test: make the suite's assertions falsifiable and its state isolated

Several assertions could not fail:

- "the catch update remains saved" was `caught.isChecked() || notes.includes(...)`
  shared by two scenarios, so either half satisfied both. Split into two steps
  that each assert the outcome their own scenario is about.
- The token-refresh check read a global counter with `> 0` and asserted an upload
  had happened `some(...)`, both already satisfied by the preceding scenario. It
  now asserts exactly one refresh, ordered before the upload.
- The box step ignored its box argument and asserted on the first N entries on
  the page; it now scopes to that box and checks its full contents.
- The filter step asserted on whichever entry was first after filtering; it now
  records the caught entry beforehand and names it, and checks the filter did not
  exclude everything.
- The empty-state precondition asserted emptiness instead of establishing it,
  which a fresh user satisfies for free.
- Offline coverage was `caches.keys().length > 0`. It now checks the precache
  contract: one workbox cache holding the shell and a revisioned web manifest,
  with _app/immutable assets cached without a revision query. The scenario that
  claimed to test a trailing slash did not; it is replaced with real offline
  client-side navigation.

The mock provider kept recorded requests, its refresh counter and the
fail-uploads switch in one process-wide object that only one step reset, so
scenario order was load-bearing and the failing-upload scenario poisoned
everything after it. An auto fixture now resets it per scenario, and the mock no
longer records its own control-plane calls. That reset is why the suite stays on
a single worker, which is now documented.

Coverage was gated at 90% per file over an allowlist of exactly the five files
that had tests, so new code was invisible to it permanently. It now measures all
of src/lib with global thresholds at the measured baseline, and no longer runs
the unit tests twice.

Also: a global teardown removes the users each run creates, the Supabase wrapper
distinguishes a stopped stack from a broken CLI call and detects an unseeded
database, the sign-in rate limit is raised above what one serial run needs, and
the integration suite no longer falls back to a hard-coded anon key that would
mask a misconfigured run.

The password-reset scenarios are renamed to what they actually cover: following a
real recovery link bounces to /signin, because the browser client persists no
cookies and so cannot keep the session it parses out of the URL. The helper for
the real flow is left in place and the gap is documented.

.github/workflows/tests.yml

@@ -9,6 +9,14 @@ concurrency:
   group: tests-${{ github.ref }}
   cancel-in-progress: true
 
+# `$env/static/public` is resolved at build time, so every variable imported from it must be
+# present for `vite build` and `svelte-check` to succeed on a clean checkout. These are the
+# local-stack defaults already published in .env.local.example - never real credentials.
+env:
+  PUBLIC_USE_LOCAL_POKEMON_SPRITE_FOLDER: 'false'
+  PUBLIC_SUPABASE_URL: http://127.0.0.1:54321
+  PUBLIC_SUPABASE_ANON_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0
+
 jobs:
   quality:
     runs-on: ubuntu-latest
@@ -22,7 +30,6 @@ jobs:
       - run: npm run check
       - run: npm run lint
       - run: npm run test:fast
-      - run: npm run test:coverage
       - uses: actions/upload-artifact@v4
         if: always()
         with:
@@ -39,8 +46,8 @@ jobs:
           node-version: 20
           cache: npm
       - run: npm ci
+      # `supabase start` applies migrations and seeds; no separate reset is needed.
       - run: npx supabase start
-      - run: npx supabase db reset
       - run: npm run test:integration
       - if: always()
         run: npx supabase stop
@@ -69,9 +76,10 @@ jobs:
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            playwright-chromium-${{ runner.os }}-
       - run: npx playwright install --with-deps chromium
       - run: npx supabase start
-      - run: npx supabase db reset
       - run: npm run test:bdd
       - uses: actions/upload-artifact@v4
         if: failure()

README.md

@@ -42,15 +42,21 @@ The test suite is split by responsibility so a failure points to the correct lay
   definitions and browser fixtures live beside it under `tests/bdd`.
 - `tests/build` verifies generated service-worker and manifest artifacts after each supported build.
 
-Run the offline suites while developing:
+Run the offline suites while developing. `test:fast` includes the coverage run, so there is no need
+to run both:
 
 ```bash
 npm run test:fast
-npm run test:coverage
 ```
 
-Database and BDD tests require Docker and the local Supabase stack. The wrappers read local keys from
-`supabase status`; no credentials are written to disk or committed:
+Coverage is measured across all of `src/lib` (excluding type-only models and the browser-only
+store/action modules) with global thresholds set to the current baseline, so new untested code lowers
+the number instead of being invisible to the gate. Ratchet the thresholds in `vitest.config.mts` up as
+coverage grows, never down.
+
+Database and BDD tests require Docker and the local Supabase stack. The wrappers read the local keys
+from `supabase status` at run time, so no keys are hard-coded in the test files; the local stack's
+well-known demo keys do appear in `.env.local.example`, and no real credentials are committed:
 
 ```bash
 npm run supabase:start
@@ -67,9 +73,24 @@ Gherkin describes outcomes in domain language. Keep selectors, API calls, test-u
 provider mocks in step definitions or support fixtures. `@product-review` marks a rule that should be
 reviewed with product stakeholders, but does not skip it. Missing or ambiguous steps fail generation.
 
-Google Drive and Dropbox scenarios use a local provider server and private endpoint overrides. They do
-not contact real provider accounts. Chromium is the only configured browser project. Playwright traces
-and screenshots are retained on failure under `test-results`.
