# Bundle 0 isolated local replay

Replayed 2026-09-24 to 2026-09-25 with a local Redis container on `127.0.0.1:6379`, Django `config.settings.test` using the ignored SQLite `db.test.sqlite3`, Next.js dev server, and Playwright Chromium. No production database, payment gateway, SMS provider, or email service was used. The disposable data came from `create-local-baseline-fixtures.py`; the payment and OTP scripts in this directory mock external side effects.

## Replayed paths

| Journey | Happy path observed | Failure path observed |
| --- | --- | --- |
| Authentication | Browser: existing mobile `09198000111` → password login → profile. Isolated API: new mobile OTP verification → signup → OTP login → password reset → login with new password. | Browser stayed in auth for invalid mobile/wrong password. Isolated API rejected invalid OTP request, incorrect code, duplicate registration, and the old password after reset. |
| Events | Browser: published events list and detail; signed-in free registration reached the success page with confirmed status and event details. | Full event had a disabled registration button and zero remaining capacity. Anonymous free registration redirected to auth. |
| Payment | Mocked Django client: gateway request produced a pending payment; successful callback marked payment paid and registration confirmed. Browser payment result rendered the paid event, amount, and reference ID. | Mocked gateway outage returned 502 without a persisted payment; canceled callback redirected to failed state; duplicate paid attempt returned 400. Browser rendered the failed payment result. |
| Blog | Browser opened the published fixture article with reading content, author, and comments area. Staff blog list showed the published article. | Missing article slug rendered the site's not-found view. |
| Staff admin | Browser login as isolated staff; event list displayed fixture events and registration count. Editing the free-event title saved and the API returned the new value. At 390px the staff event list switched to cards and the menu exposed the blog route. | Empty required event title disabled Save. The earlier anonymous `/admin` replay redirected away. |

The staff-edited fixture title was restored after verification. These fixtures live only in the ignored SQLite test file. The mocked payment success is not proof of a live gateway checkout, and the mocked OTP replay is not proof of SMS delivery or the Google OAuth path.

## Backend test baseline (historical run)

- `python manage.py check --settings=config.settings.test`: passed, zero issues.
- `python manage.py test apps.events.tests.integration.test_events --settings=config.settings.test --noinput`: **25 passed**.
- `python manage.py test apps.users.tests apps.events.tests apps.payments.tests --settings=config.settings.test --noinput`: **148 tests ran, 89 errors**. Raw output: [backend-focused-tests.txt](backend-focused-tests.txt). These errors were recorded as stale tests at the time. The current pytest rerun and results are in [test-rerun-2026-09-26.md](test-rerun-2026-09-26.md) and supersede this as the current suite status. No application business logic was changed to make the historical expectations pass.

## Runtime observations to carry forward

- Event detail's second-by-second countdown produced a server/client text mismatch and React hydration warning in the dev browser.
- The signed-in browser requested `/api/notifications/stream-token` and received HTTP 405.
- The old footer still shows the unselected contact variants. The selected About-page contacts are recorded in the content inventory and design contract for cutover.

The browser replay covers the principal local auth, event, payment-result, blog-reading, and staff-edit journeys with a failure case in each. Full SMS transport, Google OAuth, and a live payment gateway need separate integration work. This file records the starting behavior; it is not approval of those external integrations or of the CMS/API contract.