guilan-ace-deployment/tasks/baseline-2026-09-24.md

Bundle 0 flow, accessibility and performance baseline

Captured 2026-09-24 with the current Next.js 15 frontend, Playwright Chromium, and local production build. Viewports: 320×800, 390×844, 768×900 and 1440×900 CSS pixels. The backend at 127.0.0.1:8000 was not running for this initial capture; a backend-backed replay followed on 2026-09-25 below. Screenshots in evidence/2026-09-24/ are full-page browser captures, not design comps.

Route and state map

Journey	Current route/transition	States to preserve and replay
Visitor/association	/ → /about, /events, /blog	Home/About render and responsive shell; external contact links
Auth	/auth mobile lookup → existing user password or OTP login; new user OTP → registration details → profile/return; /auth/google/callback; /verify-email/[token]; /reset-password → /reset-password/[token]; /logout	Invalid mobile, expired/incorrect OTP, resend cooldown, duplicate submit, Google failure, expired reset, protected redirect
Event	/events search/filter → /events/[slug] → free registration /events/[slug]/success or paid gateway → /payments/result	Open, full, closed, already registered, ineligible, invalid coupon, payment pending/success/failure/canceled, callback replay
Blog	/blog banners/search/category/tag/author → /blog/[slug]	Empty/failure, long article, media fallback, comments/interactions and share
Staff	/admin → dashboard, events, users, taxonomy, coupons, authorizations, blog editor/review/assets	Anonymous redirect, role denial, save conflict, validation, successful edit/publish, mobile table/form navigation

Browser evidence

Page	Captures	Observed behavior
Home	home-320.png, home-390.png, home-768.png, home-1440.png	Loads with current identity/CTA. At 390px the fixed mobile navigation overlays the first offering card while scrolling; record for later shell work.
About	about-320.png, about-390.png, about-768.png, about-1440.png	Loads with static statistics, affiliations and contacts. The long page contains no <main> landmark.
Auth	auth-390.png	Mobile entry screen loads. OTP/login success requires a working auth backend and test account.
Events	events-390.png	Listing displays رویدادی یافت نشد when its API request fails, which looks like a real empty catalog. Browser console has ERR_CONNECTION_REFUSED to 127.0.0.1:8000/api/events/. Registration states cannot be replayed from this environment.
Blog	blog-390.png	Listing shell loads; API requests fail and a mock banner is visible. Post navigation and interactions need backend fixtures.
Staff	admin-390.png	Anonymous /admin redirects to /. Authorized staff walkthrough requires a test account.

Screenshots were inspected for page identity and nonblank content. The route screenshots listed above are the accepted current-site baseline; screenshots of rejected concept drafts are not part of that baseline.

Measured baseline

npm run build passed on 2026-09-24. Its First Load JS report (production build, compressed route estimate): shared 102 kB, Home 107 kB, About 103 kB, Auth 163 kB, Events listing 124 kB, Event detail 469 kB, Blog listing 141 kB, Blog detail 469 kB, Admin dashboard 302 kB, Admin event editor 727 kB, Payment result 613 kB. The build emitted existing no-img-element warnings and an ESLint plugin detection warning; it also logged API connection refusal during static page generation.

npm run lint exited successfully with 14 existing no-img-element warnings and no errors. A focused backend baseline command, .venv/Scripts/python.exe manage.py test apps.users.tests apps.events.tests apps.payments.tests --settings=config.settings.test, was started and stopped after repeated failures reaching the notification store at 127.0.0.1:6379. Docker Desktop's engine was unavailable, so Redis could not be started locally. This test run has no passing-suite result; rerun it with an isolated Redis service for the flow gate.

At 390px in one local Chromium production run, Home navigation duration was 554 ms and first contentful paint 424 ms; About was 173 ms and 204 ms. These are local machine observations, not network performance targets or p75 Web Vitals. Both pages had one <h1>, no horizontal overflow, and zero <img> elements missing an alt attribute. Home had one <main> landmark; About had none. The desktop and 320px screenshots establish layout comparison points. No automated WCAG score is claimed; a full axe/keyboard/screen-reader audit remains part of the release gate.

Manual replay status and next gate

At the initial capture, completed: Home/About rendering at four widths; auth entry; unauthenticated admin redirect; event API failure display; blog shell with backend unavailable. The backend-backed journeys were pending at that point. Do not infer a business-rule change from the initial frontend-only failure state.

Follow-up with Redis and isolated backend, 2026-09-25

The owner started a Redis container on port 6379. The local backend and frontend then ran against an isolated SQLite test database and disposable fixtures. See the local journey replay for auth, free/full/paid event, blog, staff, and failure-state evidence. The event integration suite passed 25 tests. The broader users/events/payments test run executed 148 tests with 89 errors from stale test fixtures/patch targets; its raw log is preserved. manage.py check passed.

The core browser flows are now captured. External SMS delivery, Google OAuth, and a live payment gateway were deliberately replaced with safe local mocks or left for staging. The baseline also found a countdown hydration mismatch and a notification stream-token 405. The owner accepted this baseline with its then-current limitations in bundle0-review.md on 2026-09-26, closing T02 and Checkpoint A at discovery scope. On 2026-09-26, the repository's current pytest suites passed: 79 unit and 158 integration tests. See the rerun record. The original 148-test/89-error run remains historical evidence; the external SMS, OAuth, and live gateway paths remain untested.