@fuzdev/fuz_app 0.64.0 → 0.66.0

package/dist/testing/integration.js

@@ -16,33 +16,16 @@ import './assert_dev_env.js';
  *
  * @module
  */
-import { describe, test, assert, beforeAll, afterAll } from 'vitest';
-import { auth_migration_ns } from '../auth/migrations.js';
-import { create_test_app } from './app_server.js';
-import { create_pglite_factory, create_describe_db, auth_integration_truncate_tables, } from './db.js';
+import { describe, test, assert, afterAll } from 'vitest';
 import { find_auth_route, assert_response_matches_spec, create_expired_test_cookie, assert_no_error_info_leakage, } from './integration_helpers.js';
 import { find_rpc_action, rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup, } from './rpc_helpers.js';
-import { RateLimiter } from '../rate_limiter.js';
-import { run_migrations } from '../db/migrate.js';
 import { ErrorCoverageCollector, assert_error_coverage, DEFAULT_INTEGRATION_ERROR_COVERAGE, } from './error_coverage.js';
 import { ApiError, ERROR_FORBIDDEN_ORIGIN } from '../http/error_schemas.js';
 import { is_public_auth } from '../http/auth_shape.js';
 import { account_verify_action_spec, account_session_list_action_spec, account_session_revoke_action_spec, account_session_revoke_all_action_spec, account_token_create_action_spec, account_token_list_action_spec, account_token_revoke_action_spec, } from '../auth/account_action_specs.js';
 import { invite_create_action_spec } from '../auth/admin_action_specs.js';
-/**
- * Build `CreateTestAppOptions` from standard options plus a database.
- * Forwards `options.rpc_endpoints` to the top-level `rpc_endpoints` slot on
- * `CreateTestAppOptions` so `create_app_server` auto-mounts it per-test with
- * the real ctx. `SuiteAppOptions` excludes `rpc_endpoints` so there's no way
- * for `options.app_options` to collide with the suite-level field.
- */
-const build_test_app_options = (options, db) => ({
-    session_options: options.session_options,
-    create_route_specs: options.create_route_specs,
-    db,
-    rpc_endpoints: options.rpc_endpoints,
-    app_options: options.app_options,
-});
+import { test_if } from './cross_backend/capabilities.js';
+import { DEFAULT_TEST_PASSWORD } from './app_server.js';
 /**
  * Standard integration test suite for fuz_app auth routes.
  *
@@ -55,62 +38,69 @@ const build_test_app_options = (options, db) => ({
  * Each test group asserts that required routes exist, failing with a descriptive
  * message if the consumer's route specs are misconfigured.
  *
+ * The two signup-invite-edge-case tests call `invite_create_action_spec`
+ * (admin-gated) over the fixture's session, so consumers wiring signup +
+ * admin actions must thread `extra_keeper_roles: [ROLE_ADMIN]` through
+ * either `default_in_process_suite_options` or
+ * `default_cross_process_setup(handle, {extra_keeper_roles:
+ * [ROLE_ADMIN]})`. In both modes the fixture's `fixture.account` is the
+ * fresh keeper, and the extra-keeper-roles list grants the bootstrapped
+ * keeper additional roles inline (cross-process via `_testing_reset`'s
+ * bootstrap-time seeding; in-process via `bootstrap_test_keeper`) — no
+ * per-role RPC cost, no offer/accept round-trip. The tests run against
+ * the production `open_signup: false` default — the cross-process
+ * per-test secondary mint via `fixture.create_account()` is
+ * invite-gated (keeper drives `invite_create` before signup) so the
+ * harness doesn't need to flip the setting. Consumers that don't wire
+ * signup or `invite_create` silently skip these two tests.
+ *
  * @throws Error at setup time when `options.rpc_endpoints` is empty — the
  *   suite hard-fails via `require_rpc_endpoint_path` rather than running
  *   tests that would crash mid-suite trying to dispatch
  *   `account_verify` / `account_session_*` / `account_token_*`.
  */
 export const describe_standard_integration_tests = (options) => {
+    const route_specs = options.surface_source.route_specs;
     // Hard-fail early so consumers see a clear setup error instead of a
     // confusing test failure when `rpc_endpoints` is missing. Factory-form
     // callers are resolved with a stub ctx purely to extract the endpoint
-    // path; real handlers run per-test via the top-level `rpc_endpoints` slot on `CreateTestAppOptions`.
+    // path; the running backend handles live dispatch.
     const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
     const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
-    const init_schema = async (db) => {
-        await run_migrations(db, [auth_migration_ns]);
-    };
-    const factories = options.db_factories ?? [create_pglite_factory(init_schema)];
-    const describe_db = create_describe_db(factories, auth_integration_truncate_tables);
-    describe_db('standard_integration', (get_db) => {
+    describe('standard_integration', () => {
         const { cookie_name } = options.session_options;
         // Error coverage tracking across test groups
         const error_collector = new ErrorCoverageCollector();
-        let captured_route_specs = null;
-        beforeAll(async () => {
-            // Capture route specs once up front so coverage assertion runs even if
-            // individual tests are skipped or fail early. Route specs are immutable
-            // config; the transient test app is discarded.
-            const test_app = await create_test_app(build_test_app_options(options, get_db()));
-            captured_route_specs = test_app.route_specs;
-        });
         afterAll(() => {
-            if (captured_route_specs) {
-                // Scope coverage to auth routes this suite actually exercises:
-                // the REST auth surface (login/logout/password/signup/bootstrap)
-                // plus the shared RPC endpoint. Consumer-specific routes would
-                // dilute the coverage percentage; admin-role routes are scoped
-                // to the admin suite instead.
