stand-ui-test

Use the sign_in flow helper with a manifest persona: sign_in(page, base_url, session_for("dev_lead")). It drives the real authorization-code-plus-PKCE chain through Keycloak's actual form with no token shortcuts, and each journey signs in fresh rather than sharing an authenticated page fixture.

Only when you can name a measurement proving the claim needs a browser, such as a cookie only a real browser sets, a client-side route change no HTTP call performs, or a rendering step the API response passes through. If you cannot cite the measurement, write an API test instead.

Use accessibility-first locators: get_by_role with accessible names, filtered by text where needed. Structural data-slot attributes and index chains inside role-anchored containers are permitted exceptions, but hashed CSS classes and Tailwind utility selectors are forbidden.

Use expect_download() only as the transport assertion, then save and parse the file. Compare headers, all rows, and representative values across every format offered (CSV and XLSX), assert the filename separately, and check record counts against the grid's aria-rowcount.

Hardcoded expectations break when seed data is reshuffled. Derive expectations from the stand manifest at runtime or from the response the page just received, and guard against empty derivations so a vacuous expectation cannot make assertions pass trivially.

Coverage recording happens in ApiClient.request, not at client construction. A UI journey's PersonaSession carries a client but never issues requests through it, so a ui-only run writes nothing to the coverage ledger or operation catalogue.