feat(apps): tell a guest why they were bounced to the login page (D3)

A guest tapping a personal page — orders, transactions, profile,
favourites, complete-profile — was redirected in silence, so they landed
on the login box with nothing explaining what happened. Legacy showed
«ابتدا وارد شوید» (henza_pwa/src/router/index.ts:259).

The message is now shown in both apps. The destination deliberately
stays the target's /login?redirect=…, which legacy did not have: legacy
sent the guest to home and lost where they were going, while here
signing in returns them to the page they asked for. The owner chose that
trade-off, so it is logged as «عمداً تکرار نشد — D3/الف» rather than
quietly left as a divergence. The guard also keys off meta.requiresAuth
instead of legacy's hand-kept list of five route names, so the two
sales-expert pages are covered too.

Legacy's isLoaded router guard is NOT ported, and the reasoning is
written into both apps' configStore beside the line that says so: it
guarded legacy's one big bootstrap request, which this target does not
have, so it would guard nothing and only add a bounce — a shared product
link would open home instead of the product. That is porting the
breakage, not the behaviour (D4).

Route analytics is deferred at the owner's request; its design is parked
in docs/PHASE2-D3-PLAN.md so it need not be re-derived, along with the
two reference defects not to copy (log/create was unauthenticated and
accepted any title; log/update was a GET that wrote) and the open
retention and IP questions.

Seven of D3's ten items turned out to be built already — all five
screens in both apps, the sts_verify_step_two guard, v2's cart ceiling —
verified in the code rather than from the checkmarks.

Neither app has a test runner: verified with vue-tsc -b on both (clean)
plus confirming the toast can actually appear, not merely compile —
toast.info exists and <ToastHost /> is mounted in each App.vue.

اپ: وقتی بدون ورود صفحه شخصی را باز کنید، پیام «ابتدا وارد شوید» نشان داده می‌شود.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/CHANGELOG.md

@@ -876,3 +876,56 @@ earlier ruling this deviation stays, and it is re-recorded in `ISSUES.md` so it
 is not "fixed" later by someone restoring parity for its own sake.
 
 _No data was deleted in this entry._
+
+---
+
+## 2026-10-12 — Phase 2 — item #2: D3's three outstanding behaviours
+
+- **What:** (1) A guest bounced off a personal page now sees «ابتدا وارد شوید»
+  in both apps. (2) Legacy's `isLoaded` router guard is recorded as deliberately
+  not ported. (3) Route analytics parked as ANLY-01.
+- **Why:** D3's remaining items. Seven of its ten were already built — all five
+  screens in **both** apps, the `sts_verify_step_two` guard and v2's cart stock
+  ceiling — confirmed by reading the code rather than trusting the checkmarks.
+- **Reference:** `henza_pwa/src/router/index.ts:253-261` (the notify + home),
+  `:263-266` (the `isLoaded` guard), `router/customAnalytics.ts` +
+  `henza_server/app/Http/Controllers/Api/LogController.php` (analytics).
+- **Target:** both apps' `src/router/index.ts` and `src/stores/configStore.ts`.
+- **Matrix row:** APP-03, APP-04, ANLY-01 in `ISSUES.md` §"Phase 2 — item #2".
+- **Commit:** see below.
+
+**The one judgement call.** Legacy showed the toast and then sent the guest to
+`home`, discarding where they were going. The target redirected to `/login` with
+`query.redirect`, so signing in returns the guest to the page they wanted — that
+part is better than the reference, and the gap was only the missing message.
+Rather than choose silently, the trade-off went to the owner, who kept the
+target's destination. So the message is the parity row and the destination is
+**«عمداً تکرار نشد — D3/الف»**. The guard also keys off `meta.requiresAuth`
+instead of legacy's hand-kept list of five route names, which means the two
+sales-expert pages are covered too.
+
+**`isLoaded` — argued against, and the owner agreed.** It guarded legacy's one
+big bootstrap request, which the target does not have (each page fetches its own
+data). Added, it would guard nothing and introduce a bounce: a shared product
+link would open `home` instead of the product. That is porting the breakage, not
+the behaviour (D4). The reasoning is written into both apps' `configStore.ts`,
+beside the line that says the flag was not ported, so the next reader finds it
+where they would actually look.
+
+**Analytics deferred by the owner** («ج اصلا اولیوت نداره»). The design is kept
+in `docs/PHASE2-D3-PLAN.md` so it does not have to be re-derived, including the
+two reference defects not to copy — `log/create` was unauthenticated and took any
+title, so anyone could fill the table from outside, and `log/update` was a `GET`
+that wrote — plus the two questions only the owner can answer: how long to keep
+per-customer browsing history (legacy never deleted it) and whether to store the
+IP at all.
+
+**Verification.** Neither app has a test runner, so the check is `vue-tsc -b` on
+both (clean) plus reading the three things that make the toast actually appear
+rather than merely compile: `toast.info` exists (`composables/useToast.ts:66`),
+`<ToastHost />` is mounted in each `App.vue:25`, and the call sits before the
+guard's `return`. A compiling toast with no host would have been invisible.
+Noted in the code: with the IAM enabled, silent SSO leaves the page before this
+guard runs, so the toast is a no-op there by design, not a defect.
+
+_No data was deleted in this entry._

