Deterministic Phase 2 journeys. Starting one replaces the current fake session state.
privacy-eea-suppressed
Test: Dismiss the landing-page notice, reload, then inspect Privacy Controls.
Expect: The notice stays dismissed, and no identifier or linked analytics data exists.
privacy-opt-out
Test: Export the three linked events, turn off analytics, then export again.
Expect: Rows are exported, then deleted before the identifier; the second export is empty.
privacy-deletion-failure
Test: Try to turn off analytics, read the error, then reload the page.
Expect: The failure is explicit and the identifier and linked row remain unchanged.
privacy-dnt
Test: Visit the landing page and Privacy Controls, then inspect the event viewer.
Expect: No notice, identifier, or analytics event is created while DNT is active.
auth-sign-up-us
Test: Create the account, open the fake inbox, verify the email, then sign in.
Expect: One account and verification email are created; verification enables sign-in.
auth-sign-up-non-us
Test: Complete the sign-up form, then inspect the fake inbox and event viewer.
Expect: The request is refused without creating an account or verification email.
auth-password-reset
Test: Request a reset, use its inbox link once, then expire and open a fresh link.
Expect: GET does not consume links; submitted, reused, and expired states remain distinct.