diff --git a/.agents/docs/architecture/testing-strategy.md b/.agents/docs/architecture/testing-strategy.md
index e1b4519f4..735955abf 100644
--- a/.agents/docs/architecture/testing-strategy.md
+++ b/.agents/docs/architecture/testing-strategy.md
@@ -17,11 +17,11 @@ of operations.
 
 ## Tiers
 
-| Tier       | Runner     | Where                                                    | Command         |
-| ---------- | ---------- | -------------------------------------------------------- | --------------- |
-| Unit       | vitest     | `src/__tests__/` (or `test/`) in a participating package | `pnpm test`     |
-| End-to-end | Playwright | `testing/src/specs/`                                     | `pnpm test:e2e` |
-| Type-check | `tsc`      | —                                                        | `pnpm lint`     |
+| Tier       | Runner     | Where                                                    | Command              |
+| ---------- | ---------- | -------------------------------------------------------- | -------------------- |
+| Unit       | vitest     | `src/__tests__/` (or `test/`) in a participating package | `pnpm test:coverage` |
+| End-to-end | Playwright | `testing/src/specs/`                                     | `pnpm test:e2e`      |
+| Type-check | `tsc`      | —                                                        | `pnpm lint`          |
 
 There is no integration tier. `apps/api` unit tests mock the Prisma layer entirely; the only code
 path exercised against a real database is Playwright.
@@ -115,6 +115,25 @@ no database. Only `testing` owns a `test:e2e` script; only `apps/gateway` owns a
 `globalDependencies` are `.env`, `eslint.config.js`, `tsconfig.json` and `prettier.config.js`.
 Touching any of them invalidates the cache for every task in the repo.
 
+## Coverage
+
+`pnpm test:coverage` is the unit gate, locally and in CI. The root `vitest.config.ts` sets
+`coverage.thresholds: { 100: true }`, so the run fails when statements, branches, functions or lines
+drop below 100%. The scope is its `coverage.include` — `apps/{api,gateway,web}/src` and
+`packages/*/src`; `runtime/**` and `apps/playground` are outside it — minus `coverage.exclude`,
+which lists only non-code: test fixtures and helpers (`__tests__`, `__mocks__`,
+`apps/web/src/testing`), the generated `route-tree.ts`, and the bare entrypoints.
+
+- **A line no test can reach is dead code.** Prove it (the types, every caller, the library's
+  contract) and delete it, or restructure so the impossible state cannot be written — e.g. ts-pattern
+  `.exhaustive()` instead of `.otherwise(() => null)`. Never add an ignore comment or an exclude entry
+  to pass.
+- **A scoped run fails the threshold by construction**: `--project`, a file filter or a narrowed
+  `--coverage.include` measures a fraction of the scope. Add `--coverage.thresholds.100=false` to it
+  and read the per-file report.
+- `apps/api` confines its SWC transform to its own files (`apps/api/vitest.config.ts`); letting SWC
+  transform the workspace packages it imports makes the merged report count their functions twice.
+
 ## What CI gates
 
 `.github/workflows/ci.yaml`, one job (`lint-and-test`, ubuntu-latest), triggered on
@@ -125,7 +144,7 @@ Touching any of them invalidates the cache for every task in the repo.
 | 1   | Generate Environment | `./scripts/generate-env.sh`                            |
 | 2   | Install Dependencies | `pnpm install --frozen-lockfile`                       |
 | 3   | Lint                 | `pnpm lint`                                            |
-| 4   | Unit Tests           | `pnpm test`                                            |
+| 4   | Unit Tests           | `pnpm test:coverage`                                   |
 | 5   | Install Playwright   | chromium + firefox `--with-deps`, capped at 10 minutes |
 | 6   | End-to-End Tests     | `pnpm test:e2e`                                        |
 
@@ -135,8 +154,6 @@ does not hide their results.
 Not gated, despite existing in the repo:
 
 - **No separate type-check step** — it is folded into step 3.
-- **No coverage.** Nothing in CI runs `pnpm test:coverage`, and the root config declares no
-  `thresholds`. Its `include` is `apps/**/*` and `packages/**/*`, so `runtime/**` is outside it.
 - **No knip step**, although `knip.ts` and a `pnpm knip` script exist.
 - **No format check.** Prettier runs only in the `.husky/pre-commit` hook (`prettier-pre-commit`),
   which formats rather than verifies; the hook does not run lint or tests.
diff --git a/.agents/docs/playbooks/add-env-var.md b/.agents/docs/playbooks/add-env-var.md
index 1c82306a2..57dac99d7 100644
--- a/.agents/docs/playbooks/add-env-var.md
+++ b/.agents/docs/playbooks/add-env-var.md
@@ -78,6 +78,6 @@ touched exactly two of these: `.env.template` and `$Env`, replacing a direct
 grep -n YOUR_KEY .env    # present after regeneration
 pnpm dev                 # $Env is validated at boot; an invalid value crashes here. Ctrl-C once up
 pnpm lint                # tsc + the no-process.env rule
-pnpm test
+pnpm test:coverage
 pnpm build               # only this catches a missing turbo.json `env` entry
 ```
diff --git a/.agents/docs/playbooks/add-instrument.md b/.agents/docs/playbooks/add-instrument.md
index 0674a8281..37d366f48 100644
--- a/.agents/docs/playbooks/add-instrument.md
+++ b/.agents/docs/playbooks/add-instrument.md
@@ -82,7 +82,7 @@ advice does not apply here; everything it says about the definition object does.
 pnpm exec turbo run build --filter=@opendatacapture/instrument-library  # builds runtime/v1 first
 pnpm --filter @opendatacapture/instrument-library run available         # reads dist, not src
 pnpm lint
-pnpm test
+pnpm test:coverage
 pnpm test:e2e
 ```
 
diff --git a/.agents/docs/playbooks/add-vendor-package.md b/.agents/docs/playbooks/add-vendor-package.md
index 62cf7e9a7..3f2f2c49d 100644
--- a/.agents/docs/playbooks/add-vendor-package.md
+++ b/.agents/docs/playbooks/add-vendor-package.md
@@ -73,5 +73,5 @@ pnpm --filter @opendatacapture/runtime-v1 build   # READ THE OUTPUT — it logs
 ls runtime/v1/dist/<name>@<range>                 # step 8 was silent if this is missing
 pnpm exec vitest --project runtime-v1             # peer pairing
 pnpm exec vitest --project runtime-bundler
-pnpm lint && pnpm test
+pnpm lint && pnpm test:coverage
 ```
diff --git a/.agents/docs/playbooks/add-web-data-hook.md b/.agents/docs/playbooks/add-web-data-hook.md
index 562c42508..70ebfa868 100644
--- a/.agents/docs/playbooks/add-web-data-hook.md
+++ b/.agents/docs/playbooks/add-web-data-hook.md
@@ -73,5 +73,5 @@ step type-checks and compiles, and fails at runtime or serves the wrong cached d
 ```sh
 pnpm exec vitest apps/web/src/hooks/__tests__/<hookName>.test.ts   # the new test alone
 pnpm exec vitest --project web                                     # every web test
-pnpm lint && pnpm test                                             # required before you are done
+pnpm lint && pnpm test:coverage                                    # required before you are done
 ```
diff --git a/.agents/docs/playbooks/promote-to-react-core.md b/.agents/docs/playbooks/promote-to-react-core.md
index 1325185a4..386c8f8fc 100644
--- a/.agents/docs/playbooks/promote-to-react-core.md
+++ b/.agents/docs/playbooks/promote-to-react-core.md
@@ -104,7 +104,7 @@ pnpm --filter @opendatacapture/react-core lint      # no app aliases in this pro
 pnpm --filter @opendatacapture/web lint
 pnpm --filter @opendatacapture/gateway lint         # meaningful only once step 9 wired the consumer
 pnpm exec vitest --project web
-pnpm lint && pnpm test
+pnpm lint && pnpm test:coverage
 pnpm test:e2e
 pnpm --filter @opendatacapture/storybook storybook  # port 6006 — listed under React Core, not Web
 ```
diff --git a/.agents/skills/odc-done/SKILL.md b/.agents/skills/odc-done/SKILL.md
index 782ce8282..541226bc8 100644
--- a/.agents/skills/odc-done/SKILL.md
+++ b/.agents/skills/odc-done/SKILL.md
@@ -37,14 +37,15 @@ exception rather than editing the tree yourself.
 ## 2. Test, and make the run name your file
 
 ```sh
-pnpm test
+pnpm test:coverage                  # fails below 100% on any metric — see testing-strategy.md §Coverage
 pnpm exec vitest list --filesOnly   # a green run prints counts only; this prints the collected files
 ```
 
 A test file the listing never names was collected by nothing —
 `.agents/skills/odc-testing/SKILL.md` opens on that failure and owns both the diagnosis and the fix.
 
-**Done when** the run is green _and_ `list --filesOnly` names every test file this change added.
+**Done when** the run is green at 100% coverage _and_ `list --filesOnly` names every test file this
+change added.
 
 ## 3. Run the end-to-end suite, or raise the exception
 
diff --git a/.agents/skills/odc-testing/SKILL.md b/.agents/skills/odc-testing/SKILL.md
index 9bcadfe34..4c19cfd60 100644
--- a/.agents/skills/odc-testing/SKILL.md
+++ b/.agents/skills/odc-testing/SKILL.md
@@ -27,11 +27,11 @@ and the e2e test carries the change, or this change adds its `vitest.config.ts`.
 
