@cosmicdrift/kumiko-testing 0.387.0 → 0.389.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-testing",
-  "version": "0.387.0",
+  "version": "0.389.0",
   "description": "Test template for Kumiko apps: per-flow seedTenant, app test stack, canonical test preloads, bunfig generator and integration runner.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -34,6 +34,10 @@
       "types": "./src/helpers/index.ts",
       "default": "./src/helpers/index.ts"
     },
+    "./helpers/mock-module": {
+      "types": "./src/helpers/mock-module.ts",
+      "default": "./src/helpers/mock-module.ts"
+    },
     "./helpers/real-providers": {
       "types": "./src/helpers/real-providers.ts",
       "default": "./src/helpers/real-providers.ts"
@@ -99,9 +103,9 @@
     "kumiko-testing": "./bin/kumiko-testing.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.387.0",
-    "@cosmicdrift/kumiko-guards": "0.387.0",
-    "@cosmicdrift/kumiko-types": "0.387.0",
+    "@cosmicdrift/kumiko-framework": "0.389.0",
+    "@cosmicdrift/kumiko-guards": "0.389.0",
+    "@cosmicdrift/kumiko-types": "0.389.0",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
@@ -125,8 +129,8 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.387.0",
-    "@cosmicdrift/kumiko-dev-server": "0.387.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
+    "@cosmicdrift/kumiko-dev-server": "0.389.0",
     "@happy-dom/global-registrator": "^20.11.2",
     "@playwright/test": "^1.62.1",
     "@testing-library/dom": "^10.4.1",

package/src/changes.json

@@ -1,4 +1,60 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "captureClosedConnectionError returns a Bun.SQL error",
+    "detail": "The helper opens Bun.SQL pools, so the captured error has the code ERR_POSTGRES_CONNECTION_CLOSED instead of the postgres-js CONNECTION_CLOSED. The client of createTestDb is the connection handle's listenClient, the same Bun.SQL pool as before.",
+    "migration": "Tests that compared the captured error's code with CONNECTION_CLOSED compare with ERR_POSTGRES_CONNECTION_CLOSED or call isClosedConnectionError. Manual migration, there is no codemod."
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "e2e tests fail after more than 8 app boots; the per-test client IP no longer disables the HTTP cache",
+    "detail": "The test fixture sent the per-test X-Forwarded-For through context.route, which turns Chromium's HTTP cache off for the whole context, so every page.goto re-downloaded all assets and GET /api/schema. It now uses setExtraHTTPHeaders and the cache stays on. The fixture also counts GET /api/schema per test and fails a passing test that boots the app more than 8 times (default of the new maxAppBootsPerTest fixture option), and closes pages left open (window.open tabs) before the context closes.",
+    "migration": "Seed through tenant.api, tenant.seed and tenant.addUser instead of calling page.goto(APP_BASE_PATH) before every seed; each page.goto reloads the app. runMatrix and runScreenshots boot the app once per test themselves, so they need no change; only your own scenario flows or specs that navigate on purpose raise the budget with test.use({ maxAppBootsPerTest: <n> }). Manual migration, there is no codemod. The X-Forwarded-For header is now sent on every request of the context, including cross-origin ones."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "loginViaUi no longer races the MFA auto-submit",
+    "detail": "The MFA code field submits itself on the sixth digit since 0.388. loginViaUi now fills the code while waiting for the verify response and no longer presses Enter on a field that may already be disabled."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "consoleCallsFromNamespace test helper for silent-log assertions",
+    "detail": "Filters a console spy by logger namespace prefix, so a new or reworded warning from the module under test fails a silent test. The boot-validator, client-ip and settings-hub silent tests use it."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "mockModuleForFile restores module mocks automatically",
+    "detail": "bun's mock.module is process-global, so tests had to copy the real module and restore it by hand in afterAll. The helper does both and can point re-exporting modules back at the real export."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "E2E specs can present stable identities around their own screenshots",
+    "detail": "withPresentedIdentities replaces generated identities in page text and form values, runs the callback and restores the originals in a finally block. The lower-level present and restore functions are exported too."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "setupTestStack split into setup phases",
+    "detail": "setupTestStack() keeps its signature and behavior. Feature validation, storage provisioning with its DDL cleanup, cache sync, services, the job runner and the server start are separate phases in stack/test-stack-setup.ts. The cleanup on a failed setup still stops the job runner, closes cache sync and drops the test database and Redis in that order."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Barrier, SSE reader, boundary guard and Redis helper fixes",
+    "detail": "createBarrier rejects late arrivals after a timeout instead of hanging. readSseFrames accepts CRLF and CR line endings. The error-boundary guard observes every page of the context and no longer fails on closed pages. createTestRedis disconnects the client when the initial connect fails. createE2eSeedRoutes of the e2e/seed-route subpath is also available as createE2eSeedRoutesWith, the old name stays as a deprecated alias."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "consoleCallsMentioning helper for console spies",
+    "detail": "`@cosmicdrift/kumiko-testing/helpers` exports `consoleCallsMentioning(spy, fragment)` and `ConsoleSpyLike`, replacing the per-file filters tests used to ignore console output of other test files."
+  },
   {
     "version": "0.386.0",
     "type": "fix",