-                const auth_routes = captured_route_specs.filter((s) => {
-                    if (s.auth.roles?.includes('admin') ?? false)
-                        return false;
-                    const rest_suffixes = ['/login', '/logout', '/password', '/signup', '/bootstrap'];
-                    if (rest_suffixes.some((suffix) => s.path.endsWith(suffix)))
-                        return true;
-                    return s.path === rpc_path;
-                });
-                assert_error_coverage(error_collector, auth_routes.length > 0 ? auth_routes : captured_route_specs, {
-                    min_coverage: DEFAULT_INTEGRATION_ERROR_COVERAGE,
-                });
-            }
+            // Scope coverage to auth routes this suite actually exercises:
+            // login / logout / password drivers + signup invite edge cases
+            // (when the consumer wires signup) + the shared RPC endpoint.
+            // Bootstrap (when the consumer wires it via the top-level `bootstrap`
+            // option in `mode: 'live'`) is intentionally excluded — this suite has
+            // no describe block that drives bootstrap; the dedicated
+            // `describe_bootstrap_success_tests` suite picks it up via
+            // `create_test_app_for_bootstrap`. Consumer-specific
+            // routes would dilute the ratio; admin-role routes are scoped to
+            // the admin suite instead.
+            const auth_routes = route_specs.filter((s) => {
+                if (s.auth.roles?.includes('admin') ?? false)
+                    return false;
+                const rest_suffixes = ['/login', '/logout', '/password', '/signup'];
+                if (rest_suffixes.some((suffix) => s.path.endsWith(suffix)))
+                    return true;
+                return s.path === rpc_path;
+            });
+            assert_error_coverage(error_collector, auth_routes.length > 0 ? auth_routes : route_specs, {
+                min_coverage: options.error_coverage_min ?? DEFAULT_INTEGRATION_ERROR_COVERAGE,
+            });
         });
         // --- 1. Login/logout lifecycle ---
         describe('login/logout lifecycle', () => {
             test('login with correct credentials returns 200 with Set-Cookie', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
+                const fixture = await options.setup_test();
+                const login_route = find_auth_route(route_specs, '/login', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
-                const res = await test_app.app.request(login_route.path, {
+                const res = await fixture.transport(login_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -118,8 +108,8 @@ export const describe_standard_integration_tests = (options) => {
                         'content-type': 'application/json',
                     },
                     body: JSON.stringify({
-                        username: test_app.backend.account.username,
-                        password: 'test-password-123',
+                        username: fixture.account.username,
+                        password: DEFAULT_TEST_PASSWORD,
                     }),
                 });
                 assert.strictEqual(res.status, 200);
@@ -130,10 +120,10 @@ export const describe_standard_integration_tests = (options) => {
                 assert.ok(set_cookie.includes(`${cookie_name}=`), `Expected ${cookie_name} cookie`);
             });
             test('login with wrong password returns 401', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
+                const fixture = await options.setup_test();
+                const login_route = find_auth_route(route_specs, '/login', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
-                const res = await test_app.app.request(login_route.path, {
+                const res = await fixture.transport(login_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -141,20 +131,20 @@ export const describe_standard_integration_tests = (options) => {
                         'content-type': 'application/json',
                     },
                     body: JSON.stringify({
-                        username: test_app.backend.account.username,
+                        username: fixture.account.username,
                         password: 'wrong-password',
                     }),
                 });
                 assert.strictEqual(res.status, 401);
                 const body = await res.clone().json();
                 assert.strictEqual(body.error, 'invalid_credentials');
-                await error_collector.assert_and_record(test_app.route_specs, 'POST', login_route.path, res);
+                await error_collector.assert_and_record(route_specs, 'POST', login_route.path, res);
             });
             test('login with nonexistent user returns 401', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
+                const fixture = await options.setup_test();
+                const login_route = find_auth_route(route_specs, '/login', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
-                const res = await test_app.app.request(login_route.path, {
+                const res = await fixture.transport(login_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -163,19 +153,19 @@ export const describe_standard_integration_tests = (options) => {
                     },
                     body: JSON.stringify({
                         username: 'nonexistent_user',
-                        password: 'test-password-123',
+                        password: DEFAULT_TEST_PASSWORD,
                     }),
                 });
                 assert.strictEqual(res.status, 401);
                 const body = await res.clone().json();
                 assert.strictEqual(body.error, 'invalid_credentials');
-                await error_collector.assert_and_record(test_app.route_specs, 'POST', login_route.path, res);
+                await error_collector.assert_and_record(route_specs, 'POST', login_route.path, res);
             });
             test('login trims whitespace from username', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
+                const fixture = await options.setup_test();
+                const login_route = find_auth_route(route_specs, '/login', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
-                const res = await test_app.app.request(login_route.path, {
+                const res = await fixture.transport(login_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -183,8 +173,8 @@ export const describe_standard_integration_tests = (options) => {
                         'content-type': 'application/json',
                     },
                     body: JSON.stringify({
-                        username: `  ${test_app.backend.account.username}  `,
-                        password: 'test-password-123',
+                        username: `  ${fixture.account.username}  `,
+                        password: DEFAULT_TEST_PASSWORD,
                     }),
                 });
                 assert.strictEqual(res.status, 200);
@@ -192,13 +182,13 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(body.ok, true);
             });
             test('full cycle: login → verify → logout → verify fails', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
-                const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
+                const fixture = await options.setup_test();
+                const login_route = find_auth_route(route_specs, '/login', 'POST');
+                const logout_route = find_auth_route(route_specs, '/logout', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
                 assert.ok(logout_route, 'Expected POST /logout route — ensure create_route_specs includes account routes');
                 // Login
-                const login_res = await test_app.app.request(login_route.path, {
+                const login_res = await fixture.transport(login_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -206,8 +196,8 @@ export const describe_standard_integration_tests = (options) => {
                         'content-type': 'application/json',
                     },
                     body: JSON.stringify({
-                        username: test_app.backend.account.username,
-                        password: 'test-password-123',
+                        username: fixture.account.username,
+                        password: DEFAULT_TEST_PASSWORD,
                     }),
                 });
                 assert.strictEqual(login_res.status, 200);
@@ -224,7 +214,7 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 // Verify works
                 const verify_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -232,17 +222,17 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 assert.strictEqual(verify_res.status, 200);
