Journey result: Journey and interaction sweep

Walked: 2026-06-04 against a production web build, mock-adapter BFF, and signed-in Chromium session on the named branch feat/hestia-epicure-embeddings. The record does not retain an immutable commit id.
Reconciled: 2026-09-13 against the current 722-route inventory, the three surviving sweep scripts, the fail-closed Studio Isis boundary, and the four hydration-safe implementations plus their focused unit tests. This was a source reconciliation, not a fresh application sweep.
Verdict: partial — the dated run supplied valuable broad render/link smoke, heuristic interaction triage, and a reproducible React hydration fix. It did not execute every journey end to end, its crawl was capped, several marquee assertions were presence-level, and the current render probe has drifted from the fail-closed Studio Isis route boundary.
Primary harness: walkthrough-probe-all.mjs, walkthrough-linkcrawl.mjs, and walkthrough-interact.mjs.

Result at a glance#

Evidence layer	Dated 2026-06-04 result	Current-source reading	Authority limit
Route render	655/684 passed; 29 non-AAA Studio Isis hard blocks were treated as expected	Inventory is now 722 routes: 702 walked and 20 drafted. It contains 87 distinct `/studio/isis/*` segments; the boundary fail-closes every nonempty segment, while the probe's AAA detector reads only the 31-item diagnostic catalog	Current full rerun would misclassify 56 uncatalogued fail-closed segments until the harness is aligned
Link crawl	471/500 reachable, with the same 29 hard blocks and no other broken bridge	The BFS still starts from 28 surfaces, defaults to depth 2, deduplicates route families, and caps at 500; it now prints any dropped queue explicitly	Representative link families, not all links or all route instances
Ghost scan	Six candidates on 30 pages were manually judged wired/no-op; no true ghost remained	The scan checks at most 14 unique safe controls per page, excludes destructive labels and links, and treats any URL, DOM mutation, or `/v1/` request as effect	Heuristic candidate finder; it can miss semantically wrong effects and intentionally omits risky actions
Marquee scenarios	7/7 reported pass: Tara, Arete, Veritas, two Metis surfaces, Library, and onboarding	Tara and Metis assessment assert meaningful controls/input; Arete only requires an input, Veritas absence is note-only, Metis quiz absence is note-only, and Library records its count without failing	Seven probes are not “every flow and journey” and several are smoke-level
Hydration repair	Home reload, Tara continuity, Profile Memory, and Profile Safety mismatches were fixed; focused repros and 28 unit tests passed	Stable server snapshot/default seeds and post-mount adoption remain in all four sources, with focused test files still present	Source-preserved fix; the historic prod repro was not rerun here

Evidence map#

The three harness layers answer different questions. None can substitute for the step-and-failure-mode contracts in the current journey suites.

flowchart LR A[722-route inventory<br/>702 walked · 20 drafted] --> B[Render probe<br/>status, h1, page errors] C[28 entry surfaces] --> D[Depth-2 link crawl<br/>500-family cap] E[30 interactive surfaces] --> F[Ghost heuristic<br/>safe controls only] F --> G[Seven marquee scenarios] B --> H[Hydration mismatch triage] D --> I[Broken-bridge candidates] G --> J[Interaction candidates] H --> K[Focused source and unit repair] I --> L[Dedicated journey specs] J --> L

Proven observations#

The hydration diagnosis remains source-grounded#

persistent-shell-context.ts gives useSyncExternalStore a stable getServerSnapshot() that always returns DEFAULT_SNAPSHOT. Session storage is adopted after hydration, so a domain visit cannot make the first client tree disagree with the empty server tree.
taraThemeContinuity.ts seeds its hook with null, matching SSR, and reads the persisted Tara record inside the mount effect before subscribing to storage and continuity events.
ProfileMemoryControls.tsx seeds the canonical default, adopts local state after mount, skips the first persist effect, listens for cross-tab storage, and now lets the member's real Iris BFF record win when available.
ProfileSafetyJourney.tsx retains the first-persist guard while its current surface also loads live/cached crisis frames and member report receipts. The original hydration repair should not be summarized as coverage of that whole expanded flow.
Focused tests remain for the persistent shell, Tara continuity and Home continuation, Profile Memory, and Profile Safety implementations.

