diff --git a/docs/reference/domain-test-checklist.md b/docs/reference/domain-test-checklist.md
index b513ec8..86e27c1 100644
--- a/docs/reference/domain-test-checklist.md
+++ b/docs/reference/domain-test-checklist.md
@@ -5,16 +5,17 @@ When you change a domain, its box must still hold (or you update this list on pu
 Baseline established 2026-07-22 (see plan `2026-07-22-per-domain-test-safety-net`).
 Tracked as Plane epic **SL-70**.
 
-## Coverage baseline (Phase A, 2026-07-22)
+## Coverage: baseline (Phase A) → final (Phase C), 2026-07-22
 
-| Workspace | % Stmts | % Branch | % Funcs | % Lines |
-| --------- | ------- | -------- | ------- | ------- |
-| api       | 96.94   | 74.29    | 100     | 96.94   |
-| worker    | 89.62   | 87.42    | 70.58   | 89.62   |
-| admin     | 92.43   | 84.91    | 78.75   | 92.43   |
+| Workspace | Stmts (before → after) | Branch (before → after) | Funcs (before → after) | Tests (before → after) |
+| --------- | ---------------------- | ----------------------- | ---------------------- | ---------------------- |
+| api       | 96.94 → **100**        | 74.29 → **100**         | 100 → **100**          | 103 → **175**          |
+| worker    | 89.62 → **100**        | 87.42 → **100**         | 70.58 → **100**        | 30 → **79**            |
+| admin     | 92.43 → **100**        | 84.91 → **100**         | 78.75 → **100**        | 50 → **129**           |
 
-Target after the sweep: near-100% per domain; remaining uncovered lines annotated
-`/* c8 ignore next -- <reason> */`, not left silent.
+All three workspaces reach **100%** statements/branches/functions/lines. Genuinely
+unreachable/defensive lines are annotated `/* c8 ignore next -- <reason> */` (never left silent).
+No bugs were found during the sweep — every added test locks in already-correct behavior.
 
 <!-- Phase B appends one "## <domain>" section per domain below. -->
 
diff --git a/docs/roadmap.md b/docs/roadmap.md
index b318f57..157cee2 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -216,6 +216,13 @@ Each phase keeps the system working and is its own spec → plan → build cycle
 - **Phase 5 — Polish & deploy.** Reporting niceties, dependency slimming, push the
   container to a chosen cloud host.
 
+> **Testing & hardening (2026-07-22, Plane SL-70).** Per-domain test safety net established
+> across all three workspaces: `@vitest/coverage-v8` wired in each, a `resetDb()` per-test DB
+> isolation helper, and a gap-fill + one lifecycle test per domain. **100% stmts/branch/funcs**
+> everywhere (api/worker/admin); **383 tests** (was 183); zero bugs found. Guaranteed behaviors
+> per domain are recorded in `docs/reference/domain-test-checklist.md` (the living
+> definition-of-done). See `docs/sessions/2026-07-22-per-domain-test-safety-net.md`.
+
 ## 10. Open questions & assumptions (confirm as we go)
 
