Web-UX Health

RATCHET COMPLETE · 90/90

A real crawler (scripts/webux-scan.mjs) sweeps every reachable control on the live web (:8090) and dev-admin (:8091) surfaces and runs two objective checks per control — [A] link/action integrity (no dead / self / 404 targets; React handler wiring verified from the DOM) and [B] paint integrity (contrast ≥ 4.5:1, not UA-default chrome).

Last scan: 2026-06-08 17:30

COVERAGE — controls under test ÷ discovered

95.7%

8158 / 8526 controls

SCORE — pass both [A]+[B] ÷ under test

99.8%

8142 / 8158 pass

Whole-System Confidence — can we TRUST the product?

Whole-site E2EPASS

11/11 passed

gate/login/event/marketing (HTTPS)

AuthorizationPASS

5 personas · 0 isolation leaks · 0 authority bypasses

ResiliencePASS

12/14 graceful · dep-outage graceful

missing-event:400, unauth-api:400

Data integrityPASS

golden 3/3 consistent (engine == UI)

1 clarity finding(s)

Backend loadclean

12 authed routes profiled (client round-trips)

Authorization = role separation + tenant isolation (real sessions); Resilience = adversarial-input survival (no 5xx/leak) + dependency-outage chaos; Data integrity = live readiness == the engine's golden truth; Backend load = client round-trips per authed screen. Findings are reported, never auto-"fixed" (security / data-integrity issues especially).

RATCHET ladder — paired gates, climb then STOP

60/60✓ cleared

70/70✓ cleared

80/80✓ cleared

90/90✓ cleared

All four gates cleared — RATCHET stopped at 90/90.

By surface

Surface	Routes crawled	Under test	Pass both	Surface score
web	78	3436	3436	100%
dev-admin	83	1436	1427	99.4%
core-flows	67	3286	3279	99.8%

Authed core flows (/event/*, /m/*) require a seeded Supabase session and are an honest pending bucket — never faked into the denominator.

Open control failures · 16

Low contrast (< 4.5:1 WCAG AA)13
Dead button (no handler wired)3

Content integrity clean

Mojibake (encoding garbage): 0 node(s) on 0 page(s)

Off-domain emails: 0 of 5 found

Mojibake = UTF-8 mis-decoded as Windows-1252 (e.g. an em-dash showing as â€”); run node scripts/fix-mojibake.mjs --fix to repair source. Off-domain = an address not on our domains (createrz.com / uploz.*).

Trend — coverage & score per scan round

When	Coverage	Score	Gate
2026-06-05 02:49	95.4%	99.7%	90/90
2026-06-05 03:05	95.4%	99.7%	90/90
2026-06-05 03:22	95.4%	99.8%	90/90
2026-06-05 03:25	95.4%	99.8%	90/90
2026-06-05 04:33	95.4%	99.8%	90/90
2026-06-08 17:28	95.4%	99.8%	90/90
2026-06-08 17:30	95.7%	99.8%	90/90