 ## Choose the tier before you choose the file
 
-| What you changed                                        | The tier that can prove it                 | Runner          |
-| ------------------------------------------------------- | ------------------------------------------ | --------------- |
-| A pure function, a schema, a hook, a rendered component | Unit, in that package's own project        | `pnpm test`     |
-| Who can see or do what; anything reading real rows      | End-to-end only                            | `pnpm test:e2e` |
-| A type contract — inference, a discriminated union      | The type-check, which is `tsc` inside lint | `pnpm lint`     |
+| What you changed                                        | The tier that can prove it                 | Runner               |
+| ------------------------------------------------------- | ------------------------------------------ | -------------------- |
+| A pure function, a schema, a hook, a rendered component | Unit, in that package's own project        | `pnpm test:coverage` |
+| Who can see or do what; anything reading real rows      | End-to-end only                            | `pnpm test:e2e`      |
+| A type contract — inference, a discriminated union      | The type-check, which is `tsc` inside lint | `pnpm lint`          |
 
 **There is no integration tier, and the middle row is why.** `apps/api` unit tests mock the Prisma
 layer entirely (`apps/api/src/groups/__tests__/groups.service.spec.ts`), so the only code path
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 380b751c6..95e8b6fff 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -31,7 +31,7 @@ jobs:
       - name: Lint
         run: pnpm lint
       - name: Unit Tests
-        run: pnpm test
+        run: pnpm test:coverage
       - name: Install Playwright
         # Cap the step so a hang fails fast instead of hitting the 6h job limit, skip the interactive
         # apt prompt, and install only the browsers the e2e suite uses.
diff --git a/AGENTS.md b/AGENTS.md
index 6605d779f..bd1d66e07 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -21,17 +21,20 @@ pnpm build                  # turbo build (all packages/apps)
 pnpm lint                   # turbo lint — `tsc && eslint --fix src` per package, plus lint:root for root-level scripts and configs
 pnpm format                 # turbo format (prettier per package)
 pnpm test                   # vitest across the workspace
+pnpm test:coverage          # vitest with coverage — fails below 100%, the gate CI and "Before you are done" run
 pnpm test:e2e               # playwright, in testing/
 ```
 
 Scope a run to one package with `pnpm --filter @opendatacapture/<pkg> <script>` or turbo's
 `--filter=<pkg>`. Scope vitest to one project with `pnpm exec vitest --project <name>` (names come
 from the `name` field in each package's `vitest.config.ts`, e.g. `api`, `web`, `schemas`). Run a
-single file with `pnpm exec vitest path/to/file.test.ts`.
+single file with `pnpm exec vitest path/to/file.test.ts`. A scoped run with `--coverage` measures
+only what it ran against the whole coverage scope, so add `--coverage.thresholds.100=false` to it.
 
-`pnpm lint` and `pnpm test` both need `.env` to exist. `pnpm lint` also needs a generated Prisma
-client, so a cold run is not fast. A fresh clone needs more than `pnpm install` before `pnpm dev`
-serves anything — `.agents/docs/playbooks/run-locally.md` is the order of operations.
+`pnpm lint`, `pnpm test` and `pnpm test:coverage` all need `.env` to exist. `pnpm lint` also needs a
+generated Prisma client, so a cold run is not fast. A fresh clone needs more than `pnpm install`
+before `pnpm dev` serves anything — `.agents/docs/playbooks/run-locally.md` is the order of
+operations.
 
 ## Hard rules
 
@@ -46,6 +49,11 @@ not every tool loads nested files.
 - **Every change needs a unit test _and_ an end-to-end test in `testing/`.** See
   `.agents/docs/playbooks/add-e2e-test.md`. Utility scripts under `scripts/` are the one exception
   and need no tests.
+- **Unit test coverage stays at 100%.** `pnpm test:coverage` fails below 100% statements, branches,
+  functions or lines, and CI runs it. Code no test can reach is dead code: prove it dead (the types,
+  the callers, the library contract) and delete it. Never add a coverage-ignore comment or widen
+  `coverage.exclude` to get past the gate; that list is for non-code — fixtures, generated files and
+  bare entrypoints.
 - **Commit messages follow Conventional Commits.** `type(scope): subject`, where `type` is one of the
   11 `@commitlint/config-conventional` types and `scope`, if present, is an `@opendatacapture/*`
   workspace name without the prefix. A `commit-msg` hook and the `Commitlint` CI job enforce it, and
@@ -64,7 +72,8 @@ not every tool loads nested files.
 
 ### Before you are done
 
-1. Run `pnpm lint`, `pnpm test`, and `pnpm test:e2e` from the repo root and fix every failure.
+1. Run `pnpm lint`, `pnpm test:coverage`, and `pnpm test:e2e` from the repo root and fix every
+   failure, a coverage shortfall included.
 2. **Re-read the `AGENTS.md` of every package or app you modified and confirm your change does not
    contradict it.** If it does, either revise the change or update that `AGENTS.md` in the same
    commit — never leave the two disagreeing.
diff --git a/apps/api/src/core/__tests__/prisma.spec.ts b/apps/api/src/core/__tests__/prisma.spec.ts
index 82d3a316b..b89f44cee 100644
--- a/apps/api/src/core/__tests__/prisma.spec.ts
+++ b/apps/api/src/core/__tests__/prisma.spec.ts
@@ -25,8 +25,10 @@ vi.mock('@prisma/client', async (importOriginal) => ({
   }
 }));
 
-/** Only `getUri` is read from the replica set the factory starts. */
-const createReplSet = vi.hoisted(() => vi.fn<(options: unknown) => Promise<{ getUri: (db: string) => string }>>());
+/** Only `getUri` and `stop` are used on the replica set the factory starts. */
+const createReplSet = vi.hoisted(() =>
+  vi.fn<(options: unknown) => Promise<{ getUri: (db: string) => string; stop: () => Promise<boolean> }>>()
+);
 
 vi.mock('mongodb-memory-server', () => ({
   MongoMemoryReplSet: { create: createReplSet }
@@ -238,7 +240,8 @@ describe('PrismaModuleOptionsFactory', () => {
 
   it('should connect to a fresh in-memory replica set under test, so tests never touch a real database', async () => {
     createReplSet.mockResolvedValueOnce({
-      getUri: (db) => `mongodb://127.0.0.1:41234/${db}?replicaSet=rs0`
+      getUri: (db) => `mongodb://127.0.0.1:41234/${db}?replicaSet=rs0`,
+      stop: vi.fn()
     });
     await (await createFactory({ NODE_ENV: 'test' })).create();
     expect(createReplSet).toHaveBeenCalledExactlyOnceWith({ replSet: { count: 1, name: 'rs0' } });
@@ -269,6 +272,15 @@ describe('PrismaModuleOptionsFactory', () => {
     expect(options).toStrictEqual({ client: prismaClient });
   });
 
+  it('should stop the in-memory replica set on shutdown, so no mongod outlives the application', async () => {
+    const stop = vi.fn(() => Promise.resolve(true));
+    createReplSet.mockResolvedValueOnce({ getUri: (db) => `mongodb://127.0.0.1:41234/${db}`, stop });
+    const factory = await createFactory({ NODE_ENV: 'test' });
+    await factory.create();
+    await factory.onApplicationShutdown();
+    expect(stop).toHaveBeenCalledOnce();
+  });
+
   it('should shut down cleanly when it started no in-memory replica set', async () => {
     const factory = await createFactory(externalEnv);
     await factory.create();
diff --git a/apps/api/src/core/prisma.ts b/apps/api/src/core/prisma.ts
index 27572f0e6..6cb190d8f 100644
--- a/apps/api/src/core/prisma.ts
+++ b/apps/api/src/core/prisma.ts
@@ -194,8 +194,8 @@ export class PrismaModuleOptionsFactory implements OnApplicationShutdown {
   private async createMemoryConnection(): Promise<string> {
     // prevent mongodb-memory-server from being included in the production bundle
     const { MongoMemoryReplSet } = await import('mongodb-memory-server');
-    const replSet = await MongoMemoryReplSet.create({ replSet: { count: 1, name: 'rs0' } });
-    return new URL(replSet.getUri('test')).href;
+    this.memoryReplSet = await MongoMemoryReplSet.create({ replSet: { count: 1, name: 'rs0' } });
+    return new URL(this.memoryReplSet.getUri('test')).href;
   }
 
   private getExternalConnection(): string {
diff --git a/apps/api/src/instrument-records/__tests__/instrument-records.service.spec.ts b/apps/api/src/instrument-records/__tests__/instrument-records.service.spec.ts
index a9265f13f..39778fae6 100644
--- a/apps/api/src/instrument-records/__tests__/instrument-records.service.spec.ts
+++ b/apps/api/src/instrument-records/__tests__/instrument-records.service.spec.ts
@@ -954,25 +954,6 @@ describe('InstrumentRecordsService', () => {
         await expect(result).rejects.toBe(error);
         expect(worker.terminate).toHaveBeenCalledOnce();
       });
-
-      // Pins a reported defect: a failed INIT neither rejects nor terminates. Expected to change when the source is fixed.
-      it('should leave the export pending without sending a chunk when a worker fails to initialize', async () => {
-        instrumentsService.findById.mockResolvedValueOnce({ id: 'instrument-1', internal: { edition: 1, name: 'X' } });
-        const worker = useFakeWorker();
-
-        const result = instrumentRecordsService.exportRecords({}, { ability });
-        await vi.waitFor(() => expect(worker.postMessage).toHaveBeenCalledOnce());
-        worker.emit('message', { success: false });
-
-        await expect(Promise.race([result, Promise.resolve('pending')])).resolves.toBe('pending');
-        expect(worker.postMessage).toHaveBeenCalledTimes(1);
-        expect(worker.postMessage).toHaveBeenCalledWith({
-          data: [{ edition: 1, id: 'instrument-1', name: 'X' }],
-          type: 'INIT'
-        });
-        worker.emit('error', new Error('settle'));
-        await expect(result).rejects.toThrow('settle');
-      });
     });
   });
 
diff --git a/apps/api/src/instrument-records/export-worker.js b/apps/api/src/instrument-records/export-worker.js
index bd76f954b..0bf932a8c 100644
--- a/apps/api/src/instrument-records/export-worker.js
+++ b/apps/api/src/instrument-records/export-worker.js
@@ -16,28 +16,19 @@ try {
 }
 
 /**
- * @typedef {Object} SuccessExpand
+ * @typedef {Object} ExpandedMeasure
  * @property {string} measure
  * @property {any} measureValue
- * @property {true} success
  */
 
-/**
- * @typedef {Object} FailureExpand
- * @property {string} message
- * @property {false} success
- */
-
-/** @typedef {SuccessExpand | FailureExpand} ExpandDataType */
-
 /**
  * Flattens nested record array data into a list of expandable data objects.
  * @param {any[]} listEntry - The array of records to expand.
- * @returns {ExpandDataType[]} An array of expanded measure objects.
