test: make the suite's assertions falsifiable and its state isolated

Several assertions could not fail:

- "the catch update remains saved" was `caught.isChecked() || notes.includes(...)`
  shared by two scenarios, so either half satisfied both. Split into two steps
  that each assert the outcome their own scenario is about.
- The token-refresh check read a global counter with `> 0` and asserted an upload
  had happened `some(...)`, both already satisfied by the preceding scenario. It
  now asserts exactly one refresh, ordered before the upload.
- The box step ignored its box argument and asserted on the first N entries on
  the page; it now scopes to that box and checks its full contents.
- The filter step asserted on whichever entry was first after filtering; it now
  records the caught entry beforehand and names it, and checks the filter did not
  exclude everything.
- The empty-state precondition asserted emptiness instead of establishing it,
  which a fresh user satisfies for free.
- Offline coverage was `caches.keys().length > 0`. It now checks the precache
  contract: one workbox cache holding the shell and a revisioned web manifest,
  with _app/immutable assets cached without a revision query. The scenario that
  claimed to test a trailing slash did not; it is replaced with real offline
  client-side navigation.

The mock provider kept recorded requests, its refresh counter and the
fail-uploads switch in one process-wide object that only one step reset, so
scenario order was load-bearing and the failing-upload scenario poisoned
everything after it. An auto fixture now resets it per scenario, and the mock no
longer records its own control-plane calls. That reset is why the suite stays on
a single worker, which is now documented.

Coverage was gated at 90% per file over an allowlist of exactly the five files
that had tests, so new code was invisible to it permanently. It now measures all
of src/lib with global thresholds at the measured baseline, and no longer runs
the unit tests twice.

Also: a global teardown removes the users each run creates, the Supabase wrapper
distinguishes a stopped stack from a broken CLI call and detects an unseeded
database, the sign-in rate limit is raised above what one serial run needs, and
the integration suite no longer falls back to a hard-coded anon key that would
mask a misconfigured run.

The password-reset scenarios are renamed to what they actually cover: following a
real recovery link bounces to /signin, because the browser client persists no
cookies and so cannot keep the session it parses out of the URL. The helper for
the real flow is left in place and the gap is documented.

tests/bdd/steps/account.steps.ts

@@ -28,11 +28,19 @@ Given('I am signed in', async ({ page, state }) => {
 	await expect(page).toHaveURL(/\/my-pokedexes$/);
 });
 
-Given('I am on the password reset page with a recovery session', async ({ page, state }) => {
+/**
+ * Deliberately an ordinary signed-in session, not a recovery one: following a real recovery
+ * action link currently bounces to /signin, because the browser client in src/routes/+layout.ts
+ * has no cookie `set`/`remove` method and so cannot persist the session it parses out of the
+ * URL. Until that is fixed, these scenarios cover the form, not the emailed-link flow - hence
+ * the step name. `createRecoveryLink` in ../support/app.ts is ready for when it is.
+ */
+Given('I am signed in on the password reset page', async ({ page, state }) => {
 	await createConfirmedUser(state);
 	await signIn(page, state);
 	await expect(page).toHaveURL(/\/my-pokedexes$/);
 	await page.goto('/reset-password');
+	await expect(page.getByLabel('New Password')).toBeVisible();
 });
 
 When('I register with valid account details', async ({ page, state }) => {

tests/bdd/steps/backup.steps.ts

@@ -72,7 +72,6 @@ When('I visit backup settings', async ({ page }) => {
 });
 
 When('I connect the mocked {string} provider', async ({ page }, provider: string) => {
-	await fetch(`${MOCK_URL}/__mock/reset`);
 	await page.goto('/backup-settings');
 	const card = page.locator('.card, .border').filter({ hasText: provider }).last();
 	await card.getByRole('button', { name: 'Connect' }).click();
@@ -125,29 +124,54 @@ Then('the backup connection is rejected', async ({ state }) => {
 	expect(state.lastResponseStatus).toBe(400);
 });
 