+Google Drive and Dropbox scenarios use a local provider server (`scripts/mock-provider-server.mjs`)
+and never contact real provider accounts. The endpoint overrides that point at it are refused unless
+`ALLOW_PROVIDER_ENDPOINT_OVERRIDES=true` **and** the override is a loopback URL - these endpoints
+receive the OAuth client secret and refresh token, so they must not be redirectable in a deployed
+environment. `npm run test:bdd` sets the flag; nothing else should.
+
+The mock's recorded requests, refresh counter and fail-uploads switch are reset before every scenario
+by an auto fixture in `tests/bdd/fixtures.ts`. That reset is also why the suite runs with a single
+worker: the mock is one shared process, so parallel scenarios would reset each other's state. A global
+teardown deletes the users each run creates, so repeated local runs do not need a database reset.
+
+Chromium is the only configured browser project. Playwright traces and screenshots are retained on
+failure under `test-results`.
+
+Known gap: the password-reset scenarios use an ordinary signed-in session rather than a recovery link,
+because following a real recovery link currently bounces to `/signin` - the browser client in
+`src/routes/+layout.ts` has no cookie `set`/`remove` method, so it cannot persist the session it parses
+out of the URL. `createRecoveryLink` in `tests/bdd/support/app.ts` is ready for when that is fixed.
 
 The current National Dex maximum is deliberately asserted as 1025. When adding a new generation,
 update that expectation together with Pokémon data, the corresponding game/dex files, database seed,

package.json

@@ -23,8 +23,8 @@
 		"tailwind": "npx tailwindcss -i ./static/input.css -o ./static/output.css",
 		"test:unit": "vitest run tests/unit",
 		"test:data": "vitest run tests/data",
-		"test:fast": "npm run test:unit && npm run test:data",
 		"test:coverage": "vitest run tests/unit --coverage",
+		"test:fast": "npm run test:coverage && npm run test:data",
 		"test:integration": "node scripts/run-with-local-supabase.mjs vitest run --config vitest.integration.config.mts",
 		"test:bdd:generate": "bddgen",
 		"test:bdd:inner": "npm run build-inject-manifest && npm run test:bdd:generate && playwright test --project=chromium",
@@ -34,7 +34,7 @@
 		"test:build:inject-static": "npm run build-inject-manifest && vitest run --config vitest.build.config.mts",
 		"test:build:inject-node": "npm run build-inject-manifest-node && NODE_ADAPTER=true vitest run --config vitest.build.config.mts",
 		"test:build": "npm run test:build:generate-static && npm run test:build:generate-node && npm run test:build:inject-static && npm run test:build:inject-node",
-		"test:ci": "npm run test:fast && npm run test:coverage && npm run test:integration && npm run test:build && npm run test:bdd",
+		"test:ci": "npm run test:fast && npm run test:integration && npm run test:build && npm run test:bdd",
 		"test": "npm run test:ci",
 		"supabase:start": "supabase start",
 		"supabase:stop": "supabase stop",

playwright.config.ts

@@ -25,6 +25,7 @@ import { nodeAdapter } from './adapter.mjs';
  */
 export default defineConfig({
 	testDir,
+	globalTeardown: './tests/bdd/globalTeardown.ts',
 	/* Folder for test artifacts such as screenshots, videos, traces, etc. */
 	outputDir: 'test-results/',
 	timeout: 90 * 1000,

scripts/mock-provider-server.mjs

@@ -14,7 +14,12 @@ const server = createServer(async (request, response) => {
 	const url = new URL(request.url ?? '/', `http://127.0.0.1:${port}`);
 	let body = '';
 	for await (const chunk of request) body += chunk;
-	state.requests.push({ method: request.method, path: url.pathname, query: url.search, body });
+
+	// Control-plane calls (including Playwright's webServer readiness polling of /__mock/state)
+	// must not show up as provider traffic the assertions then reason about.
+	if (!url.pathname.startsWith('/__mock/')) {
+		state.requests.push({ method: request.method, path: url.pathname, query: url.search, body });
+	}
 
 	if (url.pathname === '/__mock/state') return send(response, 200, state);
 	if (url.pathname === '/__mock/reset') {

scripts/run-with-local-supabase.mjs

@@ -8,25 +8,44 @@ if (!command) {
 	process.exit(2);
 }
 
+const SETUP_HINT = 'Run "npm run supabase:start" followed by "npm run supabase:reset".';
+// npx is a shell script on Windows, where spawn needs a shell to find it.
+const useShell = process.platform === 'win32';
+
+function fail(message, detail) {
+	console.error(message);
+	if (detail) console.error(String(detail).trim());
+	process.exit(1);
+}
+
 const status = spawnSync('npx', ['supabase', 'status', '--output', 'json'], {
 	encoding: 'utf8',
-	stdio: ['ignore', 'pipe', 'pipe']
+	stdio: ['ignore', 'pipe', 'pipe'],
+	shell: useShell
 });
 
+if (status.error) {
+	fail(
+		'Unable to run "npx supabase status" - is the supabase CLI installed?',
+		status.error.message
+	);
+}
+
 if (status.status !== 0) {
-	console.error('Local Supabase is required but is not running.');
-	console.error('Run "npm run supabase:start" followed by "npm run supabase:reset".');
-	if (status.stderr.trim()) console.error(status.stderr.trim());
-	process.exit(status.status ?? 1);
+	const stderr = status.stderr ?? '';
+	// Distinguish a stopped stack from a genuinely broken CLI invocation, so the hint is only
+	// printed when it is actually the advice the reader needs.
