All three states (loading, error, success), empty and edge cases, responsive behavior on real devices, auth flows, real-time features, keyboard and screen reader accessibility, and performance on throttled slow networks.

Because empty results, very long inputs, very long lists, and boundary values are where bugs hide. These are also where users suffer most when things go wrong, so testing them is high-value.

Because auth bugs in production are serious and hard to recover from. Test signup, signin, signout, protected route access, and persistence across reloads, ideally on the deployed app, since auth has production-specific concerns like authorized domains.