test(coverage): mutation testing sprint — cache, reporter, rules, shield

- Add tests/test_cache.py (29 tests): full coverage of CacheManager including
  atomic save, corrupt-JSON fallback, parent-directory creation, and OSError
  handling via zenzic.core.cache.json.dump patch (Path.open vs builtins.open)
- Add tests/test_reporter.py (12 tests): _read_snippet boundary conditions and
  _strip_prefix logic, killing or→and mutants on empty-file and zero-line guards
- Add TestToCanonicalUrlMutantKill (15 tests) to test_rules.py: kills rstrip/lstrip,
  backslash normalization, index.md stripping, and source_dir/docs_root guard mutations
- Add TestObfuscateSecretMutantKill (7 tests) to test_redteam_remediation.py:
  kills <= 8 boundary, prefix length, and star-count mutants in _obfuscate_secret
- Add TestNormalizeLineForShieldMutantKill (4 tests) to test_shield_obfuscation.py:
  kills MDX comment, table pipe, and whitespace-join mutants

docs: document sprint in CHANGELOG.md, CHANGELOG.it.md, RELEASE.md under [0.7.0]

Test suite: 1,195 passing tests

Author: PythonWoods-Dev

CHANGELOG.it.md

@@ -345,6 +345,46 @@ L'extra opzionale `[mkdocs]` non esiste più. `pip install zenzic` è l'installa
 
 ---
 
+### Sprint Copertura Test & Mutation Testing (2026-04-24)
+
+#### Aggiunto
+
+- **`tests/test_cache.py`** (29 test) — copertura completa di `src/zenzic/core/cache.py`.
+  Helper hash puri (`make_content_hash`, `make_config_hash`, `make_vsm_snapshot_hash`,
+  `make_file_key`) e operazioni in-memory e I/O di `CacheManager` (`get`, `put`, `load`,
+  `save`). Copre scrittura atomica, creazione directory parent, fallback JSON corrotto e
+  pulizia OSError tramite monkeypatching di `json.dump`.
+
+- **`tests/test_reporter.py`** (12 test) — copertura di `_read_snippet` e `_strip_prefix`
+  in `src/zenzic/core/reporter.py`. Verifica la guardia `or`/`and` nel caso file vuoto /
+  line_no non valido, il clamping del context-window a inizio e fine file, e la semantica
+  dello strip del prefisso (bypass linea 0, ritenzione corrispondenza parziale).
+
+- **`TestToCanonicalUrlMutantKill`** (15 test) aggiunto a `tests/test_rules.py` — targeta
+  `VSMBrokenLinkRule._to_canonical_url`. Uccide le mutazioni `rstrip(None)` / `lstrip("/")`,
+  normalizzazione backslash, strip `index.md` → directory padre, risoluzione `..`
+  context-aware, inversioni della logica di guardia `source_dir`/`docs_root` e caso limite
+  path relativo `"."`.
+
+- **`TestObfuscateSecretMutantKill`** (7 test) aggiunto a `tests/test_redteam_remediation.py`
+  — targeta `_obfuscate_secret` in `reporter.py`. Uccide le mutazioni boundary `<= 8` → `< 8`,
+  `<= 8` → `<= 9` e la mutazione di larghezza prefisso `raw[:4]` → `raw[:5]`. Verifica che
+  il conteggio asterischi sia `len(raw) - 8` e che la lunghezza totale sia sempre preservata.
+
+- **`TestNormalizeLineForShieldMutantKill`** (4 test) aggiunto a
+  `tests/test_shield_obfuscation.py` — uccide la sostituzione commento MDX → `"XXXX"`
+  (mutmut_22), pipe tabella → `"XX XX"` (mutmut_40) e join spazio → `"XX XX".join`
+  (mutmut_42).
+
+- **Run di mutation testing `mutmut`** su `rules.py`, `shield.py`, `reporter.py` — run
+  completata. Oltre 200 mutanti sopravvissuti analizzati; i mutanti logici ad alto impatto
+  in `_to_canonical_url`, `_obfuscate_secret` e `_normalize_line_for_shield` uccisi dai
+  nuovi test. I mutanti sopravvissuti restanti classificati come equivalenti (variazioni di
+  stringhe template in `SentinelReporter.render`, asserzioni difensive, o mutazioni
+  `encoding="UTF-8"` / `errors="REPLACE"` con comportamento runtime identico).
+
+---
+
 ## [0.6.1] — 2026-04-19 — Obsidian Glass [SUPERSEDED]
 
 > ⚠ **[SUPERSEDED dalla v0.7.0]** — La versione 0.6.1 è deprecata a causa di problemi di allineamento con le specifiche Docusaurus e terminologia legacy. Tutti gli utenti devono aggiornare alla v0.7.0 "Obsidian Maturity".

