Oshun V1 PWA — Walkthrough + E2E Completeness Audit

Date: 2026-06-22 · Synthesis lead: Codex · Scope: 8 newly-written route walkthroughs, an adversarial re-grade of all 52 journeys' TRUE e2e depth, and a staleness sample of the per-view docs (44 sampled across 3 surface clusters).

2026-06-23 supersession note: the /operator/lms page-DOM gap called out in this dated audit is now resolved by operator-lms.spec.ts against a seeded real BFF roster plus lms-connectors.spec.ts seeded API coverage. The current source-of-truth row is WALKTHROUGH/journeys/coverage.md.

2026-06-23 supersession note: the /personas page-DOM gap called out in this dated audit is now resolved and deepened by personas-picker.spec.ts. The browser page now renders real BFF top-level blocked[] persona cards, and the spec drives a live browser→BFF pre-consent blocked roster, real voice-consent grant, select, active read-back after reload, and clear persistence. The pure persona-session-picker.spec.ts BFF round-trip remains the companion API guard.

2026-06-23 supersession note: veritas-retraction-cascade-customer-view is no longer render-only/shallow. veritas-retraction-cascade.spec.ts now covers the /library saved-claim retraction notice with corrected-source, recourse, and remove-from-library affordances; the 2026-06-27 update adds the authenticated BFF personal-letter route plus per-user 404/no-leak browser coverage; the 2026-06-29 update adds polished /nisaba/notebook retraction-disclosure drill-down with corrected-source navigation and honest keep-with-marker placeholder state. Customer-shell subscriber/audit fan-out, persisted notebook acknowledgement writes, and kept-offering re-render remain open; current depth is partial.

2026-06-23 supersession note: nyx-tonight-observation now covers the event detail → observation-log handoff, local oshun.nyx persistence, an eventId-backed History row, and Home Nyx support-card read-back of the newly saved target/notes. 2026-06-24 deepening adds real /v1/nyx/observations POST/GET read-back plus a local-storage-cleared observation-log reload from the BFF. A later 2026-06-24 pass adds the Home footing "Sky observations" current-week KPI read-back and click-through to /domains/nyx/observation-log. A later 2026-06-24 pass verifies every generated Nyx event-detail Nisaba, Veritas, Tara, and Metis cross-domain card target against hydrated shell destinations. A later 2026-06-24 pass fixes and verifies the event-calendar close route for both direct and hydrated-shell arrivals; residual documentation-only Nyx gaps keep the depth partial.

2026-06-23 supersession note: arete-create-habit now covers the /domains/arete/habits?wizard=loop handoff, Cue→Routine→Reward wizard step-through, real /v1/arete/habits POST, returned BFF habit id persisted in local oshun.arete, the newly-created dashboard row, real /v1/arete/habits/:habitId/check-in POST, polished /arete Done-today / 1-day streak / 1 / 7 KPI read-back through /v1/arete/room, and Home Arete 1d streak • done today read-back. Cross-device check-in sync remains open; Home legacy KpiGrid is not live per the home walkthrough; current depth is partial.

2026-06-24 supersession note: the arete-create-habit cross-device check-in gap is now closed for the polished /arete BFF read model. arete-create-habit.spec.ts creates and checks in a habit on device A, then opens /arete in a second browser context using the same real member session with no oshun.arete local store; device B reads Done today, 1-day streak, and 1 / 7 from the fresh authenticated /v1/arete/room response. A later 2026-06-24 pass also asserts the wizard's selected sampleIdentityStatements line in the real habit-create whyItMatters request, persists that identity id locally, and reads the created habit back from IdentityPanel; another pass asserts seeded sample-habit toggles remain local-only and emit no BFF check-in write. Home Arete remains same-browser local continuity; a later pass asserts the live Home HomeFootingSummaryStrip practice-streak metric adds the pending same-day local Arete check-in while profile sync is still pending.

2026-06-23 supersession note: themis-assessment-appeal now covers the teacher override branch over real BFF HTTP: repeat adjudication accepts teacherOverride, downgrades to verdictClass: "inconclusive", records status: "overturned", uses decision.decidedBy: "teacher-op", and persists the override rationale into the audit read-back. Detection from the customer assessment submit, /operator/metis review UI, gradebook, and /messages notification remain open; current depth is partial.

2026-06-24 supersession note: themis-assessment-appeal now also covers the upheld branch over real BFF HTTP: repeat adjudication with a matching teacherOverride.verdictClass keeps verdictClass: "violation", records status: "upheld", preserves recommendedAction: "score_hold", and persists the upheld rationale into the audit read-back before the appeal is resolved.

2026-06-26 supersession note: customer assessment submit adjudication is now covered. /metis/assessment posts to /v1/metis/assessment-submissions, runs detection + Themis adjudication, renders the compact verdict read-back, and follows appealable verdicts into /integrity/<verdictId>/appeal.

2026-06-26 supersession note: the learner-safe evidence/rationale pane is now covered on /integrity/<verdictId>/appeal; it renders real audit rationale, signal metadata, evidence excerpts, policy binding, and classifier provenance from the BFF audit record. Upheld-without-teacherOverride, /operator/metis review UI, gradebook, and /messages remain open.

2026-06-26 supersession note: the /operator/metis review UI now reads the live BFF appeal queue, renders dispute/evidence/timeline/due-process detail, blocks blank resolution, resolves through the real BFF, and reads back status: "closed". Remaining Themis gaps are upheld-without- teacherOverride, dedicated verdict-class controls, gradebook read-back, and /messages.

