[simon-mundy]

Follow-up to the mutation run on #185, which still showed 79 escaped mutants at 97% Covered MSI.

	Before	After
Escaped mutants	79	0
Covered Code MSI	97%	100%
Mutation Code Coverage	100%	100%

Tests and Infection config only — no src/ changes.

The root cause behind 33 of them

AbstractSourceTest::setMockData() seeds $this->data by reflection before calling a getter, so the getter's own loadXData() call is a no-op and Infection deletes it for free (MethodCallRemoval). The same seeding hides protected → private on the loaders, because nothing in the suite calls them from a subclass — IncompleteSource only overrides one.

LazyRecordingSource seeds only inside loadXData(), delegates to parent:: first, and records each call:

• delete a loader call from a getter → the data is never there → the getter throws or returns empty
• protected → private → parent::loadXData() fatals from the subclass
• repeated reads → the recorded count proves the result is cached, not reloaded

Two genuine logic gaps in the same file came out with it: getConstraintKeys() matched on either half of the table/constraint pair rather than both, and prepareDataHierarchy() could leave auto-vivified nulls where the old assertArrayHasKey assertion couldn't tell the difference.

Everything else

Area	Killed
AbstractSource lazy-load, constraint-key matching, hierarchy shape	33
Sql\Argument\Values / Identifiers — neither had a test file	4
FeatureSet (both namespaces), MetadataFeature, SequenceFeature, RowGatewayFeature	10
Predicates — setSpecification() was round-tripped but never honoured in getExpressionData()	4
AbstractLengthColumn — array_splice displacement, setLength() default	4
Integer display width (new in #185) — zero width, splice displacement	2
ColumnObject::setErratas, ConfigProvider::getDependencies, ContainerException code	3
Verified equivalents, ignored in config	12

src/Sql/Ddl/Column/Integer.php was at 92% on 0.6.x after #185 merged; it is now 100%, 26/26.

Equivalent mutants, ignored with reasons

Twelve are false positives, not gaps. They are listed in infection.json5.dist with a comment each rather than papered over with a test:

• the six loader guards short-circuit prepareDataHierarchy(), which is itself idempotent, so falling through changes nothing
• getColumns() delegates to getColumnNames(), which loads the same data
• implode() discards the keys array_fill() sets, so its start index is unobservable
• a RowGatewayInterface is neither null nor a string, so the next guard returns for the same inputs
• stopPropagation() has an empty body

Exception messages

Three diagnostic messages are built by concatenation, which generated 11 Concat and ConcatOperandRemoval mutants. Three of the four call sites already asserted their message, but with a substring short enough that every mutant slipped under it — reordering the operands or dropping one left the assertion passing.

Widening them to the whole message closes all 11. The wording is not the brittle part: both RowGatewayFeature messages are short phrases wrapped around self::class and RowPrototypeResultSet::class, so a class rename flows through the assertion on its own. VunerablePlatformQuoteException had expectException at four call sites and no message assertion anywhere, so it gains a focused test.

The only mutants left in the whole suite are the 2 pre-existing timeouts in AbstractResultSet.php:237, untouched by this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!