+	if (/not running|supabase start/i.test(stderr)) {
+		fail(`Local Supabase is required but is not running.\n${SETUP_HINT}`, stderr);
+	}
+	fail(`"supabase status" failed with exit code ${status.status}.`, stderr);
 }
 
 let values;
 try {
 	values = JSON.parse(status.stdout);
 } catch (error) {
-	console.error('Unable to parse "supabase status --output json".');
-	console.error(error);
-	process.exit(1);
+	fail('Unable to parse "supabase status --output json".', error);
 }
 
 const apiUrl = values.API_URL ?? values.api_url ?? 'http://127.0.0.1:54321';
@@ -34,12 +53,30 @@ const anonKey = values.ANON_KEY ?? values.PUBLISHABLE_KEY ?? values.anon_key;
 const serviceRoleKey = values.SERVICE_ROLE_KEY ?? values.SECRET_KEY ?? values.service_role_key;
 
 if (!anonKey || !serviceRoleKey) {
-	console.error('Supabase status did not return an anonymous and service-role key.');
-	process.exit(1);
+	fail(`Supabase status did not return an anonymous and service-role key.\n${SETUP_HINT}`);
+}
+
+// A running-but-unseeded database is the most common broken state, and it surfaces downstream as
+// a confusing assertion failure. Check it here instead.
+const probe = await fetch(`${apiUrl}/rest/v1/pokedex_entries?select=id&limit=1`, {
+	headers: { apikey: anonKey, Authorization: `Bearer ${anonKey}` }
+}).catch((error) => {
+	fail(`Unable to reach the local Supabase REST API at ${apiUrl}.\n${SETUP_HINT}`, error);
+});
+
+if (!probe.ok) {
+	fail(
+		`The local Supabase database has no readable pokedex_entries (HTTP ${probe.status}).\n${SETUP_HINT}`,
+		await probe.text()
+	);
+}
+if (((await probe.json()) ?? []).length === 0) {
+	fail(`The local Supabase database is empty - migrations or seeds have not run.\n${SETUP_HINT}`);
 }
 
 const child = spawnSync(command, args, {
 	stdio: 'inherit',
+	shell: useShell,
 	env: {
 		...process.env,
 		PUBLIC_SUPABASE_URL: process.env.PUBLIC_SUPABASE_URL ?? apiUrl,
@@ -51,4 +88,6 @@ const child = spawnSync(command, args, {
 	}
 });
 
-process.exit(child.status ?? 1);
+if (child.error) fail(`Unable to run "${command}".`, child.error.message);
+// A signalled child reports status === null; exiting 0 there would hide the failure.
+process.exit(child.signal ? 1 : child.status ?? 1);

supabase/config.toml

@@ -119,7 +119,8 @@ enabled = true
 # in emails.
 site_url = "http://localhost:5173"
 # A list of *exact* URLs that auth providers are permitted to redirect to post authentication.
-additional_redirect_urls = ["http://localhost:5173"]
+# 4173 is the preview server the BDD suite runs against; recovery links redirect there.
+additional_redirect_urls = ["http://localhost:5173", "http://localhost:4173"]
 # How long tokens are valid for, in seconds. Defaults to 3600 (1 hour), maximum 604,800 (1 week).
 jwt_expiry = 3600
 # If disabled, the refresh token will never expire.
@@ -149,7 +150,8 @@ anonymous_users = 30
 # Number of sessions that can be refreshed in a 5 minute interval per IP address.
 token_refresh = 150
 # Number of sign up and sign-in requests that can be made in a 5 minute interval per IP address (excludes anonymous users).
-sign_in_sign_ups = 30
+# Raised for the BDD suite: every scenario provisions and signs in its own user from one IP.
