feat(questionnaires): F9.1 production hardening — concurrency smoke + flag matrix

[JohnD-EE]

Summary

F9.1 is the final hardening pass of P9 — the pre-ship verification gate before ConQuest is demo-grade and fork-ready. It adds no new runtime capability. Its job is to prove what P0–P8 built:

• 20+ concurrent respondent sessions don't deadlock, orphan turns, or drop audit writes
• the eleven feature flags gate exactly the surfaces they claim and nothing else
• the full respondent happy path still composes end-to-end

Scope is held strictly to the plan's four indicative tasks (concurrency smoke, flag inventory, per-flag verification, happy-path pass). Gaps surfaced during exploration are documented as follow-ups, not built.

What's in here

• Concurrency + happy-path smoke — scripts/smoke/concurrent-sessions.ts (npm run smoke:concurrent-sessions). Seeds one launched anonymous-mode version, creates 24 sessions concurrently, runs 4 turns each through the live persistence seams (createAnonymousSession → persistTurn → markSessionCompleted) against the real DB, and asserts: no rejected promise / deadlock (40P01); contiguous per-session ordinals (no orphan/dropped turns); every answered slot back-stamped with a real turn id; exactly one created + one completed audit event per session. --single runs the verbose happy path plus an F8.2 results-export read. Idempotent; cleanup cascades the whole graph. LLM is stubbed by construction — the smoke feeds persistTurn the extraction intents the orchestrator would emit, so there's no provider to mock.

• Feature-flag inventory doc — .context/app/questionnaire/feature-flags.md. The authoritative master + 10 sub-flag matrix: each flag's feature_flag name, resolver, required parents, gated surface, and off-behaviour. Names the two design rules (disabled surface 404s not 401s; a sub-flag requires its parents) and the three off-behaviour shapes (route-404 / degrade / behaviour-inside-route). Flags are DB rows, not env vars.

• Per-sub-flag verification suite — tests/unit/lib/app/questionnaire/feature-flag.test.ts, extended from master-only to all eleven resolvers. Data-driven truth tables, sub-flag independence (one off suppresses only its own surface), the live-sessions cascade (parent off closes the voice/attachment/cost-cap trio), the master transitive close, and the ensure*/with* gate contracts. 61 tests, green.

• Tracker + wiring — .context/app/planning/features/f9.1.md, plan + namespace README updates.

Out of scope (documented follow-ups)

Deliberately deferred to keep F9.1 a clean verification gate:

• IP-keyed rate limit on anonymous session creation
• Data retention / purge of completed sessions, turns, answer slots
• Per-version / per-admin spend cap (only per-session costBudgetUsd exists today)

Verification

• npm run smoke:concurrent-sessions — 24 sessions · 96 turns · invariants reconciled; idempotent
• npm run smoke:concurrent-sessions -- --single — completed session + non-empty results export
• npx vitest run tests/unit/lib/app/questionnaire/feature-flag.test.ts — 61 pass
• npm run validate clean; type-check passed in pre-push

CHANGELOG

No entry — app-owned smoke/test/docs only, no Sunrise platform surface (platform-scoped CHANGELOG policy).

🤖 Generated with Claude Code