-Then('the mocked provider receives a valid escaped CSV', async () => {
+async function mockState() {
 	const response = await fetch(`${MOCK_URL}/__mock/state`);
-	const mock = (await response.json()) as { requests: Array<{ path: string; body: string }> };
-	const upload = mock.requests.find((request) => request.path.includes('upload'));
-	expect(upload?.body).toContain('"A comma, and a ""quote"""');
+	if (!response.ok) throw new Error(`Mock provider is unavailable: ${response.status}`);
+	return (await response.json()) as {
+		refreshes: number;
+		requests: Array<{ method: string; path: string; body: string }>;
+	};
+}
+
+Then('the mocked provider receives a valid escaped CSV', async () => {
+	const { requests } = await mockState();
+	const upload = requests.find((request) => request.path.includes('upload'));
+	expect(upload, 'no upload reached the mock provider').toBeDefined();
+	expect(upload!.body).toContain('"A comma, and a ""quote"""');
 });
 
-Then('the catch update remains saved', async ({ page, state }) => {
+Then('the note survives a reload', async ({ page, state }) => {
 	await page.goto(`/pokedex/${state.pokedexId}`);
 	await expect(firstPokemon(page)).toBeVisible();
 	await openFirstPokemon(page);
-	const dialog = page.getByRole('dialog');
-	const caught = dialog.getByText('Caught:', { exact: true }).locator('..').getByRole('checkbox');
-	const notes = dialog.getByLabel('Notes:');
-	expect((await caught.isChecked()) || (await notes.inputValue()).includes('comma')).toBe(true);
+	await expect(page.getByRole('dialog').getByLabel('Notes:')).toHaveValue('A comma, and a "quote"');
+});
+
+Then('the catch remains marked caught', async ({ page, state }) => {
+	await page.goto(`/pokedex/${state.pokedexId}`);
+	await expect(firstPokemon(page)).toBeVisible();
+	await openFirstPokemon(page);
+	const caught = page
+		.getByRole('dialog')
+		.getByText('Caught:', { exact: true })
+		.locator('..')
+		.getByRole('checkbox');
+	await expect(caught).toBeChecked();
 });
 
 Then('the token is refreshed before the mocked upload', async ({ state }) => {
 	expect(state.lastResponseStatus).toBe(200);
-	const response = await fetch(`${MOCK_URL}/__mock/state`);
-	const mock = (await response.json()) as { refreshes: number; requests: Array<{ path: string }> };
-	expect(mock.refreshes).toBeGreaterThan(0);
-	expect(mock.requests.some((request) => request.path.includes('upload'))).toBe(true);
+	const { refreshes, requests } = await mockState();
+	// Exactly one refresh, and it has to come before the upload it was needed for - a global
+	// ">= 1" would be satisfied by any earlier scenario's traffic.
+	expect(refreshes).toBe(1);
+	const refreshIndex = requests.findIndex(
+		(request) =>
+			request.path.endsWith('/token') && request.body.includes('grant_type=refresh_token')
+	);
+	const uploadIndex = requests.findIndex((request) => request.path.includes('upload'));
+	expect(refreshIndex).toBeGreaterThanOrEqual(0);
+	expect(uploadIndex).toBeGreaterThan(refreshIndex);
 });
 
 Then('the provider failure is shown in backup settings', async ({ page }) => {

tests/bdd/steps/pokedex-lifecycle.steps.ts

@@ -1,6 +1,6 @@
 import { createBdd } from 'playwright-bdd';
 import { test, expect } from '../fixtures';
-import { createDexThroughUi } from '../support/app';
+import { createDexThroughUi, deleteAllPokedexes } from '../support/app';
 
 const { Given, When, Then } = createBdd(test);
 
@@ -11,11 +11,10 @@ async function dexCard(page: Parameters<typeof createDexThroughUi>[0], name: str
 	return card;
 }
 
