diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 15d46c6..ce36533 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,5 +20,16 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm typecheck
-      - run: pnpm test
+
+      # Coverage gate — fails if line/branch/function coverage regresses below the thresholds in
+      # vitest.config.ts (lines ≥90, branches ≥85). The committed seeded fuzz (fuzz.test.ts) runs here too.
+      - run: pnpm test:coverage
+
       - run: pnpm build
+
+      # Schema gate — the published JSON Schema must stay in sync with the Zod source (catches the
+      # class of bug where the runtime and the contract drift apart).
+      - name: JSON Schema is in sync with the Zod source
+        run: |
+          pnpm gen:schema
+          git diff --exit-code packages/core/schema
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
new file mode 100644
index 0000000..bc3d017
--- /dev/null
+++ b/.github/workflows/mutation.yml
@@ -0,0 +1,30 @@
+name: Mutation
+
+# Mutation testing is slow, so it runs weekly (and on demand) rather than on every PR.
+# It proves the TESTS are strong — a high pass rate with a low mutation score means the suite is
+# decorative. Scoped to the most security-critical module (the contract validator); expand `mutate`
+# in stryker.config.json to cover more modules as the budget allows.
+on:
+  schedule:
+    - cron: "0 4 * * 1" # Mondays 04:00 UTC
+  workflow_dispatch:
+
+jobs:
+  mutation:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      # Fails the job if the mutation score drops below `thresholds.break` (80) in stryker.config.json.
+      - run: pnpm exec stryker run
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: mutation-report
+          path: qa/mutation-report.json
diff --git a/.gitignore b/.gitignore
index 1bfd5e3..f483e59 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,9 @@ coverage/
 # VitePress
 docs/.vitepress/dist/
 docs/.vitepress/cache/
+
+# QA tooling artifacts (regenerated)
+coverage/
+.stryker-tmp/
+qa/.stryker-tmp/
+qa/mutation-report.json
diff --git a/QA_LOG.md b/QA_LOG.md
index 5f4c1dc..b6f0e22 100644
--- a/QA_LOG.md
+++ b/QA_LOG.md
@@ -327,3 +327,1444 @@ weren't load/chaos tested (not applicable to a local CLI — see gaps).
   `findhang.mts`, `verify4.mts`, `verify5.mts`, `fuzz2.mts`, `mockcrash.mts`, `webattack.mts`,
   `confirm.mts`, `confirm-final.mts`.
 - This log: `QA_LOG.md`.
+
+---
+---
+
+# CAMPAIGN 2 — fresh adversarial pass (branch `qa/adversarial-cycle-2`)
+
+The Campaign-1 stop condition was met and merged to `main`. Restarting the loop from scratch:
+"it works" is a hypothesis to falsify. Baseline re-verified: `pnpm test` **218 passed** (25 files).
+Strategy: aim at the surfaces Campaign 1 probed *least* — the **runner** (URL building, auth,
+assertion regexes), **workspace** (folder/env/secret resolution), **drift/coverage** math, and the
+**Postman/Bruno importers** — rather than re-grinding the response validator it already hardened.
+
+## Cycle 1 — runner / resolve / importer attack pass
+
+### Plan
+- `resolveRequest`: URL building edges (fragments, pre-existing query, apikey-in-query), CRLF in
+  header values, body encodings.
+- Postman importer: 5k random hostile-JSON iterations — must never throw past its documented guard,
+  and every emitted file must round-trip through `parse.*`.
+- `generateExample` (mock) on self-referential `$ref` — must terminate.
+
+### Findings
+
+- [BUG-A] runner/URL building — query params silently swallowed by a URL `#fragment` | severity **medium**
+  - Repro (empirical, `_qa_scratch.test.ts`): `resolveRequest({ url: "{{baseUrl}}/search#section",
+    query: { q: "hello" } })` → `http://example.com/search#section?q=hello`. `new URL(...)` then parses
+    `search=""` and `hash="#section?q=hello"` → **`searchParams.get("q") === null`**: the declared query
+    param never reaches the server. Same class with a pre-existing query: `http://h/p?a=1#f` + `{b:2}` →
+    `...?a=1#f&b=2` (b lost). And an `apikey in: query` auth param is silently dropped the same way →
+    a request goes out **unauthenticated with no error or warning**.
