Prefer tests for:
- domain invariants
- authorization
- validation
- idempotency
- concurrency-sensitive flows
- provider/webhook handling

Watch for:
- snapshot-only confidence
- mock-heavy tests with no real signal
- missing negative cases
- no tests for regressions in high-risk domains