test(mutants): kill planner check_* + type_narrowing surviving mutants

- type_narrowing: equal-length/Varchar->Char boundary + exact per-backend
  impact strings (verified 0 missed)
- check_default: per-op boundary tests for apply_op_i64/f64/str/bool,
  evaluate_op + literal_equals arms, incl. exact-EPSILON (1.0+f64::EPSILON)
  cases for the float-tolerance < comparisons (verified 0 missed)
- check_strengthening: AND/OR conjunct set-logic, BETWEEN narrowing bound
  tests, exact-EPSILON literal_equals (verified 0 missed); exclude the
  equivalent classify_strengthening || guard via mutants.toml
- check_expr_parser: trailing-operator/incomplete-exponent EOF (buffer
  over-read guards) + 70-group sequential-paren depth-leak test

Author: owjs3901

.cargo/mutants.toml

@@ -76,6 +76,14 @@ exclude_re = [
     # are byte-identical for every renderer-reachable layout while the other
     # pick_anchors arithmetic remains in scope.
     "edges[.]rs:152(:[0-9]+)?: replace > with >= in pick_anchors",
+    # E6: classify_strengthening's `||` guard
+    # (`old==Unparseable || new==Unparseable -> return None`) is equivalent
+    # under `&&`. When exactly one side is Unparseable the `&&` mutant skips
+    # the early return, but `classify_pair(Unparseable, _)` / `(_, Unparseable)`
+    # has no matching arm and falls to `_ => None` ? identical observable
+    # result for every input. The two-unparseable case is also caught earlier
+    # by `if old == new { return None }`. No test can distinguish the mutant.
+    "check_strengthening[.]rs:233(:[0-9]+)?: replace [|][|] with && in classify_strengthening",
 ]
 
 # Focus on logic-heavy crates. Exclude:

crates/vespertide-planner/src/validate/check_expr_parser/tests/mod.rs

@@ -366,6 +366,44 @@ fn and_with_unparseable_second_operand_is_unparseable() {
     assert!(matches!(parse("a > 0 AND x > b"), CheckExpr::Unparseable));
 }
 
+// A bare operator at end-of-input must not read `bytes[i+1]` out of bounds.
+// Pins the two-char-lookahead guard `i + 1 < bytes.len()` (a `-`/`*`/`<=`
+// mutant would index past the buffer and panic).
+#[test]
+fn trailing_operator_at_eof_is_unparseable_not_panic() {
+    assert!(matches!(parse("age >"), CheckExpr::Unparseable));
+}
+
+// Incomplete exponent at EOF in a SIGNED literal slot must not read the
+// exponent-sign byte out of bounds. Pins the `i < bytes.len() && ...` guard
+// in the signed-number branch (`<=` / `||` mutants index past the buffer).
+#[test]
+fn incomplete_signed_exponent_at_eof_is_unparseable_not_panic() {
+    assert!(matches!(parse("x = -1e"), CheckExpr::Unparseable));
+}
+
+// Same guard in the UNSIGNED-number branch.
+#[test]
+fn incomplete_unsigned_exponent_at_eof_is_unparseable_not_panic() {
+    assert!(matches!(parse("x = 1e"), CheckExpr::Unparseable));
+}
+
+// 70 sequential parenthesized groups never nest deeper than 1, so depth must
+// return to 0 after each. Pins `self.depth -= 1` in parse_atom: a `+=` or `/=`
+// mutant leaks depth, tripping the MAX_CHECK_EXPR_DEPTH (64) guard and
+// wrongly rejecting this valid expression.
+#[test]
+fn many_sequential_paren_groups_do_not_leak_depth() {
+    let expr = std::iter::repeat("(c > 0)")
+        .take(70)
+        .collect::<Vec<_>>()
+        .join(" OR ");
+    assert!(
+        !matches!(parse(&expr), CheckExpr::Unparseable),
+        "70 flat OR groups must parse; depth must not leak"
+    );
+}
+
 #[rstest]
 #[case::null("col = NULL", Literal::Null)]
 #[case::bool_true("col = TRUE", Literal::Bool(true))]

crates/vespertide-planner/src/validate/check_strengthening.rs

@@ -503,6 +503,125 @@ mod tests {
         assert_eq!(warnings[0].kind, CheckStrengtheningKind::BoundaryTightened);
     }
 