+  - Evidence: `[A1] does the server receive q? -> null`; `[A2] b= null`.
+  - Root cause: `resolveRequest` did `url += (url.includes("?") ? "&" : "?") + qs`, appending the query
+    string to the very end of the URL without accounting for an existing `#fragment`. Fragments are
+    legal in a TruSpec `url` (the schema accepts any string), so query params get pushed into the hash.
+  - Fix: `packages/core/src/runner/resolve.ts` — split the URL on the first `#`, insert the query
+    string before the fragment, then re-append the fragment: `head + (head.includes("?")?"&":"?") + qs + frag`.
+    Verified: `http://x/search#section` + `q=hello` → `http://x/search?q=hello#section` (param now in `search`).
+  - Regression test: `packages/core/test/runner.test.ts` → 3 cases ("inserts query params before a URL
+    fragment", "appends to an existing query string before the fragment", "places an apikey-in-query
+    before a URL fragment").
+  - Suite after fix: **PASS — 221 tests (was 218, +3), 0 regressions.**
+
+### Attacks that held (Cycle 1)
+- Postman importer (`importPostman`): 5000 random hostile-JSON collections (nested items, `__proto__`
+  keys, unicode, control chars, oversized names) — **0 unparseable emitted files**; throws only its
+  documented "Not a Postman v2.1 collection" guard on non-array `item`. Round-trip integrity holds.
+- `generateExample` on a self-referential `$ref` schema (`Node.next -> Node`, `Node.kids[] -> Node`)
+  terminates in **1ms** — the `depth > 6` cap bounds it (no infinite recursion; mock generation is safe).
+
+### Cycle outcome
+- Broke? **yes** (BUG-A medium) → fixed at root + 3 regression tests → full suite green (221).
+  Restart at Cycle 2 with surfaces not yet probed this campaign.
+
+---
+
+## Cycle 2 — importer fuzz, mock regex, header injection, folder merge
+
+### Plan
+- Bruno importer: 6k random hostile-`.bru` iterations — never throw, every emitted request round-trips.
+- Mock `pathToRegex`: adjacent-param paths (ReDoS?); CRLF in header values via the real fetch path;
+  workspace folder-merge precedence + prototype pollution.
+
+### Findings
+
+- [BUG-B] mock/`pathToRegex` — catastrophic ReDoS on adjacent path params | severity **medium-high**
+  - Repro (`_qa_scratch.test.ts` B2): a legal OpenAPI path with adjacent params (no literal separator)
+    compiled to `([^/]+)([^/]+)…`. Matching a long non-matching request path:
+    `/x/{a}{b}{c}{d}` → **17ms**, `/x/{a}{b}{c}{d}{e}{f}` → **1886ms** — a clean O(n^k) curve; 7–8
+    adjacent params + a longer path hangs for minutes.
+  - Evidence: `[B2] path=/x/{a}{b}{c}{d}{e}{f} … test_ms=1886`.
+  - Root cause: `pathToRegex` emitted a separate `([^/]+)` per `{param}`; two+ adjacent unbounded greedy
+    groups over the same class with no separator between them backtrack catastrophically when the `/?$`
+    anchor fails. The mock matches **incoming request paths** (attacker-controlled) on the single Node
+    event loop, so one crafted request stalls the whole server — a DoS. Adjacent params are legal
+    OpenAPI (`/v{major}.{minor}.{patch}`, composite ids).
+  - Fix: `packages/core/src/mock/engine.ts` — emit non-capturing `[^/]+` (the regex is only ever used
+    for `.test()`, never `.exec()`) and **collapse a run of adjacent params into a single** `[^/]+`
+    (adjacent params can't be uniquely split anyway). No two unbounded quantifiers ever sit adjacent →
+    matching is linear. Post-fix the same paths compile to `^/x/[^/]+/?$` and match in **0–1ms**.
+  - Regression test: `packages/core/test/mock.test.ts` → "mock adjacent-param path matching (ReDoS
+    regression)": 8 adjacent params vs a 5000-char hostile path completes <100ms and returns undefined;
+    a legit `/file/abcdefgh` still matches.
