Journey result: First-time anonymous visitor

Walked: 2026-05-29 by Claude against commit eff6655269 plus the fixes made during that walk.
Reconciled: 2026-07-18 against the current anonymous gate, public marketing surfaces, cookie-consent contract, real Mailpit verification, onboarding lifecycle, signed-in handoff, and deep browser suites. This was a source reconciliation, not a fresh runtime walk.
Verdict: partial — deep automation proves crawler/public metadata, redirect preservation, marketing CTAs, consent choices, real dev-infra signup and email verification, onboarding completion/resume, and signed-in continuation. The journey delegates full Home/Tara content to their own suites, and the declared onboarding/first-landing telemetry is not yet pinned end to end.
Primary specs: auth-entry-flows.spec.ts, welcome-marketing.spec.ts, email-verify-mailpit.spec.ts, onboarding-lifecycle.spec.ts, and first-time-visitor-deepening.spec.ts.

Result at a glance#

Evidence lane	Current result	Authority limit
Crawler and public metadata	Root/welcome HTML, canonical, JSON-LD, social metadata/images, sitemap, and public legal routes	Dev build and declared production metadata base
Anonymous gate	Protected-route redirect, safe redirect carry, expired/reauth variants, and signed-in welcome state	Named paths and sanitization cases, not every future route
Marketing and consent	Landing inventory/CTAs, tier telemetry, 390 px/offline replay, and accept/reject persistence	Landing content includes fixtures; preference is localStorage
Signup and verification	Real BFF signup, SMTP-to-Mailpit message, delivered token link, fresh-device cookies, and replay guards	Dev SMTP/Mailpit, not production inbox deliverability
Onboarding	Entry, drafts, abandonment/resume, completion, preferences sync, and redirect preservation	Full content quality and every preference consumer are separate
First signed-in destination	Continuation and redirect handoffs are proven	Full Home/Tara task completion is delegated
Funnel telemetry	Several public/auth actions are asserted	Onboarding and first-landing payload chain remains open

Evidence map#

The durable browser evidence now spans the public-to-member boundary. The dashed final branches identify delegated product depth and the remaining telemetry contract rather than treating them as funnel failures.

flowchart LR A[Anonymous or crawler visit] --> B[Public welcome or landing] A --> C[Protected-route redirect] B --> D[Consent choice] C --> E[Safe redirect carried] D --> F[Signup] E --> F F --> G[SMTP verification email] G --> H[Delivered token link] H --> I[Verified browser session] I --> J[Onboarding draft and completion] J --> K[Signed-in continuation] K -. delegated .-> L[Full Home or Tara task] J -. payload chain not pinned .-> M[Onboarding and first-landing telemetry]

Proven observations#

Public entry and safe routing#

Crawler-shaped requests receive public HTML and the current canonical, OpenGraph, Twitter, PNG preview, and six-domain WebApplication JSON-LD contracts. Social image handlers are exercised directly.
Anonymous root and protected-route visits land at /welcome with the intended redirect preserved. Unsafe external redirects fall back to a safe local target; expired and reauthentication variants select the sign-in path.
/landing renders the current public inventory, tier CTAs, standalone mobile state, offline warmed replay, and social metadata. The tested Hearth action emits its current funnel event.

Accept and reject both store a versioned consent choice and dismiss the banner. Rejection preserves essential-only settings; update prompts remain suppressed only while consent is unresolved.
The real dev BFF signup path establishes the browser session and produces an SMTP message. The Mailpit suite finds the message by its unique recipient, opens the actual verification token link, and confirms verified account state.
A fresh browser context with no existing cookies can open the delivered link and receive fresh HttpOnly session/access cookies. Replayed, missing, delayed, already-verified, safe-next, and unsafe-next states are separately covered.

Onboarding and continuation#

The browser drives onboarding entry, per-step drafts, abandonment at Rhythm, the Home resume banner, returning sign-in resume, completion, preference sync, and preservation of a post-onboarding redirect.
Signed-in /welcome intentionally remains public and shows a continuation panel instead of forcing another redirect. This prevents the public gate from obscuring an already-authenticated recovery path.
Full Home workspace and Tara sit behavior are covered by their own focused suites; this result limits itself to the first-time handoff boundary.

Boundaries and gaps#

Dev Mailpit is not production deliverability. The suite proves message construction, SMTP handoff, token extraction, verification, and fresh-device cookies in real dev infrastructure. It does not prove provider reputation, spam placement, production DNS, regional delivery, or human inbox clients.
A public render is not production SEO reach. Metadata and image handlers are correct in the tested build; crawler caching, deployed host headers, robots policy, and external preview refresh are outside the suite.
Landing inventory is partly fixture content. CTA and presentation contracts are real, but six-room/letter content does not establish a live CMS or merchandising pipeline.
Consent persistence is browser-local. The banner writes localStorage and downstream optional processors must honor it; this result does not audit every analytics/marketing consumer.
Onboarding completion is not every preference effect. Draft/resume and preference sync are proven, while downstream personalization across Home and all domains remains separately owned.
A successful handoff is not a first task. Landing in the signed-in shell does not prove a complete Home continuation or Tara sit; those journeys carry their own evidence.
Telemetry coverage is not continuous. Public and auth events are tested, but the declared onboarding and first-landing payload sequence remains open.
Fresh-browser automation is not every privacy state. Private browsing, storage denial, cookie blocking, cross-device resumption, locale/RTL, and assistive-technology task completion need their own matrices.

Re-run evidence#

The core first-time funnel can be run serially with:

bash

PW_BROWSER_CHANNEL=chrome pnpm exec playwright test \
  -c apps/oshun/web/playwright.config.ts \
  apps/oshun/web/e2e/auth-entry-flows.spec.ts \
  apps/oshun/web/e2e/welcome-marketing.spec.ts \
  apps/oshun/web/e2e/email-verify-mailpit.spec.ts \
  apps/oshun/web/e2e/onboarding-lifecycle.spec.ts \
  apps/oshun/web/e2e/first-time-visitor-deepening.spec.ts \
  --workers=1

It requires the real-development-infrastructure web/BFF and SMTP/Mailpit composition. A green run proves the tested public-to-onboarding funnel; it must not be summarized as production email deliverability or full post-onboarding product adoption.

Source trail#

Cross-references#

Open questions#

Which release gate covers production mail-provider configuration, DNS, bounce/complaint handling, localization, expiry copy, and inbox-client rendering without weakening the deterministic Mailpit test?
How will every optional analytics, functional, and marketing processor prove it reads and honors the stored consent version before activation?
Which receipt links onboarding completion and synced preferences to the first personalized Home state without duplicating full Home journey coverage?
What exact onboarding and first-landing telemetry payloads are required, and how will tests prevent gaps or duplicate events across redirects?
Which browser/storage/privacy matrix covers private mode, denied storage, cross-device verification, locale/RTL, and assistive-technology completion?