                 // Logout
-                const logout_res = await test_app.app.request(logout_route.path, {
+                const logout_res = await fixture.transport(logout_route.path, {
                     method: 'POST',
                     headers: create_headers(),
                 });
                 assert.strictEqual(logout_res.status, 200);
                 const logout_body = await logout_res.json();
                 assert.strictEqual(logout_body.ok, true);
-                assert.strictEqual(logout_body.username, test_app.backend.account.username, 'Logout response should include the username');
+                assert.strictEqual(logout_body.username, fixture.account.username, 'Logout response should include the username');
                 // Verify fails after logout (session revoked)
                 const verify_after = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -254,10 +244,10 @@ export const describe_standard_integration_tests = (options) => {
         // --- 1b. Login response body identity (account enumeration prevention) ---
         describe('login response body identity', () => {
             test('nonexistent user and wrong password responses are structurally identical', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
+                const fixture = await options.setup_test();
+                const login_route = find_auth_route(route_specs, '/login', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
-                const make_login = (username, password) => test_app.app.request(login_route.path, {
+                const make_login = (username, password) => fixture.transport(login_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -267,7 +257,7 @@ export const describe_standard_integration_tests = (options) => {
                     body: JSON.stringify({ username, password }),
                 });
                 // wrong password for existing user
-                const wrong_pw_res = await make_login(test_app.backend.account.username, 'wrong-password-999');
+                const wrong_pw_res = await make_login(fixture.account.username, 'wrong-password-999');
                 assert.strictEqual(wrong_pw_res.status, 401);
                 const wrong_pw_body = await wrong_pw_res.json();
                 // nonexistent user
@@ -284,10 +274,10 @@ export const describe_standard_integration_tests = (options) => {
         // --- 2. Cookie attributes ---
         describe('cookie attributes', () => {
             test('session cookie has secure attributes', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
+                const fixture = await options.setup_test();
+                const login_route = find_auth_route(route_specs, '/login', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
-                const res = await test_app.app.request(login_route.path, {
+                const res = await fixture.transport(login_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -295,8 +285,8 @@ export const describe_standard_integration_tests = (options) => {
                         'content-type': 'application/json',
                     },
                     body: JSON.stringify({
-                        username: test_app.backend.account.username,
-                        password: 'test-password-123',
+                        username: fixture.account.username,
+                        password: DEFAULT_TEST_PASSWORD,
                     }),
                 });
                 assert.strictEqual(res.status, 200);
@@ -312,9 +302,9 @@ export const describe_standard_integration_tests = (options) => {
         // --- 3. Session security ---
         describe('session security', () => {
             test('no cookie on protected route returns 401', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.fresh_transport() },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -323,9 +313,9 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(res.status, 401);
             });
             test('corrupted cookie returns 401', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -333,11 +323,12 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 assert.strictEqual(res.status, 401);
             });
-            test('expired cookie returns 401', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const expired_cookie = await create_expired_test_cookie(test_app.backend.keyring, options.session_options);
+            test_if(options.capabilities.in_process_only, 'expired cookie returns 401', async () => {
+                const fixture = await options.setup_test();
+                assert(fixture.in_process);
+                const expired_cookie = await create_expired_test_cookie(fixture.keyring, options.session_options);
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -349,11 +340,11 @@ export const describe_standard_integration_tests = (options) => {
         // --- 4. Session revocation ---
         describe('session revocation', () => {
             test('revoke single session by ID invalidates that session', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const headers = test_app.create_session_headers();
+                const fixture = await options.setup_test();
+                const headers = fixture.create_session_headers();
                 // List own sessions to get the session ID
                 const list_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_session_list_action_spec,
                     params: undefined,
@@ -364,7 +355,7 @@ export const describe_standard_integration_tests = (options) => {
                 const session_id = list_res.result.sessions[0].id;
                 // Revoke that session by ID
                 const revoke_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_session_revoke_action_spec,
                     params: { session_id },
@@ -375,7 +366,7 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(revoke_res.result.revoked, true);
                 // Session should no longer work
                 const after = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -384,11 +375,11 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(after.status, 401);
             });
             test('revoke-all invalidates existing session', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const headers = test_app.create_session_headers();
+                const fixture = await options.setup_test();
+                const headers = fixture.create_session_headers();
                 // Verify works
                 const before = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -397,7 +388,7 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(before.status, 200);
                 // Revoke all sessions
                 const revoke_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_session_revoke_all_action_spec,
                     params: undefined,
@@ -406,7 +397,7 @@ export const describe_standard_integration_tests = (options) => {
                 assert.ok(revoke_res.ok, 'account_session_revoke_all should succeed');
                 // Verify fails after revocation
                 const after = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -418,20 +409,20 @@ export const describe_standard_integration_tests = (options) => {
         // --- 4b. Password change ---
         describe('password change', () => {
             test('password change invalidates all sessions and allows login with new password', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
-                const password_route = find_auth_route(test_app.route_specs, '/password', 'POST');
+                const fixture = await options.setup_test();
+                const login_route = find_auth_route(route_specs, '/login', 'POST');
+                const password_route = find_auth_route(route_specs, '/password', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
                 assert.ok(password_route, 'Expected POST /password route — ensure create_route_specs includes account routes');
-                const headers = test_app.create_session_headers({
+                const headers = fixture.create_session_headers({
                     'content-type': 'application/json',
                 });
                 // Change password
-                const change_res = await test_app.app.request(password_route.path, {
+                const change_res = await fixture.transport(password_route.path, {
                     method: 'POST',
                     headers,
                     body: JSON.stringify({
-                        current_password: 'test-password-123',
+                        current_password: DEFAULT_TEST_PASSWORD,
                         new_password: 'new-password-456',
                     }),
                 });