+sign_in_sign_ups = 300
 # Number of OTP / Magic link verifications that can be made in a 5 minute interval per IP address.
 token_verifications = 30
 # Number of Web3 logins that can be made in a 5 minute interval per IP address.

tests/bdd/features/account-access.feature

@@ -36,12 +36,12 @@ Feature: Account access
 
   @product-review
   Scenario: Reject mismatched replacement passwords
-    Given I am on the password reset page with a recovery session
+    Given I am signed in on the password reset page
     When I enter two different replacement passwords
     Then I am told that the passwords do not match
 
   Scenario: Complete a password reset
-    Given I am on the password reset page with a recovery session
+    Given I am signed in on the password reset page
     When I enter a valid replacement password
     Then I am told that my password was updated
 

tests/bdd/features/backup-export.feature

@@ -28,7 +28,7 @@ Feature: Backup and export
     And I have a Living Dex named "Quoted, Dex"
     When I save a catch note containing a comma and quote
     Then the mocked provider receives a valid escaped CSV
-    And the catch update remains saved
+    And the note survives a reload
 
   Scenario: Refresh an expired provider token
     Given Dropbox is connected with an expired token
@@ -38,6 +38,6 @@ Feature: Backup and export
   Scenario: Record provider failure without losing progress
     Given Google Drive is connected to a failing mocked provider
     When I update collection progress
-    Then the catch update remains saved
+    Then the catch remains marked caught
     And the provider failure is shown in backup settings
 

tests/bdd/features/pwa-offline.feature

@@ -6,13 +6,18 @@ Feature: Offline-friendly application
   Scenario: Register the service worker
     When I open the built application
     Then a service worker controls the page
-    And the application cache is present
+    And the application shell is precached
 
-  Scenario: Navigate while offline
+  Scenario: Reload the home page while offline
     Given I have opened the built application online
-    When I go offline and revisit the home page with a trailing slash
+    When I go offline and reload the home page
     Then the application remains available
 
+  Scenario: Navigate to another route while offline
+    Given I have opened the built application online
+    When I go offline and navigate to the sign-in page
+    Then the sign-in form is available offline
+
   Scenario: Restore network access
     Given I have opened the built application online
     When I go offline and then return online

tests/bdd/fixtures.ts

@@ -10,11 +10,30 @@ export type ScenarioState = {
 	entries: Array<{ pokemon: string; form: string | null; num: number; id: string }>;
 	lastResponseStatus: number | null;
 	lastMessage: string | null;
+	caughtEntryLabel: string | null;
 };
 
-type Fixtures = { state: ScenarioState };
+type Fixtures = { state: ScenarioState; providerMock: void };
+
+const MOCK_URL = process.env.MOCK_PROVIDER_URL ?? 'http://127.0.0.1:4199';
 
 export const test = base.extend<Fixtures>({
+	/**
+	 * The mock provider keeps recorded requests, the refresh counter and the fail-uploads switch
+	 * in one process-wide object. Without a reset per scenario, assertions are satisfied by
+	 * whatever ran before them - and the failing-upload scenario would poison every later one.
+	 */
+	providerMock: [
+		// eslint-disable-next-line no-empty-pattern
+		async ({}, use) => {
+			const response = await fetch(`${MOCK_URL}/__mock/reset`);
+			if (!response.ok) {
+				throw new Error(`Unable to reset the mock provider at ${MOCK_URL}: ${response.status}`);
+			}
+			await use();
+		},
+		{ auto: true }
+	],
 	// Playwright fixture callbacks require the dependency object even when this fixture has none.
 	// eslint-disable-next-line no-empty-pattern
 	state: async ({}, use, testInfo) => {
@@ -31,7 +50,8 @@ export const test = base.extend<Fixtures>({
 			pokedexName: null,
 			entries: [],
 			lastResponseStatus: null,
-			lastMessage: null
+			lastMessage: null,
+			caughtEntryLabel: null
 		});
 	}
 });

tests/bdd/globalTeardown.ts

@@ -0,0 +1,48 @@
+/**
+ * Deletes the users each BDD run provisions, so repeated local runs do not need a full
+ * `supabase db reset` to stay clean. Pokédexes, catch records and integrations follow via the
+ * schema's cascades. Only the suite's own synthetic addresses are touched.
+ */
+const SUPABASE_URL = process.env.TEST_SUPABASE_URL ?? 'http://127.0.0.1:54321';
+const OWNED_EMAIL = /^(bdd|other|integration)-.*@example\.test$/;
+
+type AdminUser = { id: string; email?: string };
+
+async function adminRequest(path: string, init: RequestInit = {}) {
+	const key = process.env.E2E_SERVICE_ROLE_KEY;
+	if (!key) return null;
+	return fetch(`${SUPABASE_URL}${path}`, {
+		...init,
+		headers: {
+			apikey: key,
+			Authorization: `Bearer ${key}`,
+			'Content-Type': 'application/json',
+			...(init.headers ?? {})
+		}
+	});
+}
+
+export default async function globalTeardown() {
+	const listed = await adminRequest('/auth/v1/admin/users?per_page=1000');
+	if (!listed) {
+		console.warn('Skipping BDD teardown: E2E_SERVICE_ROLE_KEY is not set.');
+		return;
+	}
+	if (!listed.ok) {
+		console.warn(`Skipping BDD teardown: unable to list users (${listed.status}).`);
+		return;
+	}
+
+	const { users = [] } = (await listed.json()) as { users?: AdminUser[] };
+	const disposable = users.filter((user) => user.email && OWNED_EMAIL.test(user.email));
+
+	let failures = 0;
+	for (const user of disposable) {
+		const deleted = await adminRequest(`/auth/v1/admin/users/${user.id}`, { method: 'DELETE' });
+		if (!deleted?.ok) failures++;
+	}
+
+	console.log(
+		`BDD teardown removed ${disposable.length - failures} of ${disposable.length} test users.`
+	);
+}

tests/bdd/steps/account.steps.ts

@@ -28,11 +28,19 @@ Given('I am signed in', async ({ page, state }) => {
 	await expect(page).toHaveURL(/\/my-pokedexes$/);
 });
 
-Given('I am on the password reset page with a recovery session', async ({ page, state }) => {
+/**
+ * Deliberately an ordinary signed-in session, not a recovery one: following a real recovery
+ * action link currently bounces to /signin, because the browser client in src/routes/+layout.ts
+ * has no cookie `set`/`remove` method and so cannot persist the session it parses out of the
+ * URL. Until that is fixed, these scenarios cover the form, not the emailed-link flow - hence
+ * the step name. `createRecoveryLink` in ../support/app.ts is ready for when it is.
