--- status: reconciled-partial coverage_depth: partial last_reconciled: 2026-09-13 specs: - apps/oshun/web/scripts/walkthrough-probe-all.mjs - apps/oshun/web/scripts/walkthrough-linkcrawl.mjs - apps/oshun/web/scripts/walkthrough-interact.mjs source: WALKTHROUGH/matrix/routes.csv --- # Journey result: Journey and interaction sweep - **Walked**: 2026-06-04 against a production web build, mock-adapter BFF, and signed-in Chromium session on the named branch `feat/hestia-epicure-embeddings`. The record does not retain an immutable commit id. - **Reconciled**: 2026-09-13 against the current 722-route inventory, the three surviving sweep scripts, the fail-closed Studio Isis boundary, and the four hydration-safe implementations plus their focused unit tests. This was a source reconciliation, not a fresh application sweep. - **Verdict**: **partial** — the dated run supplied valuable broad render/link smoke, heuristic interaction triage, and a reproducible React hydration fix. It did not execute every journey end to end, its crawl was capped, several marquee assertions were presence-level, and the current render probe has drifted from the fail-closed Studio Isis route boundary. - **Primary harness**: `walkthrough-probe-all.mjs`, `walkthrough-linkcrawl.mjs`, and `walkthrough-interact.mjs`. ## Result at a glance | Evidence layer | Dated 2026-06-04 result | Current-source reading | Authority limit | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------- | | Route render | 655/684 passed; 29 non-AAA Studio Isis hard blocks were treated as expected | Inventory is now 722 routes: 702 walked and 20 drafted. It contains 87 distinct `/studio/isis/*` segments; the boundary fail-closes every nonempty segment, while the probe's AAA detector reads only the 31-item diagnostic catalog | Current full rerun would misclassify 56 uncatalogued fail-closed segments until the harness is aligned | | Link crawl | 471/500 reachable, with the same 29 hard blocks and no other broken bridge | The BFS still starts from 28 surfaces, defaults to depth 2, deduplicates route families, and caps at 500; it now prints any dropped queue explicitly | Representative link families, not all links or all route instances | | Ghost scan | Six candidates on 30 pages were manually judged wired/no-op; no true ghost remained | The scan checks at most 14 unique safe controls per page, excludes destructive labels and links, and treats any URL, DOM mutation, or `/v1/` request as effect | Heuristic candidate finder; it can miss semantically wrong effects and intentionally omits risky actions | | Marquee scenarios | 7/7 reported pass: Tara, Arete, Veritas, two Metis surfaces, Library, and onboarding | Tara and Metis assessment assert meaningful controls/input; Arete only requires an input, Veritas absence is note-only, Metis quiz absence is note-only, and Library records its count without failing | Seven probes are not “every flow and journey” and several are smoke-level | | Hydration repair | Home reload, Tara continuity, Profile Memory, and Profile Safety mismatches were fixed; focused repros and 28 unit tests passed | Stable server snapshot/default seeds and post-mount adoption remain in all four sources, with focused test files still present | Source-preserved fix; the historic prod repro was not rerun here | ## Evidence map The three harness layers answer different questions. None can substitute for the step-and-failure-mode contracts in the current journey suites. ```mermaid flowchart LR A[722-route inventory
702 walked · 20 drafted] --> B[Render probe
status, h1, page errors] C[28 entry surfaces] --> D[Depth-2 link crawl
500-family cap] E[30 interactive surfaces] --> F[Ghost heuristic
safe controls only] F --> G[Seven marquee scenarios] B --> H[Hydration mismatch triage] D --> I[Broken-bridge candidates] G --> J[Interaction candidates] H --> K[Focused source and unit repair] I --> L[Dedicated journey specs] J --> L ``` ## Proven observations ### The hydration diagnosis remains source-grounded - `persistent-shell-context.ts` gives `useSyncExternalStore` a stable `getServerSnapshot()` that always returns `DEFAULT_SNAPSHOT`. Session storage is adopted after hydration, so a domain visit cannot make the first client tree disagree with the empty server tree. - `taraThemeContinuity.ts` seeds its hook with `null`, matching SSR, and reads the persisted Tara record inside the mount effect before subscribing to storage and continuity events. - `ProfileMemoryControls.tsx` seeds the canonical default, adopts local state after mount, skips the first persist effect, listens for cross-tab storage, and now lets the member's real Iris BFF record win when available. - `ProfileSafetyJourney.tsx` retains the first-persist guard while its current surface also loads live/cached crisis frames and member report receipts. The original hydration repair should not be summarized as coverage of that whole expanded flow. - Focused tests remain for the persistent shell, Tara continuity and Home continuation, Profile Memory, and Profile Safety implementations. ### The harness has useful honesty mechanisms - The render and crawl scripts mint fresh sessions, default to one browser worker, relaunch periodically, and abort under configured memory pressure. - The link crawler records each referrer, canonicalizes dynamic route families, and reports a nonempty queue when `CRAWL_MAX_PAGES` truncates coverage. A cap is therefore visible rather than silently described as completeness. - The interaction probe emits raw JSON reports under `/tmp/walk`, records page errors separately from ghost candidates, and explicitly warns that an already-active control can be a correct no-op