@@ -442,15 +433,15 @@ export const describe_standard_integration_tests = (options) => {
                 assert.ok(change_body.sessions_revoked >= 1, 'Expected at least 1 session revoked');
                 // Old session should be invalid
                 const verify_after = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.strictEqual(verify_after.status, 401);
                 // Login with new password works
-                const login_res = await test_app.app.request(login_route.path, {
+                const login_res = await fixture.transport(login_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -458,7 +449,7 @@ export const describe_standard_integration_tests = (options) => {
                         'content-type': 'application/json',
                     },
                     body: JSON.stringify({
-                        username: test_app.backend.account.username,
+                        username: fixture.account.username,
                         password: 'new-password-456',
                     }),
                 });
@@ -467,12 +458,12 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(login_body.ok, true);
             });
             test('password change with wrong current password returns 401', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const password_route = find_auth_route(test_app.route_specs, '/password', 'POST');
+                const fixture = await options.setup_test();
+                const password_route = find_auth_route(route_specs, '/password', 'POST');
                 assert.ok(password_route, 'Expected POST /password route — ensure create_route_specs includes account routes');
-                const res = await test_app.app.request(password_route.path, {
+                const res = await fixture.transport(password_route.path, {
                     method: 'POST',
-                    headers: test_app.create_session_headers({
+                    headers: fixture.create_session_headers({
                         'content-type': 'application/json',
                     }),
                     body: JSON.stringify({
@@ -481,31 +472,32 @@ export const describe_standard_integration_tests = (options) => {
                     }),
                 });
                 assert.strictEqual(res.status, 401);
-                error_collector.record(test_app.route_specs, 'POST', password_route.path, 401);
+                error_collector.record(route_specs, 'POST', password_route.path, 401);
                 // Session should still be valid (password didn't change)
                 const verify_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.strictEqual(verify_res.status, 200);
             });
         });
         // --- 5. Origin verification ---
         describe('origin verification', () => {
-            test('evil origin is rejected with 403', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+            test_if(options.capabilities.in_process_only, 'evil origin is rejected with 403', async () => {
+                const fixture = await options.setup_test();
+                assert(fixture.in_process);
                 // `verify_request_source` runs before the RPC dispatcher and returns a
                 // plain REST `{error}` body — not a JSON-RPC envelope. Skip `rpc_call`.
-                const res = await test_app.app.request(rpc_path, {
+                const res = await fixture.transport(rpc_path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
                         origin: 'http://evil.com',
                         'content-type': 'application/json',
-                        cookie: `${cookie_name}=${test_app.backend.session_cookie}`,
+                        cookie: `${cookie_name}=${fixture.backend_internals.session_cookie}`,
                     },
                     body: JSON.stringify({
                         jsonrpc: '2.0',
@@ -518,26 +510,27 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(body.error, ERROR_FORBIDDEN_ORIGIN);
             });
             test('valid origin is accepted', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.strictEqual(res.status, 200);
             });
-            test('no origin header is allowed (direct access)', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+            test_if(options.capabilities.in_process_only, 'no origin header is allowed (direct access)', async () => {
+                const fixture = await options.setup_test();
+                assert(fixture.in_process);
                 // Probe the "no Origin / no Referer" path; `suppress_default_origin`
                 // skips the default `origin` header.
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: { cookie: `${cookie_name}=${test_app.backend.session_cookie}` },
+                    headers: { cookie: `${cookie_name}=${fixture.backend_internals.session_cookie}` },
                     suppress_default_origin: true,
                 });
                 assert.notStrictEqual(res.status, 403);
@@ -546,21 +539,24 @@ export const describe_standard_integration_tests = (options) => {
         // --- 6. Bearer auth ---
         describe('bearer auth', () => {
             test('valid bearer token authenticates', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: test_app.create_bearer_headers(),
+                    headers: fixture.create_bearer_headers(),
                     suppress_default_origin: true,
                 });
                 assert.strictEqual(res.status, 200);
             });
             test('invalid bearer token returns 401', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
+                // `origin: null` — bearer auth requires no browser-context
+                // indicator; the default `Origin: <base_url>` would silently
+                // discard the bearer cross-process.
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.fresh_transport({ origin: null }) },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -570,11 +566,13 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(res.status, 401);
             });
             test('bearer token with Origin header is rejected', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const bearer_headers = test_app.create_bearer_headers();
-                // Without Origin — works.
+                const fixture = await options.setup_test();
+                const bearer_headers = fixture.create_bearer_headers();
+                // Without Origin — works. `origin: null` so the transport
+                // doesn't auto-add the default Origin (which would discard
+                // the bearer as browser-context cross-process).
                 const ok_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.fresh_transport({ origin: null }) },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -584,7 +582,7 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(ok_res.status, 200);
                 // With Origin — bearer silently discarded (browser context), falls through to no auth.
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.fresh_transport() },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -596,20 +594,24 @@ export const describe_standard_integration_tests = (options) => {
         // --- 7. Token revocation ---
         describe('token revocation', () => {
             test('revoked API token returns 401', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 // Create a new token via RPC
                 const create_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
                     params: { name: 'test-revoke' },
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');
                 const { token, id } = create_res.result;
-                // Verify token works
+                // Verify token works — fresh transport so the per-test session
+                // cookie in `fixture.transport`'s jar can't give a false pass
+                // when the bearer is the credential under test. `origin: null`
+                // so the transport doesn't auto-add a default Origin (which
+                // would discard the bearer as browser-context cross-process).
                 const use_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.fresh_transport({ origin: null }) },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -619,16 +621,17 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(use_res.status, 200);
                 // Revoke via RPC
                 const revoke_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_revoke_action_spec,
                     params: { token_id: id },
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_token_revoke should succeed');
-                // Token should no longer work
+                // Token should no longer work — fresh transport same reason as
+                // the `use_res` call above.