package/src/e2e/app-boot-budget.ts

@@ -0,0 +1,22 @@
+import type { BrowserContext } from "@playwright/test";
+
+// Duplicated from kumiko-renderer (APP_SCHEMA_API_PATH): kumiko-testing does not depend on the renderer.
+export const APP_SCHEMA_API_PATH = "/api/schema";
+
+export const DEFAULT_MAX_APP_BOOTS_PER_TEST = 8;
+
+// Every app boot fetches the schema once, so the request count is the number of page loads.
+export function observeAppBoots(context: Pick<BrowserContext, "on">): {
+  readonly count: () => number;
+} {
+  let bootCount = 0;
+  context.on("request", (request) => {
+    if (new URL(request.url()).pathname === APP_SCHEMA_API_PATH) bootCount += 1;
+  });
+  return { count: () => bootCount };
+}
+
+export function appBootBudgetViolation(bootCount: number, maxBoots: number): string | undefined {
+  if (bootCount <= maxBoots) return undefined;
+  return `This test booted the app ${bootCount} times (GET ${APP_SCHEMA_API_PATH}), budget is ${maxBoots}. Seed through tenant.api instead of page.goto per seed; each page.goto reloads the app. Specs that navigate on purpose (screenshot scenarios) raise the budget with test.use({ maxAppBootsPerTest }).`;
+}

package/src/e2e/auth-kit.ts

@@ -273,8 +273,14 @@ export async function loginViaUi(page: Page, credentials: LoginCredentials): Pro
   // avoids racing the transition from the password form.
   const codeField = page.locator("#mfa-verify-code");
   await expect(codeField).toBeVisible();
-  await codeField.fill(await unburnedTotpCode(credentials.mfaTotpSecret));
-  await codeField.press("Enter");
+  const code = await unburnedTotpCode(credentials.mfaTotpSecret);
+  // The sixth digit submits on its own and disables the field; an Enter press would race that.
+  await Promise.all([
+    page.waitForResponse(
+      (response) => response.url().includes("/api/auth/mfa/verify") && response.ok(),
+    ),
+    codeField.fill(code),
+  ]);
   await expect(codeField).toHaveCount(0);
 }
 