docs/parity/ISSUES.md

@@ -211,3 +211,15 @@ Severity: `Critical` (money loss / security / data loss) · `High` · `Medium`
 ruling the target's behaviour stays — identical whenever the client sends the
 true weight (which the reference app always does, `cart.vue:178`), different
 only for a forged request, which is the point.
+
+## Phase 2 — item #2, D3 close-out (2026-10-12)
+
+Seven of D3's ten items were already built — all five screens exist in **both**
+apps, as do the `sts_verify_step_two` guard and v2's cart stock ceiling
+(verified in the code, not taken from a checkmark). Three were outstanding:
+
+| ID | Severity | Where | Description | Evidence | Status |
+|---|---|---|---|---|---|
+| **APP-03** | Medium (UX) | REF `henza_pwa/src/router/index.ts:253-261` vs TGT `apps/user-app/src/router/index.ts`, `user-app-v2` same | A guest tapping a personal page (orders, transactions, profile, favourites, complete-profile) was redirected **in silence**, so they landed on the login box with nothing saying why. Legacy showed «ابتدا وارد شوید». | Read both guards; legacy calls `showNotify('ابتدا وارد شوید')` then `next({name:'home'})`. | ✅ **FIXED 2026-10-12** — `toast.info('ابتدا وارد شوید')` in both apps' `beforeEach`. **«عمداً تکرار نشد — D3/الف»** for the destination: legacy sent the guest to `home` and lost where they were going; the owner chose to keep the target's `query.redirect`, so signing in returns them to the page they asked for. Also applied via `meta.requiresAuth` rather than legacy's hand-kept list of five names, which additionally covers the two sales-expert pages. Only reached when the IAM is off (the default) or unreachable — silent SSO leaves the page before this runs, and a toast on a document being replaced could not be read. |
+| **APP-04** | Low | REF `henza_pwa/src/router/index.ts:263-266` vs TGT both apps `stores/configStore.ts` | Legacy's `isLoaded` router guard sent a signed-in user to `home` from any route without `meta.skipLoadedCheck` until its one big bootstrap request had landed. | Read both; the target's store header already said `isLoaded` was not ported. | ⏹️ **«عمداً تکرار نشد — D3/ب»** (owner, 2026-10-12). The target has no bootstrap request — every page fetches its own data — so the flag would guard nothing and only add a bounce: opening a shared product link would land on home instead of the product. Porting it would port the breakage, not the behaviour (D4). Recorded in both apps' `configStore.ts` so a later reader finds the reasoning where they would look for the flag. |
+| **ANLY-01** | Low | REF `henza_server/app/Http/Controllers/Api/LogController.php`, `henza_pwa/src/router/customAnalytics.ts`; routes `api.php:57-58` | Per-page dwell-time analytics: `POST /log/create/{title}` opened a row (`start_at`, `ip`, `title`, `customer_id`, optional `product_id`), `GET /log/update/{id}` closed it; four admin report endpoints aggregated it. Entirely absent from the target — no table, no routes, no calls. | Read the controller, the composable and the routes. | ⏸️ **DEFERRED — lowest priority, may never be built** (owner, 2026-10-12: «ج اصلا اولیوت نداره جزو اخرین چیز هایی هست که شاید درستش کنیم»). The full design is parked in `docs/PHASE2-D3-PLAN.md` §"شکاف ۳", including two reference defects **not** to copy if it is ever built: `log/create` required no auth and accepted any title (anyone could fill the table from outside), and `log/update` was a `GET` that wrote. Open owner questions there too: retention (suggested 90 days — legacy never deleted) and whether to store the IP at all (suggested no). |

