Repair accessibility registry after Event identity migration

Outcome

Restore the mandatory full Playwright gate after the Event identity migration without weakening the accessibility registry or production media coverage.

The accessibility fixture currently keeps only the Event’s durable UUID (identity_id) and later reuses it where the migrated contracts require the database integer primary key: the Studio registration-total preview route is <int:event_id>, and HistoricalRegistrationAggregateRevision.event_id is an integer foreign key. The maintained browser command also inherits an ambient PUBLIC_MEDIA_STORE_BACKEND=s3, allowing a developer shell to turn a deterministic offline suite into S3/image 502 failures.

Normative references:

• _docs/PROCESS.md — required Playwright gates cannot be skipped, quarantined, or attributed away.
• _docs/ci/change-selective-ci.md — exact environment/evidence envelopes and full browser coverage.
• _docs/specs/05-events-registration-email.md — Event identity and registration-total behavior.
• _docs/specs/07-security-privacy-operations.md — protected aggregate data and production object-store operations.
• _docs/runbooks/data-ingest.md — memory media in CI and S3 in production.

Product decisions

• The accessibility fixture carries both identities explicitly: immutable public/durable identity_id UUID and database-only integer database_id. Public Event paths/identity assertions continue to use the UUID/public id contract; Studio <int:event_id> routes and integer foreign-key filters use database_id.
• A missing database Event for the selected published record is a bounded fixture/setup failure. The test must not silently fall back to the UUID, fabricate a row, or skip the scenario.
• Maintained local/CI test commands own their test environment. Under website.settings.test, public media for Playwright is deterministic, offline memory even if the invoking shell exports PUBLIC_MEDIA_STORE_BACKEND=s3.
• This does not change deployment behavior: production settings/configuration still require and test the S3 backend, and S3 adapter/configuration coverage remains in its dedicated non-accessibility tests. The accessibility suite does not contact S3 or require credentials.

Scope

1. Repair the accessibility environment record and historical scenario so the correct Event identifier is used at every boundary:
   • UUID for durable/public identity resolution and canonical public paths;
   • integer database PK for Studio registration-total preview reversing and aggregate_revisions__event_id filtering.
2. Add focused regression coverage that fails if a UUID is passed to the integer Studio/FK boundary or if the fixture loses the durable UUID used by public assertions.
3. Make the maintained Python/Playwright test environment force the documented memory media backend rather than inherit an ambient S3 override. Bind that deterministic value into verification/evidence expectations.
4. Preserve dedicated production/S3 configuration and adapter tests, including fail-closed behavior for missing production bucket/configuration.
5. Prove the repaired isolated candidate through the focused accessibility/Event tests and the complete maintained scripts/ci.py test-playwright tier.

Non-goals

• Changing Event models, UUID/public-id allocation, canonical public Event URLs, Studio URL converters, or historical-registration foreign keys.
• Reopening or rewriting the #412 migration/import work.
• Changing registration totals, activation/rollback rules, permissions, privacy boundaries, or public copy/layout.
• Adding S3 credentials/network calls to browser tests, changing production to memory/local media, or removing S3 coverage.
• Skipping, xfail-ing, quarantining, deleting, or narrowing accessibility registry scenarios or lowering the Playwright tier selected for template work.
• Treating focused browser success as a substitute for the required complete Playwright component.

Relationship to #412 and downstream work

• #412 is historical provenance for the contract change that exposed this stale fixture assumption. Its code is already on current main; #426 has no open dependency on #412 and must not be blocked merely because #412 remains open as a tracking issue.
• #426 is the separately tracked repair needed to unblock the full Playwright gate for #420, #425, and other render-impact work. Those issues still require their own frozen candidates and current verification plans after this repair lands; #426 does not retroactively turn a failed run green.

Acceptance criteria

Event identity contract

• The accessibility fixture resolves a published Event to a real database row and stores both the immutable UUID identity_id and integer database_id with unambiguous names/types.
• Public Event canonical-path and identity assertions continue to use the durable UUID/public-id contract; no public URL exposes the database PK by accident.
• The Studio registration-total preview is reversed with database_id, satisfies the <int:event_id> route, returns 200 for an authorized Studio actor, and renders the expected synthetic preview.
• Historical aggregate activation/lookup/rollback filters use the integer FK value and still select the intended Event/run. UUID-to-integer misuse fails a focused regression test.
• If the published fixture record has no matching database Event, setup fails with a bounded diagnostic before browser traversal; it does not skip, fabricate, or widen selection.
• Existing denied Studio access remains 403, public Event registration totals remain correct, and no protected registrant/source data enters browser evidence or logs.

Deterministic media environment

• uv run --frozen python scripts/ci.py test-playwright and its maintained Playwright subcommands run with PUBLIC_MEDIA_STORE_BACKEND=memory under test settings even when the parent shell exports PUBLIC_MEDIA_STORE_BACKEND=s3.
• The component environment fingerprint/evidence records the owned memory value; an ambient shell value cannot produce a different accepted test envelope.
• Accessibility pages load deterministic author/public images without S3/network requests, 502 responses, or console teardown errors.
• Production settings and exact-container/configuration checks still require the production S3 backend and fail closed when required bucket/region/configuration is absent.
• Dedicated public-media tests continue to cover memory behavior, S3 key/path/checksum behavior, and production refusal of the memory backend. No production assertion is deleted or relaxed.

Required verification

• Focused Event identity, historical registration, Studio preview, public-media, CI-command environment, and accessibility-registry tests pass from the frozen issue candidate.
• The complete maintained env -u DTC_SQLITE_PATH uv run --frozen python scripts/ci.py test-playwright command completes green with its full pytest summary; a partial run or isolated accessibility pass is insufficient.
• The tester recomputes the selective-CI plan from the same frozen base/head/worktree, validates all required components/evidence, and reports no required skip or pending browser evidence.
• git diff --check, system checks, and the relevant quality/CI contract tests pass.

Browser scenarios

1. Run the complete accessibility registry at both registered viewports. The public Event page renders its canonical public-id/slug URL and synthetic registration total with no accessibility regression.
2. As an authorized Studio actor, open the historical registration list/detail, activate the synthetic aggregate, open /studio/events/<database-id>/registration-total/, and roll back. Every expected page is 200 and refers to the same Event.
3. Repeat the protected Studio surface as the denied actor and confirm 403 with no protected detail disclosure.
4. Invoke the maintained full Playwright command once with no media override and once from a shell exporting PUBLIC_MEDIA_STORE_BACKEND=s3. Both child test environments use memory and produce no author-image network/console errors.
5. In dedicated non-browser configuration tests, load production settings/container checks and verify S3 remains required and memory remains refused.

Evidence to attach

• Frozen base/head, plan/graph/environment digests, and four-bucket tester report.
• Focused command results and complete full-Playwright summary.
• Browser screenshot/console/request evidence for public Event and authorized/denied Studio preview at desktop/mobile, containing synthetic data only.
• Production/S3 configuration and public-media regression results.

Start with the accessibility fixture and historical registration scenario described in the issue, then inspect the maintained scripts/ci.py test-playwright entry point and the focused Event, public-media, and CI-command tests. Verify that UUID and integer database IDs remain distinct, the test environment forces memory media, and the complete Playwright command plus production/S3 regression coverage pass without skips or weakened assertions.