2026-06-26 supersession note: the Themis decision notification bridge is now covered. POST /v1/metis/integrity/appeals/:appealId/resolve publishes an in-app incident row to the claimant's customer message center, and operator-metis-themis-review verifies /messages render, appeal-record follow, clicked receipt, and mark-read read-back over real dev infra. Remaining Themis gaps are upheld-without-teacherOverride, dedicated verdict-class controls, and gradebook read-back.

2026-06-26 supersession note: terminal gradebook correction read-back is now covered. Appealable non-clear submissions emit an initial pending Metis gradebook entry; appeal resolution emits the terminal integrity verdict as an integrity_verdict_change correction with cascadeFrom: "appeal", and operator-metis-themis-review renders the correction plus reads GET /v1/metis/gradebook/<assessmentId>/latest from the real BFF. Remaining Themis gaps are upheld-without-teacherOverride and dedicated verdict-class controls.

2026-06-26 supersession note: the remaining Themis appeal-decision gaps are now covered. /operator/metis renders Uphold / Revise / Dismiss / Escalate verdict controls, submits outcome: "uphold" to POST /v1/metis/integrity/appeals/:appealId/decision without a raw client teacherOverride, reads back verdict.status: "upheld", and keeps the gradebook and /messages read-backs. BFF route tests cover the inconclusive, clear, and severe outcome mappings through the canonical bridge. No current themis-assessment-appeal gaps remain tracked.

2026-06-23 supersession note: the high-severity studio-neith-inverse-modeling.md drift is closed. The walkthrough now matches the current JSON-payload fit-quality workspace, and studio-neith-inverse-modeling.spec.ts covers direct admin navigation, live BFF catalog/evaluate success, non-admin fail-closed, client invalid JSON with no POST, BFF invalid-payload detail, route-map, and Isis quick links.

2026-06-23 supersession note: the false Arete "unwired / DO NOT click" drift is closed for arete-living-offering-create and weekly-review-arete. The journey steps, failure modes, open questions, and spec headers now name the wired AreteOfferingActions / AreteReviewClose BFF paths and leave only the real residual gaps (draft gallery read-back, C2PA/receipt, crisis pre-screen).

2026-06-23 supersession note: the weekly-review-arete step-9 /arete continuity read-back gap is closed. AreteRoom now renders the latest member-scoped review closure from /v1/arete/room, backed by the same areteReviewStore used by /v1/arete/review/closed; arete-review-close returns to /arete and asserts the week-closed card.

2026-06-23 supersession note: the veritas-evidence-trail step-9 test.skip finding is closed for the standard local Playwright stack. The test BFF now honors OSHUN_VERITAS_ADAPTER=mock, veritas-full-journey and veritas-evidence-trail assert the seeded grounded-lead Save/Report actions without conditional skips, and veritas-route.test.ts guards the env override plus the fail-closed home-briefing outage path. Browser-level unavailable rendering and the remaining static claim/source drill gaps keep the journey partial.

2026-06-23 supersession note: the veritas-evidence-trail browser-level unavailable rendering gap is now partially closed by veritas-full-journey. The spec first proves the live BFF returns 403 domain_scope_missing for a signed-in token without domain:veritas, then loads /veritas with that same token and asserts the honest no-lead UI, Evidence · 0 claims, method note, and absent Save/Report actions. Downstream outage remains covered at veritas-route.test.ts and shares the same RSC non-2xx fallback. The static claim-underlines, source-row drill, and browser-induced downstream 503 called out here are closed by later supersession notes below.

2026-06-23 supersession note: the veritas-evidence-trail polished claim-mode interaction gap is now closed. /veritas/claim delegates to VeritasClaimInteractive, whose underlined claim buttons and all-claims table update data-veritas-selected-claim; selected evidence rows are real anchors to /veritas/source/[sourceId]. veritas-evidence-trail.spec.ts drives that browser chain and lands on the matching source profile. The source-id route is now closed; the journey remains partial because the downstream-outage browser 503 leg remains open.

2026-06-23 supersession note: the veritas-evidence-trail browser-induced downstream 503 gap is now closed by veritas-home-outage.spec.ts plus playwright.veritas-outage.config.ts. That dedicated run boots the real BFF with OSHUN_VERITAS_ADAPTER=outage, proves /v1/veritas/briefing/home returns 503 veritas_home_briefing_unavailable, then loads /veritas against that BFF and asserts the honest no-lead UI with no Save/Report action row.

2026-06-23 supersession note: the citation-drift-resolution seeded-ledger test.skip finding is closed for the standard local Playwright stack. Next now honors the harness-only OSHUN_ISIS_PROVENANCE_LEDGER_FIXTURE=clean path when OSHUN_ENABLE_TEST_HARNESSES=true; the browser spec asserts the clean hash-chain verdict, 16-field bundle detail, empty tenant, unavailable ledger, and broken-ledger verdict with no conditional skips. Recheck/re-render/retract write paths remain unwired, so the journey stays partial.

