6.5.4 Story tests — registry totality + role-gating matrix + the settings-area E2E journey + a11y sweep

Estimate: 28m · Depends on: 6.5.2, 6.5.3

The story-closing verification (Principle #18; the epic-wide journey stays Story 6.7).

Vitest (integration, real Postgres): the registry totality suite (filesystem routes ↔ registry entries, both directions — a new settings page without an entry fails); the access matrix — every registry entry × (workspace owner, project admin, member, viewer/no-access) against seeded 6.4 role fixtures, asserting nav visibility AND page-level behaviour agree with the 6.4.3 policy (no nav leak, no orphan page).

Playwright E2E (tests/e2e/settings-area.spec.ts): the recipe journey — enter from the app sidebar → land on Details (identity + danger zone) → walk every section via the nav asserting active states + unchanged URLs → open /settings/project/workflow directly in a fresh context (chrome present) → as bophilips@motir.co assert the member view (filtered nav + read-only pages, no danger zone) → command-palette deep-link into a section → the narrow-viewport nav behaviour. a11y: the strict axe sweep over the area chrome + Details + one re-housed page; keyboard-only traversal of the full nav.

Acceptance criteria

• Totality + matrix suites green and DRIVEN from the registry (a registry change without a matrix case fails — the totality-guard pattern).
• The E2E journey passes green in CI's Playwright lane; the sweep reports zero violations.
• The Story 6.5 verification recipe runs clean top to bottom; pnpm test:coverage keeps all 6.5 files ≥90%.

Context refs

• The 6.1.6/5.5 totality-guard pattern; the 6.4.7 seeded role fixtures
• tests/integration/ + tests/e2e/ conventions; the harness/selector memories
• The Story 6.5 verification recipe — the checklist this automates
• Story 6.7 (the epic-wide remainder — do not duplicate)