+    // -- classify_pair AND/OR set logic boundary kills ---------------------
+
+    fn classify(old: &str, new: &str) -> Vec<CheckStrengtheningKind> {
+        let baseline = baseline_with_check("t", "chk", old);
+        let p = plan(vec![add_check("t", "chk", new)]);
+        find_check_strengthenings(&p, &baseline)
+            .into_iter()
+            .map(|w| w.kind)
+            .collect()
+    }
+
+    #[test]
+    fn and_conjunct_added_is_strengthening() {
+        assert_eq!(
+            classify("a > 0 AND b > 0", "a > 0 AND b > 0 AND c > 0"),
+            vec![CheckStrengtheningKind::ConjunctAdded]
+        );
+    }
+
+    #[test]
+    fn and_reordered_same_conjuncts_is_not_strengthening() {
+        // Equal length, same set, reordered -> NOT a strengthening. Pins
+        // `new.len() > old.len()` (a `>=` mutant would fire on equal length).
+        assert!(classify("a > 0 AND b > 0", "b > 0 AND a > 0").is_empty());
+    }
+
+    #[test]
+    fn and_added_non_overlapping_conjuncts_is_not_strengthening() {
+        // New is longer but does NOT contain every old conjunct -> not a
+        // pure addition. Pins the `&&` (a `||` mutant would fire on length
+        // alone) and the `np == op` all-present check (a `!=` mutant would
+        // make all-present trivially true).
+        assert!(classify("a > 0 AND b > 0", "a > 0 AND c > 0 AND d > 0").is_empty());
+    }
+
+    #[test]
+    fn or_disjunct_removed_is_strengthening() {
+        assert_eq!(
+            classify("a > 0 OR b > 0 OR c > 0", "a > 0 OR b > 0"),
+            vec![CheckStrengtheningKind::DisjunctRemoved]
+        );
+    }
+
+    #[test]
+    fn or_reordered_same_disjuncts_is_not_strengthening() {
+        // Equal length, reordered -> not a removal. Pins `new.len() < old.len()`.
+        assert!(classify("a > 0 OR b > 0", "b > 0 OR a > 0").is_empty());
+    }
+
+    #[test]
+    fn or_new_disjunct_not_in_old_is_not_strengthening() {
+        // Fewer disjuncts but one is brand new (not in old) -> not a pure
+        // removal. Pins the `&&` and the `op == np` subset check.
+        assert!(classify("a > 0 OR b > 0 OR c > 0", "a > 0 OR d > 0").is_empty());
+    }
+
+    // -- between_is_narrower boundary kills --------------------------------
+
+    #[test]
+    fn between_tighten_low_only_is_narrower() {
+        // [0,10] -> [5,10]: low tightened, high equal. Pins `lo_cmp ==
+        // Ordering::Less` in any_strict (a `!=` mutant drops the only strict
+        // inequality, making it report "not narrower").
+        assert_eq!(
+            classify("x BETWEEN 0 AND 10", "x BETWEEN 5 AND 10"),
+            vec![CheckStrengtheningKind::BetweenNarrowed]
+        );
+    }
+
+    #[test]
+    fn between_tighten_high_only_is_narrower() {
+        // [0,10] -> [0,8]: high tightened, low equal. Pins `hi_cmp ==
+        // Ordering::Greater` in any_strict (a `!=` mutant drops the only
+        // strict inequality, making it report "not narrower").
+        assert_eq!(
+            classify("x BETWEEN 0 AND 10", "x BETWEEN 0 AND 8"),
+            vec![CheckStrengtheningKind::BetweenNarrowed]
+        );
+    }
+
+    #[test]
+    fn between_widened_low_tightened_high_is_not_narrower() {
+        // [5,10] -> [0,8]: low widened (lo_ok=false), high tightened. Range
+        // is NOT a subset, so not narrower. Pins both `&&`s in
+        // `lo_ok && hi_ok && any_strict` (either `||` mutant would wrongly
+        // report narrowing from the high-only tightening).
+        assert!(classify("x BETWEEN 5 AND 10", "x BETWEEN 0 AND 8").is_empty());
+    }
+
+    // -- literal_equals EPSILON-boundary kills -----------------------------
+    // `1.0000000000000002` is exactly `1.0 + f64::EPSILON`. A literal exactly
+    // EPSILON away is DISTINCT under the strict `(a-b).abs() < EPSILON`
+    // tolerance, so the bound genuinely tightened (the `<=` mutant would call
+    // the two literals equal and suppress the warning).
+
+    #[test]
+    fn float_boundary_one_epsilon_tighter_is_tightening() {
+        assert_eq!(
+            classify("x > 1.0", "x > 1.0000000000000002"),
+            vec![CheckStrengtheningKind::BoundaryTightened]
+        );
+    }
+
+    #[test]
+    fn int_vs_float_boundary_one_epsilon_tighter_is_tightening() {
+        assert_eq!(
+            classify("x > 1", "x > 1.0000000000000002"),
+            vec![CheckStrengtheningKind::BoundaryTightened]
+        );
+    }
+
+    #[test]
+    fn float_vs_int_boundary_one_epsilon_apart_is_not_operator_tightening() {
+        // `>= 1.0000000000000002` vs `> 1`: literals differ by exactly EPSILON,
+        // so this is NOT the (Ge,Gt)-same-literal operator-tightening pattern.
+        // Pins the (Float,Integer) EPSILON arm of literal_equals.
+        assert!(classify("x >= 1.0000000000000002", "x > 1").is_empty());
+    }
+
     #[test]
     fn ge_boundary_tightened() {
         let baseline = baseline_with_check("t", "c", "x >= 1");