package/src/e2e/boundary-guard.ts

@@ -3,7 +3,40 @@ import {
   ROOT_ERROR_FALLBACK_TEST_ID,
   SCREEN_ERROR_FALLBACK_TEST_ID,
 } from "@cosmicdrift/kumiko-types/error-boundary";
-import { test as base, expect } from "@playwright/test";
+import { type BrowserContext, test as base, expect } from "@playwright/test";
+
+export type BoundaryFindings = {
+  readonly boundaryLogs: readonly string[];
+  readonly visibleFallbacks: number;
+};
+
+const FALLBACK_SELECTOR = `[data-testid="${SCREEN_ERROR_FALLBACK_TEST_ID}"], [data-testid="${ROOT_ERROR_FALLBACK_TEST_ID}"]`;
+
+// Listens on the context so pages opened later (popups, context.newPage()) are covered too.
+export function observeErrorBoundaries(context: BrowserContext): {
+  readonly findings: () => Promise<BoundaryFindings>;
+} {
+  const boundaryLogs: string[] = [];
+  context.on("console", (msg) => {
+    if (msg.type() === "error" && msg.text().includes(ERROR_BOUNDARY_LOG_MARKER)) {
+      boundaryLogs.push(msg.text());
+    }
+  });
+  return {
+    async findings() {
+      let visibleFallbacks = 0;
+      for (const page of context.pages()) {
+        // A spec may close its page or a page may crash; counting then would throw and mask the test result.
+        if (page.isClosed()) continue;
+        visibleFallbacks += await page
+          .locator(FALLBACK_SELECTOR)
+          .count()
+          .catch(() => 0);
+      }
+      return { boundaryLogs: [...boundaryLogs], visibleFallbacks };
+    },
+  };
+}
 
 // An error boundary keeps the page alive, which also hides the failure from `pageerror`.
 // Every spec using `test` from this package fails when a boundary caught something.
@@ -13,21 +46,12 @@ export const boundaryGuardedTest = base.extend<{
 }>({
   expectErrorBoundary: [false, { option: true }],
   failOnErrorBoundary: [
-    async ({ page, expectErrorBoundary }, use) => {
-      const boundaryLogs: string[] = [];
-      page.on("console", (msg) => {
-        if (msg.type() === "error" && msg.text().includes(ERROR_BOUNDARY_LOG_MARKER)) {
-          boundaryLogs.push(msg.text());
-        }
-      });
+    async ({ context, expectErrorBoundary }, use) => {
+      const observer = observeErrorBoundaries(context);
       await use(undefined);
       // skip: the spec provokes a boundary on purpose and asserts the fallback itself
       if (expectErrorBoundary) return;
-      const visibleFallbacks = await page
-        .locator(
-          `[data-testid="${SCREEN_ERROR_FALLBACK_TEST_ID}"], [data-testid="${ROOT_ERROR_FALLBACK_TEST_ID}"]`,
-        )
-        .count();
+      const { boundaryLogs, visibleFallbacks } = await observer.findings();
       expect(
         { boundaryLogs, visibleFallbacks },
         "an error boundary caught a render/effect error",

package/src/e2e/index.ts

@@ -22,7 +22,11 @@ export {
   syntheticClientIpFor,
   totpCode,
 } from "./auth-kit";
-export { boundaryGuardedTest } from "./boundary-guard";
+export {
+  type BoundaryFindings,
+  boundaryGuardedTest,
+  observeErrorBoundaries,
+} from "./boundary-guard";
 export {
   CSRF_COOKIE_NAME,
   CSRF_HEADER_NAME,
@@ -47,6 +51,12 @@ export {
 } from "./mail-links";
 export { pinEnglishLocale } from "./pin-english-locale";
 export { pollForRow, waitForProjection } from "./poll";
+export {
+  type PresentIdentity,
+  presentIdentitiesOnPage,
+  restoreIdentitiesOnPage,
+  withPresentedIdentities,
+} from "./present-identities";
 export {
   requireScreenshotDir,
   SCREENSHOT_DIR_ENV,
@@ -62,7 +72,6 @@ export {
   type FlatOptions,
   findIdenticalThemeScreenshots,
   type MatrixOptions,
-  type PresentIdentity,
   runMatrix,
   runScreenshots,
   type Scenario,