+ * @returns {ExpandedMeasure[]} An array of expanded measure objects.
  * @throws {Error} If the provided listEntry is empty.
  */
 function expandData(listEntry) {
-  /** @type {SuccessExpand[]} */
+  /** @type {ExpandedMeasure[]} */
   const validRecordArrayList = [];
   if (listEntry.length < 1) {
     throw new Error('Record Array is Empty');
@@ -46,8 +37,7 @@ function expandData(listEntry) {
     for (const [dataKey, dataValue] of Object.entries(objectEntry)) {
       validRecordArrayList.push({
         measure: dataKey,
-        measureValue: dataValue,
-        success: true
+        measureValue: dataValue
       });
     }
   }
@@ -123,9 +113,6 @@ function handleChunkComplete(_data) {
 
       const expanded = expandData(measureValue);
       for (const entry of expanded) {
-        if (!entry.success) {
-          throw new Error(`exportRecords: ${instrument.name}.${measureKey} — ${entry.message}`);
-        }
         rows.push({
           groupId: record.groupId ?? DEFAULT_GROUP_NAME,
           instrumentEdition: instrument.edition,
diff --git a/apps/api/src/instrument-records/instrument-records.service.ts b/apps/api/src/instrument-records/instrument-records.service.ts
index 806acb3d2..5047187ba 100644
--- a/apps/api/src/instrument-records/instrument-records.service.ts
+++ b/apps/api/src/instrument-records/instrument-records.service.ts
@@ -40,14 +40,7 @@ import { UsersService } from '@/users/users.service';
 
 import { InstrumentMeasuresService } from './instrument-measures.service';
 
-import type {
-  BeginChunkProcessingMessage,
-  InitData,
-  InitialMessage,
-  InitMessage,
-  RecordType,
-  WorkerMessage
-} from './thread-types';
+import type { BeginChunkProcessingMessage, InitData, InitMessage, RecordType, WorkerMessage } from './thread-types';
 
 @Injectable()
 export class InstrumentRecordsService {
@@ -235,18 +228,18 @@ export class InstrumentRecordsService {
         const worker = new Worker(join(import.meta.dirname, 'export-worker.js'));
         worker.postMessage({ data: availableInstrumentArray, type: 'INIT' } satisfies InitMessage);
 
-        worker.on('message', (message: InitialMessage) => {
-          if (message.success) {
-            worker.postMessage({ data: chunk, type: 'BEGIN_CHUNK_PROCESSING' } satisfies BeginChunkProcessingMessage);
-            worker.on('message', (message: WorkerMessage) => {
-              if (message.success) {
-                resolve(message.data);
-              } else {
-                reject(new Error(message.error));
-              }
-              void worker.terminate();
-            });
-          }
+        // The worker only ever acknowledges INIT with `{ success: true }`; a failure inside it arrives
+        // as an `error` event instead, handled below.
+        worker.on('message', () => {
+          worker.postMessage({ data: chunk, type: 'BEGIN_CHUNK_PROCESSING' } satisfies BeginChunkProcessingMessage);
+          worker.on('message', (message: WorkerMessage) => {
+            if (message.success) {
+              resolve(message.data);
+            } else {
+              reject(new Error(message.error));
+            }
+            void worker.terminate();
+          });
         });
 
         worker.on('error', (error) => {
diff --git a/apps/api/src/instrument-records/thread-types.ts b/apps/api/src/instrument-records/thread-types.ts
index 005896228..d4ddfb90e 100644
--- a/apps/api/src/instrument-records/thread-types.ts
+++ b/apps/api/src/instrument-records/thread-types.ts
@@ -43,5 +43,3 @@ export type BeginChunkProcessingMessage = {
 export type ParentMessage = BeginChunkProcessingMessage | InitMessage;
 
 export type WorkerMessage = { data: InstrumentRecordsExport; success: true } | { error: string; success: false };
-
-export type InitialMessage = { success: true };
diff --git a/apps/api/src/instruments/__tests__/instruments.module.spec.ts b/apps/api/src/instruments/__tests__/instruments.module.spec.ts
index 56f14bf3c..1d8e99a28 100644
--- a/apps/api/src/instruments/__tests__/instruments.module.spec.ts
+++ b/apps/api/src/instruments/__tests__/instruments.module.spec.ts
@@ -26,9 +26,10 @@ describe('InstrumentsModule', () => {
     );
   });
 
-  // Known defect: the `development` target of `#runtime/v1/*` in apps/api/package.json is
+  // Known defect (#1653): the `development` target of `#runtime/v1/*` in apps/api/package.json is
   // `../../runtime/v1/dist/*`, which is not package-relative, so Node rejects it with
-  // ERR_INVALID_PACKAGE_TARGET under `--conditions=development` (as vitest and `pnpm dev` run).
+  // ERR_INVALID_PACKAGE_TARGET under `--conditions=development`. vitest and worker threads hit it;
+  // the `pnpm dev` main thread does not, because libnest resolves through swc-node.
   it.fails('should resolve a runtime import to the built runtime, even under the development condition', () => {
     expect(getVirtualizationContext().__resolveImport('/runtime/v1/@opendatacapture/runtime-core/index.js')).toBe(
       new URL('../../../../../runtime/v1/dist/@opendatacapture/runtime-core/index.js', import.meta.url).href
diff --git a/apps/api/src/mail/mail.service.ts b/apps/api/src/mail/mail.service.ts
index db81b9cce..05db2fc7f 100644
--- a/apps/api/src/mail/mail.service.ts
+++ b/apps/api/src/mail/mail.service.ts
@@ -156,13 +156,14 @@ export class MailService {
    */
   async test({ config, recipient }: $TestMailData): Promise<TestMailResult> {
     const { config: saved } = await this.readState();
-    if (this.requiresNewPassword(config, saved)) {
+    const resolve = this.configResolver(config, saved);
+    if (resolve === 'PASSWORD_REQUIRED') {
       return { error: 'PASSWORD_REQUIRED', success: false };
     }
     try {
       // Resolution decrypts an inherited stored password, so it belongs inside the collapse: an
       // undecryptable secret must report a code here exactly as it does on a real send.
-      const resolved = this.resolveConfig(config, saved);
+      const resolved = resolve();
       if (!resolved) {
         return { error: 'UNKNOWN', success: false };
       }
@@ -192,17 +193,19 @@ export class MailService {
       throw new ServiceUnavailableException('Cannot update mail settings before setup');
     }
     const { config: saved } = this.parseState(setupState);
-    if (this.requiresNewPassword(data.config, saved)) {
-      throw new BadRequestException('A password is required when changing the mail server');
+    let nextConfig: MailConfig | undefined;
+    if (data.config) {
+      const password = this.passwordSource(data.config, saved);
+      if (!password) {
+        throw new BadRequestException('A password is required when changing the mail server');
+      }
+      // A kept password is inherited as its stored ciphertext, so updating settings never has to
+      // decrypt the old secret — after a SECRET_KEY rotation the admin recovers by re-entering it.
+      nextConfig = this.mergeConfig(
+        data.config,
+        'plaintext' in password ? this.encryptPassword(password.plaintext) : password.ciphertext
+      );
     }
-    // A kept password is inherited as its stored ciphertext, so updating settings never has to
-    // decrypt the old secret — after a SECRET_KEY rotation the admin recovers by re-entering it.
-    const nextConfig = data.config
-      ? this.mergeConfig(
-          data.config,
-          data.config.password ? this.encryptPassword(data.config.password) : (saved?.password ?? '')
-        )
-      : undefined;
     const updated = await this.setupStateModel.update({
       data: {
         ...(nextConfig ? { mailConfig: { set: nextConfig } } : {}),
@@ -213,6 +216,30 @@ export class MailService {
     return this.toSettings(this.parseState(updated));
   }
 
+  /**
+   * How a (possibly partial) payload resolves into a complete config ready to authenticate with:
+   * a resolver to call, or `PASSWORD_REQUIRED` when the payload may not inherit the stored
+   * password. Calling the resolver decrypts an inherited password, so callers decide where that
+   * failure lands.
+   */
+  private configResolver(
+    partial: undefined | UpdateMailConfigData,
+    saved: MailConfig | null
+  ): 'PASSWORD_REQUIRED' | (() => MailConfig | null) {
+    if (!partial) {
+      return () => saved && this.decryptConfig(saved);
+    }
+    const password = this.passwordSource(partial, saved);
+    if (!password) {
+      return 'PASSWORD_REQUIRED';
+    }
+    return () =>
+      this.mergeConfig(
+        partial,
+        'plaintext' in password ? password.plaintext : this.decryptPassword(password.ciphertext)
+      );
+  }
+
   private createTransporter(config: MailConfig): Transporter {
     return createTransport({
       auth: { pass: config.password, user: config.username },
@@ -269,7 +296,7 @@ export class MailService {
 
   /** Encrypt the SMTP password so a database dump yields no working mail credential. */
   private encryptPassword(plaintext: string): string {
-    return plaintext ? encryptSecret(plaintext, this.configService.getOrThrow('SECRET_KEY')) : '';
+    return encryptSecret(plaintext, this.configService.getOrThrow('SECRET_KEY'));
   }
 
   /** Combine an update payload with an already-resolved password into a complete config. */
@@ -315,33 +342,26 @@ export class MailService {
     };
   }
 
-  private async readState(): Promise<MailState> {
-    return this.parseState(await this.setupStateModel.findFirst());
-  }
-
   /**
-   * Whether the caller has to supply a password rather than inheriting the stored one. Inheritance
-   * is confined to the server the password belongs to — see {@link isSameMailServer}.
+   * Where a payload's password comes from: its own, or for a blank one the stored ciphertext.
+   * Inheritance is confined to the server the stored password belongs to — see
+   * {@link isSameMailServer} — and null means the payload has to supply one.
    */
-  private requiresNewPassword(partial: undefined | UpdateMailConfigData, saved: MailConfig | null): boolean {
-    if (!partial || partial.password) {
-      return false;
+  private passwordSource(
+    partial: UpdateMailConfigData,
+    saved: MailConfig | null
+  ): null | { ciphertext: string } | { plaintext: string } {
+    if (partial.password) {
+      return { plaintext: partial.password };
+    }
+    if (saved && isSameMailServer(saved, partial)) {
+      return { ciphertext: saved.password };
     }
-    return !saved || !isSameMailServer(saved, partial);
+    return null;
   }
 
-  /**
-   * Resolve a (possibly partial) update payload into a complete config ready to authenticate
-   * with — an inherited stored password is decrypted here. Callers reject the payload with
-   * {@link requiresNewPassword} first, which is what confines inheritance to the server the
-   * stored password belongs to.
-   */