2026-06-23 supersession note: the sophia-grounded-answer grounded-WITH- citations BFF gap is closed for the real /v1/sophia/answer branch. sophia-answer-bff.spec.ts now drives the live BFF through the in-process Nisaba public-domain corpus and asserts groundingState: "grounded", stable citation IDs, retrieved claims, and citation-map invariants; it also preserves the no-sources abstention guard. sophia-grounded-answer-page.spec.ts submits the shipped /sophia form to the live BFF and renders grounding state, witnesses, claim rows, and the live citation handoff into a Nisaba passage reading frame. The same spec now also saves the grounded answer through the real saved-items BFF and verifies a fresh /library context hydrates the saved Sophia answer snapshot, witness trail, and grounded trust state; it now also carries the citation locator into Nisaba, highlights the exact reading excerpt, and verifies browser-back restores the /sophia answer card and scroll position. The same spec now submits the shipped /search input to the live /v1/search BFF for a Nisaba query and verifies the grounded preview evidence context. Contradiction loop UI, synthetic/retracted/cross-tenant failure modes, and labels beyond the current extractive retrieved path remain open, so the journey stays partial.

2026-06-24 supersession note: pwa-update-flow no longer has open browser-level gaps for the reading-mode prompt, lost OSHUN_SKIP_WAITING, or controllerchange reload-loop guard. pwa-smoke drives the Nisaba reading-mode prompt, Keep-reading deferral, and mid-passage scroll restore after an explicit refresh; pwa-failure-modes now drives the lost-message manual reload escape and a real apply path that reloads exactly once, clears the prompt, and preserves /explore. The journey remains partial: the real sw.js stale-cache purge, multi-tab reload sequence, cold-start no-prompt behavior, and the in-flight BFF write/read-back leg are now browser-driven in pwa-lifecycle-deepening; the raw service-worker queue/replay substrate is browser-driven in offline-background-sync. 2026-06-26 adds the queued-write update-prompt UI and telemetry: sw.js publishes OSHUN_SYNC_QUEUE_STATUS, pwa-lifecycle-deepening verifies a real pending service-worker queue row is surfaced in the Refresh-now prompt, and the same spec now asserts pwa_update_applied for both the Refresh-now controllerchange path and the silent standalone cold-start path plus pwa_sync_queued for the pending queue row. Current canonical matrix depth for pwa-update-flow is deep.

2026-06-24 supersession note: public-scene-abuse-report now covers the real operator decision write verbs. public-scene-abuse-report.spec.ts seeds fresh public reports, resolves one through POST /v1/admin/abuse-reports/:id/resolve with note/actor/list read-back, dismisses another through POST /v1/admin/abuse-reports/:id/dismiss, and asserts an unknown report id returns 404 abuse_report_not_found. The prior operator-row/deep-link leg and the public form/report edges remain covered. The artifact takedown cascade is now covered as real-BFF infrastructure by scene-password-and-grants.spec.ts: an operator-scoped originating-user-account-deletion takedown tombstones both public share links for one artifact, denies both embeds as revoked, makes an existing download grant return 410 download_grant_inactive_share, and writes takedown_cascaded to tenant audit. Remaining public-report gaps are the unbuilt operator-detail UI that connects a public-report INC to that cascade action, actor restriction branch, modal rationale-floor UX, brigade clustering, and signed-in reporter status surface.

2026-06-24 supersession note: scene-keep-and-share now covers the password-protected embed branch. scene-password-and-grants.spec.ts seeds a link-with-password share, opens /scene/:shortCode/embed in the browser, and asserts the iframe-safe "not embeddable" card, target="_top" Open-offering link, and absence of full viewer chrome, Report, Download-grant, and form controls. The direct public playable embed, revoke tombstone, delete cascade, password unlock, explicit-consent 400, tenant_internal_only policy public-share 403 denied_public_scope on the Playwright dev-BFF override path, mass-share 429, and download-grant request remain covered by sibling scene specs. The private_only crisis-touched artifact branch is also now covered: a crafted private-link share with x-oshun-living-scene-crisis-label: crisis-frame-active fails with 422 and crisis-private-only:crisis-frame-active. The production-mode stored-tenant-policy posture is now covered by scene-stored-tenant-policy.e2e.ts under playwright.living-scenes-stored-policy.config.ts: the isolated real BFF runs with header policy overrides off, rejects spoofed tenant_lotus public sharing with 403 denied_public_scope, records share_denied in tenant audit, and still allows tenant-internal. At that point, the keep/share gaps still included customer share-settings snippet/oEmbed copy UI, download-media integrity, non-crisis Lilith pre-share failure, and network-idempotent retry.

2026-06-24 supersession note: the scene-keep-and-share network-idempotent retry gap is now closed by the BFF share route and scene-viewer-deepening.spec.ts: a retry for the same artifact + channel at a later timestamp returns the existing active share with idempotentReplay: true and the tenant audit API still has exactly one share_created row for that artifact/channel. At that point, the keep/share gaps still included customer share-settings snippet/oEmbed copy UI, download-media integrity, and non-crisis Lilith pre-share failure.

2026-06-24 supersession note: the scene-keep-and-share non-crisis Lilith pre-share failure gap is now closed by the BFF share route and scene-password-and-grants.spec.ts. A kept artifact whose materialized segment trips the safety-frame check is rejected with 422 lilith_blocked, returns structured lilithReasons, creates no share id, and records a tenant-audit share_denied row with policyDisposition: "denied_lilith_pre_share". At that point, the keep/share gaps still included customer share-settings snippet/oEmbed copy UI and download-media integrity.

2026-06-24 supersession note: the prior download-media integrity gap is now closed for the shipped V1 renderer by the BFF grant-redemption route and scene-password-and-grants.spec.ts. POST /download-grants now returns the actual APNG materialization format instead of claiming MP4; redeeming /download-grants/<grantId>/media streams the same bytes signed into the share's C2PA manifest, exposes the visible-mark short code, reports audioWatermarkIntact: "not-applicable" for the silent renderer, and expires after the 900-second TTL. At that point, the remaining keep/share gap was the customer share-settings snippet/oEmbed copy UI.

