Test-coverage gaps: 17 surviving mutations, mostly cli.ts and tools.ts

[MGrin]

An independent mutation sweep applied 53 mutations; after the final fix wave, 17 still survive. The shipped code is correct in every case — these are places where a future regression would ship unnoticed because no test pins the behaviour.

Ranked by what could go wrong:

1. tools.ts — submit default false→true survives. browser_type would press Enter on every fill: unrequested form submissions, on the surface a prompt-injected page reaches.
2. cli.ts — routing close to operations.read survives. bb browser close would report success and never close, so tabs accumulate — the exact failure the reaper exists for.
3. cli.ts — inverting !rest.includes("--full") survives. snapshot and snapshot --full would swap outputs.
4. operations.ts — never removing the screenshot temp file survives. Every screenshot would leave a PNG of page content in $TMPDIR forever.
5. stream.ts — dropping stopped from the onFrame guard survives. A departed viewer keeps encoding into a dead controller.
6. reaper.ts — dropping the post-sleep if (signal.aborted) return survives. One extra sweep runs against a browser mid-teardown on shutdown.
7. panel-rpc.ts — .strict() is tested on view only; dropping it from input and navigate survives. That is the only guarantee the "no key smuggling" comment actually claims.

Lower consequence: cli arity and usage checks, interactive default, click .min(1), !response.ok, httpOriginOf always http, idle boundary <→<=, unboundSince.delete (self-heals next sweep).

Where the gaps cluster: cli.ts (5 tests for 8 subcommands — read, snapshot, eval, close and type-without---submit are never exercised) and browser-endpoint.ts.

Also open, from the final review:

• screencast.test.ts frame-delivery assertions still flake ~2 in 21 runs under load; tick(20) budgets a real loopback round trip. Fix is a signal from the fake server, not a bigger budget.
• Three documented functional gaps in docs/design.md: the reaper never shuts the browser down (Chromium stays resident after the last tab is reaped), no last-URL restore after a headed relaunch, and the headed exemption is not self-clearing.
• session-key.ts reads .childOrigin off whatever bb.sdk.threads.get returns; a host answering null for an already-deleted thread throws out of the resolver.

🤖 Generated with Claude Code

[MGrin]

Closed in #3.

Test gaps. The seven that mattered now fail when the code they defend is removed — close→read, --full inverted, submit defaulting to true, the screenshot temp file, the teardown sweep, .strict() on navigate/input, and a wss:// endpoint probed over http. Each was verified one mutation at a time rather than as a batch.

Two of the original 21 were not worth closing and are deliberately left: the idle boundary < vs <= (a page exactly on the deadline waits one more minute) and unboundSince.delete after a successful close (self-heals on the next sweep). Both are equivalent-mutant territory — a test pinning them would assert an implementation detail, not a behaviour.

Functional gaps. All three closed:

• The reaper shuts an empty browser down, and forgets its address in the same act.
• A thread goes back where it was after a headed relaunch — once, within ten minutes, never after an explicit close.
• The headed exemption reaps what this plugin opened and never touches a tab it did not, so it no longer waits for a mode change to clear.

session-key.ts no longer throws on a thread the host answers null for.

Still open, and now the only things here: the screencast.test.ts frame-delivery assertions still flake under heavy CPU load (tick(20) budgets a real loopback round trip; the fix is a signal from the fake server rather than a bigger budget), and docs/design.md gaps 2-4 remain deliberate — bb browser sessions/mode do not exist, and frameQuality/maxFrameWidth are constants.

scripts/verify now checks twelve of these claims against a running bb.