-  private resolveConfig(partial: undefined | UpdateMailConfigData, saved: MailConfig | null): MailConfig | null {
-    if (!partial) {
-      return saved && this.decryptConfig(saved);
-    }
-    // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- a blank password means "keep the stored one"; fall through intentionally
-    return this.mergeConfig(partial, partial.password || this.decryptPassword(saved?.password ?? ''));
+  private async readState(): Promise<MailState> {
+    return this.parseState(await this.setupStateModel.findFirst());
   }
 
   private async send(transporter: Transporter, config: MailConfig, { body, subject, to }: MailMessage): Promise<void> {
diff --git a/apps/api/src/users/users.service.ts b/apps/api/src/users/users.service.ts
index b66e10c98..ccb94a575 100644
--- a/apps/api/src/users/users.service.ts
+++ b/apps/api/src/users/users.service.ts
@@ -98,10 +98,7 @@ export class UsersService {
 
     // Check that all group exist and are accessible to the user
     for (const id of groupIds) {
-      const group = await this.groupsService.findById(id, options);
-      if (!group) {
-        throw new NotFoundException(`Failed to resolve group with ID: ${id}`);
-      }
+      await this.groupsService.findById(id, options);
     }
 
     const hashedPassword = await this.cryptoService.hashPassword(password);
diff --git a/apps/web/src/components/BulkRemoteAssignmentWizard/MapStep.tsx b/apps/web/src/components/BulkRemoteAssignmentWizard/MapStep.tsx
index f845881af..2dec22700 100644
--- a/apps/web/src/components/BulkRemoteAssignmentWizard/MapStep.tsx
+++ b/apps/web/src/components/BulkRemoteAssignmentWizard/MapStep.tsx
@@ -54,21 +54,9 @@ export const MapStep = ({ groupName, onBack, onResolved, onStepChange, parsed }:
     });
   };
 
-  const resolve = async () => {
+  const resolve = async (sourceMode: BulkSourceMode) => {
     setErrors([]);
-    if (!mode) {
-      setErrors([
-        {
-          message: t({
-            en: 'Map a subject ID column, or a complete set of first name, last name, date of birth and sex.',
-            es: 'Asocie una columna de identificador de sujeto, o un conjunto completo de nombre, apellido, fecha de nacimiento y sexo.',
-            fr: "Associez une colonne d'identifiant, ou un ensemble complet de prénom, nom, date de naissance et sexe."
-          })
-        }
-      ]);
-      return;
-    }
-    const resolvedParsed: BulkParseResult = { ...parsed, mapping, mode };
+    const resolvedParsed: BulkParseResult = { ...parsed, mapping, mode: sourceMode };
     try {
       onResolved(await resolveSubjectIds(resolvedParsed, { groupName, maxSubjects: BULK_ASSIGNMENT_MAX_SUBJECTS }));
     } catch (err) {
@@ -101,7 +89,12 @@ export const MapStep = ({ groupName, onBack, onResolved, onStepChange, parsed }:
           <Button type="button" variant="outline" onClick={onBack}>
             {t({ en: 'Back', es: 'Atrás', fr: 'Retour' })}
           </Button>
-          <Button data-testid="bulk-confirm-mapping" disabled={!mode} type="button" onClick={() => void resolve()}>
+          <Button
+            data-testid="bulk-confirm-mapping"
+            disabled={!mode}
+            type="button"
+            onClick={mode ? () => void resolve(mode) : undefined}
+          >
             {t({ en: 'Continue', es: 'Continuar', fr: 'Continuer' })}
           </Button>
         </React.Fragment>
diff --git a/apps/web/src/components/EmailTemplateEditor/EmailTemplateEditor.tsx b/apps/web/src/components/EmailTemplateEditor/EmailTemplateEditor.tsx
index 675689e72..5b8b1b57b 100644
--- a/apps/web/src/components/EmailTemplateEditor/EmailTemplateEditor.tsx
+++ b/apps/web/src/components/EmailTemplateEditor/EmailTemplateEditor.tsx
@@ -11,8 +11,8 @@ export type EmailTemplateEditorProps = {
   error?: string;
   /** Namespaces the control ids and test ids, so two editors can coexist on one page. */
   idPrefix: string;
-  onChange: (template: MailTemplate) => void;
-  readOnly?: boolean;
+  /** Omit to show the template read-only. */
+  onChange?: (template: MailTemplate) => void;
   template: MailTemplate;
   /** Placeholder names offered as insert buttons above the body. */
   variables?: readonly string[];
@@ -23,7 +23,6 @@ export const EmailTemplateEditor = ({
   error,
   idPrefix,
   onChange,
-  readOnly = false,
   template,
   variables = []
 }: EmailTemplateEditorProps) => {
@@ -36,15 +35,15 @@ export const EmailTemplateEditor = ({
   const body = template.body[language] ?? '';
   const subject = template.subject[language] ?? '';
 
-  const insertVariable = (variable: string) => {
+  const insertVariable = (edit: (template: MailTemplate) => void, variable: string) => {
     const tag = `{{${variable}}}`;
     const cursor = bodyCursorRef.current;
     if (cursor === null) {
-      onChange({ ...template, body: { ...template.body, [language]: body ? `${body} ${tag}` : tag } });
+      edit({ ...template, body: { ...template.body, [language]: body ? `${body} ${tag}` : tag } });
       return;
     }
     bodyCursorRef.current = { end: cursor.start + tag.length, start: cursor.start + tag.length };
-    onChange({
+    edit({
       ...template,
       body: { ...template.body, [language]: body.slice(0, cursor.start) + tag + body.slice(cursor.end) }
     });
@@ -67,10 +66,11 @@ export const EmailTemplateEditor = ({
         <Input
           data-testid={`${idPrefix}-subject`}
           id={`${idPrefix}-subject`}
-          readOnly={readOnly}
+          readOnly={!onChange}
           value={subject}
-          onChange={(event) =>
-            onChange({ ...template, subject: { ...template.subject, [language]: event.target.value } })
+          onChange={
+            onChange &&
+            ((event) => onChange({ ...template, subject: { ...template.subject, [language]: event.target.value } }))
           }
         />
       </div>
@@ -78,7 +78,7 @@ export const EmailTemplateEditor = ({
       <div className="flex flex-col gap-1.5">
         <div className="flex flex-wrap items-center justify-between gap-2">
           <Label htmlFor={`${idPrefix}-body`}>{t({ en: 'Body', es: 'Cuerpo', fr: 'Corps' })}</Label>
-          {!readOnly && variables.length > 0 && (
+          {onChange && variables.length > 0 && (
             <div className="flex flex-wrap items-center gap-1.5">
               <span className="text-muted-foreground text-xs">
                 {t({ en: 'Insert:', es: 'Insertar:', fr: 'Insérer :' })}
@@ -94,7 +94,7 @@ export const EmailTemplateEditor = ({
                     size="sm"
                     type="button"
                     variant="outline"
-                    onClick={() => insertVariable(variable)}
+                    onClick={() => insertVariable(onChange, variable)}
                   >
                     {tag}
                   </Button>
@@ -107,7 +107,7 @@ export const EmailTemplateEditor = ({
           className="min-h-[15rem]"
           data-testid={`${idPrefix}-body`}
           id={`${idPrefix}-body`}
-          readOnly={readOnly}
+          readOnly={!onChange}
           value={body}
           onBlur={(event: React.FocusEvent<HTMLTextAreaElement>) => {
             bodyCursorRef.current = {
@@ -115,7 +115,10 @@ export const EmailTemplateEditor = ({
               start: event.currentTarget.selectionStart
             };
           }}
-          onChange={(event) => onChange({ ...template, body: { ...template.body, [language]: event.target.value } })}
+          onChange={
+            onChange &&
+            ((event) => onChange({ ...template, body: { ...template.body, [language]: event.target.value } }))
+          }
         />
         {error && (
           <p className="text-destructive text-xs font-medium" data-testid={`${idPrefix}-error`}>
diff --git a/apps/web/src/components/EmailTemplateEditor/__tests__/EmailTemplateEditor.test.tsx b/apps/web/src/components/EmailTemplateEditor/__tests__/EmailTemplateEditor.test.tsx
index 016c5ec38..6d8f4b6c8 100644
--- a/apps/web/src/components/EmailTemplateEditor/__tests__/EmailTemplateEditor.test.tsx
+++ b/apps/web/src/components/EmailTemplateEditor/__tests__/EmailTemplateEditor.test.tsx
@@ -114,8 +114,8 @@ describe('EmailTemplateEditor', () => {
     expect(screen.queryByText('Insert:')).toBeNull();
   });
 
-  it('should lock the fields and hide the insert buttons when read-only', () => {
-    renderEditor({ readOnly: true, variables: ['name'] });
+  it('should lock the fields and hide the insert buttons without a change handler, so a template can be shown read-only', () => {
+    renderEditor({ onChange: undefined, variables: ['name'] });
     expect(subjectInput().readOnly).toBe(true);
     expect(bodyInput().readOnly).toBe(true);
     expect(screen.queryByTestId('invite-insert-name')).toBeNull();
diff --git a/apps/web/src/components/GroupEmailTemplates/EditTemplateDialog.tsx b/apps/web/src/components/GroupEmailTemplates/EditTemplateDialog.tsx
index 3800b7dab..25956d4ee 100644
--- a/apps/web/src/components/GroupEmailTemplates/EditTemplateDialog.tsx
+++ b/apps/web/src/components/GroupEmailTemplates/EditTemplateDialog.tsx
@@ -29,8 +29,8 @@ const EditTemplateForm = ({
   const addNotification = useNotificationsStore((store) => store.addNotification);
   const [name, setName] = React.useState(template.name);
   const [draft, setDraft] = React.useState<MailTemplate>({
-    body: template.body ?? {},
-    subject: template.subject ?? {}
+    body: template.body,
+    subject: template.subject
   });
 
   const contentError = validateContent(draft);
diff --git a/apps/web/src/components/GroupEmailTemplates/ViewDefaultTemplateDialog.tsx b/apps/web/src/components/GroupEmailTemplates/ViewDefaultTemplateDialog.tsx
index a6d2a0e28..0343048eb 100644
--- a/apps/web/src/components/GroupEmailTemplates/ViewDefaultTemplateDialog.tsx
+++ b/apps/web/src/components/GroupEmailTemplates/ViewDefaultTemplateDialog.tsx
@@ -31,12 +31,7 @@ export const ViewDefaultTemplateDialog = ({ onOpenChange, open }: ViewDefaultTem
             })}
           </Dialog.Description>
         </Dialog.Header>
-        <EmailTemplateEditor
-          readOnly
-          idPrefix="template-builtin"
-          template={DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE}
-          onChange={() => undefined}
-        />
+        <EmailTemplateEditor idPrefix="template-builtin" template={DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE} />
         <Dialog.Footer>
           <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
             {t('core.close')}
diff --git a/apps/web/src/components/IdentificationForm/IdentificationForm.tsx b/apps/web/src/components/IdentificationForm/IdentificationForm.tsx
index 651ad45eb..15578fd73 100644
--- a/apps/web/src/components/IdentificationForm/IdentificationForm.tsx
+++ b/apps/web/src/components/IdentificationForm/IdentificationForm.tsx