-Given('I have no Pokédexes', async ({ page }) => {
-	await page.goto('/my-pokedexes');
-	await expect(
-		page.locator('.card').filter({ has: page.getByRole('button', { name: 'View' }) })
-	).toHaveCount(0);
+// Establishes the precondition rather than asserting it - a fresh user happens to be empty,
+// which would make an assertion here pass without testing anything.
+Given('I have no Pokédexes', async ({ state }) => {
+	await deleteAllPokedexes(state);
 });
 
 Given('I have a Living Dex named {string}', async ({ page, state }, name: string) => {

tests/bdd/steps/progress.steps.ts

@@ -50,17 +50,27 @@ When('I add the note {string} to the first Pokémon', async ({ page }, note: str
 	await page.getByRole('dialog').getByLabel('Notes:').blur();
 });
 
+function boxContainer(page: Parameters<typeof firstPokemon>[0], box: number) {
+	return page
+		.getByRole('heading', { name: `Box ${box}`, exact: true })
+		.locator('..')
+		.locator('..');
+}
+
 When('I mark box {int} as caught', async ({ page }, box: number) => {
-	const heading = page.getByRole('heading', { name: `Box ${box}`, exact: true });
-	const container = heading.locator('..').locator('..');
+	const container = boxContainer(page, box);
 	await container.getByRole('button', { name: 'Open bulk actions menu' }).click();
 	await container.getByRole('button', { name: 'Mark box as Caught' }).click();
 });
 
-When('I filter to Pokémon that are not caught', async ({ page }) => {
+When('I filter to Pokémon that are not caught', async ({ page, state }) => {
 	if ((await page.getByRole('dialog').count()) > 0) {
 		await page.getByRole('dialog').getByRole('button', { name: 'Close', exact: true }).click();
 	}
+	// Remember which entry was caught, so the assertion can name it rather than trusting
+	// whichever entry happens to be first after filtering.
+	state.caughtEntryLabel = await firstPokemon(page).getAttribute('aria-label');
+	expect(state.caughtEntryLabel).toMatch(/Status: Caught/);
 	await page.getByText('Not caught', { exact: true }).locator('..').getByRole('checkbox').check();
 });
 
@@ -94,18 +104,31 @@ Then('its HOME state and note persist after reloading', async ({ page }) => {
 	);
 });
 
-Then('box {int} contains {int} caught Pokémon', async ({ page }, _box: number, count: number) => {
+Then('box {int} contains {int} caught Pokémon', async ({ page }, box: number, count: number) => {
 	await settleAndReload(page);
-	const firstBoxEntries = page
-		.getByRole('button', { name: /^View details for / })
-		.filter({ hasNot: page.locator('[disabled]') });
-	for (let index = 0; index < count; index++) {
-		await expect(firstBoxEntries.nth(index)).toHaveAttribute('aria-label', /Status: Caught/);
-	}
+	const entries = boxContainer(page, box).getByRole('button', { name: /^View details for / });
+	await expect(entries).toHaveCount(count);
+	const labels = await entries.evaluateAll((elements) =>
+		elements.map((element) => element.getAttribute('aria-label') ?? '')
+	);
+	expect(labels.filter((label) => /Status: Caught/.test(label))).toHaveLength(count);
 });
 
-Then('the caught Pokémon is filtered out', async ({ page }) => {
-	await expect(firstPokemon(page)).toHaveAttribute('aria-disabled', 'true');
+Then('the caught Pokémon is filtered out', async ({ page, state }) => {
+	const label = state.caughtEntryLabel;
+	if (!label) throw new Error('No caught entry was recorded before filtering');
+	// That specific entry is excluded...
+	await expect(page.getByRole('button', { name: label, exact: true })).toHaveAttribute(
+		'aria-disabled',
+		'true'
+	);
+	// ...and the filter did not simply exclude everything.
+	await expect(
+		page
+			.getByRole('button', { name: /^View details for / })
+			.and(page.locator('[aria-disabled="false"]'))
+			.first()
+	).toBeVisible();
 });
 