                 const after_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.fresh_transport({ origin: null }) },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -641,36 +644,36 @@ export const describe_standard_integration_tests = (options) => {
         // --- 8. Cross-account isolation ---
         describe('cross-account isolation', () => {
             test('non-admin cannot access admin routes', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 // admin routes are optional in the base suite — admin-specific coverage
                 // lives in describe_standard_admin_integration_tests
-                const admin_route = test_app.route_specs.find((s) => s.auth.roles?.includes('admin') ?? false);
+                const admin_route = route_specs.find((s) => s.auth.roles?.includes('admin') ?? false);
                 if (!admin_route)
                     return;
-                const res = await test_app.app.request(admin_route.path, {
+                const res = await fixture.transport(admin_route.path, {
                     method: admin_route.method,
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.strictEqual(res.status, 403);
                 const body = await res.json();
                 assert.strictEqual(body.error, 'insufficient_permissions');
             });
             test("user A cannot revoke user B's sessions", async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 // Create a second account
-                const user_b = await test_app.create_account({ username: 'user_b' });
+                const user_b = await fixture.create_account({ username: 'user_b' });
                 // User A revokes all their own sessions
                 const revoke_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_session_revoke_all_action_spec,
                     params: undefined,
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke_all should succeed');
                 // User B's session should still work
                 const verify_b = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -679,12 +682,12 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(verify_b.status, 200);
             });
             test("user A cannot revoke user B's session by ID", async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const user_b = await test_app.create_account({ username: 'user_b' });
+                const fixture = await options.setup_test();
+                const user_b = await fixture.create_account({ username: 'user_b' });
                 const user_b_headers = { cookie: `${cookie_name}=${user_b.session_cookie}` };
                 // Get user B's session ID by listing as user B
                 const list_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_session_list_action_spec,
                     params: undefined,
@@ -695,17 +698,17 @@ export const describe_standard_integration_tests = (options) => {
                 const session_id_b = list_res.result.sessions[0].id;
                 // User A tries to revoke user B's session by ID
                 const revoke_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_session_revoke_action_spec,
                     params: { session_id: session_id_b },
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_session_revoke should succeed');
                 assert.strictEqual(revoke_res.result.revoked, false, 'Should not revoke another account session');
                 // User B's session should still work
                 const verify_b = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -714,12 +717,12 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(verify_b.status, 200);
             });
             test("user A cannot revoke user B's token by ID", async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const user_b = await test_app.create_account({ username: 'user_b' });
+                const fixture = await options.setup_test();
+                const user_b = await fixture.create_account({ username: 'user_b' });
                 const user_b_headers = { cookie: `${cookie_name}=${user_b.session_cookie}` };
                 // Get user B's token ID by listing as user B
                 const list_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_list_action_spec,
                     params: undefined,
@@ -730,17 +733,17 @@ export const describe_standard_integration_tests = (options) => {
                 const token_id_b = list_res.result.tokens[0].id;
                 // User A tries to revoke user B's token by ID
                 const revoke_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_revoke_action_spec,
                     params: { token_id: token_id_b },
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.ok(revoke_res.ok, 'account_token_revoke should succeed');
                 assert.strictEqual(revoke_res.result.revoked, false, 'Should not revoke another account token');
                 // User B's bearer token should still work
                 const verify_b = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -750,37 +753,37 @@ export const describe_standard_integration_tests = (options) => {
                 assert.strictEqual(verify_b.status, 200);
             });
             test("user A's session list does not include user B's sessions", async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const user_b = await test_app.create_account({ username: 'user_b' });
+                const fixture = await options.setup_test();
+                const user_b = await fixture.create_account({ username: 'user_b' });
                 // User A lists sessions
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_session_list_action_spec,
                     params: undefined,
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.ok(res.ok, 'account_session_list should succeed');
                 // Sessions should only belong to user A's account
                 for (const session of res.result.sessions) {
-                    assert.strictEqual(session.account_id, test_app.backend.account.id, `Session ${session.id} should belong to user A, not user B (${user_b.account.id})`);
+                    assert.strictEqual(session.account_id, fixture.account.id, `Session ${session.id} should belong to user A, not user B (${user_b.account.id})`);
                 }
             });
             test("user A's token list does not include user B's tokens", async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const user_b = await test_app.create_account({ username: 'user_b' });
+                const fixture = await options.setup_test();
+                const user_b = await fixture.create_account({ username: 'user_b' });
                 // User A lists tokens
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_list_action_spec,
                     params: undefined,
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.ok(res.ok, 'account_token_list should succeed');
                 // Tokens should only belong to user A's account
                 for (const token of res.result.tokens) {
-                    assert.strictEqual(token.account_id, test_app.backend.account.id, `Token ${token.id} should belong to user A, not user B (${user_b.account.id})`);
+                    assert.strictEqual(token.account_id, fixture.account.id, `Token ${token.id} should belong to user A, not user B (${user_b.account.id})`);
                 }
             });
         });
@@ -791,10 +794,10 @@ export const describe_standard_integration_tests = (options) => {
             // /password remain as REST routes whose responses we exercise here.
             // RPC output validation is covered by `describe_rpc_round_trip_tests`.