requiring source triage. - Dynamic route concretization and BFS serve complementary purposes: the render layer reaches inventory entries with representative ids; the crawl follows ids actually emitted by the current UI. ### Current harness drift blocks a clean rerun claim - `WALKTHROUGH/matrix/routes.csv` now holds 722 routes: 702 walked and 20 drafted. It includes 88 rows across 87 distinct Studio Isis first segments. - `isAaaOnlyRoute()` is intentionally fail-closed: every nonempty Studio Isis segment is AAA-only because the allowed-segment list is empty. - `walkthrough-probe-all.mjs` instead derives AAA status from the 31-item `AAA_ONLY_STUDIO_ROUTES` diagnostic catalog. The other 56 current segments receive a normal member session and can be reported as failures even though the product correctly hides them. - The old 655/684 and 471/500 totals remain valid only as dated artifacts. They are not predictions for the current inventory. ## Boundaries and gaps - **“Every flow and journey” is not supported by the evidence.** Route renders, link families, 30 page scans, and seven scenarios are broad smoke layers; the current registry contains 64 authored journeys with deeper contracts. - **A branch name is not immutable provenance.** Without the walked commit id, the exact 2026-06-04 web, BFF, inventory, and harness tree cannot be recreated from this record alone. - **A production web build over mock adapters is not production behavior.** It improves rendering fidelity while retaining in-memory stores, local identity, deterministic fixtures, and no external providers. - **A representative dynamic id is not a real entity.** The render probe's `demo` substitutions find routing/render failures but cannot certify persistence, ownership, or data-dependent states. - **A 500-page BFS is not a complete link graph.** Depth, family deduplication, seed selection, and the cap intentionally trade completeness for bounded runtime. - **Any DOM mutation is not a meaningful result.** Animation, unrelated attributes, or incidental requests can satisfy the ghost heuristic while the intended outcome remains wrong. - **Excluded actions remain untested.** Destructive, purchase, publish, unsubscribe, revoke, and similar controls are deny-listed for safety. - **Several marquee passes are permissive.** Missing Veritas save and Metis quiz controls do not fail; Library only records its collection-affordance count; Arete does not submit or read back a habit. - **The current AAA classification is inconsistent.** Align the render probe with the fail-closed boundary before treating a new total as a product verdict. - **Source reconciliation is not execution.** No web build, BFF, route sweep, crawl, interaction scan, or hydration repro was run for this docs audit. ## Re-run evidence The scripts still expose the historical workflow, but first repair or explicitly account for the Studio Isis classification mismatch described above: ```bash # terminal 1: mock-adapter BFF cd apps/oshun/bff USE_MOCK_ADAPTERS=true PORT=4010 pnpm exec tsx src/server.ts # terminal 2: production web cd apps/oshun/web pnpm exec next build PORT=3010 NEXT_PUBLIC_OSHUN_BFF_URL=http://127.0.0.1:4010 pnpm exec next start -p 3010 # terminal 3: one layer at a time cd apps/oshun/web node scripts/walkthrough-probe-all.mjs node scripts/walkthrough-linkcrawl.mjs node scripts/walkthrough-interact.mjs ``` Retain the exact commit, environment, JSON reports, cap status, route totals, and expected-boundary policy. Do not combine these memory-heavy layers or summarize a green smoke layer as completed journey coverage. ## Source trail - [Current route inventory](../matrix/routes.csv) - [Render probe](../../apps/oshun/web/scripts/walkthrough-probe-all.mjs) - [Link crawler](../../apps/oshun/web/scripts/walkthrough-linkcrawl.mjs) - [Interaction probe](../../apps/oshun/web/scripts/walkthrough-interact.mjs) - [Studio Isis boundary](../../libs/isis/entitlements/src/studio-boundary.ts) - [Studio boundary tests](../../libs/isis/entitlements/src/studio-boundary.test.ts) - [Persistent shell store](../../apps/oshun/web/src/navigation/persistent-shell-context.ts) - [Persistent shell tests](../../apps/oshun/web/src/navigation/persistent-shell-context.test.ts) - [Tara continuity hook](../../apps/oshun/web/src/components/home/taraThemeContinuity.ts) - [Tara continuity tests](../../apps/oshun/web/src/components/home/taraThemeContinuity.test.ts) - [Profile Memory controls](../../apps/oshun/web/src/app/profile/memory/ProfileMemoryControls.tsx) - [Profile Safety journey](../../apps/oshun/web/src/app/profile/safety/ProfileSafetyJourney.tsx) ## Cross-references - [Current journey coverage registry](../journeys/coverage.md) - [Base journey-E2E quality audit](./journey-e2e-quality-audit-2026-06-05.md) - [First Tara sit result](./first-tara-sit.md) - [Install-as-PWA result](./install-as-pwa.md) - [First-time visitor result](./first-time-anonymous-visitor.md) - [Incident-triage result](./incident-triage.md) ## Open questions - Should the render probe derive AAA-only behavior from the fail-closed predicate or grant the AAA session to every `/studio/isis/` route? - Which marquee scenarios must become true submit→read-back journeys, and which should be deleted in favor of their dedicated Playwright specs? - How should ghost scanning distinguish intended outcome from incidental DOM mutation without making destructive actions unsafe? - Which link seeds, depth, family rules, and cap define an acceptable release gate, and how will uncrawled families fail that gate visibly? - Where should immutable commit, environment manifest, JSON artifacts, and expected-boundary policy be retained for the next sweep?