Journey result: Journey E2E quality audit — base pass

Walked: 2026-06-05 as an eight-auditor adversarial review of all 52 journey specs then present. The same-day Waves 1–3 removed fake coverage, corrected grades and links, added real tests, and built selected product gaps.
Reconciled: 2026-07-18 against the current 64-journey registry, the Wave 4–6 successor records, and the surviving messages, assistant, scene, Arete, incident, and Themis evidence. This was a source reconciliation, not a fresh full-suite runtime walk.
Verdict: partial — the base audit found a real self-fulfilling inbox test, local-only decisions presented as audited writes, dead helpers, stale headers, grade inflation, and uncovered registered behavior. Its repair waves produced durable improvements, but its old backlog and 52-journey grade snapshot are not current authority.
Successors: Wave 4, Wave 5, and Wave 6 continue the dated evidence chain; current coverage owns the inventory.

Result at a glance#

Base-audit lane	Original defect	Current source disposition	Authority limit
Messages center	A hand-authored inbox response was asserted as if the product had produced it; the producer seam had no caller	Closed and expanded: real dispatch drives inbox, follow, read, archive, unsubscribe, suppression, resubscribe, isolation, limits, and auth/error gates	Development BFF/store, not external channel delivery
Assistant access denial	A 403 could fall through to a high-confidence simulated reply and shared generic-outage copy	Closed: session and message 403 paths expose distinct current-access fallback/notice and do not add a fabricated answer or spoken turn	Entitlement/error honesty, not model/provider availability
Public scene outage	A transient 5xx/network failure was reported as a definitive retired tombstone	Closed: 5xx/network maps to `unavailable`; 4xx maps to tombstone; the route renders “Temporarily unavailable” with retry	Fail-safe route resolution, not a generic segment error boundary
Arete streak drift	A hand-typed best-habit label duplicated source data, while unlike metrics were mistaken for inconsistent values	Closed: best-habit streak is derived; overall practice streak uses a shared constant; the two metrics intentionally differ	Canonical fixture/domain semantics, not live activity persistence
Operator inbox	Category chips were inert and a local timeout flag claimed an audited decision	Closed: chips filter 6→2→6 rows; decision/reopen uses admin-scoped real HTTP, audit id, validation, read-back, and operator isolation	Fixture inbox start and dev store still bound the proof
Themis appeal	The learner filing path existed, but operator uphold/overturn was not exercised	Closed: a learner is forbidden, an admin resolves with a note, and the appellant reads the result back	Route-level cross-actor proof, not an operator queue/SLA
Provenance ledger	Core checks silently depended on a configured ledger	Closed later: a test-only fixture now drives clean, broken, unavailable, empty, and unknown-bundle states	Harness ledger, not production persistence
Grades and links	Roughly ten deep labels, stale headers, dead code, and broken cross-links overstated evidence	Historically corrected, then changed again as later specs shipped; the current 64-journey matrix is authoritative	A grade is a bounded summary, not a suite-execution artifact

Evidence map#

The base pass was not one result; it was a repair sequence. Later waves continue the chain, while the current registry is deliberately kept separate from the dated runtime verdict.

flowchart LR A[Base adversarial audit 52 journeys] --> B[Wave 1 fake coverage, grades, links] B --> C[Wave 2 wireable tests and product gaps] C --> D[Wave 3 surgical product repairs] D --> E[Waves 4–6 premise checks and real HTTP] E --> F[Current coverage registry 64 journeys] F -. new full run required .-> G[Current runtime baseline]

Proven observations#

Fake success was replaced with accountable outcomes#

messages-center-bff.spec.ts no longer asserts the body a route handler just invented. It sends real customer messages, follows links without implicit reads, marks and archives, suppresses after unsubscribe, restores after resubscribe, bounds snapshots, isolates users, and exercises auth/error gates.
assistant-not-entitled-fallback.spec.ts reissues requests to obtain real BFF 403 responses. Session creation flips the downstream fallback reason; message denial renders an honest current-access notice without a reply card, confidence, transcript turn, or speech side effect.
operator-inbox-decision-bff.spec.ts owns create/read, short-rationale and verdict validation, 401/403, reopen, not-found, audit emission, and per-operator isolation. The browser panel consumes that contract and exposes the returned audit identifier instead of synthesizing success.