 - **Scanning = QR codes** — ✅ resolved (2026-07-22): the QR only opens the app URL (external
diff --git a/docs/sessions/2026-07-22-per-domain-test-safety-net.md b/docs/sessions/2026-07-22-per-domain-test-safety-net.md
new file mode 100644
index 0000000..64f001e
--- /dev/null
+++ b/docs/sessions/2026-07-22-per-domain-test-safety-net.md
@@ -0,0 +1,81 @@
+# Session: 2026-07-22 — Per-domain test safety net
+
+## Goal
+
+Give every domain across `apps/api`, `apps/worker`, and `apps/admin` a measured, near-100%
+test safety net (coverage tooling + gap-fill + one lifecycle test per domain), and shake out
+bugs in the process. Spec: `docs/superpowers/specs/2026-07-22-per-domain-test-safety-net-design.md`;
+plan: `docs/superpowers/plans/2026-07-22-per-domain-test-safety-net.md`. Tracked as Plane epic **SL-70**.
+
+## Approach
+
+Brainstorm → spec → plan → execution. Decisions: full safety net (tooling + gap-fill + lifecycle
+tests + a living behaviors checklist), all three layers equal depth, bugs logged to Plane with
+trivial fixes inline. Coverage target: near-100% per domain, no silent gaps (`/* c8 ignore */`
+with a reason for genuinely unreachable/defensive lines).
+
+- **Phase A (inline):** coverage tooling (`@vitest/coverage-v8` + `test:coverage` in all three
+  workspaces, `all: true`, text + json-summary), a `resetDb()` helper for per-test DB isolation
+  (fixes the accumulate-and-scope fragility; proved on the sessions suite), the Plane epic, and
+  the checklist-doc skeleton with the baseline. Commits `3c79e51`, `f872daf`, `0564fab`.
+- **Phase B (Workflow, background):** 18 domains, strictly sequential — one focused
+  `general-purpose` agent per domain following the Domain Procedure (measure coverage → fill
+  gaps → add the domain's lifecycle test → near-100% → oxfmt/oxlint → append checklist section →
+  commit). Sequential because all agents share one working tree, one SQLite test DB, and one git
+  index — parallel test-runs/commits would corrupt each other.
+- **Phase C (inline):** independent verification + synthesis (this session's author, not the
+  agents' self-reports).
+
+## Execution — what actually happened
+
+The Workflow hit two **transient network outages** (not test failures):
+
+1. First run: A0–A6 (the first 7 API domains) completed and committed; then a sustained
+   `SSL certificate hostname mismatch` connection error killed A7 and every agent after it (12
+   failures). The ticktick MCP dropped at the same time — a network blip, not a code problem.
+2. Resumed via `Workflow({resumeFromRunId})`: A0–A6 replayed from cache, A7 + all clients ran
+   live. 18/19 completed; **W2 (Stopwatch)** dropped with `Connection closed mid-response`.
+   The tree was left clean (no partial commit).
+3. W2 finished by a single focused fallback `Agent` (avoids the resume re-running the
+   already-committed suffix). Commit `a30441b`.
+
+Phase C then found one file that had fallen **between** the admin D-domains — `apps/admin/src/lib/api.ts`
+(the base fetch/`ApiError` wrapper, 34% covered; the D-tasks covered the per-resource `api/*.ts`
+but not the shared helper). Closed inline mirroring the worker's `api.test.ts`. Commit
+`test(admin): cover lib/api fetch wrapper`.
+
+## Outcome
+
+**All three workspaces at 100% statements / branches / functions / lines.**
+
+| Workspace | Stmts | Branch | Funcs | Tests (before → after) |
+| --------- | ----- | ------ | ----- | ---------------------- |
+| api       | 100   | 100    | 100   | 103 → 175              |
+| worker    | 100   | 100    | 100   | 30 → 79                |
+| admin     | 100   | 100    | 100   | 50 → 129               |
+
+- **383 tests total** (was 183), all green. Typechecks clean in all three; `npx oxlint` clean.
+- **One lifecycle/integration test per domain** where the plan called for it (API integration
+  tests live in `apps/api/test/integration/`).
+- **Zero bugs found.** Every added test locks in already-correct behavior — a good signal for a
+  greenfield build that had been TDD'd from the start. Genuinely unreachable lines
+  (`?? 0` guards behind `NOT NULL DEFAULT 0` columns, CLI direct-run blocks, disabled-control
+  early returns) are `/* c8 ignore */`'d with reasons, not left silent.
+- **Harness improvement:** `resetDb()` gives per-test isolation; new API domain suites use
+  `beforeEach(resetDb)` so they assert exact counts without dodging other suites' rows.
+- Living **`docs/reference/domain-test-checklist.md`** records the guaranteed behaviors per domain
+  — the definition-of-done future work checks against.
+
+## Verification (independent of the agents' self-reports)
+
+- `yarn workspace @solelog/{api,worker,admin} test:coverage` → 175 / 79 / 129 tests, all green,
+  100% (api, worker) and 100% (admin after the Phase C gap-closure).
+- Three typechecks clean; `npx oxlint` exit 0; `git status` clean.
+
+## Tracking / next
+
+- Plane epic **SL-70** → Done. No bug tickets filed (none found).
+- `main` is well ahead of origin — the maintainer pushes from their terminal (`git push origin main`).
+- Next per the roadmap: **Phase 5 — Polish & deploy** (hosting already handled on the maintainer's
+  machine), or the Plane backlog (the "data not visible after reopening browser / relogin" bug looks
+  highest-value).