@@ -136,7 +136,7 @@ export const IdentificationForm = ({ onSubmit }: IdentificationFormProps) => {
                 path: ['id']
               });
             }
-          } else if (val.identificationMethod === 'PERSONAL_INFO') {
+          } else {
             const requiredKeys = ['firstName', 'lastName', 'sex', 'dateOfBirth'] as const;
             for (const key of requiredKeys) {
               if (!val[key]) {
diff --git a/apps/web/src/components/InstrumentPreviewDialog/InstrumentPreviewDialog.tsx b/apps/web/src/components/InstrumentPreviewDialog/InstrumentPreviewDialog.tsx
index e385335c9..2b5fe586f 100644
--- a/apps/web/src/components/InstrumentPreviewDialog/InstrumentPreviewDialog.tsx
+++ b/apps/web/src/components/InstrumentPreviewDialog/InstrumentPreviewDialog.tsx
@@ -68,12 +68,7 @@ export const InstrumentPreviewDialog = ({ item, items, onClose }: InstrumentPrev
   }, [item.seriesItems, items, t]);
 
   return (
-    <Dialog
-      open
-      onOpenChange={(open) => {
-        if (!open) onClose();
-      }}
-    >
+    <Dialog open onOpenChange={onClose}>
       <Dialog.Content className={showForm ? 'sm:max-w-[800px]' : 'max-h-[85vh] sm:max-w-[560px]'}>
         <Dialog.Header>
           <Dialog.Title>{item.title}</Dialog.Title>
diff --git a/apps/web/src/components/InstrumentShowcase/InstrumentShowcase.tsx b/apps/web/src/components/InstrumentShowcase/InstrumentShowcase.tsx
index df5ce225b..ba880d54c 100644
--- a/apps/web/src/components/InstrumentShowcase/InstrumentShowcase.tsx
+++ b/apps/web/src/components/InstrumentShowcase/InstrumentShowcase.tsx
@@ -62,9 +62,8 @@ export const InstrumentShowcase: React.FC<{
   }, [availableInstruments]);
 
   useEffect(() => {
-    if (highlightedIndex < 0 || !listRef.current) return;
-    const items = listRef.current.querySelectorAll<HTMLElement>('[data-instrument-index]');
-    items[highlightedIndex]?.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+    const items = listRef.current?.querySelectorAll<HTMLElement>('[data-instrument-index]');
+    items?.[highlightedIndex]?.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
   }, [highlightedIndex]);
 
   const handleKeyDown = useCallback(
diff --git a/apps/web/src/components/LoginBranding/LoginBrandingPanel.tsx b/apps/web/src/components/LoginBranding/LoginBrandingPanel.tsx
index 4ff4b4393..654524189 100644
--- a/apps/web/src/components/LoginBranding/LoginBrandingPanel.tsx
+++ b/apps/web/src/components/LoginBranding/LoginBrandingPanel.tsx
@@ -17,7 +17,6 @@ import { BookOpenIcon, GithubIcon, LinkIcon } from 'lucide-react';
 import { config } from '@/config';
 import { getLoginGradient } from '@/utils/branding';
 import { getValueForLanguage } from '@/utils/language';
-import type { LocalizedValues } from '@/utils/language';
 
 const CURRENT_YEAR = new Date().getFullYear();
 
@@ -131,7 +130,7 @@ type ResourcesSectionProps = {
   links: ResourceLink[];
   preview: boolean;
   tc: (slateClass: string) => null | string;
-  tl: (obj: LocalizedValues<string>) => string;
+  tl: (copy: { [L in Language]: string }) => string;
 };
 
 const ResourcesSection = ({ boldResourceLinks, fontSize, lang, links, preview, tc, tl }: ResourcesSectionProps) => (
@@ -147,7 +146,7 @@ const ResourcesSection = ({ boldResourceLinks, fontSize, lang, links, preview, t
       style={fontStyle(fontSize, preview)}
     >
       {links.map((link, index) => {
-        const linkLabel = getValueForLanguage(link.label ?? {}, lang)?.trim();
+        const linkLabel = getValueForLanguage(link.label, lang)?.trim();
         if (!linkLabel) return null;
         return (
           <a
@@ -174,7 +173,7 @@ type PanelFooterProps = {
   preview: boolean;
   showFooterLinks: boolean;
   tc: (slateClass: string) => null | string;
-  tl: (obj: LocalizedValues<string>) => string;
+  tl: (copy: { [L in Language]: string }) => string;
 };
 
 const PanelFooter = ({ preview, showFooterLinks, tc, tl }: PanelFooterProps) => (
@@ -226,7 +225,7 @@ export const LoginBrandingPanel = ({
   const { resolvedLanguage } = useTranslation();
   const lang = langOverride ?? resolvedLanguage;
 
-  const tl = (obj: LocalizedValues<string>): string => getValueForLanguage(obj, lang) ?? '';
+  const tl = (copy: { [L in Language]: string }): string => copy[lang];
 
   const derived = useMemo(() => {
     const instanceName = getValueForLanguage(branding?.instanceName ?? {}, lang)?.trim() ?? DEFAULT_INSTANCE_NAME;
diff --git a/apps/web/src/components/LoginPageEditor/hooks.ts b/apps/web/src/components/LoginPageEditor/hooks.ts
index 45fc4f8c6..3638f51c1 100644
--- a/apps/web/src/components/LoginPageEditor/hooks.ts
+++ b/apps/web/src/components/LoginPageEditor/hooks.ts
@@ -372,7 +372,7 @@ export const useBrandingForm = () => {
           logoSource: form.logoSource,
           nameAlignment: form.nameAlignment,
           nameFontSize: form.nameFontSize,
-          panelTextColor: HEX_PATTERN.test(form.panelTextColor) ? form.panelTextColor : null,
+          panelTextColor: form.panelTextColor,
           resourceLinks: form.showResourceLinks ? cleanedLinks : [],
           resourceLinksFontSize: form.resourceLinksFontSize,
           rightPanelPrimaryColor: form.rightPanelOption === 'custom' ? form.rightPanelPrimaryColor : null,
diff --git a/apps/web/src/components/LoginPageEditor/sections/SectionCards.tsx b/apps/web/src/components/LoginPageEditor/sections/SectionCards.tsx
index 10f1d4661..b9b471ce6 100644
--- a/apps/web/src/components/LoginPageEditor/sections/SectionCards.tsx
+++ b/apps/web/src/components/LoginPageEditor/sections/SectionCards.tsx
@@ -510,7 +510,5 @@ export const SectionCard = ({ editor, section }: { editor: BrandingEditor; secti
       return <ResourcesCard editor={editor} />;
     case 'tagline':
       return <TaglineCard editor={editor} />;
-    default:
-      return null;
   }
 };
diff --git a/apps/web/src/components/MailSettings/MailSettings.tsx b/apps/web/src/components/MailSettings/MailSettings.tsx
index d435ec402..6a0ba9382 100644
--- a/apps/web/src/components/MailSettings/MailSettings.tsx
+++ b/apps/web/src/components/MailSettings/MailSettings.tsx
@@ -4,6 +4,7 @@ import { Checkbox, Heading } from '@douglasneuroinformatics/libui/components';
 import { useNotificationsStore, useTranslation } from '@douglasneuroinformatics/libui/hooks';
 import { $UpdateMailConfigData, isSameMailServer } from '@opendatacapture/schemas/mail';
 import type { MailConfigDto, MailTemplate, UpdateMailConfigData } from '@opendatacapture/schemas/mail';
+import { z } from 'zod/v4';
 
 import { SectionCard } from '@/components/SectionCard';
 import { useUpdateMailSettingsMutation } from '@/hooks/useUpdateMailSettingsMutation';
@@ -101,11 +102,12 @@ export const MailSettings = ({ config, newUserEmailTemplate }: MailSettingsProps
         : errorMessages.password;
     }
     if (!parsed.success) {
-      const isFormField = (key: unknown): key is keyof MailConfigFormValues => typeof key === 'string' && key in values;
-      for (const issue of parsed.error.issues) {
-        const [field] = issue.path;
-        if (isFormField(field)) {
-          nextErrors[field] = errorMessages[field] ?? issue.message;
+      // Only these fields can fail: `enabled` and `encryption` come from typed controls, and the
+      // optional `senderName` and `password` accept any string.
+      const { fieldErrors } = z.flattenError(parsed.error);
+      for (const field of ['host', 'port', 'senderAddress', 'username'] as const) {
+        if (fieldErrors[field]) {
+          nextErrors[field] = errorMessages[field];
         }
       }
       return { errors: nextErrors };
diff --git a/apps/web/src/components/MailSettings/__tests__/MailSettings.test.tsx b/apps/web/src/components/MailSettings/__tests__/MailSettings.test.tsx
index 0ed82ba20..b4f712f77 100644
--- a/apps/web/src/components/MailSettings/__tests__/MailSettings.test.tsx
+++ b/apps/web/src/components/MailSettings/__tests__/MailSettings.test.tsx
@@ -191,6 +191,21 @@ describe('MailSettings', () => {
       expect(mocks.patch).not.toHaveBeenCalled();
     });
 
+    it('should flag only the field that is invalid, so valid entries are not marked as errors', () => {
+      renderSettings(null);
+      toggleEnabled();
+      fillNewServer();
+      type('mail-sender-address', 'not-an-address');
+      saveConfig();
+      expect(fieldError('mail-sender-address')).toBe('Enter a valid sender address (e.g. noreply@example.org)');
+      expect([fieldError('mail-host'), fieldError('mail-port'), fieldError('mail-username')]).toEqual([
+        undefined,
+        undefined,
+        undefined
+      ]);
+      expect(mocks.patch).not.toHaveBeenCalled();
+    });
+
     it('should require a password when none is stored, even if every other field is valid', () => {
       renderSettings({ ...storedConfig, hasPassword: false });
       saveConfig();
diff --git a/apps/web/src/components/StartSessionForm/StartSessionForm.tsx b/apps/web/src/components/StartSessionForm/StartSessionForm.tsx
index 3817ede55..31d8218ef 100644
--- a/apps/web/src/components/StartSessionForm/StartSessionForm.tsx
+++ b/apps/web/src/components/StartSessionForm/StartSessionForm.tsx
@@ -287,7 +287,7 @@ export const StartSessionForm = ({
                 console.error(err);
               }
             }
-          } else if (val.subjectIdentificationMethod === 'PERSONAL_INFO') {
+          } else {
             const requiredKeys = ['subjectFirstName', 'subjectLastName', 'subjectSex', 'subjectDateOfBirth'] as const;
             for (const key of requiredKeys) {
               if (!val[key]) {
diff --git a/apps/web/src/hooks/useGraphData.ts b/apps/web/src/hooks/useGraphData.ts
index 69133bf1d..a439027da 100644
--- a/apps/web/src/hooks/useGraphData.ts
+++ b/apps/web/src/hooks/useGraphData.ts
@@ -20,30 +20,28 @@ type UseGraphDataOptions = {
 export function useGraphData({ models, records, selectedMeasures }: UseGraphDataOptions): GraphRecord[] {
   return useMemo(() => {
     const graphRecords: GraphRecord[] = [];
-    if (records) {
-      for (const record of records) {
-        const graphRecord: GraphRecord = {
-          ...pickBy(record, (_, key) => selectedMeasures.find((item) => item.key === key)),
-          __time__: record.__time__
-        };
-        for (const key in record) {
-          const model = models?.[key];
-          if (!model) {
-            continue;
-          }
-          graphRecord[key + 'Group'] = Number((model.intercept + model.slope * graphRecord.__time__).toFixed(2));
+    for (const record of records) {
+      const graphRecord: GraphRecord = {
+        ...pickBy(record, (_, key) => selectedMeasures.find((item) => item.key === key)),
+        __time__: record.__time__
+      };
+      for (const key in record) {
+        const model = models?.[key];
+        if (!model) {
+          continue;
         }
-        graphRecords.push(graphRecord);
