QA had no net for navigation. Pass C already mandated "from every screen confirm
there's always a way out", and C-NAV-004 still shipped: the pack library drew no
app bar and no bottom bar, stranding the user on the system Back gesture. A human
walking ~50 routes misses one.
A dead end is statically provable, so it should not be hunted by eye. The shell
draws chrome from two hand-kept sets — topLevelRoutes (bottom bar) and
shellBackRoutes (app bar + back). A route in neither, whose screen also draws no
back of its own, has no exit by construction. nav-scan.sh cross-references both
sets against each route's screen composable and reports those as CRITICAL,
exiting 1 so it can gate. It follows the existing scanner family (theme-scan,
painter-xml-scan, wiring-scan) and is wired into Pass C as a pre-check, run
before the manual sweep like the theme scan.
Proven both ways rather than assumed: it flags QUESTION_PACKS when the fix is
reverted, and reports 0 with the fix in place. Scanning the whole route table
found no other dead ends. Excludes the entry flow (C-NAV-001: back out of Home
must not resurface onboarding) and two self-contained flows whose own CTAs are
the exit (PAIR_PROMPT, RECOVERY).
Also records the durable substance where it belongs:
- ERM landmine C-NAV-004 — the exact inverse of C-NAV-003 (wrongly *added* to
shellBackRoutes = double app bar; wrongly *omitted* = no bar at all). The two
failure modes point in opposite directions, so there is no safe default; the
scanner is the guard.
- Future.md — the Tier 3 screenshot-diff idea is no longer hypothetical. Five
visual defects surfaced in one day (star glyph fallback, "Chat Bubble Outline"
chip leak, mid-word truncation, double back arrow, hard-edged art) and every
one was caught only by a human reading a screenshot. They share a shape: the
UI stays renderable and shows the wrong thing, so compile/unit/theme-scan all
stay green. That is the class the tooling is structurally blind to.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- scripts/git-hooks/pre-push: the fixed hook (dirty-tree guards kept; the
self-defeating 'unpushed commits' blocker replaced with a behind-remote
fail-fast + an informational listing of what a push will publish). Hooks
don't sync on clone, so scripts/install-git-hooks.sh installs them; verified
idempotent against the live .git/hooks copy.
- Future.md: scheduledOutcomesReminder .limit(200) no-pagination scaling cap
recorded with the fix pattern (assignDailyQuestion's page loop); npm-audit
entry re-verified 2026-07-11 (still 9 moderate, transitive; no lockfile churn).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
null