# Website quality report

Adds a public, bilingual report at `/en/web-quality` and `/veebikvaliteet`.
The existing `/demo` remains the interactive dashboard demonstration.

## Evidence scope

Measure the publicly deployed `https://next.wifi.ee` as a signed-out visitor.
Cover English and Estonian homepages, the directory, one published hotspot,
mobile-app information, and the privacy policy at mobile and desktop widths.
Keep timestamps, exact URLs, tool versions, sample counts, and downloadable
evidence. Scores describe the sampled release, not an unmeasured new release.

Include Lighthouse performance, accessibility, best practices and SEO; axe
WCAG A/AA findings; reflow, keyboard and reduced-motion observations; HTTPS,
TLS certificate and HTTP headers; first-visit cookies and third-party requests;
and transferred bytes as an environmental-impact proxy. Do not equate automated
checks with WCAG certification, a penetration test, legal privacy compliance,
real-user Core Web Vitals, or measured carbon emissions.

## Collection

Use Node 24 and a locally installed Google Chrome. Keep audit tooling separate
from application dependencies:

```sh
npm install --prefix /tmp/wifi-quality-tools lighthouse@13.4.1 playwright@1.62.1 axe-core@4.13.0 chrome-launcher@1.2.1
WIFI_QUALITY_TOOLS=/tmp/wifi-quality-tools node scripts/measure-website-quality.mjs
```

The collector resolves tooling relative to `WIFI_QUALITY_TOOLS/package.json`.
The original collection reused already installed copies of these packages;
exact versions are recorded in `report.tools`. Chrome was the locally installed
stable browser, not a bundled Playwright browser.

Public downloads include this method document and the self-contained collector.
To measure the public site without a checkout, run the downloaded collector with
`--phase=browser` and then `--phase=lighthouse`. The dependency phase requires the
application checkout, Git, and its committed `package-lock.json`.

Environment variables: `WIFI_QUALITY_ORIGIN` (default `https://next.wifi.ee`),
`WIFI_QUALITY_DATE` (UTC date by default), `WIFI_QUALITY_OUTPUT` (default
`public/quality/<date>`). Use a **new output directory for a new snapshot**.
The script resumes completed groups in an existing report. An origin mismatch
is rejected. Do not run other browser tests, builds or deployments while
Lighthouse is collecting. Audits run sequentially; homepage groups have three
runs and other Lighthouse groups have one. Category/metric medians are computed
independently; each HTML report and the score range are preserved.

For phased collection, use `--phase=browser`, `--phase=lighthouse`, then
`--phase=dependencies`. Browser collection stores accessibility, headers,
privacy, resource-transfer and document metadata observations. Failed samples
are discarded and recorded rather than scored; rerun to fill any missing groups.
The directory desktop observation timed out once during the original collection
and succeeded on retry. That initial aborted attempt preceded checkpointed
failure logging; the 12 successful browser groups are retained.

The production and full dependency advisory checks evaluate this repository's
lockfile, not a proven running deployment tree. `sourceCommit` identifies the
checkout during collection; `lockfileSha256` identifies the audited file exactly.
Neither is a claim about the public deployment SHA. No exploit attempts were made.

Reflow conclusions use the desktop-browser contexts at 320 and 720 CSS pixels.
Mobile browser emulation can expand its layout viewport; its raw dimensions
are retained, but not counted as a desktop zoom/reflow result. The 720px test
approximates available CSS width at 200% zoom on a 1440px window; it is not an
actual browser zoom or text-only resizing test. Reduced-motion recognition only
checks the media query; it does not prove animation compliance.

Transfer bytes use Chrome DevTools Protocol `Network.loadingFinished` and are
collected five seconds after load, before axe injection or keyboard checks.
Only the page target is counted, including headers; worker/cross-origin frame
traffic, below-fold lazy content and unfinished requests may be missing. Counts
and unfinished/failed requests are provided alongside the totals. Do not infer
energy, emissions, green hosting or a carbon grade from the transfer measurements.

The report is a dated snapshot and does not run scans in visitors' browsers.
Cookie values, tokens, full request URLs and authorization headers are excluded
from the browser evidence. Cookies list metadata; cross-origin services list
origins only. Lighthouse reports describe signed-out public pages.

## New page validation

Check `/en/web-quality` and `/veebikvaliteet` in both themes at 320, 390 and
1440 CSS pixels, with keyboard navigation, native expandable evidence sections,
working JSON/HTML downloads, correct language and canonical/hreflang metadata.
Check the footer and sitemap links. The shared About dropdown now becomes
`inert` while closed so its hidden links cannot receive keyboard focus.
This small repair does not rewrite the historical baseline findings.
The shared footer copyright text also uses sufficient contrast in both themes.
The main navigation keeps its compact menu below 1024px so the controls remain
inside the viewport at tablet and zoom-equivalent widths.
The shared dark primary action now pairs a light blue background with dark text,
including hover/active states, after the new page's dark-theme check found that
the previous white-on-blue pairing did not meet normal-text contrast.

Run `scripts/check-local.sh` before push and inspect the Vercel deployment check.
Public evidence and the page must refer to the same snapshot. Do not relabel
local new-page validation as a new score for all deployed pages.