How Much Is Enough

Coverage is a measurement, not a goal. A hundred percent coverage with tests asserting nothing meaningful is worse than a dozen tests covering the things that would actually hurt, because it produces confidence you have not earned.

A reasonable standard for a project this size.

Every permission rule has a test.

Every form's validation has a test for the invalid case, not just the valid one.

Every view returns the status code you expect, for a signed-in user, a signed-out one, and a stranger.

Every bug you fix gets a test first, so it cannot come back.

That last habit is the one that compounds.