+        graphRecord[key + 'Group'] = Number((model.intercept + model.slope * graphRecord.__time__).toFixed(2));
       }
-      graphRecords.sort((a, b) => {
-        if (a.__time__ > b.__time__) {
-          return 1;
-        } else if (b.__time__ > a.__time__) {
-          return -1;
-        }
-        return 0;
-      });
+      graphRecords.push(graphRecord);
     }
+    graphRecords.sort((a, b) => {
+      if (a.__time__ > b.__time__) {
+        return 1;
+      } else if (b.__time__ > a.__time__) {
+        return -1;
+      }
+      return 0;
+    });
     return graphRecords;
   }, [selectedMeasures, models, records]);
 }
diff --git a/apps/web/src/routes/_app/admin/instrument-repos/index.tsx b/apps/web/src/routes/_app/admin/instrument-repos/index.tsx
index 1464312f4..f49a276d0 100644
--- a/apps/web/src/routes/_app/admin/instrument-repos/index.tsx
+++ b/apps/web/src/routes/_app/admin/instrument-repos/index.tsx
@@ -150,14 +150,12 @@ const RouteComponent = () => {
   return (
     <Dialog
       open={isDialogOpen || isConfirmDeleteOpen || isViewOpen}
-      onOpenChange={(open) => {
-        if (!open) {
-          setIsDialogOpen(false);
-          setIsConfirmDeleteOpen(false);
-          setIsViewOpen(false);
-          setRepoToView(null);
-          setRepoToDelete(null);
-        }
+      onOpenChange={() => {
+        setIsDialogOpen(false);
+        setIsConfirmDeleteOpen(false);
+        setIsViewOpen(false);
+        setRepoToView(null);
+        setRepoToDelete(null);
       }}
     >
       <PageHeader>
diff --git a/apps/web/src/routes/_app/admin/instruments.tsx b/apps/web/src/routes/_app/admin/instruments.tsx
index e5c4b21e3..8e1e13fc2 100644
--- a/apps/web/src/routes/_app/admin/instruments.tsx
+++ b/apps/web/src/routes/_app/admin/instruments.tsx
@@ -43,12 +43,7 @@ const ArchiveDialog = ({ onClose, row }: { onClose: () => void; row: SeriesRow }
   const groupLabel = row.groupName ?? t({ en: 'All groups', es: 'Todos los grupos', fr: 'Tous les groupes' });
 
   return (
-    <Dialog
-      open
-      onOpenChange={(open) => {
-        if (!open) onClose();
-      }}
-    >
+    <Dialog open onOpenChange={onClose}>
       <Dialog.Content className="sm:max-w-[500px]" data-testid="archive-series-dialog">
         <Dialog.Header>
           <Dialog.Title>
@@ -98,7 +93,7 @@ type InstrumentRow = {
 
 type InstrumentViewProps = {
   // Every scalar instrument, of every edition, so a series' items can be named in its preview.
-  scalarInstruments: TranslatedInstrumentInfo[];
+  scalarInstruments: Exclude<TranslatedInstrumentInfo, { kind: 'SERIES' }>[];
 };
 
 const useInstrumentSource = () => {
@@ -118,9 +113,7 @@ const FormInstrumentsView = ({ scalarInstruments }: InstrumentViewProps) => {
   const toSource = useInstrumentSource();
   const [previewItem, setPreviewItem] = useState<InstrumentPreviewItem | null>(null);
 
-  const rows: InstrumentRow[] = selectLatestEditions(
-    scalarInstruments.flatMap((info) => (info.kind === 'SERIES' ? [] : [info]))
-  )
+  const rows: InstrumentRow[] = selectLatestEditions(scalarInstruments)
     .map((info) => {
       const source = toSource(info.sourceRepo);
       return {
diff --git a/apps/web/src/routes/_app/admin/users/create.tsx b/apps/web/src/routes/_app/admin/users/create.tsx
index 432628010..573e2159f 100644
--- a/apps/web/src/routes/_app/admin/users/create.tsx
+++ b/apps/web/src/routes/_app/admin/users/create.tsx
@@ -223,7 +223,7 @@ const RouteComponent = () => {
                   return {
                     kind: 'set',
                     label: t('common.groups'),
-                    options: Object.fromEntries((groupsQuery.data ?? []).map((group) => [group.id, group.name])),
+                    options: Object.fromEntries(groupsQuery.data.map((group) => [group.id, group.name])),
                     variant: 'listbox'
                   };
                 }
@@ -337,11 +337,9 @@ const RouteComponent = () => {
       />
       <Dialog
         open={fallbackMessage !== null}
-        onOpenChange={(open) => {
-          if (!open) {
-            setFallbackMessage(null);
-            void navigate({ to: '..' });
-          }
+        onOpenChange={() => {
+          setFallbackMessage(null);
+          void navigate({ to: '..' });
         }}
       >
         <Dialog.Content className="max-w-lg" data-testid="welcome-email-fallback">
diff --git a/apps/web/src/routes/_app/admin/users/index.tsx b/apps/web/src/routes/_app/admin/users/index.tsx
index 79a5ad567..f8d86e8d1 100644
--- a/apps/web/src/routes/_app/admin/users/index.tsx
+++ b/apps/web/src/routes/_app/admin/users/index.tsx
@@ -164,12 +164,7 @@ const RouteComponent = () => {
         onRowClick={(user) => setHighlightedRowId(user.id)}
         onRowDoubleClick={openUser}
       />
-      <Dialog
-        open={pendingAction !== null}
-        onOpenChange={(open) => {
-          if (!open) setPendingAction(null);
-        }}
-      >
+      <Dialog open={pendingAction !== null} onOpenChange={() => setPendingAction(null)}>
         <Dialog.Content>
           <Dialog.Header>
             <Dialog.Title>
diff --git a/apps/web/src/routes/_app/datahub/$subjectId/graph.tsx b/apps/web/src/routes/_app/datahub/$subjectId/graph.tsx
index 03565a2cf..1e5773b2f 100644
--- a/apps/web/src/routes/_app/datahub/$subjectId/graph.tsx
+++ b/apps/web/src/routes/_app/datahub/$subjectId/graph.tsx
@@ -62,20 +62,17 @@ const RouteComponent = () => {
         const subjectId = params.subjectId.slice(0, 7);
 
         graphDesc.innerText = t('datahub.downloadInfo.subjectText', {
-          args: [formType ?? '', subjectId ?? '']
+          args: [formType, subjectId]
         });
 
         graphDesc.className = 'p-2 font-semibold text-center';
         element.prepend(graphDesc);
 
-        if (selectedMeasures) {
-          const graphMeasure = document.createElement('p');
-          graphMeasure.innerText = t('datahub.downloadInfo.measurement');
-          selectedMeasures.map((measure) => measure.label).join(', ');
-          graphMeasure.innerText += selectedMeasures.map((measure) => measure.label).join(', ');
-          graphMeasure.className = 'p-2 font-semibold';
-          element.append(graphMeasure);
-        }
+        const graphMeasure = document.createElement('p');
+        graphMeasure.innerText = t('datahub.downloadInfo.measurement');
+        graphMeasure.innerText += selectedMeasures.map((measure) => measure.label).join(', ');
+        graphMeasure.className = 'p-2 font-semibold';
+        element.append(graphMeasure);
 
         const graphTime = document.createElement('p');
         if (minDate) {
diff --git a/apps/web/src/routes/_app/group/manage.tsx b/apps/web/src/routes/_app/group/manage.tsx
index 5db0d2d7a..d63e9f9d9 100644
--- a/apps/web/src/routes/_app/group/manage.tsx
+++ b/apps/web/src/routes/_app/group/manage.tsx
@@ -53,19 +53,27 @@ type InstrumentItem = InstrumentPreviewItem & {
   isDeletable: boolean;
 };
 
+type SeriesInstrumentItem = InstrumentItem & { seriesItems: { id: string }[] };
+
 type CategorizedInstruments = {
   form: InstrumentItem[];
   interactive: InstrumentItem[];
-  series: InstrumentItem[];
+  series: SeriesInstrumentItem[];
 };
 
-const expandSelectedSeriesIds = ({ selectedIds, series }: { selectedIds: Set<string>; series: InstrumentItem[] }) => {
+const expandSelectedSeriesIds = ({
+  selectedIds,
+  series
+}: {
+  selectedIds: Set<string>;
+  series: SeriesInstrumentItem[];
+}) => {
   const expandedIds = new Set(selectedIds);
   for (const item of series) {
     if (!selectedIds.has(item.id)) {
       continue;
     }
-    for (const seriesItem of item.seriesItems ?? []) {
+    for (const seriesItem of item.seriesItems) {
       expandedIds.add(seriesItem.id);
     }
   }
@@ -332,12 +340,7 @@ const CreateSeriesInstrumentDialog = ({
 
   return (
     <React.Fragment>
-      <Dialog
-        open
-        onOpenChange={(open) => {
-          if (!open) onClose();
-        }}
-      >
+      <Dialog open onOpenChange={onClose}>
         <Dialog.Content className="sm:max-w-[600px]">
           <Dialog.Header>
             <Dialog.Title>
@@ -470,12 +473,7 @@ const CreateSeriesInstrumentDialog = ({
         </Dialog.Content>
       </Dialog>
       {duplicateOf !== null && (
-        <Dialog
-          open
-          onOpenChange={(open) => {
-            if (!open) setDuplicateOf(null);
-          }}
-        >
+        <Dialog open onOpenChange={() => setDuplicateOf(null)}>
           <Dialog.Content className="sm:max-w-[450px]">
             <Dialog.Header>
               <Dialog.Title>
@@ -522,12 +520,7 @@ const DeleteInstrumentDialog = ({
     deleteMutation.mutate({ id: item.id }, { onSettled: onClose, onSuccess: () => onDeleted(item.id) });
 
   return (
-    <Dialog
-      open
-      onOpenChange={(open) => {
-        if (!open) onClose();
-      }}
-    >
+    <Dialog open onOpenChange={onClose}>
       <Dialog.Content className="sm:max-w-[450px]">
         <Dialog.Header>
           <Dialog.Title>
@@ -571,15 +564,6 @@ const ManageGroupForm = ({ data, onSubmit, readOnly }: ManageGroupFormProps) =>
   // so a just-deleted instrument is never re-sent as a dangling relation.
   const [deletedIds, setDeletedIds] = useState<Set<string>>(() => new Set());
 
-  // Reseed the selection only when the user switches groups. `initialSelectedIds` gets a new identity
-  // on every instrument-info refetch — including the one triggered by creating a series — and resyncing
-  // on that would discard unsaved edits, among them the newly created series we just selected.
-  const [syncedGroupId, setSyncedGroupId] = useState(groupId);
-  if (syncedGroupId !== groupId) {
-    setSyncedGroupId(groupId);
-    setSelectedIds(new Set(initialSelectedIds));
-  }
-
   const toggle = (id: string) => {
     setSelectedIds((prev) => {
       const next = new Set(prev);
@@ -929,7 +913,7 @@ const RouteComponent = () => {
       } else if (instrument.kind === 'INTERACTIVE') {
         instruments.interactive.push(item);
       } else if (instrument.kind === 'SERIES') {
-        instruments.series.push(item);
+        instruments.series.push({ ...item, seriesItems: instrument.seriesItems });
       }
     }
 
@@ -981,6 +965,8 @@ const RouteComponent = () => {
           {t('manage.pageTitle')}
         </Heading>
       </PageHeader>
+      {/* The key remounts the form on a group switch, the only time its selection may be reseeded:
+          `initialSelectedIds` changes identity on every refetch, and reseeding then would drop unsaved edits. */}
       <WithFallback
         Component={ManageGroupForm}
         key={currentGroup?.id}
diff --git a/apps/web/src/routes/_app/session/remote-assignment.tsx b/apps/web/src/routes/_app/session/remote-assignment.tsx
index 68a9abe29..47854b655 100644
--- a/apps/web/src/routes/_app/session/remote-assignment.tsx
