# Domain test checklist — guaranteed behaviors

Living definition-of-done. Each domain lists the behaviors its tests guarantee.
When you change a domain, its box must still hold (or you update this list on purpose).
Baseline established 2026-07-22 (see plan `2026-07-22-per-domain-test-safety-net`).
Tracked as Plane epic **SL-70**.

## Coverage baseline (Phase A, 2026-07-22)

| Workspace | % Stmts | % Branch | % Funcs | % Lines |
| --------- | ------- | -------- | ------- | ------- |
| api       | 96.94   | 74.29    | 100     | 96.94   |
| worker    | 89.62   | 87.42    | 70.58   | 89.62   |
| admin     | 92.43   | 84.91    | 78.75   | 92.43   |

Target after the sweep: near-100% per domain; remaining uncovered lines annotated
`/* c8 ignore next -- <reason> */`, not left silent.

<!-- Phase B appends one "## <domain>" section per domain below. -->

## Infra (health/db/schema/seed/env/migrate)

Src covered: `src/routes/health.ts`, `src/db/client.ts`, `src/db/ensure-dir.ts`,
`src/db/migrate.ts`, `src/db/seed.ts`, `src/env.ts` — all at 100% stmts/branch/funcs/lines.
(`src/db/schema.ts` is generated and excluded from coverage by config.)

Guaranteed behaviors:

- `GET /health` returns `{ status: 'ok' }`.
- `env.ts` applies every dev default (`DATABASE_URL`, `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`,
  `PORT`, `WEB_ORIGINS`) when the vars are unset, and reads each override when set (`PORT`
  coerced to a number).
- `env.WEB_ORIGINS` parses `CORS_ORIGINS` into a list, trimming whitespace and dropping empty
  entries; falls back to the default localhost origins when `CORS_ORIGINS` is empty/unset.
- `runMigrations()` is idempotent — re-running it against an already-migrated DB does not throw.
- `ensureDbDir()` is a no-op for non-`file:` URLs and for a bare filename in the current dir.
- `seed()` seeds the reference activities idempotently and seeds the dev worker + dev admin with
  the correct roles, idempotently.
- `seed()` never creates the dev users when `NODE_ENV=production` (reference activities still
  seeded).
- The `migrate.ts` / `seed.ts` CLI direct-run blocks are `c8 ignore`d — unreachable under the
  test runner (exercised only via `tsx src/db/{migrate,seed}.ts`).