             test('POST /login 401 response matches declared error schema', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
+                const fixture = await options.setup_test();
+                const login_route = find_auth_route(route_specs, '/login', 'POST');
                 assert.ok(login_route, 'Expected POST /login route — ensure create_route_specs includes account routes');
-                const res = await test_app.app.request(login_route.path, {
+                const res = await fixture.transport(login_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -807,25 +810,25 @@ export const describe_standard_integration_tests = (options) => {
                     }),
                 });
                 assert.strictEqual(res.status, 401);
-                await assert_response_matches_spec(test_app.route_specs, 'POST', login_route.path, res);
+                await assert_response_matches_spec(route_specs, 'POST', login_route.path, res);
             });
             test('POST /logout 200 response matches output schema', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
+                const fixture = await options.setup_test();
+                const logout_route = find_auth_route(route_specs, '/logout', 'POST');
                 assert.ok(logout_route, 'Expected POST /logout route — ensure create_route_specs includes account routes');
-                const res = await test_app.app.request(logout_route.path, {
+                const res = await fixture.transport(logout_route.path, {
                     method: 'POST',
-                    headers: test_app.create_session_headers({ 'content-type': 'application/json' }),
+                    headers: fixture.create_session_headers({ 'content-type': 'application/json' }),
                     body: JSON.stringify({}),
                 });
                 assert.strictEqual(res.status, 200);
-                await assert_response_matches_spec(test_app.route_specs, 'POST', logout_route.path, res);
+                await assert_response_matches_spec(route_specs, 'POST', logout_route.path, res);
             });
             test('POST /logout 401 response matches declared error schema', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
+                const fixture = await options.setup_test();
+                const logout_route = find_auth_route(route_specs, '/logout', 'POST');
                 assert.ok(logout_route, 'Expected POST /logout route — ensure create_route_specs includes account routes');
-                const res = await test_app.app.request(logout_route.path, {
+                const res = await fixture.fresh_transport()(logout_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -835,129 +838,92 @@ export const describe_standard_integration_tests = (options) => {
                     body: JSON.stringify({}),
                 });
                 assert.strictEqual(res.status, 401);
-                await assert_response_matches_spec(test_app.route_specs, 'POST', logout_route.path, res);
-            });
-        });
-        // --- 10b. Rate limiting smoke test (full middleware stack) ---
-        describe('rate limiting smoke test', () => {
-            test('rate limiter fires in full middleware stack', async () => {
-                const test_app = await create_test_app({
-                    ...build_test_app_options(options, get_db()),
-                    app_options: {
-                        ...options.app_options,
-                        // tight limiter: 2 attempts / 1 minute
-                        ip_rate_limiter: new RateLimiter({
-                            max_attempts: 2,
-                            window_ms: 60_000,
-                            cleanup_interval_ms: 0,
-                        }),
-                    },
-                });
-                const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
-                if (!login_route)
-                    return; // skip if login route not wired
-                const make_bad_login = (ip_header) => {
-                    const headers = {
-                        host: 'localhost',
-                        origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
-                    };
-                    if (ip_header) {
-                        headers['x-forwarded-for'] = ip_header;
-                    }
-                    return test_app.app.request(login_route.path, {
-                        method: 'POST',
-                        headers,
-                        body: JSON.stringify({ username: 'nobody', password: 'wrong' }),
-                    });
-                };
-                // exhaust the limiter (2 attempts)
-                await make_bad_login();
-                await make_bad_login();
-                // third attempt should be rate-limited
-                const limited_res = await make_bad_login();
-                assert.strictEqual(limited_res.status, 429, 'Expected 429 after exceeding rate limit');
-                const limited_body = await limited_res.clone().json();
-                assert.strictEqual(limited_body.error, 'rate_limit_exceeded');
-                await error_collector.assert_and_record(test_app.route_specs, 'POST', login_route.path, limited_res);
-                // Retry-After header present
-                const retry_after = limited_res.headers.get('Retry-After');
-                assert.ok(retry_after, 'Expected Retry-After header on 429 response');
+                await assert_response_matches_spec(route_specs, 'POST', logout_route.path, res);
             });
         });
+        // Rate-limit behavior is covered end-to-end by
+        // `describe_rate_limiting_tests` against the full middleware stack.
+        // A per-suite smoke test isn't reintroduced here because the
+        // `setup_test` single-fixture model can't carry per-test rate-limiter
+        // overrides without each test re-constructing its own `TestApp`.
         // --- 10c2. Error coverage: unauthenticated access to auth-required routes ---
         describe('error coverage breadth', () => {
             test('exercises 401 on multiple auth-required routes for error coverage', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 // Hit several auth-required RPC methods without credentials to
                 // broaden error coverage beyond just /login. RPC 401s are tracked
                 // against the shared endpoint path. The dispatcher runs auth before
                 // params validation, so any well-formed param body works — we just
                 // need each call to be type-correct wrt its spec.
+                //
+                // Fresh transport so the per-test session cookie in
+                // `fixture.transport`'s jar doesn't leak into these unauthed
+                // probes and convert their expected 401s into 200s.
+                const unauthed = fixture.fresh_transport();
                 const session_list = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: unauthed },
                     path: rpc_path,
                     spec: account_session_list_action_spec,
                     params: undefined,
                     headers: { host: 'localhost' },
                 });
                 assert.strictEqual(session_list.status, 401);
-                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                error_collector.record(route_specs, 'POST', rpc_path, 401);
                 const session_revoke_all = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: unauthed },
                     path: rpc_path,
                     spec: account_session_revoke_all_action_spec,
                     params: undefined,
                     headers: { host: 'localhost' },
                 });
                 assert.strictEqual(session_revoke_all.status, 401);
-                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                error_collector.record(route_specs, 'POST', rpc_path, 401);
                 const token_list = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: unauthed },
                     path: rpc_path,
                     spec: account_token_list_action_spec,
                     params: undefined,
                     headers: { host: 'localhost' },
                 });
                 assert.strictEqual(token_list.status, 401);
-                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                error_collector.record(route_specs, 'POST', rpc_path, 401);
                 const token_create = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: unauthed },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
                     params: { name: 'unauth-probe' },
                     headers: { host: 'localhost' },
                 });
                 assert.strictEqual(token_create.status, 401);
-                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                error_collector.record(route_specs, 'POST', rpc_path, 401);
                 const verify = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: unauthed },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: { host: 'localhost' },
                 });
                 assert.strictEqual(verify.status, 401);
-                error_collector.record(test_app.route_specs, 'POST', rpc_path, 401);
+                error_collector.record(route_specs, 'POST', rpc_path, 401);
                 // Also exercise POST /logout without auth (still REST)
-                const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
+                const logout_route = find_auth_route(route_specs, '/logout', 'POST');
