frontend-patterns/research/reviews/ZulipNavigationSourceStudy.md

Zulip navigation/search source contrast — 2026-09-27

LEARN-0014; Codex author-model review. Protocol committed as f3ac569 before source inspection. Stream B, group B-independent-navigation-source-v1. Static source evidence only: no application build, browser run, upstream test execution or inference call.

Pinned Zulip revision 5b06fa3d34f28fa01f459fbf3ba053e3c0858e9c, deliberately reused from the earlier recovery review, not claimed latest. Source manifest records twelve files, raw SHA256 and reviewed line ranges. This is one independently developed application family, already known to this research through different paths; it is not twelve independent uses or an independent review of our conclusions.

Located claims

Claim	Exact pinned locators	Observed code	Interpretation / limit
ZN01	hash reconstruction, history metadata, save guard	Hash terms select a message view; history state supplies message pointer/offset. Saving selection checks URL/filter agreement first.	Addressability and within-session continuation are separate contracts; these paths require the client. No no-script or direct-load runtime claim.
ZN02	fetch continuation, selection guard, current-list lifecycle	Main narrow-fetch continuation returns when its captured message list is no longer current; selected-message rendering also checks list identity.	Partial support for protecting current selection/hash effects without requiring a global navigation counter. Not a proof for all callbacks.
ZN03	success routing, processing, preserved view policy, list updates	For a noncurrent, nonpreserved list, success switches to data-only processing instead of discarding the response. Preserved combined-feed views are an explicit exception. Other message/sidebar processing still occurs.	Leaving a view does not make its data useless. Cache/data applicability differs from permission to affect active navigation. Not a claim that inactive results have zero UI effects.
ZN04	error and connection feedback	Success and HTTP 400 close shared connection feedback before the noncurrent-list error guard. Errors for noncurrent, non-combined lists return before further processing/retry; other errors have backoff/retry handling.	Feedback has scopes too. Global connection evidence and view-specific errors are different; helper internals and runtime correctness were not audited.
ZN05	query dispatch, suggestion callback, suggestion construction, IME/Enter handling	Committed search passes parsed terms to an injected callback and blurs search; the inspected suggestion provider synchronously returns a list. Enter/IME handling distinguishes composing or selecting a suggestion from submitting search.	Do not treat every keystroke as a remote query race. Callback wiring and all imported suggestion-helper internals are outside this twelve-file slice.
ZN06	search continuation, close focused search, editing focus restore	Search entry focuses search; exit may keep a narrow, redirect or focus the app. Editing focus capture records message/selection; restoration checks selected-message identity, then schedules focus work.	Non-modal task continuation differs from return to a modal invoker. A pre-timeout identity check is not proof of completion-time focus ownership or AT behavior.
ZN07	target-message lookup, anchor navigation	An auxiliary target lookup re-enters show from success/error callbacks. The anchor fetch continuation creates/uses the then-current list through a closure. These branches have no visible captured-current-list guard like ZN02.	Concrete unverified paths prevent a whole-app ownership guarantee. No reproduced race, exploit or vendor bug claim; unseen transport/caller behavior may constrain execution.
ZN08	preserved-list reuse, filter source, inspected upstream test	A preserved combined-feed list may be reused; narrow state derives from the current view. The inspected test covers date-anchor parameter handling.	List identity is not equivalent to a monotonically increasing navigation generation. This test file supplies no executed or inspected competing-navigation coverage; the rest of the suite was not reviewed.

Bounded trace and counterexample to overgeneralization

The hash path parses route terms and calls message_view.show. That function constructs or restores a list, updates the hash when required and makes the list current. A needed message fetch captures that list. When it completes, data/fetch state can still be processed, while the main view continuation checks current-list identity before changing selected-view state. See ZN01–ZN03. This is a trace across located functions, not a running-session observation. Search dispatch itself is located, but the initializer that supplies its injected navigation callback was not included; do not infer its complete wiring from the naming alone.

The meaningful contrast is applicability per effect:

Effect	Located decision / remaining uncertainty
Populate cached message data	Can remain useful after leaving a view; cache consistency/retention internals not audited
Update a preserved rendered list	Explicit conditional combined-feed exception; not a universal discard rule
Change selected view/hash/message position	Main continuation and selection paths check current list identity
Update shared connection feedback	Some updates precede view-specific error applicability checks
Move input focus	Search-task policy and editing selection context are distinct; timer completion still untested

Our earlier generation guard is one implementation of a selected-view policy. It must not become a requirement to drop an entire response or every side effect whenever a newer navigation exists. Nor does Zulip's list identity establish that all effects are safe: ZN07 and deferred focus in ZN06 are explicit limits requiring additional evidence. A preserved object can become current again; object identity and latest-intent generation encode different policies. Freshness, authorization and data consistency are not proven by either identity mechanism.

Pattern disposition: revision without promotion

Revise URL-addressable State to make client-fragment reconstruction an explicit option, with its required client/runtime contract, separate from server-visible path/query resolution. Hash-based addressability does not establish progressive enhancement.

Refine Progressive Enhancement's asynchronous-navigation obligation to decide result applicability per effect: cache data, current selection, global versus local feedback, and focus. Zulip is a static implementation contrast for that obligation, not a verified no-script application or a full known use of Progressive Enhancement. Focus Return gains only a non-modal scope contrast, not an additional complete modal use.

This is one consequential revision, with corroborating identity guards and limiting branches recorded together. CAND-0009/0010/0016 remain draft/hypothesis; independent full-contract use counts stay unassessed. Independent implementation provenance is stronger than another authored fixture variant, but the review remains author-model. No new canonical identity, relation, pattern, M1/M2 acceptance or usefulness finding.

Scope closure and follow-up

The twelve-file cap is reached; no further callees were fetched. Files were inspected at the manifest's ranges, not exhaustively audited. The raw GitHub URLs supplied the source after the browsing tool could not open the commit page; retrieval hashes are preserved. No upstream code or frozen evaluation artifact changed. A source test was read, not executed. The earlier htmx fixture remains paused.

Effort receipt records active source work versus repository-check execution, with final administration excluded and token/cost unknown. This source-review protocol is a separate comparison group; four distinct prospective protocols still do not provide a diminishing-returns window. Full language usefulness and independent human/AT review remain unresolved.

WP-0003 T01 follow-up: before trusting ZN07 or delayed focus, preregister a narrowly scoped upstream call-path/test study of the target lookup and anchor continuation; include callback wiring/transport context, preserve negative findings, and do not report a bug until reproduced or otherwise established. Broader evidence collection can proceed without expanding our local adapter. T02 retains independent review and the offline case branch. WP-0006 T03 retains comparable-window/review-date work.