2026-06-24 supersession note: the customer share-settings snippet/oEmbed copy gap is now closed by apps/oshun/web/src/app/scene/[id]/ShareSettingsPanel.tsx and living-scene-card.spec.ts. The browser journey opens the public viewer, asserts the literal 960×540 iframe snippet and oEmbed endpoint, clicks the iframe and oEmbed copy controls, verifies clipboard contents, fetches /scene/<shortCode>/oembed, and asserts the returned oEmbed HTML matches the copied iframe snippet. The journey remains partial until the persisted customer kept-artifact share/revoke management surface is fully shipped and browser-driven; the real lifecycle is currently proven through authenticated BFF requests plus the public viewer/browser branches.

1. Executive Summary#

Routes documented this pass: 8#

All 8 routes were written from source-reading (status: drafted, no live walk). Every one has real interactions; none is a render-only specimen. 5/8 already have a backing e2e spec; 3/8 (/operator/lms, /operator/personas, /personas) have no page-DOM spec and need one authored.

Dated finding: the /operator/lms, /operator/personas, and /personas page-DOM gaps are now closed by the 2026-06-23 supersession notes above and the reconciled route rows below.

2026-06-23 supersession note: the /operator/personas page-DOM gap is now resolved and deepened by operator-personas-console.spec.ts. The browser console reads the live BFF roster with persona-admin scope, covers auto-select and empty fail-soft states, drives a real browser submit-for-review transition to in-review with status/audit repaint and BFF read-back, verifies approve-for-release field rendering, and keeps a deterministic 409 inline-error branch. persona-lifecycle-bff.spec.ts remains the pure real-BFF lifecycle chain/scope/rollback companion.

Journeys by TRUE depth (52 total)#

Note: this dated section has been superseded by the 2026-06-23 notes above for /operator/lms and veritas-retraction-cascade-customer-view; use WALKTHROUGH/journeys/coverage.md for canonical current counts.

Over-claims (TRUE depth < claimed): 2#

• tenant-sso-config-saml-oidc-claim-mapping — claimed deep, TRUE partial
• offline-first-time-use — claimed deep, TRUE partial

Under-claims (TRUE depth > claimed): 5 (grade up the matrix)#

scene-public-viewer-anonymous (partial→deep), account-deletion-and-dsar (partial→deep), incident-triage (partial→deep), lilith-studio-tara-scene-publish (partial→deep), metis-byom-ingest-to-course (shallow→partial).

Walkthrough staleness drift (44 sampled)#

• customer: 16 sampled, 0 drift
• studio: 16 sampled, 1 high
• operator+workspace+shell: 12 sampled, 2 low

2. The 8 Routes#

3. Journey Re-grade (worst-first)#

Legend: ⚠ = over-claim (TRUE < claimed); ⬆ = under-claim (grade up).

4. Stale-Spec Risks (deduped — likely RED when run / silent-drift hazards)#

These are line-anchor drift, fixture-coupling, or stub/tautology hazards flagged across the journey specs. Ordered roughly by severity (skip/tautology first, then fixture-coupling, then line-anchor drift).

Test-skip / tautology / silent-degrade (highest):

1. veritas-evidence-trail.spec.ts:351-354 — step-9 Save→/library (the only deep candidate) is test.skip when data-veritas-article-actions count===0 ("veritas downstream offline"). Closed 2026-06-23: Playwright boots the BFF with OSHUN_VERITAS_ADAPTER=mock; Save→/library, Save toggle, and Report now assert the seeded grounded lead without conditional skips.
2. sophia-grounded-deepening.spec.ts — runs on VeritasRAG DEMO_RESPONSES['renewable'] (3s setTimeout canned reply, hard-coded IEA/BloombergNEF/IRENA citations, skipAxe): a tautology for the grounding pipeline — must not be read as covering grounding. Closed 2026-06-23 for the real-BFF grounded-WITH-citations requirement and extended 2026-06-24 for the real-BFF cautious/partial branch: sophia-answer-bff.spec.ts now asserts the live BFF cited branch and limited-support partial branch; sophia-grounded-answer-page.spec.ts renders both through /sophia, follows a normalized passage citation into the Nisaba reading frame, verifies the cited locator highlight/back restore leg, and verifies the grounded answer persists through real saved-items Library readback. The VeritasRAG spec remains intentionally scoped to canned citation drill-down and pin UI behavior.
3. citation-drift-resolution.spec.ts — steps 5-6 hash-chain + 16-field bundle assertions run only with a seeded Isis ledger; default e2e env skips them (test.skip). Closed 2026-06-23: Playwright now starts Next with a harness-only Isis fixture ledger, and the spec asserts clean, broken, unavailable, empty-tenant, and 16-field detail branches without skips.
4. account-deletion-dsar (profile-customer-data-deletion.spec.ts:105-171) — hand-builds the deletion-snapshot wire shape inline (receiptSignatureHex/auditKeyId/rowsRemoved); if state.ts:393 emitted shape changes, the mock silently diverges from production without failing. Closed 2026-06-26: the positive generated_artifact browser receipt now runs against the live BFF and Isis generated_outputs table; the inline snapshot remains only for the unattested tombstone negative-render guard.

