--- status: reconciled-partial coverage_depth: deep last_reconciled: 2026-07-18 specs: - apps/oshun/web/e2e/messages-center-bff.spec.ts - apps/oshun/web/e2e/assistant-not-entitled-fallback.spec.ts - apps/oshun/web/e2e/incident-triage.spec.ts - apps/oshun/web/e2e/operator-inbox-decision-bff.spec.ts - apps/oshun/web/e2e/integrity-appeal.spec.ts source: WALKTHROUGH/journeys/coverage.md --- # Journey result: Journey E2E quality audit — base pass - **Walked**: 2026-06-05 as an eight-auditor adversarial review of all 52 journey specs then present. The same-day Waves 1–3 removed fake coverage, corrected grades and links, added real tests, and built selected product gaps. - **Reconciled**: 2026-07-18 against the current 64-journey registry, the Wave 4–6 successor records, and the surviving messages, assistant, scene, Arete, incident, and Themis evidence. This was a source reconciliation, not a fresh full-suite runtime walk. - **Verdict**: **partial** — the base audit found a real self-fulfilling inbox test, local-only decisions presented as audited writes, dead helpers, stale headers, grade inflation, and uncovered registered behavior. Its repair waves produced durable improvements, but its old backlog and 52-journey grade snapshot are not current authority. - **Successors**: [Wave 4](./journey-e2e-quality-audit-2026-06-05-wave4.md), [Wave 5](./journey-e2e-quality-audit-2026-06-05-wave5.md), and [Wave 6](./journey-e2e-quality-audit-2026-06-05-wave6.md) continue the dated evidence chain; [current coverage](../journeys/coverage.md) owns the inventory. ## Result at a glance | Base-audit lane | Original defect | Current source disposition | Authority limit | | ----------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------- | | Messages center | A hand-authored inbox response was asserted as if the product had produced it; the producer seam had no caller | Closed and expanded: real dispatch drives inbox, follow, read, archive, unsubscribe, suppression, resubscribe, isolation, limits, and auth/error gates | Development BFF/store, not external channel delivery | | Assistant access denial | A 403 could fall through to a high-confidence simulated reply and shared generic-outage copy | Closed: session and message 403 paths expose distinct current-access fallback/notice and do not add a fabricated answer or spoken turn | Entitlement/error honesty, not model/provider availability | | Public scene outage | A transient 5xx/network failure was reported as a definitive retired tombstone | Closed: 5xx/network maps to `unavailable`; 4xx maps to tombstone; the route renders “Temporarily unavailable” with retry | Fail-safe route resolution, not a generic segment error boundary | | Arete streak drift | A hand-typed best-habit label duplicated source data, while unlike metrics were mistaken for inconsistent values | Closed: best-habit streak is derived; overall practice streak uses a shared constant; the two metrics intentionally differ | Canonical fixture/domain semantics, not live activity persistence | | Operator inbox | Category chips were inert and a local timeout flag claimed an audited decision | Closed: chips filter 6→2→6 rows; decision/reopen uses admin-scoped real HTTP, audit id, validation, read-back, and operator isolation | Fixture inbox start and dev store still bound the proof | | Themis appeal | The learner filing path existed, but operator uphold/overturn was not exercised | Closed: a learner is forbidden, an admin resolves with a note, and the appellant reads the result back | Route-level cross-actor proof, not an operator queue/SLA | | Provenance ledger | Core checks silently depended on a configured ledger | Closed later: a test-only fixture now drives clean, broken, unavailable, empty, and unknown-bundle states | Harness ledger, not production persistence | | Grades and links | Roughly ten deep labels, stale headers, dead code, and broken cross-links overstated evidence | Historically corrected, then changed again as later specs shipped; the current 64-journey matrix is authoritative | A grade is a bounded summary, not a suite-execution artifact | ## Evidence map The base pass was not one result; it was a repair sequence. Later waves continue the chain, while the current registry is deliberately kept separate from the dated runtime verdict. ```mermaid flowchart LR A[Base adversarial audit
52 journeys] --> B[Wave 1
fake coverage, grades, links] B --> C[Wave 2
wireable tests and product gaps] C --> D[Wave 3
surgical product repairs] D --> E[Waves 4–6
premise checks and real HTTP] E --> F[Current coverage registry
64 journeys] F -. new full run required .-> G[Current runtime baseline] ``` ## Proven observations ### Fake success was replaced with accountable outcomes - `messages-center-bff.spec.ts` no longer asserts the body a route handler just invented. It sends real customer messages, follows links without implicit reads, marks and archives, suppresses after unsubscribe, restores after resubscribe, bounds snapshots, isolates users, and exercises auth/error gates. - `assistant-not-entitled-fallback.spec.ts` reissues requests to obtain real BFF 403 responses. Session creation flips the downstream fallback reason; message denial renders an honest current-access notice without a reply card, confidence, transcript turn, or speech side effect. - `operator-inbox-decision-bff.spec.ts` owns create/read, short-rationale and verdict validation, 401/403, reopen, not-found, audit emission, and per-operator isolation. The browser panel consumes that contract and exposes the returned audit identifier instead of synthesizing success. ### Primary-source review corrected the audit as well as the product - The scene defect was not “missing `error.tsx`.” The loader already failed