Runtime verification (plan row 8, branch fix/verification-round-findings) — logged in as verify1@styx.test from an IP with no region (localhost proxy, fail-closed):
Observed: dashboard renders fully (integrity score, TRUTH LOG, empty contracts); 3× console 403 on /api/contracts (JURISDICTION_BLOCKED). The contracts section shows the empty state ('Your recovery journey starts here') — NOT the jurisdiction notice, and NOT the reachability line.
Root cause:
- The geofence guard is only on /contracts (also fitbit/pay/proofs). Wallet endpoints are NOT guarded.
- The dashboard fetches: getBalance(/wallet/balance, not guarded), getHistory(/wallet/history, not guarded), getUserContracts(/contracts, guarded, but
page.tsx:58 wraps it in .catch(() => [])), getStreakChain (also caught).
- E2 (0a9e3d1) made the jurisdiction notice a FULL-PAGE error state fed by the non-caught fetches (getBalance/getHistory). Since neither is geofenced, the notice can only render if a non-swallowed request throws JURISDICTION_BLOCKED — which never happens.
So E2's 'no backend service is reachable on 403' fix is correct but unobservable in the dashboard; the plan's 'contracts section shows the jurisdiction notice' is not delivered.
Options:
- Guard the wallet balance/history endpoints (consistent fail-closed) so the full-page notice becomes reachable.
- Surface the swallowed contracts 403 as an in-section jurisdiction notice instead of silent empty.
- Accept empty-as-design and update the plan's row-8 expectation.
Note: the reachability-line behavior was verified at the API envelope level (403 JURISDICTION_BLOCKED carries error_code/message/trace_id, no stack).
Runtime verification (plan row 8, branch
fix/verification-round-findings) — logged in as verify1@styx.test from an IP with no region (localhost proxy, fail-closed):Observed: dashboard renders fully (integrity score, TRUTH LOG, empty contracts); 3× console 403 on /api/contracts (JURISDICTION_BLOCKED). The contracts section shows the empty state ('Your recovery journey starts here') — NOT the jurisdiction notice, and NOT the reachability line.
Root cause:
page.tsx:58wraps it in.catch(() => [])), getStreakChain (also caught).So E2's 'no backend service is reachable on 403' fix is correct but unobservable in the dashboard; the plan's 'contracts section shows the jurisdiction notice' is not delivered.
Options:
Note: the reachability-line behavior was verified at the API envelope level (403 JURISDICTION_BLOCKED carries error_code/message/trace_id, no stack).