run `go test ./...`
+- **Before `$gsd-verify-work`:** Full suite must be green
+- **Max feedback latency:** 60 seconds
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| 10-01-01 | 01 | 0 | EVENT-01, EVENT-05 | T-10-01 / T-10-02 | Event data is scoped through owned tablos and user-scoped aggregation filters by `tablos.user_id` | DB/integration | `go test ./backend/internal/web ./backend/internal/db/sqlc` | W0 | pending |
+| 10-01-02 | 01 | 0 | EVENT-01 | T-10-04 | Invalid end times are rejected before persistence and by DB constraint | handler/DB | `go test ./backend/internal/web ./backend/internal/db/sqlc` | W0 | pending |
+| 10-02-01 | 02 | 1 | EVENT-01, EVENT-02, EVENT-03 | T-10-01 / T-10-03 | Create/edit/delete forms require CSRF and ownership checks | handler | `go test ./backend/internal/web` | W0 | pending |
+| 10-02-02 | 02 | 1 | EVENT-02, EVENT-03 | T-10-05 | Calendar output is escaped and HTMX fragments remain scoped to the Events tab | handler/template | `go test ./backend/internal/web` | W0 | pending |
+| 10-03-01 | 03 | 2 | EVENT-04, EVENT-05 | T-10-02 | Planning query returns only accessible events and includes tablo metadata | DB/integration | `go test ./backend/internal/web ./backend/internal/db/sqlc` | W0 | pending |
+
+*Status: pending until the phase plan defines exact task IDs and files.*
+
+## Wave 0 Requirements
+
+- [ ] Add focused SQLC/query coverage for create/list/update/delete and user-scoped date-range aggregation.
+- [ ] Add focused handler coverage for Events tab rendering, create validation, update, delete, and cross-user 404 behavior.
+- [ ] Add helper coverage indirectly through handler tests for month parsing, date prefill, and submitted-value precedence.
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Month calendar scanability and HTMX interactions | EVENT-02, EVENT-03 | Layout and perceived interaction quality are browser-sensitive | Open a tablo, switch to Events, navigate months, create from New event, create from a day cell, edit an event title, delete it, and confirm the tab refreshes without leaving stale content. |
+
+## Validation Sign-Off
+
+- [x] All tasks have automated verify or Wave 0 dependencies
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify
+- [x] Wave 0 covers all missing references
+- [x] No watch-mode flags
+- [x] Feedback latency < 60s
+- [x] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending
+