The harness has useful honesty mechanisms#

The render and crawl scripts mint fresh sessions, default to one browser worker, relaunch periodically, and abort under configured memory pressure.
The link crawler records each referrer, canonicalizes dynamic route families, and reports a nonempty queue when CRAWL_MAX_PAGES truncates coverage. A cap is therefore visible rather than silently described as completeness.
The interaction probe emits raw JSON reports under /tmp/walk, records page errors separately from ghost candidates, and explicitly warns that an already-active control can be a correct no-op requiring source triage.
Dynamic route concretization and BFS serve complementary purposes: the render layer reaches inventory entries with representative ids; the crawl follows ids actually emitted by the current UI.

Current harness drift blocks a clean rerun claim#

WALKTHROUGH/matrix/routes.csv now holds 722 routes: 702 walked and 20 drafted. It includes 88 rows across 87 distinct Studio Isis first segments.
isAaaOnlyRoute() is intentionally fail-closed: every nonempty Studio Isis segment is AAA-only because the allowed-segment list is empty.
walkthrough-probe-all.mjs instead derives AAA status from the 31-item AAA_ONLY_STUDIO_ROUTES diagnostic catalog. The other 56 current segments receive a normal member session and can be reported as failures even though the product correctly hides them.
The old 655/684 and 471/500 totals remain valid only as dated artifacts. They are not predictions for the current inventory.

Boundaries and gaps#

“Every flow and journey” is not supported by the evidence. Route renders, link families, 30 page scans, and seven scenarios are broad smoke layers; the current registry contains 64 authored journeys with deeper contracts.
A branch name is not immutable provenance. Without the walked commit id, the exact 2026-06-04 web, BFF, inventory, and harness tree cannot be recreated from this record alone.
A production web build over mock adapters is not production behavior. It improves rendering fidelity while retaining in-memory stores, local identity, deterministic fixtures, and no external providers.
A representative dynamic id is not a real entity. The render probe's demo substitutions find routing/render failures but cannot certify persistence, ownership, or data-dependent states.
A 500-page BFS is not a complete link graph. Depth, family deduplication, seed selection, and the cap intentionally trade completeness for bounded runtime.
Any DOM mutation is not a meaningful result. Animation, unrelated attributes, or incidental requests can satisfy the ghost heuristic while the intended outcome remains wrong.
Excluded actions remain untested. Destructive, purchase, publish, unsubscribe, revoke, and similar controls are deny-listed for safety.
Several marquee passes are permissive. Missing Veritas save and Metis quiz controls do not fail; Library only records its collection-affordance count; Arete does not submit or read back a habit.
The current AAA classification is inconsistent. Align the render probe with the fail-closed boundary before treating a new total as a product verdict.
Source reconciliation is not execution. No web build, BFF, route sweep, crawl, interaction scan, or hydration repro was run for this docs audit.

Re-run evidence#

The scripts still expose the historical workflow, but first repair or explicitly account for the Studio Isis classification mismatch described above:

bash

# terminal 1: mock-adapter BFF
cd apps/oshun/bff
USE_MOCK_ADAPTERS=true PORT=4010 pnpm exec tsx src/server.ts

# terminal 2: production web
cd apps/oshun/web
pnpm exec next build
PORT=3010 NEXT_PUBLIC_OSHUN_BFF_URL=http://127.0.0.1:4010 pnpm exec next start -p 3010

# terminal 3: one layer at a time
cd apps/oshun/web
node scripts/walkthrough-probe-all.mjs
node scripts/walkthrough-linkcrawl.mjs
node scripts/walkthrough-interact.mjs

Retain the exact commit, environment, JSON reports, cap status, route totals, and expected-boundary policy. Do not combine these memory-heavy layers or summarize a green smoke layer as completed journey coverage.

Source trail#

Cross-references#

Open questions#

Should the render probe derive AAA-only behavior from the fail-closed predicate or grant the AAA session to every /studio/isis/<segment> route?
Which marquee scenarios must become true submit→read-back journeys, and which should be deleted in favor of their dedicated Playwright specs?
How should ghost scanning distinguish intended outcome from incidental DOM mutation without making destructive actions unsafe?
Which link seeds, depth, family rules, and cap define an acceptable release gate, and how will uncrawled families fail that gate visibly?
Where should immutable commit, environment manifest, JSON artifacts, and expected-boundary policy be retained for the next sweep?