package/src/e2e/present-identities.ts

@@ -0,0 +1,90 @@
+import type { Page } from "@playwright/test";
+
+// Seeded identities are unique per run (admin-<tenantId>@…), so a screenshot
+// would show a different address every time. Replaced in the page's text and
+// form values right before each capture; the seeded data stays untouched.
+export interface PresentIdentity {
+  readonly from: string;
+  readonly to: string;
+}
+
+export function assertPresentableMappings(mappings: readonly PresentIdentity[]): void {
+  for (const { from } of mappings) {
+    if (from === "") throw new Error("presentIdentities: `from` must not be empty");
+  }
+}
+
+declare global {
+  interface Window {
+    __kumikoPresentRestore?: Array<() => void>;
+  }
+}
+
+// Runs in the browser, so it may not reference module scope. Originals are kept
+// on window so a later evaluate can put them back (captureScreenshot runs
+// mid-flow, where the spec keeps asserting and submitting forms).
+function replaceIdentitiesInDocument(mappings: readonly PresentIdentity[]): void {
+  window.__kumikoPresentRestore ??= [];
+  const restorers = window.__kumikoPresentRestore;
+  const present = (text: string): string =>
+    mappings.reduce((current, { from, to }) => current.replaceAll(from, to), text);
+  const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT);
+  for (let node = walker.nextNode(); node !== null; node = walker.nextNode()) {
+    const text = node.nodeValue ?? "";
+    const presented = present(text);
+    if (presented !== text) {
+      const textNode = node;
+      textNode.nodeValue = presented;
+      restorers.push(() => {
+        textNode.nodeValue = text;
+      });
+    }
+  }
+  for (const field of document.querySelectorAll("input, textarea")) {
+    if (field instanceof HTMLInputElement || field instanceof HTMLTextAreaElement) {
+      const original = field.value;
+      const presented = present(original);
+      if (presented !== original) {
+        field.value = presented;
+        restorers.push(() => {
+          field.value = original;
+        });
+      }
+    }
+  }
+}
+
+// Reverse order: a second presentation pass records already-presented values.
+function restoreIdentitiesInDocument(): void {
+  const restorers = window.__kumikoPresentRestore ?? [];
+  for (const restore of restorers.reverse()) restore();
+  window.__kumikoPresentRestore = [];
+}
+
+export async function presentIdentitiesOnPage(
+  page: Page,
+  mappings: readonly PresentIdentity[],
+): Promise<void> {
+  if (mappings.length > 0) await page.evaluate(replaceIdentitiesInDocument, mappings);
+}
+
+export async function restoreIdentitiesOnPage(
+  page: Page,
+  mappings: readonly PresentIdentity[],
+): Promise<void> {
+  if (mappings.length > 0) await page.evaluate(restoreIdentitiesInDocument);
+}
+
+export async function withPresentedIdentities<T>(
+  page: Page,
+  mappings: readonly PresentIdentity[],
+  fn: () => Promise<T>,
+): Promise<T> {
+  assertPresentableMappings(mappings);
+  await presentIdentitiesOnPage(page, mappings);
+  try {
+    return await fn();
+  } finally {
+    await restoreIdentitiesOnPage(page, mappings);
+  }
+}

package/src/e2e/screenshots.ts

@@ -6,6 +6,12 @@ import { E2E_TIMEOUT_MS } from "../e2e-timeouts";
 import { isRealProviderRun } from "../helpers/real-providers.ts";
 import { DESKTOP_VIEWPORT } from "./constants";
 import { pinEnglishLocale } from "./pin-english-locale";
+import {
+  assertPresentableMappings,
+  type PresentIdentity,
+  presentIdentitiesOnPage,
+  restoreIdentitiesOnPage,
+} from "./present-identities";
 import { requireScreenshotDir, SCREENSHOT_DIR_ENV } from "./screenshot-dir";
 import { type SeedTenantFixture, test } from "./seeded-tenant-fixture";
 
@@ -33,14 +39,6 @@ export async function applyDefaultTheme(page: Page, theme: DefaultThemeId): Prom
   }, theme);
 }
 
-// Seeded identities are unique per run (admin-<tenantId>@…), so a screenshot
-// would show a different address every time. Replaced in the page's text and
-// form values right before each capture; the seeded data stays untouched.
-export interface PresentIdentity {
-  readonly from: string;
-  readonly to: string;
-}
-
 export interface ScenarioFixtures {
   readonly seedTenant: SeedTenantFixture;
   // runMatrix's current locale, for apps whose routes carry the locale in the
@@ -165,73 +163,6 @@ async function waitForSettledPage(page: Page, inFlightDataRequests: () => number
     .toBeGreaterThanOrEqual(STABLE_POLLS);
 }
 
