⭐ Testing Strategy

Testing here runs on three layers — Pest (backend), Vitest (frontend, in isolation), and Playwright/manual (real browser, real HTTP) — each blind to what the other two cover. See testing-strategy-layers.html for what each layer actually proves, what it's blind to, and a real bug example only that layer caught. Same content as docs/smoketest.md's own framing of this.

Two things worth knowing that the diagram doesn't have room for:

This isn't 100% coverage. Real, documented gaps remain — several SSH-touching happy paths are covered by Pest's safe/validation-rejection tests but not by a live SSH session (see docs/smoketest.md).

Pest 4's own browser-testing plugin can't run in this dev environment — it needs PHP and Node in the same process, and this stack's container split (coolify has PHP, no Node; coolify-vite has Node, no PHP) doesn't support that. Tracked as its own backlog item, issue #11 in the main repo. Vitest + Playwright/manual are what stand in for it today.