+ */
+Given('I am signed in on the password reset page', async ({ page, state }) => {
 	await createConfirmedUser(state);
 	await signIn(page, state);
 	await expect(page).toHaveURL(/\/my-pokedexes$/);
 	await page.goto('/reset-password');
+	await expect(page.getByLabel('New Password')).toBeVisible();
 });
 
 When('I register with valid account details', async ({ page, state }) => {

tests/bdd/steps/backup.steps.ts

@@ -72,7 +72,6 @@ When('I visit backup settings', async ({ page }) => {
 });
 
 When('I connect the mocked {string} provider', async ({ page }, provider: string) => {
-	await fetch(`${MOCK_URL}/__mock/reset`);
 	await page.goto('/backup-settings');
 	const card = page.locator('.card, .border').filter({ hasText: provider }).last();
 	await card.getByRole('button', { name: 'Connect' }).click();
@@ -125,29 +124,54 @@ Then('the backup connection is rejected', async ({ state }) => {
 	expect(state.lastResponseStatus).toBe(400);
 });
 
-Then('the mocked provider receives a valid escaped CSV', async () => {
+async function mockState() {
 	const response = await fetch(`${MOCK_URL}/__mock/state`);
-	const mock = (await response.json()) as { requests: Array<{ path: string; body: string }> };
-	const upload = mock.requests.find((request) => request.path.includes('upload'));
-	expect(upload?.body).toContain('"A comma, and a ""quote"""');
+	if (!response.ok) throw new Error(`Mock provider is unavailable: ${response.status}`);
+	return (await response.json()) as {
+		refreshes: number;
+		requests: Array<{ method: string; path: string; body: string }>;
+	};
+}
+
+Then('the mocked provider receives a valid escaped CSV', async () => {
+	const { requests } = await mockState();
+	const upload = requests.find((request) => request.path.includes('upload'));
+	expect(upload, 'no upload reached the mock provider').toBeDefined();
+	expect(upload!.body).toContain('"A comma, and a ""quote"""');
 });
 
-Then('the catch update remains saved', async ({ page, state }) => {
+Then('the note survives a reload', async ({ page, state }) => {
 	await page.goto(`/pokedex/${state.pokedexId}`);
 	await expect(firstPokemon(page)).toBeVisible();
 	await openFirstPokemon(page);
-	const dialog = page.getByRole('dialog');
-	const caught = dialog.getByText('Caught:', { exact: true }).locator('..').getByRole('checkbox');
-	const notes = dialog.getByLabel('Notes:');
-	expect((await caught.isChecked()) || (await notes.inputValue()).includes('comma')).toBe(true);
+	await expect(page.getByRole('dialog').getByLabel('Notes:')).toHaveValue('A comma, and a "quote"');
+});
+
+Then('the catch remains marked caught', async ({ page, state }) => {
+	await page.goto(`/pokedex/${state.pokedexId}`);
+	await expect(firstPokemon(page)).toBeVisible();
+	await openFirstPokemon(page);
+	const caught = page
+		.getByRole('dialog')
+		.getByText('Caught:', { exact: true })
+		.locator('..')
+		.getByRole('checkbox');
+	await expect(caught).toBeChecked();
 });
 
 Then('the token is refreshed before the mocked upload', async ({ state }) => {
 	expect(state.lastResponseStatus).toBe(200);
-	const response = await fetch(`${MOCK_URL}/__mock/state`);
-	const mock = (await response.json()) as { refreshes: number; requests: Array<{ path: string }> };
-	expect(mock.refreshes).toBeGreaterThan(0);
-	expect(mock.requests.some((request) => request.path.includes('upload'))).toBe(true);
+	const { refreshes, requests } = await mockState();
+	// Exactly one refresh, and it has to come before the upload it was needed for - a global
+	// ">= 1" would be satisfied by any earlier scenario's traffic.
+	expect(refreshes).toBe(1);
+	const refreshIndex = requests.findIndex(
+		(request) =>
+			request.path.endsWith('/token') && request.body.includes('grant_type=refresh_token')
+	);
+	const uploadIndex = requests.findIndex((request) => request.path.includes('upload'));
+	expect(refreshIndex).toBeGreaterThanOrEqual(0);
+	expect(uploadIndex).toBeGreaterThan(refreshIndex);
 });
 
 Then('the provider failure is shown in backup settings', async ({ page }) => {

tests/bdd/steps/pokedex-lifecycle.steps.ts

@@ -1,6 +1,6 @@
 import { createBdd } from 'playwright-bdd';
 import { test, expect } from '../fixtures';
-import { createDexThroughUi } from '../support/app';
+import { createDexThroughUi, deleteAllPokedexes } from '../support/app';
 
 const { Given, When, Then } = createBdd(test);
 
@@ -11,11 +11,10 @@ async function dexCard(page: Parameters<typeof createDexThroughUi>[0], name: str
 	return card;
 }
 
-Given('I have no Pokédexes', async ({ page }) => {
-	await page.goto('/my-pokedexes');
-	await expect(
-		page.locator('.card').filter({ has: page.getByRole('button', { name: 'View' }) })
-	).toHaveCount(0);
+// Establishes the precondition rather than asserting it - a fresh user happens to be empty,
+// which would make an assertion here pass without testing anything.
+Given('I have no Pokédexes', async ({ state }) => {
+	await deleteAllPokedexes(state);
 });
 
 Given('I have a Living Dex named {string}', async ({ page, state }, name: string) => {

tests/bdd/steps/progress.steps.ts

@@ -50,17 +50,27 @@ When('I add the note {string} to the first Pokémon', async ({ page }, note: str
 	await page.getByRole('dialog').getByLabel('Notes:').blur();
 });
 
+function boxContainer(page: Parameters<typeof firstPokemon>[0], box: number) {
+	return page
+		.getByRole('heading', { name: `Box ${box}`, exact: true })
+		.locator('..')