-function assertPresentableMappings(mappings: readonly PresentIdentity[]): void {
-  for (const { from } of mappings) {
-    if (from === "") throw new Error("presentIdentities: `from` must not be empty");
-  }
-}
-
-declare global {
-  interface Window {
-    __kumikoPresentRestore?: Array<() => void>;
-  }
-}
-
-// Runs in the browser, so it may not reference module scope. Originals are kept
-// on window so a later evaluate can put them back (captureScreenshot runs
-// mid-flow, where the spec keeps asserting and submitting forms).
-function replaceIdentitiesInDocument(mappings: readonly PresentIdentity[]): void {
-  window.__kumikoPresentRestore ??= [];
-  const restorers = window.__kumikoPresentRestore;
-  const present = (text: string): string =>
-    mappings.reduce((current, { from, to }) => current.replaceAll(from, to), text);
-  const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT);
-  for (let node = walker.nextNode(); node !== null; node = walker.nextNode()) {
-    const text = node.nodeValue ?? "";
-    const presented = present(text);
-    if (presented !== text) {
-      const textNode = node;
-      textNode.nodeValue = presented;
-      restorers.push(() => {
-        textNode.nodeValue = text;
-      });
-    }
-  }
-  for (const field of document.querySelectorAll("input, textarea")) {
-    if (field instanceof HTMLInputElement || field instanceof HTMLTextAreaElement) {
-      const original = field.value;
-      const presented = present(original);
-      if (presented !== original) {
-        field.value = presented;
-        restorers.push(() => {
-          field.value = original;
-        });
-      }
-    }
-  }
-}
-
-// Reverse order: a second presentation pass records already-presented values.
-function restoreIdentitiesInDocument(): void {
-  const restorers = window.__kumikoPresentRestore ?? [];
-  for (const restore of restorers.reverse()) restore();
-  window.__kumikoPresentRestore = [];
-}
-
-async function presentIdentitiesOnPage(
-  page: Page,
-  mappings: readonly PresentIdentity[],
-): Promise<void> {
-  if (mappings.length > 0) await page.evaluate(replaceIdentitiesInDocument, mappings);
-}
-
-async function restoreIdentitiesOnPage(
-  page: Page,
-  mappings: readonly PresentIdentity[],
-): Promise<void> {
-  if (mappings.length > 0) await page.evaluate(restoreIdentitiesInDocument);
-}
-
 // Order matters: beforeCapture first (it may hide/mask), identities after, so
 // the replaced text is what the screenshot sees. Exported for unit tests.
 export async function captureScenario(

package/src/e2e/seed-route.ts

@@ -107,6 +107,12 @@ function assertSeededTenant(tenantId: string, seededTenantIds: ReadonlySet<strin
 export type E2eSeederContext = {
   readonly write: (handlerQn: string, payload: unknown) => Promise<unknown>;
   readonly query: (handlerQn: string, payload: unknown) => Promise<unknown>;
+  // System user with "system" plus exactly these roles, no SystemAdmin.
+  readonly writeAs: (
+    roles: readonly string[],
+    handlerQn: string,
+    payload: unknown,
+  ) => Promise<unknown>;
 };
 
 // `body` is whatever the client sent; validate it with a zod schema's parse(),
@@ -156,7 +162,7 @@ function toCapturedMail(message: InboxMessage): CapturedMail {
 // createE2eSeedRoutes() : [])` in a server entry that also runs in prod.
 // Each route's own assertGateOpen() 404s outside the seed condition regardless
 // — this is belt-and-suspenders, not the only gate.
-export function createE2eSeedRoutes(
+export function createE2eSeedRoutesWith(
   options: E2eSeedRoutesOptions,
   bundled: SeedRouteBundledApi,
 ): readonly ExtraRouteDefinition[] {
@@ -311,6 +317,11 @@ export function createE2eSeedRoutes(
             handlerQn,
             await deps.dispatchSystemWrite({ handlerQn, payload, tenantId }),
           ),
+        writeAs: async (roles, handlerQn, payload) =>
+          unwrapWriteData(
+            handlerQn,
+            await deps.dispatchWriteAs({ handlerQn, payload, tenantId, roles }),
+          ),
         query: (handlerQn, payload) => deps.dispatchSystemQuery({ handlerQn, payload, tenantId }),
       };
       try {
@@ -327,3 +338,6 @@ export function createE2eSeedRoutes(
 