Fixture-string coupling (medium — breaks many assertions on a fixture edit): 5. Closed 2026-06-25 — nisaba-notebook-capture-cite.spec.ts now runs through the authenticated shell without stubNisabaWorkspaceApi, waits for the live /v1/nisaba/passages/nisaba-passage-attention response, and asserts the live Dhammapada source/provenance trail instead of the removed "Practice Commentary Reader" fixture. A related 2026-06-25 closure removed stubNisabaWorkspaceApi from the Nisaba compare breakpoint leg in viewport-fit.spec.ts; it now opens /domains/nisaba?origin=explore&path=%2Fcompare through the authenticated shell, clears stale Nisaba offline snapshots only for that live route, waits for /v1/nisaba/passages/daily, and asserts the compare layout plus evidence/notebook inspector posture across audited breakpoints. A further 2026-06-25 closure removed the same fixture from shell-route-signoff.spec.ts; the shell signoff path now seeds and reads back a real /v1/nisaba/notebooks record, clears stale Nisaba offline snapshots, waits for live /v1/nisaba/passages/daily or /v1/nisaba/passages/:id hydration, and captures compare/passage signoff evidence from the authenticated shell. A further 2026-06-25 closure removed the fixture from redesigned-surface-breakpoints.spec.ts; it now seeds and reads back a real /v1/nisaba/notebooks record, clears stale Nisaba offline snapshots, and waits for live daily/detail BFF hydration while asserting compare, passage, and notebook split/stacked breakpoint posture through the authenticated Nisaba shell. A further 2026-06-25 closure removed the fixture from visual-regression-pages.spec.ts; the Nisaba passage, compare, notebook, evidence, note, mobile lineage, and mobile note snapshots now seed/read a real /v1/nisaba/notebooks record, clear stale offline snapshots, and wait for live daily/detail BFF hydration before capture. 6. atelier-image-to-library.spec.ts — pinned to exact atelier-depth.ts strings ("Specimen 047", "Seed - 0x4f2a - locked", "p.07"); ~10 render assertions break on any fixture wording change. Also internally inconsistent: line 8 calls "Cast twelve more" unwired, line 233 treats it wired. 7. veritas-retraction-cascade.spec.ts / veritas.tsx:1774-1937 — page content still pins the seeded Renata notice (38%/41%, "16 January", promise list), but the route now loads it through the authenticated BFF personal-letter endpoint and asserts a second reader receives 404/no letter. 8. veritas-to-nisaba-bridge.spec.ts — hard-codes CANONICAL_CLAIMS['claim-renewables-capacity'] text + source-iea; also pins URL fragments from buildHydratedWebDomainRoutePath (encoding-coupled). 9. tenant-audit-log-investigation.spec.ts — pins AUDIT_FIXTURE rows ("eli@oshun.app", "incident.acknowledge", "tenant:tenant-oxbow"; domain-stubs.ts:479-515) → fixture edit breaks 6 assertions. 10. incident-triage.spec.ts — pins "6 open · 1 critical" (line 140) + INC-2036..INC-2041 with fixed category→filter mapping (operator-depth.ts:280-326); also threshold desync: UI rationale floor 20 chars (line 292) vs BFF escalate/resolve floor 50 chars (445-465). 11. tenant-onboard.spec.ts / tenant-member-invite-scim.spec.ts — hard-code EXPECTED_KPI ('247'…'0.9% monthly churn') + row IDs L-00041..L-00048 (operator-depth.ts:127-193); high brittleness, low correctness-risk. 12. lilith-saraswati-persona-dossier-smoke.spec.ts:40-41 — pins data-required-field-count='17'; computed from editorState.validation, so adding/removing a required dossier field silently breaks it. Also persona-rehearsal-bff.spec.ts:219 seeds persona-zen-guide (404s if the workspace seed renames it). 13. Closed 2026-06-24 — arete-streak-recovery.spec.ts now clicks the primary recovery offer and Begin · 6 min through to the exact Tara sit URL, so the former loose href regex cannot mask a target/order change for the primary return path. 14. search-saved-and-recent.spec.ts:156,277 — hardcoded 2-item SEARCH_RESULTS; recent-row label "compassion in Nisaba" depends on client <query> in <domain> build; source==='recent' tag coupled to search-suggestions.ts. 15. metis-lesson-completion — tutor header "session 14 · 11 turns · saved to library" is a fixture string; no spec verifies a real library write (product gap masked by fixture).

