docs: record approved website redesign plan

tasks/baseline-2026-09-24.md

@@ -0,0 +1,44 @@
+# Bundle 0 flow, accessibility and performance baseline
+
+Captured 2026-09-24 with the current Next.js 15 frontend, Playwright Chromium, and local production build. Viewports: 320×800, 390×844, 768×900 and 1440×900 CSS pixels. The backend at `127.0.0.1:8000` was not running for this initial capture; a backend-backed replay followed on 2026-09-25 below. Screenshots in [`evidence/2026-09-24/`](evidence/2026-09-24/) are full-page browser captures, not design comps.
+
+## Route and state map
+
+| Journey | Current route/transition | States to preserve and replay |
+| --- | --- | --- |
+| Visitor/association | `/` → `/about`, `/events`, `/blog` | Home/About render and responsive shell; external contact links |
+| Auth | `/auth` mobile lookup → existing user password or OTP login; new user OTP → registration details → profile/return; `/auth/google/callback`; `/verify-email/[token]`; `/reset-password` → `/reset-password/[token]`; `/logout` | Invalid mobile, expired/incorrect OTP, resend cooldown, duplicate submit, Google failure, expired reset, protected redirect |
+| Event | `/events` search/filter → `/events/[slug]` → free registration `/events/[slug]/success` or paid gateway → `/payments/result` | Open, full, closed, already registered, ineligible, invalid coupon, payment pending/success/failure/canceled, callback replay |
+| Blog | `/blog` banners/search/category/tag/author → `/blog/[slug]` | Empty/failure, long article, media fallback, comments/interactions and share |
+| Staff | `/admin` → dashboard, events, users, taxonomy, coupons, authorizations, blog editor/review/assets | Anonymous redirect, role denial, save conflict, validation, successful edit/publish, mobile table/form navigation |
+
+## Browser evidence
+
+| Page | Captures | Observed behavior |
+| --- | --- | --- |
+| Home | `home-320.png`, `home-390.png`, `home-768.png`, `home-1440.png` | Loads with current identity/CTA. At 390px the fixed mobile navigation overlays the first offering card while scrolling; record for later shell work. |
+| About | `about-320.png`, `about-390.png`, `about-768.png`, `about-1440.png` | Loads with static statistics, affiliations and contacts. The long page contains no `<main>` landmark. |
+| Auth | `auth-390.png` | Mobile entry screen loads. OTP/login success requires a working auth backend and test account. |
+| Events | `events-390.png` | Listing displays `رویدادی یافت نشد` when its API request fails, which looks like a real empty catalog. Browser console has `ERR_CONNECTION_REFUSED` to `127.0.0.1:8000/api/events/`. Registration states cannot be replayed from this environment. |
+| Blog | `blog-390.png` | Listing shell loads; API requests fail and a mock banner is visible. Post navigation and interactions need backend fixtures. |
+| Staff | `admin-390.png` | Anonymous `/admin` redirects to `/`. Authorized staff walkthrough requires a test account. |
+
+Screenshots were inspected for page identity and nonblank content. The route screenshots listed above are the accepted current-site baseline; screenshots of rejected concept drafts are not part of that baseline.
+
+## Measured baseline
+
+`npm run build` passed on 2026-09-24. Its First Load JS report (production build, compressed route estimate): shared **102 kB**, Home **107 kB**, About **103 kB**, Auth **163 kB**, Events listing **124 kB**, Event detail **469 kB**, Blog listing **141 kB**, Blog detail **469 kB**, Admin dashboard **302 kB**, Admin event editor **727 kB**, Payment result **613 kB**. The build emitted existing `no-img-element` warnings and an ESLint plugin detection warning; it also logged API connection refusal during static page generation.
+
+`npm run lint` exited successfully with 14 existing `no-img-element` warnings and no errors. A focused backend baseline command, `.venv/Scripts/python.exe manage.py test apps.users.tests apps.events.tests apps.payments.tests --settings=config.settings.test`, was started and stopped after repeated failures reaching the notification store at `127.0.0.1:6379`. Docker Desktop's engine was unavailable, so Redis could not be started locally. This test run has **no passing-suite result**; rerun it with an isolated Redis service for the flow gate.
+
+At 390px in one local Chromium production run, Home navigation duration was **554 ms** and first contentful paint **424 ms**; About was **173 ms** and **204 ms**. These are local machine observations, not network performance targets or p75 Web Vitals. Both pages had one `<h1>`, no horizontal overflow, and zero `<img>` elements missing an `alt` attribute. Home had one `<main>` landmark; About had none. The desktop and 320px screenshots establish layout comparison points. No automated WCAG score is claimed; a full axe/keyboard/screen-reader audit remains part of the release gate.
+
+## Manual replay status and next gate
+
+At the initial capture, completed: Home/About rendering at four widths; auth entry; unauthenticated admin redirect; event API failure display; blog shell with backend unavailable. The backend-backed journeys were pending at that point. Do not infer a business-rule change from the initial frontend-only failure state.
+
+## Follow-up with Redis and isolated backend, 2026-09-25
+
+The owner started a Redis container on port 6379. The local backend and frontend then ran against an isolated SQLite test database and disposable fixtures. See the [local journey replay](evidence/2026-09-24/local-replay.md) for auth, free/full/paid event, blog, staff, and failure-state evidence. The event integration suite passed 25 tests. The broader users/events/payments test run executed 148 tests with 89 errors from stale test fixtures/patch targets; its [raw log](evidence/2026-09-24/backend-focused-tests.txt) is preserved. `manage.py check` passed.
+
+The core browser flows are now captured. External SMS delivery, Google OAuth, and a live payment gateway were deliberately replaced with safe local mocks or left for staging. The baseline also found a countdown hydration mismatch and a notification stream-token 405. The owner accepted this baseline with its then-current limitations in `bundle0-review.md` on 2026-09-26, closing T02 and Checkpoint A at discovery scope. On 2026-09-26, the repository's current pytest suites passed: 79 unit and 158 integration tests. See [the rerun record](evidence/2026-09-24/test-rerun-2026-09-26.md). The original 148-test/89-error run remains historical evidence; the external SMS, OAuth, and live gateway paths remain untested.