Roda route_csrf tokens are path-specific. Fetching from the
dashboard's matching form gets a token valid for the target action.

Assisted-by: Claude Opus 4.6 via Claude Code

diff --git a/test/test_web.rb b/test/test_web.rb
index 5e98971..56b1d5b 100644
--- a/test/test_web.rb
+++ b/test/test_web.rb
@@ -547,8 +547,9 @@ class TestWeb < Minitest::Test
   private
 
   def csrf_post(path, params = {}, headers = auth_headers)
-    get "/series/new", {}, headers  # establish session and get CSRF token
-    token = last_response.body[/name="_csrf" value="([^"]+)"/, 1]
+    get "/", {}, headers
+    escaped = Regexp.escape(path)
+    token = last_response.body[/action="#{escaped}".*?name="_csrf" value="([^"]+)"/m, 1]
     post path, params.merge("_csrf" => token), headers
   end