Line-anchor drift (lower — selectors resolve, cited line numbers stale): 16. citation-drift-resolution.spec.ts header — cites operator.tsx:514/543-546/618-619 + operator-depth.ts:206-213 but selectors actually live in AdminInboxConsole.tsx:36/49/109; every file:line citation drifted. 17. first-time-visitor-deepening.spec.ts — pins MarketingLanding.tsx:244, WelcomeAuthPanel.tsx:828-831/862-919. 18. memory-edit-pause-forget specs — pin many ProfileMemoryControls.tsx anchors (:508/:525-550/:604/:641-669/:709/:719/:1127-1130); also localStorage key oshun-profile-memory-controls-v1 hardcoded (memory-state.ts:18) — a key bump silently breaks seeding. 19. nisaba-notebook-capture-cite.spec.ts — pins ~dozen NisabaSurface.tsx anchors (10302/10419/10433/10459/10484/5280-5281/12631-12670) in a ~13k-line component + NisabaCitationTrailPanel.tsx:577. 20. onboarding-deepening.spec.ts — pins OnboardingWizard.tsx (542-565/1170/1456/2168/307-380/901-913/1199/3557); button-label literals ("Get started"/"Continue") asserted by accessible name. 21. account-deletion-dsar.spec.ts — drifted anchors: grace-banner :553-577→:574, dsar-input :1223→:1240, button-text :1226→:1245. 22. sophia-grounded-deepening.spec.ts — line-number comments at GroundedAnswerEvidenceSidebar.tsx:153/187/263/264 + VeritasRAG.tsx:817/872; abstention assert coupled to answer-composer.ts copy. 23. nisaba-scholarly-read.spec.ts — pins scholar fixture strings ("Marcus Aurelius...IV.viii-xii", "4 witnesses · 6 editions · 11 translations", "Edition: Farquharson 1944"; nisaba.tsx:195-221); two different scholar surfaces (/nisaba/scholar vs data-nisaba-scholar-mode-toggle) — maintenance hazard. 24. pwa-lifecycle-deepening.spec.ts — PwaUpdatePrompt.tsx:250→267, PwaBootstrap.tsx:240-242→242. 25. multi-device-handoff-deepening.spec.ts — MultiPanelWorkspace.tsx:1300-1306→1402; hard-codes notebook slug nisaba-notebook-1 + tab=study-evidence. 26. nyx-tonight-observation.spec.ts — rooms.tsx:814-817→891-893, canon Link 1028-1058→1135-1136. 27. arete-streak-recovery.spec.ts — arete.tsx:341-345→ masthead :201, eyebrows :370/:423/:440. 28. Closed 2026-06-25 — tara-to-nisaba-handoff-destination.spec.ts now opens the live authenticated Nisaba destination without stubNisabaWorkspaceApi and asserts the real citation-trail panel/status/derivation step over the live passage. 29. assistant-handoff-deepening.spec.ts:64 — test NAME says outcome=success but body correctly asserts ...outcome='applied' (cosmetic title drift).

Stale doc-claim baked into a spec (will mislead a maintainer): 30. Closed 2026-06-24 — tenant-sso-config.spec.ts now consistently says /operator/sso renders the live ssoConnectionStore after real POST /v1/admin/sso seeds; the contradictory retired-SSO_FIXTURE wording is gone. 31. Closed 2026-06-23 — arete-living-offering-create.spec.ts and arete-living-offering-create.md now describe Save-draft/Send as wired through AreteOfferingActions and /v1/arete/offerings/keep; residual gaps are draft gallery read-back, crisis pre-screen, and C2PA/receipt. 32. Closed 2026-06-23 — arete-weekly-review.spec.ts and weekly-review-arete.md now describe Save-as-private-letter/Close-the-week as wired through AreteReviewClose and /v1/arete/review/close, with /arete read-back now asserted through /v1/arete/room; the data-backed margin suggestion reveal is also now covered in arete-weekly-review.spec.ts. Residual gaps are Sunday push, per-act completion, and richer plan-adjustment propagation. 33. Closed 2026-06-24 — the arete-streak-recovery session-completion → streak-engagement gap is now covered. A recovery-origin Tara sitting completion posts to /v1/tara/sittings/:id/complete, returns areteRecoveryEngagement, writes a member-scoped Tara recovery return Arete partial / done check-in, and reads it back through /v1/arete/room plus the /arete hub. 2026-06-29 update: /v1/arete/streak trigger-engine timing now proves the two-missed-window grace boundary vs third-missed-window recovery threshold. Durable session-start, browser-visible route/notification gating from that engine state, and crisis supersession remain open. 34. Closed 2026-06-26 — the arete-streak-recovery approved coach re-scope now reads the durable /v1/arete/coach/decision state into /arete/plan?intent=adjust and asserts the plan invitation plus next intention row carry the same offered action. 35. editorial-review-approval — operator-editorial-review-approval.spec.ts actually drives the INCIDENT decision panel (INC-2041, shared with incident-triage), NOT the editorial artifact lifecycle; the journey's substance is not what the spec drives.

5. Walkthrough Staleness Drift (high-severity first)#

6. Prioritized Closure Backlog (highest leverage first)#

A. Fix over-claimed matrix grades (de-fabricate; do first — cheapest, restores trust)#

1. pwa-update-flow → closed 2026-06-24 for stale-cache purge evidence; later 2026-06-24 coverage also closes reading-mode mid-passage scroll restore and the multi-tab controllerchange reload sequence; the cold-start no-prompt path and in-flight BFF write/read-back path are also now browser-driven; later coverage also drives the raw service-worker queue/replay substrate; 2026-06-26 coverage also renders the real queued service-worker write count in the update prompt and asserts pwa_update_applied / pwa_sync_queued telemetry. The current matrix is deep for this journey.
2. tenant-sso-config-saml-oidc-claim-mapping → regrade deep→partial; live callback transform semantics are now covered for lowercase + first-only, with callback failures for missing mapped email and JIT-disabled unknown users; BFF OIDC test-connection has both successful and fail-closed real-HTTP coverage; SAML/OIDC metadata import now has real-HTTP coverage; /operator/sso now persists metadata/discovery imports, all seven claim slots, and all four transform options through the live BFF; tenant-admin /identity now has real-infra browser coverage for anonymous gating, tenant-scoped SSO roster read-back, read-only sample identity-engine evidence, and axe. The remaining uncovered spine is tenant-admin import/upload controls, auth-policy edit panel, sandbox-probe UI verdicts, and enable state. The contradictory SSO_FIXTURE comment (#30) is closed.
3. offline-first-time-use → regrade deep→partial; the /healthz probe, deep-route fallback controls, local offline library edit, and raw service-worker queue/replay substrate now meet the browser bar. The auth/session network-only cache-denial transport and uncached deep-route document fall-through with service-worker fallback controls are now also real-SW covered. Search-result offline-save local persistence and visible sync feedback plus Tara reflection offline queue UI are now driven, and the profile Active devices refresh path shows the exact network-only denial copy; the Nisaba 24h cache window now has real-service-worker fresh/expired BFF response coverage plus component-level expired-cache workspace copy. The uncached Nisaba lexicon/morphology offline hint is now covered by nisaba-split-view against a live hydrated passage. Natural sync scheduling for those writes is still undriven.