crates/vespertide-planner/src/validate/tests/check_default.rs

@@ -157,6 +157,205 @@ fn integer_default_violates_ne() {
     assert!(is_default_violates_check(&validate_one(table).unwrap_err()));
 }
 
+// ---------------------------------------------------------------------------
+// Boundary kills: each comparison op exactly at its threshold so the
+// `<`/`>`/`==` and EPSILON-arithmetic mutations are distinguished.
+// ---------------------------------------------------------------------------
+
+fn boundary_table(ty: SimpleColumnType, default: DefaultValue, expr: &str) -> TableDef {
+    table_with(
+        "t",
+        col_with_default("v", ColumnType::Simple(ty), default),
+        vec![check_constraint("c", expr)],
+    )
+}
+
+#[test]
+fn integer_default_equal_violates_lt_boundary() {
+    // 5 < 5 is false (violates). Kills apply_op_i64 `< -> <=` and `< -> ==`.
+    let t = boundary_table(SimpleColumnType::Integer, DefaultValue::Integer(5), "v < 5");
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn float_default_equal_violates_lt_boundary() {
+    // 5.0 < 5.0 is false. Kills apply_op_f64 Lt `< -> <=`.
+    let t = boundary_table(SimpleColumnType::Real, DefaultValue::Float(5.0), "v < 5.0");
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn float_default_equal_violates_gt_boundary() {
+    // 5.0 > 5.0 is false. Kills apply_op_f64 Gt `> -> >=`.
+    let t = boundary_table(SimpleColumnType::Real, DefaultValue::Float(5.0), "v > 5.0");
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn float_default_equal_satisfies_eq() {
+    // (2-2).abs() < EPS is true. Kills apply_op_f64 Eq `- -> +`, `- -> /`,
+    // and `< -> ==`.
+    let t = boundary_table(SimpleColumnType::Real, DefaultValue::Float(2.0), "v = 2.0");
+    assert!(validate_one(t).is_ok());
+}
+
+#[test]
+fn float_opposite_sign_satisfies_ne() {
+    // 2 <> -2: (2-(-2)).abs()=4 >= EPS true. Kills apply_op_f64 Ne `- -> +`
+    // (where (2+(-2)).abs()=0 would wrongly report "equal").
+    let t = boundary_table(
+        SimpleColumnType::Real,
+        DefaultValue::Float(2.0),
+        "v <> -2.0",
+    );
+    assert!(validate_one(t).is_ok());
+}
+
+#[test]
+fn float_zero_satisfies_ne_nonzero() {
+    // 0 <> 5: (0-5).abs()=5 >= EPS true. Kills apply_op_f64 Ne `- -> /`
+    // (where (0/5).abs()=0 would wrongly report "equal").
+    let t = boundary_table(SimpleColumnType::Real, DefaultValue::Float(0.0), "v <> 5.0");
+    assert!(validate_one(t).is_ok());
+}
+
+#[test]
+fn string_default_equal_violates_lt_boundary() {
+    // "'m'" < "'m'" is false. Kills apply_op_str `< -> <=` and `< -> ==`.
+    let t = boundary_table(
+        SimpleColumnType::Text,
+        DefaultValue::String("'m'".into()),
+        "v < 'm'",
+    );
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn string_default_equal_violates_gt_boundary() {
+    // "'m'" > "'m'" is false. Kills apply_op_str `> -> >=`.
+    let t = boundary_table(
+        SimpleColumnType::Text,
+        DefaultValue::String("'m'".into()),
+        "v > 'm'",
+    );
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn bool_default_equal_violates_ne() {
+    // true <> true is false (violates). Kills apply_op_bool delete of the
+    // `Op::Ne` arm (which would fall through to `_ => true`).
+    let t = boundary_table(
+        SimpleColumnType::Boolean,
+        DefaultValue::Bool(true),
+        "v <> true",
+    );
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn float_default_int_literal_violates_evaluate_op_arm() {
+    // (Float, Integer) arm: 5.0 < 3 is false. Kills evaluate_op delete of the