docs/parity/PROGRESS.md

@@ -19,11 +19,11 @@ The "Current state" table below is the parity project's and was last updated 202
 
 | Field | Value |
 |---|---|
-| **Phase** | **Phase 2 — apps parity — item #1 done** (Phase 1 closed and committed, `83e5d28`) |
+| **Phase** | **Phase 2 — apps parity — items #1 and #2 done** (Phase 1 closed, `83e5d28`) |
 | **Branch** | `main` (the parity branches were merged; see git log 2026-10-08..10-12) |
-| **Status** | Phase 1: all in-scope sections closed (§2 §4 §5 §6 §7 §8 §9 ✅ · §3 ⏸️ by D16). Phase 2: **item #1 MON-08 ✅**. **286/286** jest tests, typecheck clean. |
-| **Next step** | Phase 2 item #2 — **the 5 screens missing from both apps (D3)**. `02-APPS-MATRIX.md` still to be created. |
-| **Blocked on** | nothing. Two additive items await an owner ruling when convenient: **PERM-02** and the open rows below. |
+| **Status** | Phase 1: all in-scope sections closed (§2 §4 §5 §6 §7 §8 §9 ✅ · §3 ⏸️ by D16). Phase 2: **#1 MON-08 ✅**, **#2 D3 ✅**. **286/286** jest tests; both apps `vue-tsc` clean. |
+| **Next step** | Build **`02-APPS-MATRIX.md`** — the field-by-field apps matrix (D12), which Phase 2 has been running without. Then the remaining app rows it turns up. |
+| **Blocked on** | nothing. Awaiting an owner ruling when convenient: **PERM-02**. Deferred by the owner: **ANLY-01** (route analytics, lowest priority). |
 | **Last updated** | 2026-10-12 |
 
 ### Phase 1 close-out (2026-10-12)
@@ -207,6 +207,24 @@ actually had: the suite only covered a tampered request, not an honest one.
 An operator ordering from the panel still keeps the numbers they typed — only an
 app order is re-priced by the server.
 
+## Phase 2 — item #2 (D3) — ✅ DONE 2026-10-12
+
+D3 was ten items, not one. **Seven were already built** — all five screens
+(`/report`, `/report/detail`, `/ChildOrder`, `/customerChoice`,
+`/complete_profile`) exist in **both** apps, as do the `sts_verify_step_two`
+guard and v2's cart stock ceiling. Checked in the code, not read off a
+checkmark.
+
+| Outstanding item | Result |
+|---|---|
+| guest toast «ابتدا وارد شوید» | ✅ both apps (**APP-03**). The destination stays the target's `/login?redirect=…`, better than legacy's `home` — owner's call, logged as «عمداً تکرار نشد — D3/الف». |
+| `isLoaded` router guard | ⏹️ **not ported** (**APP-04**) — guards a bootstrap request the target does not have; would only bounce a shared product link to `home` (D4). Owner agreed. |
+| route analytics | ⏸️ **deferred, lowest priority** (**ANLY-01**) — design parked in `docs/PHASE2-D3-PLAN.md`, with the two reference defects not to copy and the two retention/privacy questions still open. |
+
+⚠️ **Phase 2 is running without its matrix.** `02-APPS-MATRIX.md` still does not
+exist, so "what else do the apps miss" rests on the earlier survey rather than a
+field-by-field comparison (D12). That is the next item.
+
 The original requirement, for the record:
 
 Before anything else in Phase 2: the server must derive `wagePercent`,