+		.locator('..');
+}
+
 When('I mark box {int} as caught', async ({ page }, box: number) => {
-	const heading = page.getByRole('heading', { name: `Box ${box}`, exact: true });
-	const container = heading.locator('..').locator('..');
+	const container = boxContainer(page, box);
 	await container.getByRole('button', { name: 'Open bulk actions menu' }).click();
 	await container.getByRole('button', { name: 'Mark box as Caught' }).click();
 });
 
-When('I filter to Pokémon that are not caught', async ({ page }) => {
+When('I filter to Pokémon that are not caught', async ({ page, state }) => {
 	if ((await page.getByRole('dialog').count()) > 0) {
 		await page.getByRole('dialog').getByRole('button', { name: 'Close', exact: true }).click();
 	}
+	// Remember which entry was caught, so the assertion can name it rather than trusting
+	// whichever entry happens to be first after filtering.
+	state.caughtEntryLabel = await firstPokemon(page).getAttribute('aria-label');
+	expect(state.caughtEntryLabel).toMatch(/Status: Caught/);
 	await page.getByText('Not caught', { exact: true }).locator('..').getByRole('checkbox').check();
 });
 
@@ -94,18 +104,31 @@ Then('its HOME state and note persist after reloading', async ({ page }) => {
 	);
 });
 
-Then('box {int} contains {int} caught Pokémon', async ({ page }, _box: number, count: number) => {
+Then('box {int} contains {int} caught Pokémon', async ({ page }, box: number, count: number) => {
 	await settleAndReload(page);
-	const firstBoxEntries = page
-		.getByRole('button', { name: /^View details for / })
-		.filter({ hasNot: page.locator('[disabled]') });
-	for (let index = 0; index < count; index++) {
-		await expect(firstBoxEntries.nth(index)).toHaveAttribute('aria-label', /Status: Caught/);
-	}
+	const entries = boxContainer(page, box).getByRole('button', { name: /^View details for / });
+	await expect(entries).toHaveCount(count);
+	const labels = await entries.evaluateAll((elements) =>
+		elements.map((element) => element.getAttribute('aria-label') ?? '')
+	);
+	expect(labels.filter((label) => /Status: Caught/.test(label))).toHaveLength(count);
 });
 
-Then('the caught Pokémon is filtered out', async ({ page }) => {
-	await expect(firstPokemon(page)).toHaveAttribute('aria-disabled', 'true');
+Then('the caught Pokémon is filtered out', async ({ page, state }) => {
+	const label = state.caughtEntryLabel;
+	if (!label) throw new Error('No caught entry was recorded before filtering');
+	// That specific entry is excluded...
+	await expect(page.getByRole('button', { name: label, exact: true })).toHaveAttribute(
+		'aria-disabled',
+		'true'
+	);
+	// ...and the filter did not simply exclude everything.
+	await expect(
+		page
+			.getByRole('button', { name: /^View details for / })
+			.and(page.locator('[aria-disabled="false"]'))
+			.first()
+	).toBeVisible();
 });
 
 Then('the {string} box layout remains selected', async ({ page }, layout: string) => {

tests/bdd/steps/pwa.steps.ts

@@ -17,6 +17,17 @@ async function waitForServiceWorker(page: Page) {
 	});
 }
 
+async function cacheContents(page: Page) {
+	return page.evaluate(async () => {
+		const contents: Record<string, string[]> = {};
+		for (const name of await caches.keys()) {
+			const cache = await caches.open(name);
+			contents[name] = (await cache.keys()).map((request) => request.url);
+		}
+		return contents;
+	});
+}
+
 When('I open the built application', async ({ page }) => {
 	await page.goto('/');
 	await waitForServiceWorker(page);
@@ -29,9 +40,16 @@ Given('I have opened the built application online', async ({ page }) => {
 	await page.reload();
 });
 
-When('I go offline and revisit the home page with a trailing slash', async ({ page }) => {
+When('I go offline and reload the home page', async ({ page }) => {
 	await page.context().setOffline(true);
-	await page.goto('/', { waitUntil: 'domcontentloaded' });
+	await page.reload({ waitUntil: 'domcontentloaded' });
+});
+
+When('I go offline and navigate to the sign-in page', async ({ page }) => {
+	await page.context().setOffline(true);
+	// Client-side navigation, which only works if the route's chunks were precached.
+	await page.getByRole('link', { name: 'Sign In' }).click();
+	await expect(page).toHaveURL(/\/signin$/);
 });
 
 When('I go offline and then return online', async ({ page }) => {
@@ -45,11 +63,45 @@ Then('a service worker controls the page', async ({ page }) => {
 	expect(await waitForServiceWorker(page)).toMatch(/\/(?:sw|prompt-sw)\.js$/);
 });
 
-Then('the application cache is present', async ({ page }) => {
-	const cacheNames = await page.evaluate(() => caches.keys());
-	expect(cacheNames.length).toBeGreaterThan(0);
+/**
+ * Replaces the deleted client-test/sw.spec.ts assertions. The precise entries differ by build
+ * strategy, so this checks the contract that matters: one workbox precache, the app shell and
+ * web manifest are in it, and `_app/immutable` assets are cached WITHOUT a revision query -
+ * that last one is the `dontCacheBustURLsMatching` behaviour, and it silently regresses.
