# guest-session-webkit

_Witnessed 2026-09-05T16:11:58.361Z — QRATE-UAT-1_

**Who:** one diner, alone, on an **iPhone 14 Pro** descriptor driven on the **webkit** engine.

**Where:** the Canary Mosaic fixture, table 9994 — a test table, so nobody's real meal is touched.

_This walk is deliberately ORDINARY. Nothing a person does here is unusual. The point is that the visible journey succeeds on both engines, and the last step is the only place they differ — which is exactly why no screenshot-based check would ever catch it._

### 01 · PATRON

**I expected:** I scan the code at my table and a menu appears

**I saw:** the app asked me welcome card and dietary question, then showed me 11 dishes I could add. It reads: M M2BS Chef 24194822 M M2BS Boost 24194822 Drinks Starters Mains Desserts Beverages 1 dish C Canary Iced Tea Canary base

### 02 · PATRON

**I expected:** I add something to my order

**I saw:** the dish went into my order

### 03 · PATRON

**I expected:** I open my order and send it to the kitchen

**I saw:** I placed the order. The screen reads: M M2BS Chef 24194822 M M2BS Boost 24194822 Drinks Starters Mains Desserts Beverages 1 dish C Canary Iced Tea Canary baseline beverage — DO N

> **Cookies the app is holding:** **none at all**

> **Session calls the server refused:** 401 POST /auth/guest/attach-session · 401 POST /diner/session/snapshot

### 04 · PATRON

**I expected:** the app has actually identified me to the restaurant

**I saw:** STOPPED — the restaurant never learned who I am — 401 POST /auth/guest/attach-session; 401 POST /diner/session/snapshot (cookies held: none)

---

**Every session call this walk saw, in order:**

```
200 POST /auth/guest/bootstrap
200 GET /diner/session/current
401 POST /auth/guest/attach-session
401 POST /diner/session/snapshot
401 POST /diner/session/snapshot
401 POST /diner/session/snapshot
401 POST /diner/session/snapshot
401 POST /diner/session/snapshot
401 POST /diner/session/snapshot
```

---

**Verdict:** STOPPED

**Why it ended here:** the restaurant never learned who I am — 401 POST /auth/guest/attach-session; 401 POST /diner/session/snapshot (cookies held: none)