test: kill batch-2 surviving mutants → 96% mutation score

[williamdewitt]

Closes #41 — the batch-2 mutation survivors (the set the @claude agent stalled on, being too large for one autonomous run). Done by hand with local Stryker verification.

Result

• Mutation score 59.92% → 96.26% (batch 1 took it to 65%; this is the rest).
• 98 → 153 tests, all green on net8.0 + net10.0.
• Exactly 1 survivor remains, by design (see below).

New / strengthened coverage

Area	What was missing	Added
AddCaliberWebhooks validation	boundaries + message text untested	min-valid-accepted tests (kill the < 1/>= flips) + message-fragment assertions
Constructor guards	null-collaborator guards untested	ConstructorGuardTests across every internal component
HttpDeliveryChannel	no dedicated tests at all	new suite: 2xx success, non-2xx → "HTTP {n}", null guards
DeliveryManager	no-due path, claim token, throttle	no-due returns 0; owner-is-the-claim-token (spy store); a batch > MaxConcurrency drains fully (proves the semaphore is released)
Ingestion / Subscription / MessageStore	publish/claim guards, lease boundary	guard tests + an exact-lease-expiry boundary test

Equivalent mutants

• ConfigureAwait is added to Stryker's ignore-methods — its boolean mutant (false→true) is not observable in a unit test, so it was 31 mutants of pure noise.
• The rest are annotated in source with // Stryker disable once … : equivalent — … (fast-path returns; lease release on already-terminal messages; the defensive key-wipe finally; guards the downstream already enforces).
• One survivor left on purpose: the format string ("n") of the random fallback claim token, used only when no owner is configured — purely cosmetic, no observable behaviour.

Note

Touches src/ (the // Stryker disable annotations, incl. SigningEngine), so this classifies risk:critical and is human-gated. No behaviour changes — comments only on the source side.

🤖 Generated with Claude Code