# Remote Coverage Review (2026-03-31, Updated)

## Scope
Review current API and E2E test definitions for remote-server-first validation and identify additional high-value coverage.

## Current Coverage Strengths
- Event CRUD and recurrence exception behavior are covered.
- User lifecycle (register, verify, approve, reset) is covered.
- ICS and CalDAV interoperability paths are covered.
- Security smoke items include token leakage, rate limit, password hashing, and CalDAV resource handling.

## Coverage Gaps Identified

### API Gaps
- Unauthorized write-path checks were under-specified for event create/update paths.
- Validation-path checks were missing for:
  - invalid event time range (`end < start`)
  - invalid `preview-occurrences` payloads
- Single-use token behavior needed an explicit regression check for password reset token reuse.
- Monthly ordinal recurrence parity needed executable checks (last weekday-of-month behavior).
- Slug-path link contract in rendered shortcode output needed explicit assertions.
- Post-removal auth revocation for plugin users needed explicit checks.

### E2E Gaps
- UI shell control presence checks were incomplete (verify/reset/future/theme/occurrence-delete controls).
- User lifecycle e2e missed explicit “remove user -> auth denied” verification.
- Event deletion e2e missed explicit not-found checks for deleted records.

## New Coverage Added (This Update)

### Executable Coverage
- `compatibility-layer/e2e_wp_emulation.php` now includes:
  - unauthenticated event create denied (`403`)
  - invalid event range returns `422`
  - preview-occurrences valid + invalid-path checks
  - password reset token single-use check (`422` on reuse)
  - remove-user revokes login access
  - monthly ordinal recurrence date assertions
  - shortcode link assertions for `url_slug` pathing
- `compatibility-layer/ui_e2e_wp_emulation.php` now includes:
  - UI shell control presence checks (verify/reset/future/theme/occurrence delete)
  - deleted-event not-found check
  - remove-user auth denial via `/users/me`

### Test Spec Updates
- `tests/api_test_cases.md` expanded with API-EVT/API-USR/API-ICS additions for the above gaps.
- `tests/e2e_test_cases.md` expanded with E2E-ADM-008, E2E-UI-003, E2E-CDV-005, E2E-ICS-004.
- `tests/ui_e2e_cases.md` updated to reflect new automated UI cases.

## Remaining High-Value Gaps
- Diagnostics admin-page/download flow still needs a dedicated authenticated admin-browser or WP-cookie harness test.
- Remote runner still does not exercise nonce-protected diagnostics download end-to-end.