docs: reorder & testing

integration/testenv/gateway.go

@@ -86,6 +86,16 @@ func StartGateway(t *testing.T, opts GatewayOptions) *GatewayContainer {
 		// Negative-path edge tests tighten these per-test.
 		"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_PUBLIC_AUTH_RATE_LIMIT_REQUESTS":         "10000",
 		"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_PUBLIC_AUTH_RATE_LIMIT_BURST":            "1000",
+		// Identity-bucket limits sit on top of the class limits and are
+		// keyed by the request identity (email for send-email-code,
+		// challenge_id for confirm-email-code). The defaults are
+		// purposely tight in production (3 sends per email per window);
+		// happy-path scenarios that re-issue codes for the same email
+		// would otherwise trip the limiter mid-test.
+		"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_SEND_EMAIL_CODE_IDENTITY_RATE_LIMIT_REQUESTS":    "10000",
+		"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_SEND_EMAIL_CODE_IDENTITY_RATE_LIMIT_BURST":       "1000",
+		"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_CONFIRM_EMAIL_CODE_IDENTITY_RATE_LIMIT_REQUESTS": "10000",
+		"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_CONFIRM_EMAIL_CODE_IDENTITY_RATE_LIMIT_BURST":    "1000",
 		"GATEWAY_AUTHENTICATED_GRPC_ANTI_ABUSE_IP_RATE_LIMIT_REQUESTS":           "10000",
 		"GATEWAY_AUTHENTICATED_GRPC_ANTI_ABUSE_IP_RATE_LIMIT_BURST":              "1000",
 		"GATEWAY_AUTHENTICATED_GRPC_ANTI_ABUSE_SESSION_RATE_LIMIT_REQUESTS":      "10000",

integration/testenv/images.go

@@ -61,6 +61,13 @@ func EnsureGameImage(t *testing.T) {
 	}
 }
 
+// integrationImageLabel is the docker label stamped onto every image
+// built from `integration/testenv/images.go`. The pre-clean script
+// (`integration/scripts/preclean.sh`) keys off this label to wipe
+// stale builds without touching testcontainers-pulled service images
+// (postgres, redis, ryuk, mailpit) which we want to keep cached.
+const integrationImageLabel = "galaxy.test.kind=integration-image"
+
 func buildImage(tag, dockerfile string) error {
 	root, err := workspaceRoot()
 	if err != nil {
@@ -72,6 +79,7 @@ func buildImage(tag, dockerfile string) error {
 	cmd := exec.CommandContext(ctx, "docker", "build",
 		"-t", tag,
 		"-f", filepath.Join(root, dockerfile),
+		"--label", integrationImageLabel,
 		root,
 	)
 	out, err := cmd.CombinedOutput()

integration/testenv/network.go

@@ -11,12 +11,19 @@ import (
 // StartNetwork creates a user-defined Docker bridge network and
 // registers a t.Cleanup to remove it. All platform containers attach
 // to the same network so they can resolve each other by alias.
+//
+// A failure here is fatal, not a skip: the network create path runs
+// long after `RequireDocker` has confirmed the daemon is reachable, so
+// any error here is a real environment break (subnet exhaustion, a
+// half-dead Ryuk reaper, a daemon-side network plugin issue) and
+// silently skipping it would mask the rest of the suite as
+// "passing" when nothing in fact ran.
 func StartNetwork(t *testing.T) *testcontainers.DockerNetwork {
 	t.Helper()
 	ctx := context.Background()
 	net, err := tcnetwork.New(ctx)
 	if err != nil {
-		t.Skipf("docker network unavailable: %v", err)
+		t.Fatalf("create docker network: %v", err)
 	}
 	t.Cleanup(func() {
 		if err := net.Remove(ctx); err != nil {