B. New page-DOM specs for the 3 spec-less routes (this pass's direct gap)#

4. Closed 2026-06-23 — apps/oshun/web/e2e/operator-personas-console.spec.ts covers roster auto-select/detail, empty fail-soft, approve-for-release field rendering, 409 inline error/no optimistic mutation, and now a real browser submit-for-review success path with status/audit repaint and BFF read-back.
5. Closed 2026-06-23 — apps/oshun/web/e2e/operator-lms.spec.ts covers seeded roster + invalid-panel skip ordering, wrong-scope empty state, malformed-JSON client reject with no POST, real-BFF validate verdicts, and 503 failure copy.
6. Closed 2026-06-23 — apps/oshun/web/e2e/personas-picker.spec.ts now covers the /personas page DOM, real BFF blocked roster rendering, voice consent unlock, select→active persistence, reload read-back, clear persistence, and deterministic 401/500 UI failure branches.
7. Reconciled apps/oshun/web/e2e/notifications-route.spec.ts: the route now has direct deep coverage plus live BFF write persistence, retry recovery, and normalized browser telemetry for open/filter/reset/read/dismiss/mark-all interactions. A follow-up update added BFF cursor-backed load-more coverage for 50+ notification feeds. Remaining route question is first-class nav intent.

C. Walkthrough doc fixes (drift)#

8. Closed 2026-06-23 — studio-neith-inverse-modeling.md now matches the current JSON-payload form workspace, and studio-neith-inverse-modeling.spec.ts covers the live lane.
9. Fix operator-admin.md line citation (operator.tsx:657 → AdminInboxConsole.tsx:140).
10. Fix operator-overview.md LOperatorBar product value (Lilith → OSHUN, page.tsx:27).

D. Spec de-fabrication / stale-comment fixes (RED-when-run + misleading)#

11. Reconcile scene-public-viewer-anonymous doc Uncovered list — it undersells coverage (reduced-motion + tenant-auth ARE driven) — and grade matrix partial→deep.
12. Reconcile lilith-studio-tara-scene-publish (partial→deep), account-deletion-and-dsar (partial→deep), incident-triage (partial→deep), metis-byom-ingest-to-course (shallow→partial) matrix grades.
13. Closed 2026-06-23 — deleted/reconciled the false "unwired / DO NOT click" claims in the Arete living-offering and weekly-review specs and journey docs; both now point at the wired AreteOfferingActions / AreteReviewClose BFF paths.
14. Closed 2026-06-24 — updated telegram-bot-assistant-delivery evidence: voice STT is documented as real fail-closed (resolveSttVoiceProvider, "could not transcribe"), and the focused real-BFF spec now also proves the route-level 13th-message rate-limit trigger instead of leaving it as unit-only.
15. Closed 2026-06-24 — wired the Telegram webhook response audit envelope into the BFF admin audit-events sink and proved the real local Postgres-backed admin_audit_event row from telegram-webhook-delivery. The remaining Telegram gaps are outbound delivery/TTS-back and external STT credentials. The grounder throw paths were closed on 2026-06-26 as fail-closed abstention coverage instead of 500 behavior.
16. Closed 2026-06-24 — updated user-flag-to-review docs and browser E2E evidence for the shipped TrustSafetyFlagButton + POST /v1/user-reports path; the focused spec now reads the real admin moderation workspace back and asserts the submitted live cust-ur-* report is queued.
17. Closed 2026-06-26 — extended the user-flag-to-review origin coverage to the Metis lesson and Metis tutor headers. The focused browser spec now asserts both Metis report buttons expose stable target kind/id/label metadata and open the shared category/rationale dialog; the full live submit → moderation read-back path remains covered by the Nisaba flag in the same spec.

E. Convert test.skip/tautology coverage into real assertions#

16. veritas-evidence-trail — save/report skip closed 2026-06-23: Playwright seeds the Veritas adapter through the BFF, and the browser specs now fail if the grounded-lead action row is absent. Browser no-lead render partially closed 2026-06-23: veritas-full-journey drives a live BFF non-Veritas-scope denial through the /veritas RSC fallback and asserts the honest empty state plus no Save/Report actions. Claim/source drill closed 2026-06-23: veritas-evidence-trail now clicks an underlined claim, asserts the rail changes, clicks the claims table back to the peak claim, and follows the selected Statnett source row to /veritas/source/statnett-operator-data. Source-id profile routing closed 2026-06-23: the spec also renders /veritas/source/nve-regulator-note and asserts its non-default source profile. Browser downstream-503 leg closed 2026-06-23: veritas-home-outage boots a real outage-mode BFF and asserts the /veritas no-lead browser render after a live 503.
17. sophia-grounded-answer — BFF/page grounded-WITH-citations gap closed 2026-06-23; cautious/partial branch added 2026-06-24: sophia-answer-bff.spec.ts drives the live BFF in-process Nisaba corpus to groundingState='grounded', groundingState='partial', stable-ID citations, retrieved claims, and citation-map invariants, while sophia-grounded-answer-page.spec.ts renders both cited states through /sophia, including a normalized passage-citation handoff into Nisaba, cited-locator highlighting/back-nav restoration, and real saved-items Library readback for the grounded answer; it also submits a typed /search query to live /v1/search and verifies grounded preview evidence context. Remaining work: contradiction loop UI, synthetic/retracted/cross-tenant failure modes, and labels beyond the current extractive retrieved path.
18. citation-drift-resolution — seeded-ledger skip closed 2026-06-23: steps 5-6 hash-chain assertions execute under the harness fixture ledger, and the BROKEN-ledger fixture asserts data-verification-ok='false'. Remaining work: wire recheck/re-render/retract actions and audit-log chain.

