V1 Web PWA · Walk result

Journey result: Scene anonymous viewer

A dated evidence record for V1 Web PWA: observed behavior, current source reconciliation, automation evidence, and explicit proof limits.

verdict: partial· 2026-05-29
5sections1 minread
Markdown source
On this page
  • Source: WALKTHROUGH/journeys/scene-public-viewer-anonymous.md
  • Walked: 2026-05-29 by Claude (Opus 4.8) against commit eff6655269
  • Verdict: pass (tombstone + embed) / partial (seeded-share branches) — public access, tombstone, embed, error params, and routing all verified; password/playable/tenant-auth branches need a seeded share.
  • Walker: /tmp/claude-oshun-lt-2-walkthrough/walk.mjs scene-public-viewer-anonymous

Summary#

/scene/<shortCode> is public (no auth bounce) and renders the tombstone for an unknown code with noindex,nofollow. The prior P0 ('use server' violation in unlock-actions.ts) and P2 (double | OSHUN | OSHUN title) are both resolved — titles are now single-suffix ("Living Offering Retired | OSHUN", "Embedded Living Offering | OSHUN"). All 6 scripted steps pass.

Steps#

  • Step 1 — /scene/* public: pass (200 anonymous, no redirect).
  • Step 2 — Tombstone render: pass (retired copy + robots=noindex,nofollow).
  • Step 3 — OpenGraph: pass for tombstone (generic site OG; acceptable since noindex). Scene-specific OG for a real share is unverified (no seed).
  • Step 4 — /scene/<id>/embed: pass (200; frame-ancestors CSP).
  • Step 5 — Error params don't crash: pass (?error=invalid-password etc → 200).
  • Step 6 — Anonymous middleware allowance: pass.

Resolved since prior walk#

  • Bug #11 (unlock-actions.ts 'use server' non-async export) — fixed.
  • Bug #12 (double | OSHUN | OSHUN title) — fixed (single suffix confirmed).

Not exercisable without seed data#

  • Password-required, playable, and tenant-auth-required branches; scene-specific OG on a real share. Needs a seeded /v1/living-scenes share (POST is 404 for unknown codes by design). See results/external-dependencies/.

Note#

  • The walker's flagged /api/auth/session → 401 is benign (anonymous viewer; the auth probe legitimately 401s) — not a defect.