Six specs driving the user-reported controls the way a human does,
encoding the sweep rules COVERAGE.md now states: menus/modals assert
VISIBILITY (never DOM text — hidden menus' text is why the 2026-10-30
panel sweep certified dead controls), geometry asserts the z-ladder
via elementFromPoint and viewport containment via boundingBox, every
click must produce an observable outcome (PUT fired, class flipped,
chip text swapped) and zero new console problems — the silent
CSP-throw family (theme buttons, connective chip, invisible op menu)
now fails a test instead of surviving to a user's mouse.
Covers: theme picker (interpolation regression from eb57b720),
pencil-glyph vs card-body contract, builder field menu / op menu
(full non-empty vocabulary) / connective both directions, the
Smart→Episodes create-modal seed, the picker overlay's ladder and
height, and the chain-order select's persistence round-trip.
Fixtures self-create/self-delete under test-prefixed names; localStorage
token + selectedLibrary=__all__ are seeded because the API login
establishes only the cookie; run the folder with --workers=1 (the login
route rate-limits and all suites share testuser — a parallel worker's
login revokes another's mid-run).
tests/ui — Playwright sweep (plan §7.5)
Real-browser sweep of the SSR/HTMX frontend. Dev server must be up on localhost:8765. Run inside the official image (no host browsers needed):
cd tests/ui
docker run --rm --network host \
-v "$PWD":/work -w /work \
mcr.microsoft.com/playwright:v1.49.0 \
bash -c "npm install --no-audit --no-fund && npx playwright test"
Personas (see rls_sweep.spec.ts): testuser (admin) and rls-phone
(restricted — Audiobooks hidden from them).
Coverage: COVERAGE.md enumerates every swept page/control per the
plan; new pages/controls get a line when added.