   return [seedTenantRoute, seedUserRoute, inboxRoute, extraSeedRoute];
 }
+
+/** @deprecated Use `createE2eSeedRoutesWith`; the old name collides with the bound `createE2eSeedRoutes` of dev-server/testing. */
+export const createE2eSeedRoutes = createE2eSeedRoutesWith;

package/src/e2e/seeded-tenant-fixture.ts

@@ -3,7 +3,6 @@ import type {
   APIRequestContext,
   BrowserContext,
   Page,
-  Request as PlaywrightRequest,
   PlaywrightTestArgs,
   PlaywrightTestOptions,
   PlaywrightWorkerArgs,
@@ -19,6 +18,11 @@ import {
   type SeedTenantOptions,
   withSession,
 } from "../seed-types";
+import {
+  appBootBudgetViolation,
+  DEFAULT_MAX_APP_BOOTS_PER_TEST,
+  observeAppBoots,
+} from "./app-boot-budget";
 import {
   CLIENT_IP_HEADER,
   clearSession,
@@ -69,6 +73,7 @@ export type E2eSeededTenant = Omit<SeededTenant, "addUser"> & {
 export type SeedTenantFixture = (opts?: E2eSeedTenantOptions) => Promise<E2eSeededTenant>;
 
 type E2eFixtures = {
+  maxAppBootsPerTest: number;
   seedTenant: SeedTenantFixture;
 };
 
@@ -230,52 +235,35 @@ export function perTestClientIpKey(
   return `${runToken ?? ""}:${testInfo.testId}:${testInfo.repeatEachIndex}:${testInfo.retry}`;
 }
 
-// Same-origin only: on a cross-origin fetch the extra header would force a
-// CORS preflight the target never agreed to (why extraHTTPHeaders is no option
-// here). An explicit X-Forwarded-For set by the test wins.
-export function headersWithClientIp(
-  request: { readonly url: string; readonly frameUrl: string | undefined },
-  headers: Readonly<Record<string, string>>,
-  clientIp: string,
-): Record<string, string> | undefined {
-  if (request.frameUrl === undefined) return undefined;
-  let sameOrigin: boolean;
-  try {
-    sameOrigin = new URL(request.frameUrl).origin === new URL(request.url).origin;
-  } catch {
-    return undefined;
-  }
-  return sameOrigin ? { [CLIENT_IP_HEADER]: clientIp, ...headers } : undefined;
-}
-
-function frameUrlOf(request: PlaywrightRequest): string | undefined {
-  try {
-    return request.frame().url();
-  } catch {
-    // Service-worker requests have no frame.
-    return undefined;
-  }
-}
-
+// Chromium turns its HTTP cache off for a context as soon as it has a route,
+// so the header goes through setExtraHTTPHeaders and the cache stays on.
 export async function providePerTestClientIpContext(
-  { context }: Pick<PlaywrightTestArgs, "context">,
+  {
+    context,
+    maxAppBootsPerTest,
+  }: Pick<PlaywrightTestArgs, "context"> & Pick<E2eFixtures, "maxAppBootsPerTest">,
   use: (context: BrowserContext) => Promise<void>,
-  testInfo: Pick<TestInfo, "testId" | "repeatEachIndex" | "retry">,
+  testInfo: Pick<TestInfo, "testId" | "repeatEachIndex" | "retry" | "status" | "expectedStatus">,
 ): Promise<void> {
-  const clientIp = syntheticClientIpFor(perTestClientIpKey(testInfo));
-  await context.route("**/api/**", (route) => {
-    const request = route.request();
-    const headers = headersWithClientIp(
-      { url: request.url(), frameUrl: frameUrlOf(request) },
-      request.headers(),
-      clientIp,
-    );
-    return headers === undefined ? route.fallback() : route.fallback({ headers });
+  await context.setExtraHTTPHeaders({
+    [CLIENT_IP_HEADER]: syntheticClientIpFor(perTestClientIpKey(testInfo)),
   });
+  const appBoots = observeAppBoots(context);
   await use(context);
+
+  // A window.open tab left open stalls the context close by seconds.
+  await Promise.all(context.pages().map((page) => (page.isClosed() ? undefined : page.close())));
+
+  // Only after a passing body, so the budget never hides the original failure.
+  const violation =
+    testInfo.status === testInfo.expectedStatus
+      ? appBootBudgetViolation(appBoots.count(), maxAppBootsPerTest)
+      : undefined;
+  if (violation !== undefined) throw new Error(violation);
 }
 
