Prove that it works

Test with safe data of your own

Use synthetic notes, two test accounts and your own empty Drive test folder. Do not send real user content to test services. Use unit and integration tests with fakes to reproduce failures. Then check real OAuth and Drive storage separately. A passing fake does not prove a live integration works.

bun install --frozen-lockfile
bun run test
bun run dev

Run browser checks with BrowserOS Neo. First check whether it is running with pgrep -f "BrowserOS neo"; if needed, start it with open -a "BrowserOS neo". The configured connections are CDP 9110, MCP 9010 and server 9210. If the browser is unavailable, report the missing browser evidence. Do not use another browser as though it meets this requirement.

Reference maintenance checks · 28 October 2026

The maintained reference app passed 1,843 Bun tests and seven BrowserOS Neo checks after the dependency update. The Neo fixture uses a temporary server, signed synthetic Google sessions and separate browser contexts. It checks current theme tokens, desktop/mobile layouts, rejection of password login, the initial Google authorization redirect, API failures and offline note/folder persistence. See Setup & Operations for the fixture contract and bun run test:browser.

These checks do not complete this chapter's scenarios for a new app. They do not prove real OAuth token exchange, live Drive behavior, account-isolation acceptance budgets or deployment. Keep those evidence layers separate.

V01 · Startup, login and isolation

P00/P01

Steps

Start clean with your own .env. Sign in with Google. Test a state mismatch, denied access, signup without consent, session rotation and logout. Test two accounts against the same note/media ID and a restricted admin route.

Expected result

Redirects/401 responses and error messages are correct; OAuth state is checked and account data stays separate. No secrets are stored in Git.

V02 · Local writing and transfer

P01/P02

Steps

Create a note without Drive using a unique test sentence. Save, reload and reopen it with the offline shell already loaded. Export app-preserving Markdown/ZIP, import it and compare; also verify the explicit lossy plain-Markdown path from chapter 13. Search server data and logs for the test sentence.

Expected result

Text exists in account-specific IndexedDB and the export, with no new readable server copy. There is no promise that a first visit while offline will work.

V03 · Editor and keyboard

P02

Steps

Test formatting, an app-preserving Markdown round trip and a separately labelled plain exchange, a GFM table, lists/task lists, a nested quote and double Enter. Use the slash menu, @, Cmd/Ctrl+K and Markdown help. Test Escape, Tab and focus restoration.

Expected result

Supported rich content is preserved in the app-preserving format; plain exchange matches the explicit loss/fallback matrix. A menu handles only its own keys, with no unintended note switch. No duplicate editor appears.

V04 · Folders and multi-select

P02

Steps

Create empty root and nested folders; root children use folder-notes as their parent. Rename and reload a locally created folder while offline, reconnect, and delete it. Select with Shift and Cmd/Ctrl, move items through the menu and by dragging, and inject a failure for one item. Switch to another folder while waiting.

Expected result

Feedback is immediate; only the failed item is restored. No stale folder is used as a destination. The active note and destination folder stay consistent.

V05 · Search scope and correct selection

P02

Steps

Create a note, folder and media file with the same search term, and delete another match. Run a global search, then search in Files. Open the second note result while an earlier detail request is slow.

Expected result

Global search returns only non-deleted notes/folders; Files uses its own scope. The selected note takes priority over an old response and remains editable.

V06 · Delete and late responses

P02/P04

Steps

Select several notes, cancel Delete, then confirm it once. Delay detail/list/push responses and let them arrive after deletion. Also check a folder with contents and existing Trash.

Expected result

Canceling preserves everything; confirming permanently deletes the selection. Deleted items do not reappear and no new editor is mounted. Existing Trash can be managed separately.

V07 · Queue, status and real Drive

P04

Steps

Create, edit, rename and move several notes, including during a push. Force 429/503 errors and a lost response. Reload and restore the network. Check the actual content in your own Drive test folder.

Expected result

Retries are automatic, with no duplicate items. A ticket does not yet mean success. Only confirmed revisions leave the queue; new text is preserved. Record fake and live results separately.

V08 · Cache and incremental listings

P04

Steps

Use more than 40 synthetic notes. Slow down Drive, omit one page, and simulate a 503 response and an unreadable document. Measure opening with a populated cache and count downloads after one change.

Expected result

The cache opens without waiting for Drive; all hasMore pages are processed. Only changed or missing content is fetched. An error is not treated as an empty list and valid local text is preserved.

V09 · Merging and two tabs

P04

Steps

Starting from base B, edit different sections in two tabs, then change the same words differently. Change the etag between reading and writing. Type more text while an old acknowledgment arrives.

Expected result

Independent text changes are merged; genuine conflicts are safely preserved. The new local revision stays pending, and another tab cannot silently clear the shared error state.

V10 · Encryption, restart and migration

P04

Steps

Push a unique test sentence, interrupt Drive, inspect ticket files/logs and restart the server. Try a ticket from another test account. Retrieve the result later. If migration is needed, simulate a crash before and after the receipt is acknowledged.

Expected result

Only an encrypted packet is stored on disk, with no plaintext content or cross-account leak. Retries and deduplication preserve work. Completed tickets are cleaned up; old sources are deleted only after proven receipt.

V11 · Media and uploads

P03/P04

Steps

Test byte range 0–99, open-ended ranges, suffix ranges and invalid ranges. Seek in video, resume audio and open PDF/EPUB files. Test with ffmpeg missing. Upload two files with the same name at once and interrupt a chunk or finalization.

Expected result

206/416 responses and headers are correct. Seeking works. A placeholder appears without ffmpeg. Uploads do not overwrite files and can be retried safely. Status is honest when no storage source is available.

V12 · Extensions

P05

Steps

For each chosen integration: recheck the mandatory V16 source flow, then save and reopen a canvas; request AI explicitly and cancel it; test YouTube and a Whisper failure.

Expected result

Every chosen feature has a working flow, with no lost context or late insertion. The core keeps working without configuration; no unsolicited AI request is made. Separate fake and live results.

V13 · Settings and administration

P01/P02/P04/P07 core; P05 advanced account controls

Steps

Switch themes, log out and connect/disconnect a test Drive account. If optional FR-21 is selected, test an unauthorized admin action and run reset/deletion only on a synthetic test account. Check the production configuration example.

Expected result

Permissions, confirmation and focus are correct. Only the specified data is deleted. Google OAuth, HTTPS and secure cookies are documented.

V15 · Delivery and mobile web

P07

Steps

Check every chosen ID against evidence. Compare the interface with 09 Design. Test the browser on desktop and at 390px width, including keyboard, focus, themes and dialogs. Repeat the README installation/startup steps in a clean environment when available.

Expected result

No horizontal page overflow, readable text and touch targets ≥44px. Outstanding criteria are visible. Do not claim a live integration or deployment without evidence.

V16 · Existing large source → annotated note

P03/P04 · FR-09, FR-11, FR-17 · US-09, US-11 · A01/A10

Report format

Scope: web core / full web app
Environment and date:
Version / commit:

Requirement | Story | Scenario | Evidence | Status | Limitation
FR-02       | US-01 | V02      | test name + actual output / browser observation | ... | ...

Unit/integration tests with fakes:
BrowserOS Neo desktop/mobile:
Real Google OAuth/Drive:
Deployment: not performed / evidence of the exact version
Outstanding criteria and next step: