---
status: walked + e2e-covered
coverage_depth: deep
last_walked:
  '2026-07-02 by Codex — reconciled against current real-dev-infra Playwright:
  public-scene-abuse-report.spec.ts plus scene-password-and-grants.spec.ts.'
specs:
  - apps/oshun/web/e2e/public-scene-abuse-report.spec.ts
  - apps/oshun/web/e2e/scene-password-and-grants.spec.ts
source: WALKTHROUGH/journeys/public-scene-abuse-report.md
---

# Journey result: Public scene abuse report

- **Source**: `WALKTHROUGH/journeys/public-scene-abuse-report.md`
- **Walked**: 2026-05-29 by Claude (Opus 4.8) against commit `eff6655269`;
  coverage reconciled 2026-07-02 by Codex against current real-dev-infra
  Playwright.
- **Verdict**: **pass / deep E2E covered for shipped flow** — seeded public
  shares now exercise the real report POST, operator inbox surfacing,
  resolution/dismissal verbs, signed-in reporter receipts, and the abuse
  protection / revoked-share / takedown-cascade edges.
- **Walker**:
  `/tmp/claude-oshun-lt-2-walkthrough/walk.mjs public-scene-abuse-report`

## Summary

`/scene/<id>/report` renders anonymously with the 6-reason `<select>`, a
2000-char detail `<textarea>`, a `type="submit"` "Send report" button (prior Bug
4-1 fixed), and a `role="status" aria-live="polite"` result region. All 4
scripted steps pass. Current Playwright now seeds real public shares, drives the
success path, accepts empty optional detail, verifies failure/offline status
copy, proves self-harm reports surface as live S1 operator INCs with scene deep
links, covers admin resolve/dismiss persistence, and covers signed-in reporter
receipt read-back through `/profile/safety`.

## Steps

- **Step 1 — Report form renders anonymously**: pass (200; H1 "Report this
  offering"; 6 reasons; textarea; typed submit button).
- **Step 2 — POST endpoint**: pass — current specs seed a real public share and
  submit `POST /v1/living-scenes/public/<code>/report` through both browser form
  and API legs; unknown IDs remain guarded.
- **Step 3 — UI submit**: pass — submit button has `type="submit"`, status copy
  reflects success/failure, and signed-in bearer stamping is proven by reporter
  receipts.
- **Step 4 — Rate-limit / burst guard**: pass — `scene-password-and-grants`
  drives the real `publicAbuseProtection` 120-request window to `429`.

## Resolved since prior walk

- Bug 4-1 (submit button missing `type`) — fixed (`type="submit"` present).

## Current boundaries

- Product/UI gaps remain documented in the journey: public-report operator
  detail does not yet expose the takedown-cascade confirmation modal or
  sharer-side warn/restrict/suspend UI, and coordinated brigade-report grouping
  is not shipped. The BFF-backed report, operator surfacing, decision verbs,
  signed-in receipt, rate-limit, revoked-share, and artifact cascade paths are
  covered.