 export const test = base.extend<E2eFixtures>({
+  maxAppBootsPerTest: [DEFAULT_MAX_APP_BOOTS_PER_TEST, { option: true }],
   context: providePerTestClientIpContext,
   seedTenant: provideSeedTenant,
 });

package/src/helpers/barrier.ts

@@ -19,6 +19,8 @@ export function createBarrier(options: {
   let arrived = 0;
   let skipped = 0;
   let timer: ReturnType<typeof setTimeout> | undefined;
+  // Late arrivals after a timeout must fail loudly too instead of hanging until the test timeout.
+  let timedOutError: Error | undefined;
   const waiting: { resolve: () => void; reject: (error: Error) => void }[] = [];
 
   function openIfComplete(): void {
@@ -30,15 +32,17 @@ export function createBarrier(options: {
 
   return {
     arrive() {
+      if (timedOutError !== undefined) return Promise.reject(timedOutError);
       arrived++;
       const pending = new Promise<void>((resolve, reject) => {
         waiting.push({ resolve, reject });
       });
-      if (arrived === 1 && arrived + skipped < expected) {
+      if (timer === undefined && arrived + skipped < expected) {
         timer = setTimeout(() => {
           const error = new Error(
             `barrier timed out: ${arrived} of ${expected} arrived, ${skipped} skipped`,
           );
+          timedOutError = error;
           for (const waiter of waiting.splice(0)) waiter.reject(error);
         }, timeoutMs);
       }

package/src/helpers/closed-connection-error.ts

@@ -2,7 +2,6 @@
 // the production matcher checks driver-specific codes a fake can't reproduce.
 
 import { isClosedConnectionError } from "@cosmicdrift/kumiko-framework/internal/stack-support";
-import postgres from "postgres";
 import { requireEnv } from "../stack/db.ts";
 
 export function testDatabaseUrl(): string {
@@ -14,8 +13,6 @@ const READS_PER_ROUND = 5;
 
 type AdminClient = { unsafe(sql: string, params?: readonly unknown[]): Promise<unknown> };
 
-// A per-round admin client hits a postgres-js reconnect timing bug (the first
-// retry after terminate hangs); a single long-lived admin client avoids it.
 export async function terminateBackendsByApplicationName(
   admin: AdminClient,
   applicationName: string,
@@ -31,11 +28,11 @@ export async function terminateBackendsByApplicationName(
 export async function captureClosedConnectionError(
   url: string = testDatabaseUrl(),
 ): Promise<unknown> {
-  const admin = postgres(url, { max: 1 });
+  const admin = new Bun.SQL(url, { max: 1 });
   try {
     for (let round = 0; round < MAX_WARMUP_ROUNDS; round++) {
       const applicationName = `kumiko-closed-conn-test-${crypto.randomUUID()}`;
-      const pool = postgres(url, { max: 1, connection: { application_name: applicationName } });
+      const pool = new Bun.SQL(url, { max: 1, connection: { application_name: applicationName } });
       try {
         await pool.unsafe("select 1");
         await terminateBackendsByApplicationName(admin, applicationName);
@@ -47,13 +44,13 @@ export async function captureClosedConnectionError(
           }
         }
       } finally {
-        await pool.end({ timeout: 0 });
+        await pool.close({ timeout: 0 });
       }
     }
     throw new Error(
       `captureClosedConnectionError: no closed-connection error observed after ${MAX_WARMUP_ROUNDS} rounds.`,
     );
   } finally {
-    await admin.end({ timeout: 0 });
+    await admin.close({ timeout: 0 });
   }
 }