 Then('the {string} box layout remains selected', async ({ page }, layout: string) => {

tests/bdd/steps/pwa.steps.ts

@@ -17,6 +17,17 @@ async function waitForServiceWorker(page: Page) {
 	});
 }
 
+async function cacheContents(page: Page) {
+	return page.evaluate(async () => {
+		const contents: Record<string, string[]> = {};
+		for (const name of await caches.keys()) {
+			const cache = await caches.open(name);
+			contents[name] = (await cache.keys()).map((request) => request.url);
+		}
+		return contents;
+	});
+}
+
 When('I open the built application', async ({ page }) => {
 	await page.goto('/');
 	await waitForServiceWorker(page);
@@ -29,9 +40,16 @@ Given('I have opened the built application online', async ({ page }) => {
 	await page.reload();
 });
 
-When('I go offline and revisit the home page with a trailing slash', async ({ page }) => {
+When('I go offline and reload the home page', async ({ page }) => {
 	await page.context().setOffline(true);
-	await page.goto('/', { waitUntil: 'domcontentloaded' });
+	await page.reload({ waitUntil: 'domcontentloaded' });
+});
+
+When('I go offline and navigate to the sign-in page', async ({ page }) => {
+	await page.context().setOffline(true);
+	// Client-side navigation, which only works if the route's chunks were precached.
+	await page.getByRole('link', { name: 'Sign In' }).click();
+	await expect(page).toHaveURL(/\/signin$/);
 });
 
 When('I go offline and then return online', async ({ page }) => {
@@ -45,11 +63,45 @@ Then('a service worker controls the page', async ({ page }) => {
 	expect(await waitForServiceWorker(page)).toMatch(/\/(?:sw|prompt-sw)\.js$/);
 });
 
-Then('the application cache is present', async ({ page }) => {
-	const cacheNames = await page.evaluate(() => caches.keys());
-	expect(cacheNames.length).toBeGreaterThan(0);
+/**
+ * Replaces the deleted client-test/sw.spec.ts assertions. The precise entries differ by build
+ * strategy, so this checks the contract that matters: one workbox precache, the app shell and
+ * web manifest are in it, and `_app/immutable` assets are cached WITHOUT a revision query -
+ * that last one is the `dontCacheBustURLsMatching` behaviour, and it silently regresses.
+ */
+Then('the application shell is precached', async ({ page }) => {
+	const contents = await cacheContents(page);
+	const names = Object.keys(contents).filter((name) => name.startsWith('workbox-precache'));
+	expect(names).toHaveLength(1);
+
+	const origin = new URL(page.url()).origin;
+	const urls = contents[names[0]].map((url) => url.slice(`${origin}/`.length));
+
+	expect(urls, 'app shell is not precached').toContain('');
+	expect(
+		urls.some((url) => url.startsWith('manifest.webmanifest?__WB_REVISION__=')),
+		'revisioned manifest.webmanifest is not precached'
+	).toBe(true);
+	expect(
+		urls.some((url) => url.startsWith('_app/version.json?__WB_REVISION__=')),
+		'revisioned _app/version.json is not precached'
+	).toBe(true);
+
+	const immutable = urls.filter((url) => url.startsWith('_app/immutable/'));
+	expect(immutable.some((url) => url.endsWith('.css'))).toBe(true);
+	expect(immutable.some((url) => url.endsWith('.js'))).toBe(true);
+	expect(
+		immutable.filter((url) => url.includes('__WB_REVISION__')),
+		'immutable assets must not be cache-busted'
+	).toEqual([]);
 });
 
 Then('the application remains available', async ({ page }) => {
 	await expect(page.getByRole('heading', { name: /Start Your Pokédex Journey/ })).toBeVisible();
 });
+
+Then('the sign-in form is available offline', async ({ page }) => {
+	await expect(page.getByLabel('Email')).toBeVisible();
+	await expect(page.getByLabel('Password')).toBeVisible();
+	await expect(page.getByRole('button', { name: 'Sign In' })).toBeVisible();
+});