+    // `(Float, Integer)` arm (which would fall through to `_ => true`).
+    let t = boundary_table(SimpleColumnType::Real, DefaultValue::Float(5.0), "v < 3");
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn integer_in_list_match_exercises_literal_equals_int_arm() {
+    // 5 matches the IN list -> literal_equals (Int,Int) arm. Kills the
+    // delete of that arm (-> `_ => false` -> not in list -> would violate).
+    let t = boundary_table(
+        SimpleColumnType::Integer,
+        DefaultValue::Integer(5),
+        "v IN (1, 5, 9)",
+    );
+    assert!(validate_one(t).is_ok());
+}
+
+#[test]
+fn float_in_list_matches_exercise_literal_equals_float_arms() {
+    // Float==Float, Int==Float, Float==Int IN-list matches. Each
+    // `(a-b).abs() < EPS` distinguishes `< -> >` (0 > EPS would miss).
+    assert!(
+        validate_one(boundary_table(
+            SimpleColumnType::Real,
+            DefaultValue::Float(2.0),
+            "v IN (2.0)"
+        ))
+        .is_ok()
+    );
+    assert!(
+        validate_one(boundary_table(
+            SimpleColumnType::Integer,
+            DefaultValue::Integer(2),
+            "v IN (2.0)"
+        ))
+        .is_ok()
+    );
+    assert!(
+        validate_one(boundary_table(
+            SimpleColumnType::Real,
+            DefaultValue::Float(2.0),
+            "v IN (2)"
+        ))
+        .is_ok()
+    );
+}
+
+#[test]
+fn bool_in_list_match_exercises_literal_equals_bool_arm() {
+    // true IN (true) -> literal_equals (Bool,Bool) `==`. Kills `== -> !=`.
+    let t = boundary_table(
+        SimpleColumnType::Boolean,
+        DefaultValue::Bool(true),
+        "v IN (true)",
+    );
+    assert!(validate_one(t).is_ok());
+}
+
+// `1.0000000000000002` is exactly `1.0 + f64::EPSILON` (the next representable
+// double). A value exactly EPSILON away is treated as DISTINCT by the strict
+// `(a-b).abs() < EPSILON` tolerance, so the default violates an `=`/`IN` check.
+// These pin `<` against `<=` at the tolerance boundary (the `<=` mutant would
+// treat the pair as equal and wrongly pass).
+const ONE_PLUS_EPS: &str = "1.0000000000000002";
+
+#[test]
+fn float_eq_at_exact_epsilon_distance_violates() {
+    // apply_op_f64 Eq line: `(a-b).abs() < EPSILON`. Kills `< -> <=`.
+    let expr = format!("v = {ONE_PLUS_EPS}");
+    let t = boundary_table(SimpleColumnType::Real, DefaultValue::Float(1.0), &expr);
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn float_float_in_list_at_exact_epsilon_distance_misses() {
+    // literal_equals (Float,Float) EPSILON line. Kills `< -> <=`.
+    let expr = format!("v IN ({ONE_PLUS_EPS})");
+    let t = boundary_table(SimpleColumnType::Real, DefaultValue::Float(1.0), &expr);
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn int_float_in_list_at_exact_epsilon_distance_misses() {
+    // literal_equals (Integer,Float) EPSILON line. Kills `< -> <=`.
+    let expr = format!("v IN ({ONE_PLUS_EPS})");
+    let t = boundary_table(SimpleColumnType::Integer, DefaultValue::Integer(1), &expr);
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
+#[test]
+fn float_int_in_list_at_exact_epsilon_distance_misses() {
+    // literal_equals (Float,Integer) EPSILON line. Kills `< -> <=`.
+    let t = boundary_table(
+        SimpleColumnType::Real,
+        DefaultValue::Float(1.000_000_000_000_000_2),
+        "v IN (1)",
+    );
+    assert!(is_default_violates_check(&validate_one(t).unwrap_err()));
+}
+
 // ---------------------------------------------------------------------------
 // Satisfied: every op passes when the default fits
 // ---------------------------------------------------------------------------