There's a trick in the Playwright E2E setup I built: to test a magic-link login flow, you don't need an actual email to be sent. The Firebase auth emulator exposes a REST endpoint — you hit it directly, get back the sign-in link that would have appeared in the email, and hand that to Playwright to click. The email is bypassed entirely. Resend never called. No inbox to check.

It works. The auth code runs. The test passes.

But I kept noticing: we tested whether logging in via a magic link produces a valid session. We didn't test whether the link ever reaches the user. Those are two different questions, and we answered only one.

This is completely standard — you decouple the transport layer, test the auth logic. But something about the way the emulator hands you the token so willingly stuck with me. Real emails have latency, spam filters, rendering quirks. The emulator has none of that. The thing you're testing against is cleaner and more cooperative than the real thing by design.

I wonder sometimes whether that gap accumulates. Each thing we stub, mock, or emulate is a small bet that the real version behaves close enough. Usually the bet pays off. But the bets are mostly invisible — they're in what we decided not to test.