+ */
+Then('the application shell is precached', async ({ page }) => {
+	const contents = await cacheContents(page);
+	const names = Object.keys(contents).filter((name) => name.startsWith('workbox-precache'));
+	expect(names).toHaveLength(1);
+
+	const origin = new URL(page.url()).origin;
+	const urls = contents[names[0]].map((url) => url.slice(`${origin}/`.length));
+
+	expect(urls, 'app shell is not precached').toContain('');
+	expect(
+		urls.some((url) => url.startsWith('manifest.webmanifest?__WB_REVISION__=')),
+		'revisioned manifest.webmanifest is not precached'
+	).toBe(true);
+	expect(
+		urls.some((url) => url.startsWith('_app/version.json?__WB_REVISION__=')),
+		'revisioned _app/version.json is not precached'
+	).toBe(true);
+
+	const immutable = urls.filter((url) => url.startsWith('_app/immutable/'));
+	expect(immutable.some((url) => url.endsWith('.css'))).toBe(true);
+	expect(immutable.some((url) => url.endsWith('.js'))).toBe(true);
+	expect(
+		immutable.filter((url) => url.includes('__WB_REVISION__')),
+		'immutable assets must not be cache-busted'
+	).toEqual([]);
 });
 
 Then('the application remains available', async ({ page }) => {
 	await expect(page.getByRole('heading', { name: /Start Your Pokédex Journey/ })).toBeVisible();
 });
+
+Then('the sign-in form is available offline', async ({ page }) => {
+	await expect(page.getByLabel('Email')).toBeVisible();
+	await expect(page.getByLabel('Password')).toBeVisible();
+	await expect(page.getByRole('button', { name: 'Sign In' })).toBeVisible();
+});

tests/bdd/support/app.ts

@@ -33,6 +33,44 @@ export async function createConfirmedUser(state: ScenarioState): Promise<void> {
 	state.userId = body.id;
 }
 
+export async function deleteAllPokedexes(state: ScenarioState): Promise<void> {
+	const key = requireServiceRoleKey();
+	if (!state.userId) throw new Error('A confirmed user is required before clearing Pokédexes');
+	const response = await fetch(
+		`${SUPABASE_URL}/rest/v1/pokedexes?userId=eq.${encodeURIComponent(state.userId)}`,
+		{ method: 'DELETE', headers: { apikey: key, Authorization: `Bearer ${key}` } }
+	);
+	if (!response.ok) throw new Error(`Unable to clear Pokédexes: ${await response.text()}`);
+}
+
+/**
+ * Asks Supabase for a real recovery action link - the same token-bearing URL the emailed link
+ * carries - so the reset scenarios exercise token verification rather than an ordinary session.
+ * `redirectTo` must be listed in `auth.additional_redirect_urls` in supabase/config.toml.
+ */
+export async function createRecoveryLink(
+	state: ScenarioState,
+	redirectTo: string
+): Promise<string> {
+	const key = requireServiceRoleKey();
+	const response = await fetch(`${SUPABASE_URL}/auth/v1/admin/generate_link`, {
+		method: 'POST',
+		headers: {
+			apikey: key,
+			Authorization: `Bearer ${key}`,
+			'Content-Type': 'application/json'
+		},
+		body: JSON.stringify({ type: 'recovery', email: state.email, redirect_to: redirectTo })
+	});
+	if (!response.ok)
+		throw new Error(
+			`Unable to generate a recovery link: ${response.status} ${await response.text()}`
+		);
+	const body = (await response.json()) as { action_link?: string };
+	if (!body.action_link) throw new Error('Supabase returned no recovery action link');
+	return body.action_link;
+}
+
 export async function signIn(page: Page, state: ScenarioState, password = state.password) {
 	await page.goto('/signin');
 	await page.getByLabel('Email').fill(state.email);

tests/integration/defaultForm.integration.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, beforeAll } from 'vitest';
 import { createClient, type SupabaseClient } from '@supabase/supabase-js';
-import CombinedDataRepository from '../../src/lib/repositories/CombinedDataRepository';
+import CombinedDataRepository from '$lib/repositories/CombinedDataRepository';
 import { readRepoCsv } from '../support/csv';
 
 /**
@@ -9,14 +9,22 @@ import { readRepoCsv } from '../support/csv';
  * fix branch makes the same assertions pass without test-only schema knowledge.
  */
 const SUPABASE_URL = process.env.TEST_SUPABASE_URL ?? 'http://127.0.0.1:54321';
-const SUPABASE_KEY =
-	process.env.TEST_SUPABASE_ANON_KEY ??
-	'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0';
+const SETUP_HINT =
+	'Run integration tests through "npm run test:integration", which reads the local keys from "supabase status".';
+
+// No baked-in key: a fallback would silently point a misconfigured run at the wrong stack
+// instead of failing with the instruction above.