+++ b/apps/web/src/routes/_app/session/remote-assignment.tsx
@@ -1,4 +1,4 @@
-import React, { useEffect, useState } from 'react';
+import React, { useEffect, useRef, useState } from 'react';
 
 import { Button, Dialog, Form, Heading, Input, Label, Sheet } from '@douglasneuroinformatics/libui/components';
 import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
@@ -95,6 +95,7 @@ const RouteComponent = () => {
 
   const [selectedInstrument, setSelectedInstrument] = useState<null | TranslatedInstrumentInfo>(null);
   const [isCreateModalOpen, setIsCreateModalOpen] = useState(false);
+  const createDialogRef = useRef<HTMLDivElement>(null);
   const [isResultSliderOpen, setIsResultSliderOpen] = useState(false);
   const [assignment, setAssignment] = useState<Assignment | null>(null);
 
@@ -136,11 +137,10 @@ const RouteComponent = () => {
       />
       <Dialog open={isCreateModalOpen} onOpenChange={setIsCreateModalOpen}>
         <Dialog.Content
+          ref={createDialogRef}
           onOpenAutoFocus={(event) => {
             event.preventDefault();
-            if (event.currentTarget instanceof HTMLElement) {
-              event.currentTarget.querySelector<HTMLButtonElement>('button[type="submit"]')?.focus();
-            }
+            createDialogRef.current?.querySelector<HTMLButtonElement>('button[type="submit"]')?.focus();
           }}
         >
           <Dialog.Header>
diff --git a/apps/web/src/utils/__tests__/upload.test.ts b/apps/web/src/utils/__tests__/upload.test.ts
index 5ad0f8e96..46fdc942a 100644
--- a/apps/web/src/utils/__tests__/upload.test.ts
+++ b/apps/web/src/utils/__tests__/upload.test.ts
@@ -558,10 +558,6 @@ describe('Zod4', () => {
       expect(result).toBe('number (optional)');
     });
 
-    it('should describe an integer as a number', () => {
-      expect(Zod4.generateSampleData({ isOptional: false, typeName: 'int' })).toBe('number');
-    });
-
     it('should generate sample data for enum type', () => {
       const result = Zod4.generateSampleData({
         enumValues: ['option1', 'option2', 'option3'],
@@ -623,6 +619,16 @@ describe('Zod4', () => {
   });
 
   describe('createUploadTemplateCSV', () => {
+    it('should describe an integer column as a number, since zod 4 integers are number schemas', () => {
+      const { content } = createUploadTemplateCSV(instrumentWith(z4.object({ age: z4.int() })));
+      expect(content).toBe(
+        unparse([
+          ['subjectID', 'date', 'age'],
+          ['string', 'yyyy-mm-dd', 'number']
+        ])
+      );
+    });
+
     it('should list the internal columns, then every field with sample data', () => {
       const schema = z4.object({
         count: z4.number().optional(),
diff --git a/apps/web/src/utils/bulk-assignments.ts b/apps/web/src/utils/bulk-assignments.ts
index c4931f4b7..086165bc3 100644
--- a/apps/web/src/utils/bulk-assignments.ts
+++ b/apps/web/src/utils/bulk-assignments.ts
@@ -260,7 +260,9 @@ export function parseDelimitedText(input: string): BulkParseResult {
   if (fatal.length > 0) {
     throw new BulkParseFailure(fatal.map((error) => ({ message: error.message, row: error.row })));
   }
-  return buildResult(parsed.meta.fields ?? [], parsed.data);
+  // Papa Parse always reports the header row as `meta.fields` in header mode; its types mark the field
+  // optional only because it is absent when `header` is false.
+  return buildResult(parsed.meta.fields!, parsed.data);
 }
 
 /**
diff --git a/apps/web/src/utils/upload.ts b/apps/web/src/utils/upload.ts
index d4b3c4fae..0e9eb6176 100644
--- a/apps/web/src/utils/upload.ts
+++ b/apps/web/src/utils/upload.ts
@@ -157,12 +157,6 @@ function extractRecordArrayEntry(entry: string): { [key: string]: string }[] {
 
   return recordArrayDataList.map((listData) => {
     const recordsList = listData.split(',');
-    if (!recordsList) {
-      throw new UploadError({
-        en: `Record in the record array was left undefined`,
-        fr: `L'enregistrement dans le tableau d'enregistrements n'est pas défini`
-      });
-    }
     if (recordsList.some((str) => str === '')) {
       throw new UploadError({
         en: `One or more of the record array fields was left empty`,
@@ -565,9 +559,6 @@ export namespace Zod3 {
           for (let i = 0; i < headers.length; i++) {
             const key = headers[i]!.trim();
             const rawValue = elements[i]!.trim();
-            if (rawValue === '\n') {
-              continue;
-            }
 
             //Check for non visible char in every row, return error if present
             const nonVisibleChars = nonVisibleCharChecker(rawValue);
@@ -634,7 +625,7 @@ export namespace Zod3 {
 export namespace Zod4 {
   export type TypeName = Extract<
     z4.core.$ZodTypeDef['type'],
-    'array' | 'boolean' | 'date' | 'enum' | 'int' | 'number' | 'object' | 'optional' | 'set' | 'string'
+    'array' | 'boolean' | 'date' | 'enum' | 'number' | 'object' | 'optional' | 'set' | 'string'
   >;
 
   type BaseZodConvertResult = {
@@ -760,7 +751,6 @@ export namespace Zod4 {
         return parseDateEntry(entry);
       case 'enum':
         return entry;
-      case 'int':
       case 'number':
         return parseNumberEntry(entry);
       case 'set':
@@ -789,7 +779,6 @@ export namespace Zod4 {
         possibleEnumOutputs = possibleEnumOutputs.slice(0, -1);
         return formatOptionalEntry(possibleEnumOutputs, convertResult.isOptional);
       }
-      case 'int':
       case 'number':
         return formatOptionalEntry('number', convertResult.isOptional);
       case 'object': {
@@ -918,7 +907,6 @@ export namespace Zod4 {
             const key = headers[i]!.trim();
             const cell = elements[i];
             const rawValue = cell == null ? '' : cell.trim();
-            if (rawValue === '\n') continue;
             // Return error if any non‑visible character is present
             const nonVisibleChars = nonVisibleCharChecker(rawValue);
             if (nonVisibleChars !== null) {
diff --git a/packages/instrument-utils/src/translate.ts b/packages/instrument-utils/src/translate.ts
index 20b964d28..2e7b4bb3f 100644
--- a/packages/instrument-utils/src/translate.ts
+++ b/packages/instrument-utils/src/translate.ts
@@ -35,7 +35,7 @@ import {
 } from './guards.js';
 
 /**
- * Determine the target language for translation based on instrument and preferred language.
+ * Determine the language to translate a multilingual instrument into.
  *
  * The preferred language is the one the user is reading the *interface* in, which is a wider set
  * than instruments are authored in. A reader whose language no instrument offers is served the
@@ -45,13 +45,7 @@ import {
  * @param preferredLanguage - The language the user is reading the interface in.
  * @returns The target language for translation.
  */
-function getTargetLanguage(
-  instrument: Pick<AnyInstrument, 'language'>,
-  preferredLanguage: InterfaceLanguage
-): Language {
-  if (typeof instrument.language === 'string') {
-    return instrument.language;
-  }
+function getTargetLanguage(instrument: { language: Language[] }, preferredLanguage: InterfaceLanguage): Language {
   const preferred = $InstrumentAuthoringLanguage.safeParse(preferredLanguage);
   if (preferred.success && instrument.language.includes(preferred.data)) {
     return preferred.data;
diff --git a/packages/playground-url/AGENTS.md b/packages/playground-url/AGENTS.md
index 322709e46..1e8059309 100644
--- a/packages/playground-url/AGENTS.md
+++ b/packages/playground-url/AGENTS.md
@@ -32,6 +32,9 @@ query string is sent to the server, and a large instrument pushes the request li
 
 ## Tests
 
-`pnpm exec vitest --project playground-url`. The one test file, `src/share-url.test.ts`, sits beside
-the source rather than in a `__tests__/` folder and is round-trip based: encode, decode, assert
-equality. Follow that shape.
+`pnpm exec vitest --project playground-url`. Both test files sit beside the source rather than in a
+`__tests__/` folder. `src/share-url.test.ts` is round-trip based: encode, decode, assert equality —
+follow that shape for the library. `src/cli.test.ts` runs the CLI by importing `src/cli.ts` with a
+stubbed `process.argv` and a mocked `spawn`. Pin `process.platform` in any test that reaches
+`openInBrowser`: CI runs on Linux, so a branch only the host OS takes is uncovered there and fails
+the 100% coverage gate.
diff --git a/packages/playground-url/src/cli.test.ts b/packages/playground-url/src/cli.test.ts
index a3a1529b6..ee5bc884b 100644
--- a/packages/playground-url/src/cli.test.ts
+++ b/packages/playground-url/src/cli.test.ts
@@ -85,12 +85,13 @@ describe('cli', () => {
     expect(isFullscreenShareURL(url)).toBe(true);
   });
 
-  it('should open the generated link in the browser when --open is given', async () => {
-    const { spawn } = await import('node:child_process');
+  it('should open the generated link with open on macOS when --open is given', async () => {
     fs.writeFileSync(path.join(tmpDir, 'index.ts'), 'export default {};');
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin');
     process.argv = ['node', 'cli.js', tmpDir, '--open'];
+    const { spawn } = await import('node:child_process');
     await import('./cli.js');
-    expect(spawn).toHaveBeenCalled();
+    expect(spawn).toHaveBeenLastCalledWith('open', expect.anything(), expect.objectContaining({ shell: false }));
   });
 
   it("should open with the platform's own command on win32 and any other platform", async () => {
diff --git a/packages/react-core/src/components/InstrumentRenderer/ScalarInstrumentRenderer.tsx b/packages/react-core/src/components/InstrumentRenderer/ScalarInstrumentRenderer.tsx
index 4b25e682c..ef7af1205 100644
--- a/packages/react-core/src/components/InstrumentRenderer/ScalarInstrumentRenderer.tsx
+++ b/packages/react-core/src/components/InstrumentRenderer/ScalarInstrumentRenderer.tsx
@@ -62,10 +62,11 @@ export const ScalarInstrumentRenderer = ({
   const { t } = useTranslation();
   const addNotification = useNotificationsStore((store) => store.addNotification);
 
-  const handleSubmit = async ({ data, ...result }: AnyContentResult) => {
-    if (interpreted.status === 'DONE') {
+  const createSubmitHandler =
+    (instrument: AnyUnilingualScalarInstrument) =>
+    async ({ data, ...result }: AnyContentResult) => {
       const serializedData = JSON.parse(JSON.stringify(data, replacer)) as Json;
-      const validationResult = validateSubmission(interpreted.instrument, serializedData);
+      const validationResult = validateSubmission(instrument, serializedData);
       if (!validationResult.success) {
         console.error(validationResult.issues);
         addNotification({
@@ -78,16 +79,15 @@ export const ScalarInstrumentRenderer = ({
         });
         return;
       }
-    }
-    await onSubmit?.({
-      ...result,