                 if (logout_route) {
-                    const res = await test_app.app.request(logout_route.path, {
+                    const res = await unauthed(logout_route.path, {
                         method: 'POST',
                         headers: { host: 'localhost', 'content-type': 'application/json' },
                         body: JSON.stringify({}),
                     });
                     assert.strictEqual(res.status, 401, 'POST /logout without auth should return 401');
-                    error_collector.record(test_app.route_specs, 'POST', logout_route.path, 401);
+                    error_collector.record(route_specs, 'POST', logout_route.path, 401);
                 }
             });
         });
         // --- 10c. Error response information leakage ---
         describe('error response information leakage', () => {
             test('401 responses contain no leaky fields', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.fresh_transport() },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -973,11 +939,12 @@ export const describe_standard_integration_tests = (options) => {
         });
         // --- 11. Expired credential rejection ---
         describe('expired credential rejection', () => {
-            test('expired session cookie returns 401', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const expired_cookie = await create_expired_test_cookie(test_app.backend.keyring, options.session_options);
+            test_if(options.capabilities.in_process_only, 'expired session cookie returns 401', async () => {
+                const fixture = await options.setup_test();
+                assert(fixture.in_process);
+                const expired_cookie = await create_expired_test_cookie(fixture.keyring, options.session_options);
                 const res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -985,12 +952,13 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 assert.strictEqual(res.status, 401, 'Expired session cookie should be rejected');
             });
-            test('expired session cookie returns 401 on mutation route', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
+            test_if(options.capabilities.in_process_only, 'expired session cookie returns 401 on mutation route', async () => {
+                const fixture = await options.setup_test();
+                assert(fixture.in_process);
+                const logout_route = find_auth_route(route_specs, '/logout', 'POST');
                 assert.ok(logout_route, 'Expected POST /logout route — ensure create_route_specs includes account routes');
-                const expired_cookie = await create_expired_test_cookie(test_app.backend.keyring, options.session_options);
-                const res = await test_app.app.request(logout_route.path, {
+                const expired_cookie = await create_expired_test_cookie(fixture.keyring, options.session_options);
+                const res = await fixture.transport(logout_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -998,60 +966,60 @@ export const describe_standard_integration_tests = (options) => {
                     },
                 });
                 assert.strictEqual(res.status, 401, 'Expired session cookie should be rejected on POST');
-                error_collector.record(test_app.route_specs, 'POST', logout_route.path, 401);
+                error_collector.record(route_specs, 'POST', logout_route.path, 401);
             });
         });
         // --- 12. Bearer token browser context on mutation routes ---
         describe('bearer token browser context silently discarded on mutations', () => {
             test('bearer token with Origin header discarded on POST logout', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
+                const fixture = await options.setup_test();
+                const logout_route = find_auth_route(route_specs, '/logout', 'POST');
                 assert.ok(logout_route, 'Expected POST /logout route — ensure create_route_specs includes account routes');
-                const bearer_headers = test_app.create_bearer_headers({
+                const bearer_headers = fixture.create_bearer_headers({
                     'content-type': 'application/json',
                 });
-                const res = await test_app.app.request(logout_route.path, {
+                const res = await fixture.fresh_transport()(logout_route.path, {
                     method: 'POST',
                     headers: { ...bearer_headers, origin: 'http://localhost:5173' },
                 });
                 assert.strictEqual(res.status, 401, 'Bearer with Origin should be discarded → unauthenticated');
-                error_collector.record(test_app.route_specs, 'POST', logout_route.path, 401);
+                error_collector.record(route_specs, 'POST', logout_route.path, 401);
             });
             test('bearer token with Referer header discarded on POST password', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const password_route = find_auth_route(test_app.route_specs, '/password', 'POST');
+                const fixture = await options.setup_test();
+                const password_route = find_auth_route(route_specs, '/password', 'POST');
                 assert.ok(password_route, 'Expected POST /password route — ensure create_route_specs includes account routes');
-                const bearer_headers = test_app.create_bearer_headers({
+                const bearer_headers = fixture.create_bearer_headers({
                     'content-type': 'application/json',
                 });
-                const res = await test_app.app.request(password_route.path, {
+                const res = await fixture.fresh_transport()(password_route.path, {
                     method: 'POST',
                     headers: { ...bearer_headers, referer: 'http://localhost:5173/admin' },
                 });
                 assert.strictEqual(res.status, 401, 'Bearer with Referer should be discarded → unauthenticated');
-                error_collector.record(test_app.route_specs, 'POST', password_route.path, 401);
+                error_collector.record(route_specs, 'POST', password_route.path, 401);
             });
         });
         // --- 13. Password change revokes API tokens ---
         describe('password change revokes API tokens', () => {
             test('API tokens are invalidated after password change', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const password_route = find_auth_route(test_app.route_specs, '/password', 'POST');
+                const fixture = await options.setup_test();
+                const password_route = find_auth_route(route_specs, '/password', 'POST');
                 assert.ok(password_route, 'Expected POST /password route');
                 // Create an API token via RPC
                 const create_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
                     params: { name: 'test-token' },
-                    headers: test_app.create_session_headers(),
+                    headers: fixture.create_session_headers(),
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');
                 const { token: raw_token } = create_res.result;
                 assert.ok(raw_token, 'Expected raw token in create response');
                 // Verify bearer token works
                 const verify_before = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -1060,11 +1028,11 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 assert.strictEqual(verify_before.status, 200, 'Bearer token should work before password change');
                 // Change password (still REST)
-                const change_res = await test_app.app.request(password_route.path, {
+                const change_res = await fixture.transport(password_route.path, {
                     method: 'POST',
-                    headers: test_app.create_session_headers({ 'content-type': 'application/json' }),
+                    headers: fixture.create_session_headers({ 'content-type': 'application/json' }),
                     body: JSON.stringify({
-                        current_password: 'test-password-123',
+                        current_password: DEFAULT_TEST_PASSWORD,
                         new_password: 'new-password-456',
                     }),
                 });
@@ -1074,7 +1042,7 @@ export const describe_standard_integration_tests = (options) => {
                 assert.ok(change_body.tokens_revoked >= 1, 'Expected at least 1 token revoked');
                 // Bearer token should now be invalid
                 const verify_after = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
@@ -1087,8 +1055,8 @@ export const describe_standard_integration_tests = (options) => {
         // --- 14. Signup invite edge cases ---
         describe('signup invite edge cases', () => {
             test('signup with non-matching email cannot claim another email invite', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const signup_route = test_app.route_specs.find((s) => s.method === 'POST' && s.path.endsWith('/signup') && is_public_auth(s.auth));
+                const fixture = await options.setup_test();
+                const signup_route = route_specs.find((s) => s.method === 'POST' && s.path.endsWith('/signup') && is_public_auth(s.auth));
                 if (!signup_route)
                     return; // signup is optional
                 // `invite_create` lives on the RPC surface; consumers that don't
@@ -1096,22 +1064,28 @@ export const describe_standard_integration_tests = (options) => {
                 // rather than fail.