safe; its semantic mistake was treating temporary failure as retirement. `living-scenes-public.test.ts` now distinguishes playable, tombstone, unavailable, network-reject, and missing-body resolution. - The Arete values were not meant to be equal. A best single-habit streak and an overall practice streak are separate metrics. `arete-streak.test.ts` pins derivation, formatting, no-drift consistency, and the intended relationship. - The assistant safe-fallback was initially called unwireable. Deeper source reading found its downstream subsystem was error-driven, which enabled the honest 403 product fix and removal of the simulated response. - The Themis resolve route already existed. The missing work was a test: the current integrity-appeal suite proves scope separation and cross-actor read-back rather than inventing a new endpoint. ### Later waves superseded the original backlog - Wave 4 repaired the editorial auth regression, PWA cache false positive, provenance skip, grades, and traceability headers. - Wave 5 used a live run to reject auditor assumptions, added Tara/scene failure modes, removed vacuous guards, and corrected consent language. - Wave 6 found registered routes behind “blocked” prose, shipped 11 real-HTTP specs, repointed dead-component coverage, and removed more silent guards. - Current coverage later re-earned depth for several historically downgraded journeys. The base page therefore records the defect and repair lineage, not a present-tense work queue. ## Boundaries and gaps - **A 52-journey audit is not the 64-journey inventory.** New journeys and later specs must be read from current `coverage.md`. - **A source-preserved repair is not a current test run.** This docs audit did not execute Oshun's application E2E, BFF, or unit suites. - **A real development BFF is not production authority.** Dev bearers, in-process stores, deterministic fixtures, and local corpora stop short of production identity, databases, providers, and operational telemetry. - **A server-confirmed write is not shared lifecycle state.** The operator decision proof is per-operator; it does not establish a globally shared inbox status, assignment, SLA, or paging workflow. - **An in-route unavailable state is not universal error handling.** It is the correct contract for a fail-safe scene loader. Other routes need their own honest failure semantics rather than a copied `error.tsx` requirement. - **Two named streak metrics need not match.** Canonical derivation prevents drift inside each definition; it does not collapse distinct product concepts. - **A harness provenance ledger is not durable production evidence.** It makes browser behavior deterministic without claiming database retention or cross-tenant operational controls. - **The base backlog is historical.** Any “blocked,” “wireable,” or “still deferred” item must be rechecked against current source and successor audits. ## Re-run evidence The central browser/BFF repairs can be exercised serially: ```bash PW_BROWSER_CHANNEL=chrome pnpm exec playwright test \ -c apps/oshun/web/playwright.config.ts \ apps/oshun/web/e2e/messages-center-bff.spec.ts \ apps/oshun/web/e2e/assistant-not-entitled-fallback.spec.ts \ apps/oshun/web/e2e/incident-triage.spec.ts \ apps/oshun/web/e2e/operator-inbox-decision-bff.spec.ts \ apps/oshun/web/e2e/integrity-appeal.spec.ts \ --workers=1 ``` The corrected scene and streak semantics have focused unit coverage: ```bash pnpm exec vitest run \ apps/oshun/web/src/lib/living-scenes-public.test.ts \ apps/oshun/web/src/lib/lilith-data/arete-streak.test.ts ``` Retain web/BFF revisions and artifacts with any rerun. Green results prove these named repairs, not every successor-wave spec or the current 64-journey suite. ## Source trail - [Current journey coverage registry](../journeys/coverage.md) - [Messages-center real-HTTP suite](../../apps/oshun/web/e2e/messages-center-bff.spec.ts) - [Assistant not-entitled suite](../../apps/oshun/web/e2e/assistant-not-entitled-fallback.spec.ts) - [Incident-triage browser suite](../../apps/oshun/web/e2e/incident-triage.spec.ts) - [Operator decision BFF suite](../../apps/oshun/web/e2e/operator-inbox-decision-bff.spec.ts) - [Themis integrity-appeal suite](../../apps/oshun/web/e2e/integrity-appeal.spec.ts) - [Scene resolution unit suite](../../apps/oshun/web/src/lib/living-scenes-public.test.ts) - [Arete streak unit suite](../../apps/oshun/web/src/lib/lilith-data/arete-streak.test.ts) - [Public scene resolver](../../apps/oshun/web/src/lib/living-scenes-public.ts) - [Canonical Arete streak model](../../apps/oshun/web/src/lib/lilith-data/arete-streak.ts) ## Cross-references - [Wave 4 audit result](./journey-e2e-quality-audit-2026-06-05-wave4.md) - [Wave 5 audit result](./journey-e2e-quality-audit-2026-06-05-wave5.md) - [Wave 6 audit result](./journey-e2e-quality-audit-2026-06-05-wave6.md) - [Incident-triage result](./incident-triage.md) - [Editorial-review result](./editorial-review-approval.md) - [Messages-center journey](../journeys/messages-center-deliver-and-unsubscribe.md) - [Citation-drift journey](../journeys/citation-drift-resolution.md) ## Open questions - What exact app, BFF, database, and harness revisions should define the next complete 64-journey baseline? - Which real-HTTP route contracts still lack a reachable customer/operator UI, and which are intentionally API-only? - How should shared incident lifecycle, assignment, paging, and SLA state extend the current per-operator decision receipt? - Which development-store read-backs need a disposable durable-store variant before stronger persistence language is justified? - Can one maintained current backlog replace copied “blocked” lists while these historical pages retain only their dated findings and dispositions?