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-      data: JSON.parse(JSON.stringify(data, replacer)),
-      instrumentId: target.id
-    });
-    setIndex(2);
-    setData(data);
-  };
+      await onSubmit?.({
+        ...result,
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+        data: JSON.parse(JSON.stringify(data, replacer)),
+        instrumentId: target.id
+      });
+      setIndex(2);
+      setData(data);
+    };
 
   return (
     <InstrumentRendererContainer className={className} index={index} NavigationBlocker={NavigationBlocker}>
@@ -123,7 +123,11 @@ export const ScalarInstrumentRenderer = ({
               />
             ))
             .with({ index: 1, instrument: { kind: 'FORM' } }, ({ instrument }) => (
-              <FormContent instrument={instrument} submitButtonLabel={submitButtonLabel} onSubmit={handleSubmit} />
+              <FormContent
+                instrument={instrument}
+                submitButtonLabel={submitButtonLabel}
+                onSubmit={createSubmitHandler(instrument)}
+              />
             ))
             .with({ index: 1, instrument: { kind: 'INTERACTIVE' } }, ({ instrument }) => (
               <InteractiveContent
@@ -133,11 +137,16 @@ export const ScalarInstrumentRenderer = ({
                 enableLanguageSelect={instrument.content.enableLanguageSelect}
                 enableLanguageToggle={instrument.content.enableLanguageToggle}
                 supportedLanguages={instrument.supportedLanguages}
-                onSubmit={handleSubmit}
+                onSubmit={createSubmitHandler(instrument)}
               />
             ))
             .with({ index: 1, instrument: { kind: 'FILE' } }, ({ instrument }) => {
-              return <FileInstrumentContent instrument={{ ...instrument, id: target.id }} onSubmit={handleSubmit} />;
+              return (
+                <FileInstrumentContent
+                  instrument={{ ...instrument, id: target.id }}
+                  onSubmit={createSubmitHandler(instrument)}
+                />
+              );
             })
             .with({ index: 2 }, () => (
               <InstrumentSummary
diff --git a/packages/react-core/src/components/InstrumentRenderer/SeriesInstrumentRenderer.tsx b/packages/react-core/src/components/InstrumentRenderer/SeriesInstrumentRenderer.tsx
index 9af0f3c4f..045f03ae0 100644
--- a/packages/react-core/src/components/InstrumentRenderer/SeriesInstrumentRenderer.tsx
+++ b/packages/react-core/src/components/InstrumentRenderer/SeriesInstrumentRenderer.tsx
@@ -75,10 +75,11 @@ export const SeriesInstrumentRenderer = ({
   const params = rootState.status === 'DONE' ? getSeriesInstrumentParams(rootState.instrument.content) : {};
   const skipProgress = params.skipProgress ?? false;
 
-  const handleSubmit = async ({ data }: FormContentSubmitResult | InteractiveContentSubmitResult) => {
-    const parsedData = JSON.parse(JSON.stringify(data, replacer)) as Json;
-    if (scalarState.status === 'DONE') {
-      const validationResult = validateSubmission(scalarState.instrument, parsedData);
+  const createSubmitHandler =
+    (instrument: AnyUnilingualScalarInstrument) =>
+    async ({ data }: FormContentSubmitResult | InteractiveContentSubmitResult) => {
+      const parsedData = JSON.parse(JSON.stringify(data, replacer)) as Json;
+      const validationResult = validateSubmission(instrument, parsedData);
       if (!validationResult.success) {
         console.error(validationResult.issues);
         addNotification({
@@ -91,34 +92,32 @@ export const SeriesInstrumentRenderer = ({
         });
         return;
       }
-    }
-    const isLastItem = currentItemIndex === target.items.length - 1;
-    // `scalarState` is DONE here (its content is what was just submitted); its
-    // `internal.name` gives the item name for the predicate context.
-    const itemName = scalarState.status === 'DONE' ? (scalarState.instrument.internal?.name ?? '') : '';
-    const shouldTerminate = params.terminate?.(parsedData, { itemIndex: currentItemIndex, itemName }) ?? false;
+      const isLastItem = currentItemIndex === target.items.length - 1;
+      // The item name is the predicate context `terminate` receives.
+      const itemName = instrument.internal?.name ?? '';
+      const shouldTerminate = params.terminate?.(parsedData, { itemIndex: currentItemIndex, itemName }) ?? false;
 
-    await onSubmit?.({
-      complete: isLastItem || shouldTerminate,
-      data: parsedData,
-      index,
-      instrumentId: scalarId!,
-      kind: 'SERIES',
-      seriesInstrumentId: target.id
-    });
+      await onSubmit?.({
+        complete: isLastItem || shouldTerminate,
+        data: parsedData,
+        index,
+        instrumentId: scalarId!,
+        kind: 'SERIES',
+        seriesInstrumentId: target.id
+      });
 
-    if (isLastItem || shouldTerminate) {
-      setCompletion({ itemName, terminated: shouldTerminate });
-    }
-    if (shouldTerminate) {
-      setIndex(2);
-      return;
-    }
-    setCurrentItemIndex(currentItemIndex + 1);
-    if (!skipProgress) {
-      setIsInstrumentInProgress(false);
-    }
-  };
+      if (isLastItem || shouldTerminate) {
+        setCompletion({ itemName, terminated: shouldTerminate });
+      }
+      if (shouldTerminate) {
+        setIndex(2);
+        return;
+      }
+      setCurrentItemIndex(currentItemIndex + 1);
+      if (!skipProgress) {
+        setIsInstrumentInProgress(false);
+      }
+    };
 
   const completionMessage =
     params.completionMessage?.({ itemName: completion?.itemName, terminated: completion?.terminated ?? false }) ?? null;
@@ -218,15 +217,19 @@ export const SeriesInstrumentRenderer = ({
                         instrument={instrument}
                         key={currentItemIndex}
                         submitButtonLabel={submitButtonLabel}
-                        onSubmit={handleSubmit}
+                        onSubmit={createSubmitHandler(instrument)}
                       />
                     ))
-                    .with({ instrument: { kind: 'INTERACTIVE' } }, () => (
-                      <InteractiveContent bundle={scalarBundle!} key={currentItemIndex} onSubmit={handleSubmit} />
+                    .with({ instrument: { kind: 'INTERACTIVE' } }, ({ instrument }) => (
+                      <InteractiveContent
+                        bundle={scalarBundle!}
+                        key={currentItemIndex}
+                        onSubmit={createSubmitHandler(instrument)}
+                      />
                     ))
                     .otherwise(() => null)
                 )
-                .otherwise(() => null)
+                .exhaustive()
             )
             .with({ index: 2 }, () => (
               <div className="mx-auto flex max-w-prose grow flex-col items-center justify-center space-y-1 py-32 text-center">
@@ -257,7 +260,7 @@ export const SeriesInstrumentRenderer = ({
                 </p>
               </div>
             ))
-            .otherwise(() => null)
+            .exhaustive()
         )
         .exhaustive()}
     </InstrumentRendererContainer>
diff --git a/packages/react-core/src/components/InstrumentSummary/InstrumentSummary.tsx b/packages/react-core/src/components/InstrumentSummary/InstrumentSummary.tsx
index f6d19cbf9..d6796db81 100644
--- a/packages/react-core/src/components/InstrumentSummary/InstrumentSummary.tsx
+++ b/packages/react-core/src/components/InstrumentSummary/InstrumentSummary.tsx
@@ -153,7 +153,7 @@ export const InstrumentSummary = ({
                       es: 'Fecha de nacimiento',
                       fr: 'Date de naissance'
                     }),
-                    value: subject.dateOfBirth ? toBasicISOString(subject.dateOfBirth) : null
+                    value: toBasicISOString(subject.dateOfBirth)
                   },
                   {
                     label: t({
@@ -168,13 +168,11 @@ export const InstrumentSummary = ({
                             es: 'Masculino',
                             fr: 'Masculin'
                           })
-                        : subject.sex === 'FEMALE'
-                          ? t({
-                              en: 'Female',
-                              es: 'Femenino',
-                              fr: 'Féminin'
-                            })
-                          : null
+                        : t({
+                            en: 'Female',
+                            es: 'Femenino',
+                            fr: 'Féminin'
+                          })
                   }
                 ]
               : [
diff --git a/packages/react-core/src/utils/__tests__/zodErrorMap.test.ts b/packages/react-core/src/utils/__tests__/zodErrorMap.test.ts
index 2c7040106..e09167df4 100644
--- a/packages/react-core/src/utils/__tests__/zodErrorMap.test.ts
+++ b/packages/react-core/src/utils/__tests__/zodErrorMap.test.ts
@@ -129,9 +129,7 @@ describe('zod v4 error map', () => {
     expect(describeV4({ code: 'invalid_union', errors: [[]], input: 'x' })).toBe(INVALID);
   });
 
-  // Defect: describeIssue passes no args when the issue has no affix, so the message keeps its
-  // placeholder. This pins today's output so a fix shows up as a deliberate change here.
-  it('should leave the {} placeholder unfilled when the issue carries no affix (defect)', () => {
+  it('should leave the placeholder unfilled for a hand-raised issue without an affix, which zod itself always sets', () => {
     expect(describeV4({ code: 'invalid_format', format: 'includes', input: 'x' })).toBe('Must include "{}"');
   });
 
diff --git a/packages/runtime-internal/src/interactive/worker.js b/packages/runtime-internal/src/interactive/worker.js
index a53a3b3ed..6295fdbb1 100644
--- a/packages/runtime-internal/src/interactive/worker.js
+++ b/packages/runtime-internal/src/interactive/worker.js
@@ -63,11 +63,6 @@ addEventListener('message', (event) => {
 });
 
 worker.addEventListener('fetch', (_event) => {
-  if (!staticAssets) {
-    console.error('staticAssets is not defined');
-    return;
-  }
-
   const event = /** @type {FetchEvent} */ (_event);
   const url = new URL(event.request.url);
   let pathname = url.pathname;
diff --git a/vitest.config.ts b/vitest.config.ts
index 83a39f467..edf5f3d1c 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -28,7 +28,10 @@ export default defineConfig({
       include: ['apps/{api,gateway,web}/src/**/*.?(c|m)[jt]s?(x)', 'packages/*/src/**/*.?(c|m)[jt]s?(x)'],
       provider: 'v8',
       reportsDirectory: path.resolve(import.meta.dirname, 'coverage'),
-      skipFull: true
+      skipFull: true,
+      thresholds: {
+        100: true
+      }
     },
     include: ['**/*/test.?(c|m)[jt]s?(x)', '**/*.{test,spec}.?(c|m)[jt]s?(x)'],
     projects: ['apps/*/vitest.config.ts', 'packages/*/vitest.config.ts', 'runtime/*/vitest.config.ts'],