                 if (!find_rpc_action(rpc_endpoints_for_setup, invite_create_action_spec.method))
                     return;
-                // Create an admin to manage invites
-                const admin = await test_app.create_account({
-                    username: 'invite_edge_admin',
-                    roles: ['admin'],
-                });
+                // Drive the admin-gated `invite_create` over the fixture's
+                // session. In both modes the fixture is the fresh keeper,
+                // holding `[ROLE_KEEPER, ROLE_ADMIN, ...extra_keeper_roles]`
+                // from the bootstrap-equivalent seed step — `extra_keeper_roles:
+                // [ROLE_ADMIN]` is technically redundant for the admin suite
+                // but harmless. `fixture.create_session_headers()` resolves to
+                // a session with admin role.
+                // `open_signup` stays at production default (`false`) across both
+                // in-process (per-test bootstrap default) and cross-process (the
+                // invite-gated `mint_account` flow doesn't need it flipped), so
+                // the assertion fires without any mid-test setting toggle.
                 // Create invite for alice@example.com via RPC
                 const invite_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: invite_create_action_spec,
                     params: { email: 'alice@example.com' },
-                    headers: { cookie: `${cookie_name}=${admin.session_cookie}` },
+                    headers: fixture.create_session_headers(),
                 });
                 assert.ok(invite_res.ok, `invite_create failed: ${invite_res.ok ? '' : JSON.stringify(invite_res.error)}`);
                 // Try to sign up with a different email — should fail (no matching invite)
-                const signup_res = await test_app.app.request(signup_route.path, {
+                const signup_res = await fixture.transport(signup_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -1132,25 +1106,30 @@ export const describe_standard_integration_tests = (options) => {
         // --- 15. Signup response body identity ---
         describe('signup response body identity', () => {
             test('no-invite and conflict failure responses are structurally identical', async () => {
-                const test_app = await create_test_app(build_test_app_options(options, get_db()));
+                const fixture = await options.setup_test();
                 // Find signup route (POST ending in /signup, public)
-                const signup_route = test_app.route_specs.find((s) => s.method === 'POST' && s.path.endsWith('/signup') && is_public_auth(s.auth));
+                const signup_route = route_specs.find((s) => s.method === 'POST' && s.path.endsWith('/signup') && is_public_auth(s.auth));
                 if (!signup_route)
                     return; // signup is optional
                 // `invite_create` lives on the RPC surface; consumers that don't
                 // wire admin RPC actions can't exercise invites.
                 if (!find_rpc_action(rpc_endpoints_for_setup, invite_create_action_spec.method))
                     return;
-                // We need admin access — create an admin account
-                const admin = await test_app.create_account({
-                    username: 'signup_test_admin',
-                    roles: ['admin'],
-                });
-                const admin_headers = { cookie: `${cookie_name}=${admin.session_cookie}` };
+                // Drive admin-gated calls over the fixture's session — see the
+                // previous test's comment for the in-process / cross-process
+                // admin-resolution paths. This test creates a separate
+                // `existing_user` for the username-conflict assertion, so
+                // reusing the fixture's admin session for the invite-creating
+                // path has no cross-account-isolation impact on the test's intent.
+                const admin_headers = fixture.create_session_headers();
+                // Mint the conflict-test sibling account for the username-conflict
+                // assertion below. Both transports preserve hardcoded usernames
+                // now that fresh-keeper-per-test wipes the DB between tests.
+                const existing_user = await fixture.create_account({ username: 'existing_user' });
                 // Create an invite for a specific test email via RPC
                 const test_email = 'signup-test@example.com';
                 const invite_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: invite_create_action_spec,
                     params: { email: test_email },
@@ -1158,7 +1137,7 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 assert.ok(invite_res.ok, `invite_create failed: ${invite_res.ok ? '' : JSON.stringify(invite_res.error)}`);
                 // Attempt 1: signup with a non-matching email (no invite match) → 403
-                const no_match_res = await test_app.app.request(signup_route.path, {
+                const no_match_res = await fixture.transport(signup_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',
@@ -1173,14 +1152,10 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 assert.strictEqual(no_match_res.status, 403, 'Expected 403 for non-matching invite');
                 const no_match_body = await no_match_res.json();
-                // For conflict test: create a second account with a known username,
-                // then create an invite for a different email, then try signup with
-                // the invited email but the colliding username
-                const existing_user = await test_app.create_account({ username: 'existing_user' });
                 // Create invite for a different email via RPC
                 const conflict_email = 'conflict-test@example.com';
                 const invite2_res = await rpc_call_for_spec({
-                    app: test_app.app,
+                    app: { request: fixture.transport },
                     path: rpc_path,
                     spec: invite_create_action_spec,
                     params: { email: conflict_email },
@@ -1188,7 +1163,7 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 assert.ok(invite2_res.ok, `invite2_create failed: ${invite2_res.ok ? '' : JSON.stringify(invite2_res.error)}`);
                 // Attempt 2: signup with the invited email but a colliding username → 409
-                const conflict_res = await test_app.app.request(signup_route.path, {
+                const conflict_res = await fixture.transport(signup_route.path, {
                     method: 'POST',
                     headers: {
                         host: 'localhost',