QA had no net for navigation. Pass C already mandated "from every screen confirm
there's always a way out", and C-NAV-004 still shipped: the pack library drew no
app bar and no bottom bar, stranding the user on the system Back gesture. A human
walking ~50 routes misses one.
A dead end is statically provable, so it should not be hunted by eye. The shell
draws chrome from two hand-kept sets — topLevelRoutes (bottom bar) and
shellBackRoutes (app bar + back). A route in neither, whose screen also draws no
back of its own, has no exit by construction. nav-scan.sh cross-references both
sets against each route's screen composable and reports those as CRITICAL,
exiting 1 so it can gate. It follows the existing scanner family (theme-scan,
painter-xml-scan, wiring-scan) and is wired into Pass C as a pre-check, run
before the manual sweep like the theme scan.
Proven both ways rather than assumed: it flags QUESTION_PACKS when the fix is
reverted, and reports 0 with the fix in place. Scanning the whole route table
found no other dead ends. Excludes the entry flow (C-NAV-001: back out of Home
must not resurface onboarding) and two self-contained flows whose own CTAs are
the exit (PAIR_PROMPT, RECOVERY).
Also records the durable substance where it belongs:
- ERM landmine C-NAV-004 — the exact inverse of C-NAV-003 (wrongly *added* to
shellBackRoutes = double app bar; wrongly *omitted* = no bar at all). The two
failure modes point in opposite directions, so there is no safe default; the
scanner is the guard.
- Future.md — the Tier 3 screenshot-diff idea is no longer hypothetical. Five
visual defects surfaced in one day (star glyph fallback, "Chat Bubble Outline"
chip leak, mid-word truncation, double back arrow, hard-edged art) and every
one was caught only by a human reading a screenshot. They share a shape: the
UI stays renderable and shows the wrong thing, so compile/unit/theme-scan all
stay green. That is the class the tooling is structurally blind to.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
7700c84e4d