CHANGELOG.md

@@ -391,6 +391,44 @@ The `[mkdocs]` optional extra no longer exists. `pip install zenzic` is the comp
 
 ---
 
+### Test Coverage & Mutation Testing Sprint (2026-04-24)
+
+#### Added
+
+- **`tests/test_cache.py`** (29 tests) — full coverage of `src/zenzic/core/cache.py`.
+  Pure hash helpers (`make_content_hash`, `make_config_hash`, `make_vsm_snapshot_hash`,
+  `make_file_key`) and `CacheManager` in-memory and I/O operations (`get`, `put`, `load`,
+  `save`). Covers atomic write, parent-dir creation, corrupt-JSON fallback, and OSError
+  cleanup via `json.dump` monkeypatching.
+
+- **`tests/test_reporter.py`** (12 tests) — coverage of `_read_snippet` and `_strip_prefix`
+  in `src/zenzic/core/reporter.py`. Exercises `or`/`and` boundary in the empty-file /
+  invalid-line-no guard, context-window clamping at file start and end, and prefix
+  stripping semantics (line 0 bypass, partial-match retention).
+
+- **`TestToCanonicalUrlMutantKill`** (15 tests) added to `tests/test_rules.py` — targets
+  `VSMBrokenLinkRule._to_canonical_url`. Kills `rstrip(None)` / `lstrip("/")` mutations,
+  backslash normalisation, `index.md` → parent-dir strip, context-aware `..` resolution,
+  `source_dir`/`docs_root` guard logic inversions, and `"."` relative-path edge case.
+
+- **`TestObfuscateSecretMutantKill`** (7 tests) added to `tests/test_redteam_remediation.py`
+  — targets `_obfuscate_secret` in `reporter.py`. Kills `<= 8` → `< 8`, `<= 8` → `<= 9`
+  boundary mutations and `raw[:4]` → `raw[:5]` prefix-width mutation. Verifies star count
+  equals `len(raw) - 8` and total length is always preserved.
+
+- **`TestNormalizeLineForShieldMutantKill`** (4 tests) added to
+  `tests/test_shield_obfuscation.py` — kills MDX-comment sub → `"XXXX"` (mutmut_22),
+  table-pipe sub → `"XX XX"` (mutmut_40), and whitespace join → `"XX XX".join` (mutmut_42).
+
+- **`mutmut` mutation testing run** on `rules.py`, `shield.py`, `reporter.py` — full run
+  completed. 200+ surviving mutants analysed; high-impact logic mutants in
+  `_to_canonical_url`, `_obfuscate_secret`, and `_normalize_line_for_shield` killed by new
+  tests. Remaining surviving mutants classified as equivalent (template string variations in
+  `SentinelReporter.render`, defensive assertions, or `encoding="UTF-8"` / `errors="REPLACE"`
+  mutations with identical runtime behaviour).
+
+---
+
 ## [0.6.1] — 2026-04-19 — Obsidian Glass [SUPERSEDED]
 
 > ⚠ **[SUPERSEDED by v0.7.0]** — Version 0.6.1 is deprecated due to alignment issues with Docusaurus specifications and legacy terminology. All users must upgrade to v0.7.0 "Obsidian Maturity".

RELEASE.md

@@ -74,6 +74,40 @@ reminder for when pip ships a fix.
 
 ---
 
+### 🧬 Test Coverage & Mutation Testing Sprint (2026-04-24)
+
+A targeted sprint to measure and strengthen the test suite using both line coverage
+and mutation testing (`mutmut`). The output: 1 195 passing tests, a new `test_cache.py`
+module from scratch, and targeted mutant-killing tests for three critical subsystems.
+
+#### New Test Modules
+
+- **`tests/test_cache.py`** — 29 tests covering the entire content-addressable cache
+  (`cache.py`). Pure hash stability, `CacheManager` get/put/overwrite, hit-rate tracking,
+  atomic save, parent-dir creation, corrupt-JSON resilience, and OSError cleanup.
+- **`tests/test_reporter.py`** — 12 tests for `_read_snippet` and `_strip_prefix`.
+  Exercises the `or`/`and` boundary that guards against empty files and invalid line
+  numbers, context-window clamping, and prefix-stripping semantics.
+
+#### Mutation Testing Results
+
+Full `mutmut` run across `rules.py`, `shield.py`, and `reporter.py`. High-impact logic
+mutants confirmed killed:
+
+| Mutant class | Function | Representative mutation | Killed by |
+|---|---|---|---|
+| Boundary | `_obfuscate_secret` | `<= 8` → `< 8` | `TestObfuscateSecretMutantKill` |
+| Logic inversion | `_to_canonical_url` | `and "…" in path` → `or` | `TestToCanonicalUrlMutantKill` |
+| Strip substitution | `_normalize_line_for_shield` | MDX sub → `"XXXX"` | `TestNormalizeLineForShieldMutantKill` |
+| String mutation | `_to_canonical_url` | `rstrip("/")` → `rstrip(None)` | `test_trailing_slash_is_stripped_*` |
+| Index arithmetic | `_to_canonical_url` | `parts[:-1]` → `parts[:+1]` | `test_nested_index_removed` |
+
+Remaining survivors are equivalent mutants: template string variations in
+`SentinelReporter.render` output formatting and `encoding`/`errors` argument
+mutations that Python's codec system normalises at runtime.
+
+---
+
 ### 🚀 What Changed
 
 #### 1. Z104 Proactive Suggestion Engine (New)