Primary-source review corrected the audit as well as the product#

The scene defect was not “missing error.tsx.” The loader already failed safe; its semantic mistake was treating temporary failure as retirement. living-scenes-public.test.ts now distinguishes playable, tombstone, unavailable, network-reject, and missing-body resolution.
The Arete values were not meant to be equal. A best single-habit streak and an overall practice streak are separate metrics. arete-streak.test.ts pins derivation, formatting, no-drift consistency, and the intended relationship.
The assistant safe-fallback was initially called unwireable. Deeper source reading found its downstream subsystem was error-driven, which enabled the honest 403 product fix and removal of the simulated response.
The Themis resolve route already existed. The missing work was a test: the current integrity-appeal suite proves scope separation and cross-actor read-back rather than inventing a new endpoint.

Later waves superseded the original backlog#

Wave 4 repaired the editorial auth regression, PWA cache false positive, provenance skip, grades, and traceability headers.
Wave 5 used a live run to reject auditor assumptions, added Tara/scene failure modes, removed vacuous guards, and corrected consent language.
Wave 6 found registered routes behind “blocked” prose, shipped 11 real-HTTP specs, repointed dead-component coverage, and removed more silent guards.
Current coverage later re-earned depth for several historically downgraded journeys. The base page therefore records the defect and repair lineage, not a present-tense work queue.

Boundaries and gaps#

A 52-journey audit is not the 64-journey inventory. New journeys and later specs must be read from current coverage.md.
A source-preserved repair is not a current test run. This docs audit did not execute Oshun's application E2E, BFF, or unit suites.
A real development BFF is not production authority. Dev bearers, in-process stores, deterministic fixtures, and local corpora stop short of production identity, databases, providers, and operational telemetry.
A server-confirmed write is not shared lifecycle state. The operator decision proof is per-operator; it does not establish a globally shared inbox status, assignment, SLA, or paging workflow.
An in-route unavailable state is not universal error handling. It is the correct contract for a fail-safe scene loader. Other routes need their own honest failure semantics rather than a copied error.tsx requirement.
Two named streak metrics need not match. Canonical derivation prevents drift inside each definition; it does not collapse distinct product concepts.
A harness provenance ledger is not durable production evidence. It makes browser behavior deterministic without claiming database retention or cross-tenant operational controls.
The base backlog is historical. Any “blocked,” “wireable,” or “still deferred” item must be rechecked against current source and successor audits.

Re-run evidence#

The central browser/BFF repairs can be exercised serially:

bash

PW_BROWSER_CHANNEL=chrome pnpm exec playwright test \
  -c apps/oshun/web/playwright.config.ts \
  apps/oshun/web/e2e/messages-center-bff.spec.ts \
  apps/oshun/web/e2e/assistant-not-entitled-fallback.spec.ts \
  apps/oshun/web/e2e/incident-triage.spec.ts \
  apps/oshun/web/e2e/operator-inbox-decision-bff.spec.ts \
  apps/oshun/web/e2e/integrity-appeal.spec.ts \
  --workers=1

The corrected scene and streak semantics have focused unit coverage:

bash

pnpm exec vitest run \
  apps/oshun/web/src/lib/living-scenes-public.test.ts \
  apps/oshun/web/src/lib/lilith-data/arete-streak.test.ts

Retain web/BFF revisions and artifacts with any rerun. Green results prove these named repairs, not every successor-wave spec or the current 64-journey suite.

Source trail#

Cross-references#

Open questions#

What exact app, BFF, database, and harness revisions should define the next complete 64-journey baseline?
Which real-HTTP route contracts still lack a reachable customer/operator UI, and which are intentionally API-only?
How should shared incident lifecycle, assignment, paging, and SLA state extend the current per-operator decision receipt?
Which development-store read-backs need a disposable durable-store variant before stronger persistence language is justified?
Can one maintained current backlog replace copied “blocked” lists while these historical pages retain only their dated findings and dispositions?