+function requireAnonKey(): string {
+	const key = process.env.TEST_SUPABASE_ANON_KEY;
+	if (!key) throw new Error(`Integration tests require TEST_SUPABASE_ANON_KEY. ${SETUP_HINT}`);
+	return key;
+}
 
 async function requireSupabase() {
+	const key = requireAnonKey();
 	try {
 		const res = await fetch(`${SUPABASE_URL}/rest/v1/pokedex_entries?select=id&limit=1`, {
-			headers: { apikey: SUPABASE_KEY, Authorization: `Bearer ${SUPABASE_KEY}` },
+			headers: { apikey: key, Authorization: `Bearer ${key}` },
 			signal: AbortSignal.timeout(2000)
 		});
 		if (!res.ok) throw new Error(`HTTP ${res.status}: ${await res.text()}`);
@@ -43,7 +51,7 @@ describe('pokedex behavior regressions', () => {
 
 	beforeAll(async () => {
 		await requireSupabase();
-		supabase = createClient(SUPABASE_URL, SUPABASE_KEY);
+		supabase = createClient(SUPABASE_URL, requireAnonKey());
 		const all: Row[] = [];
 		for (let from = 0; ; from += 1000) {
 			const { data, error } = await supabase
@@ -118,9 +126,7 @@ describe('pokedex behavior regressions', () => {
 	});
 
 	it('returns every expected entry despite the PostgREST row cap', async () => {
-		const { calculateExpectedEntries } = await import(
-			'../../src/lib/services/PokedexMappingService'
-		);
+		const { calculateExpectedEntries } = await import('$lib/services/PokedexMappingService');
 		const baseDex = {
 			id: 'test',
 			name: 'test',

tests/support/csv.ts

@@ -56,6 +56,13 @@ export function readRepoCsv(relativePath: string): CsvRow[] {
 	return parseCsv(readFileSync(resolve(process.cwd(), relativePath), 'utf8'));
 }
 
+/**
+ * Typographic and straight apostrophes are the same identity here (Farfetch'd, Sirfetch'd), so
+ * the comparison absorbs the difference rather than forcing every data file to agree on one
+ * code point.
+ */
 export function normalizedIdentity(...parts: Array<string | null | undefined>): string {
-	return parts.map((part) => (part ?? '').trim().toLocaleLowerCase('en-GB')).join('|');
+	return parts
+		.map((part) => (part ?? '').trim().replace(/[‘’ʼ]/g, "'").toLocaleLowerCase('en-GB'))
+		.join('|');
 }

tests/unit/auth.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
-import { getOptionalUserId, requireAuth } from '../../src/lib/utils/auth';
+import { getOptionalUserId, requireAuth } from '$lib/utils/auth';
 
 function eventReturning(value: unknown) {
 	return { locals: { safeGetSession: vi.fn(async () => value) } } as never;

tests/unit/boxPlacement.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { calculateBoxNumbers, calculateBoxPlacement } from '../../src/lib/utils/boxPlacement';
+import { calculateBoxNumbers, calculateBoxPlacement } from '$lib/utils/boxPlacement';
 
 describe('box placement', () => {
 	it.each([

tests/unit/catchRecordWriteQueue.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { createCatchRecordWriteQueue } from '../../src/lib/utils/catchRecordWriteQueue';
-import type { CatchRecord } from '../../src/lib/models/CatchRecord';
+import { createCatchRecordWriteQueue } from '$lib/utils/catchRecordWriteQueue';
+import type { CatchRecord } from '$lib/models/CatchRecord';
 
 function mkRecord(overrides: Partial<CatchRecord> = {}): CatchRecord {
 	return {

tests/unit/combinedDataRepository.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import CombinedDataRepository from '../../src/lib/repositories/CombinedDataRepository';
+import CombinedDataRepository from '$lib/repositories/CombinedDataRepository';
 
 type Call = { method: string; args: unknown[] };
 type TableQuery = { table: string; calls: Call[] };

tests/unit/oauthState.test.ts

@@ -5,7 +5,7 @@ import {
 	readOAuthStateCookie,
 	setOAuthStateCookie,
 	type OAuthStatePayload
-} from '../../src/lib/utils/oauthState';
+} from '$lib/utils/oauthState';
 
 function eventWithCookie(raw?: string) {
 	return {

tests/unit/regionalDexMapping.test.ts

@@ -4,7 +4,7 @@ import {
 	getRegionalDexFieldName,
 	getRegionalDexKey,
 	hasRegionalDex
-} from '../../src/lib/utils/regionalDexMapping';
+} from '$lib/utils/regionalDexMapping';
 
 describe('regional dex mapping', () => {
 	it.each([

vitest.config.mts

@@ -15,19 +15,17 @@ export default defineConfig({
 			provider: 'v8',
 			reporter: ['text', 'json-summary', 'html'],
 			reportsDirectory: 'coverage',
-			include: [
-				'src/lib/utils/boxPlacement.ts',
-				'src/lib/utils/catchRecordWriteQueue.ts',
-				'src/lib/utils/oauthState.ts',
-				'src/lib/utils/regionalDexMapping.ts',
-				'src/lib/services/PokedexExportFormatting.ts'
-			],
+			// The whole library surface is measured, so anything new and untested drags the
+			// numbers down instead of being invisible to the gate. Excluded here: type-only
+			// models, and the store/action modules that only run in a browser.
+			include: ['src/lib/**/*.ts'],
+			exclude: ['src/lib/models/**', 'src/lib/stores/**', 'src/lib/actions/**'],
+			// Set to the measured baseline. Ratchet these up as coverage grows; never down.
 			thresholds: {
-				perFile: true,
-				statements: 90,
-				functions: 90,
-				lines: 90,
-				branches: 80
+				statements: 33,
+				functions: 73,
+				lines: 33,
+				branches: 79
 			}
 		}
 	}