docs: approve dashboard analytics defaults

docs/DASHBOARD-SPEC.md

@@ -40,6 +40,9 @@ Give a non-technical merchant a fast, trustworthy Persian RTL view of payment pe
 22. Authentication uses a backend-owned server-side session. The frontend receives only a `Secure`, `HttpOnly`, `SameSite=Lax` cookie and never reads or stores an authentication token.
 23. Expired, revoked, logged-out, or disabled-account sessions stop dashboard and SSE access immediately and return the user to login without exposing internal authentication details.
 24. The demo login handles typed throttling with `Retry-After`, never reveals whether a username exists, and does not implement password recovery, registration, or SSO. ZarinPal SSO replaces the demo credential screen after product acceptance.
+25. First dashboard access defaults to the latest complete Jalali month containing data. The comparison is the immediately previous equivalent complete month; if unavailable/empty, the UI explicitly says comparison is unavailable and does not silently substitute another baseline.
+26. Overview KPI order is bank-paid amount, bank-paid session count, payment success rate, then verification completion. Retry, processing-time, and fee analysis follow below.
+27. Read-only drill-downs are available for unverified-paid, failed, and retried sessions. They exclude payer tokens and peer-level data and may distinguish zero-attempt/reached-bank stages without inventing failure causes.
 
 ## Frontend architecture baseline
 
@@ -72,6 +75,8 @@ Give a non-technical merchant a fast, trustworthy Persian RTL view of payment pe
 - Missing heartbeats trigger controlled connection recovery; one-hour replay or snapshot fallback restores the authorized current state.
 - Rate-limited responses enqueue no duplicate work, preserve ready sections, and delay retry according to `Retry-After`.
 - Daily, weekly, Jalali-month, and Persian-season filters use the same explicit boundaries as the API and database.
+- The initial static-demo view selects the latest complete Jalali month with data and uses only the immediately previous equivalent period as its baseline.
+- Overview KPI order and read-only unverified/failed/retried drill-downs match the approved analytics contract without exposing payer tokens or peers.
 - Production build passes type checking, linting, unit/component tests, and Playwright critical-flow tests.
 - No raw dataset record, payer-card key, credential, or AvalAI key enters client bundles/logging/storage.