F. Highest-value uncovered journey legs (real product/coverage gaps)#

19. Closed 2026-06-24 for the message-center replay seam — messages-quiet-hours-and-channel-binding now proves delayed quiet-hours dispatch replays via /v1/admin/customer-messages/replay-due after the window closes and writes queued → sent → delivered receipts. 2026-06-26 update: the local message-center dispatch seam also now proves active crisis-frame suppression for non-essential messages and safety-critical incident bypass, including a delayed quiet-hours replay that remains held with dispatch.suppressed.crisis_frame if a crisis frame activates before the replay boundary runs. 2026-06-29 update: the shipped notifications-preferences BFF matrix now covers all launch domains × persisted modalities × category kinds via PATCH→GET read-back. Remaining gaps are external Telegram/WhatsApp/email/SMS provider handoff beyond that receipt seam, provider-level category binding for those real channels, Lilith tone-band persona-policy, and real OTP/magic-link ownership flows.
20. Closed 2026-06-24 for different-device verify-link semantics — first-time-anonymous-visitor now opens the real Mailpit verification link in a fresh browser context with no auth cookies, confirms the single-use BFF token through the same-origin verify-email proxy, lands in /onboarding?redirect=/tara, and proves the new device receives HttpOnly oshun-session and oshun-access cookies plus a verified /api/auth/session.
21. account-deletion-and-dsar — finish the residual deletion edges: full six-service fan-out with service-specific @oshun/audit-platform attestations and deletion identity-verification email-link round-trip. 2026-06-25 update: local-dev Isis generated_artifact completion is now covered by data-rights-dsar-bff: the spec migrates the Isis DB, seeds generated_outputs, runs immediate category-select deletion over the live Redis-backed BFF fan-out, verifies a signed erased receipt with rowsRemoved=1, and confirms the row is hard-deleted. A real Redis voice_profile signed receipt also renders from live BFF data. 2026-06-26 update: the /profile?path=data-rights browser flow now covers the generated_artifact Isis path too, including the signed UI receipt and post-erasure row-count check.
22. nyx-tonight-observation / nyx-event-calendar-sync-reminder — observation persistence closed 2026-06-23 and BFF read-back deepened 2026-06-24: NewObservationForm now writes local-first, carries the eventId back-reference, posts to /v1/nyx/observations, and reloads from the BFF after local Nyx storage is cleared. 2026-06-24 update: the Home footing "Sky observations" KPI now counts the newly saved current-week row and routes back to /domains/nyx/observation-log. Later 2026-06-24 update: event-detail Nisaba/Veritas/Tara/Metis cross-domain card target click-throughs now land on hydrated shell destinations. Later 2026-06-24 update: event-calendar direct-route close now replaces to /domains/nyx?origin=explore, and hydrated-shell close removes only path while preserving origin and stack.
23. arete-create-habit — browser wizard→BFF and polished /arete read-back closed 2026-06-23; first check-in same-browser continuity closed 2026-06-23: the Cue/Routine/Reward wizard POSTs /v1/arete/habits, stores the returned BFF id locally, renders the dashboard row, POSTs the first check-in to /v1/arete/habits/:habitId/check-in, and /arete reads Done-today / 1-day streak / 1 / 7 back through /v1/arete/room; Home reads the local continuity store as 1d streak • done today. 2026-06-24 update: a second browser context now reads the checked-in habit back from /v1/arete/room with no Arete localStorage, and the wizard's selected identity is asserted in the real create request, persisted locally, and read back in IdentityPanel; a later pass asserts the live Home HomeFootingSummaryStrip practice-streak metric adds the pending same-day local Arete check-in. A later pass wires /arete/streak to the live /v1/arete/streak rollup and asserts both the fresh-member 0 days state and the first-check-in 1 day state with the padded 42-cell heatmap.
24. Partially closed 2026-06-24 — public-scene-abuse-report artifact-side takedown cascade is now proven against the real local BFF by scene-password-and-grants: a tenant operator cascades an originating-user-account-deletion takedown across two public share links, both public viewers tombstone, embeds deny as revoked, an existing download grant returns 410, and tenant audit records takedown_cascaded. Remaining work for this item is the public-report operator-detail UI connection, ≥50-char rationale modal UX, actor-side consequence branch, brigade clustering, and signed-in reporter status surface.

G. Line-anchor hygiene (batch, lowest leverage)#

25. Refresh drifted file:line citations across specs in §4 items 16-29 (selectors resolve; comments mislead). Prefer attribute selectors over line anchors; remove pinned line-number comments in long components (NisabaSurface ~13k lines especially).