+  - Suite after fix: **PASS — 223 tests (was 221, +2), typecheck 7/7, 0 regressions.**
+
+### Attacks that held (Cycle 2)
+- Bruno importer (`bruToRequest`): 6000 random hostile-`.bru` iterations — **0 throws, 0 round-trip
+  failures**. `__proto__`/`constructor` header keys land as own properties (Object.fromEntries define
+  semantics) — `Object.prototype` not polluted.
+- CRLF / control chars in a header value reach undici's `Headers.append`, which throws; `runRequest`'s
+  try/catch turns it into a clean `ok:false` result — **no crash, no unhandledRejection**.
+- `mergeFolderConfigs`: precedence correct (leaf wins, root keys preserved); `__proto__` in folder
+  headers stored as own property via spread — no prototype pollution.
+
+### Cycle outcome
+- Broke? **yes** (BUG-B medium-high) → fixed at root + 2 regression tests → full suite green (223).
+  Restart at Cycle 3.
+
+---
+
+## Cycle 3 — response contract validator (untrusted-response correctness)
+
+### Plan
+- Hunt false-negatives in `validateAgainstSchema` (the flagship `contract` / `run --spec` engine that
+  validates **untrusted API responses**): integer-vs-float, enum, required, and — the lead —
+  composition keywords (`allOf`/`anyOf`/`oneOf`) as siblings of `type`/`properties`/`required`.
+
+### Findings
+
+- [BUG-C] spec/validate-response — composition keywords treated as mutually exclusive → silent
+  false-negatives | severity **medium**
+  - Repro (`_qa_scratch.test.ts` C1–C3, all returned `[]` = "conforms"):
+    - C1 `allOf` sibling of `required:[id]`/`properties` + value `{name:"x"}` (missing `id`).
+    - C2 `anyOf` sibling of `properties:{a:string}` + value `{a:123}` (a is a number).
+    - C3 `allOf:[{$ref: Base}]` + own `required:[id]` (**the most common OpenAPI composition shape**) +
+      value missing `id`.
+    All three **passed a non-conforming response** — the contract check the tool exists to provide was
+    silently skipped.
+  - Root cause: in `validateInto`, the `allOf`/`anyOf`/`oneOf` blocks each ended with `return`, so any
+    sibling `type`/`properties`/`required`/`items` constraints were never evaluated. JSON Schema
+    keywords are **conjunctive** — every keyword present in a schema object is an independent constraint
+    the value must satisfy simultaneously.
+  - Fix: `packages/core/src/spec/validate-response.ts` — drop the early `return` from `allOf`/`anyOf`/
+    `oneOf` so their violations accumulate and control falls through to the sibling type-dispatch.
+    (`$ref`/`null`/`enum`/array-`type` keep their returns: array-`type` already folds siblings in via
+    its `{...schema, type:t}` spread, and C1–C3 are fixed through the `allOf`/`anyOf` change. Verified
+    no false positives: a fully-conforming value still returns `[]`, and pure-`allOf` schemas with no
+    siblings are unchanged — C5 control.)
+  - Regression tests: `packages/core/test/validate-response.test.ts` → "composition keywords are
+    conjunctive with sibling constraints" (4 cases: sibling required+allOf, required+allOf:[{$ref}]
+    incl. a conforming + a $ref-violating case, properties+anyOf, type+oneOf).
+  - Suite after fix: **PASS — 227 tests (was 223, +4), typecheck 7/7, 0 regressions.**
+
+### Attacks that held (Cycle 3)
+- `integer` vs a float, `enum` membership, `required`, `additionalProperties:false` all flag correctly;
+  the existing 29 validator tests still pass unchanged (the conjunction fix added strictness without
+  introducing false positives).
+
+### Cycle outcome
+- Broke? **yes** (BUG-C medium) → fixed at root + 4 regression tests → full suite green (227).
+  Restart at Cycle 4.
+
+---
+
+## Cycle 4 — broad property fuzz (5 seeds) — CLEAN
+
+### Plan
+- ~62k randomized iterations over the engines touched this campaign, guarding all three fix classes:
+  D1 resolve (query-survives-fragment, BUG-A), D2 validator (conjunctive + recursive `$ref`/cycle
+  termination, BUG-C), D3 mock `pathToRegex` (adjacent-param ReDoS, BUG-B), D4 jsonpath/interpolate.
+
+### Findings
+- **No new failures.** D1 crashes=0 **lostParams=0**; D2 crashes=0 slowest=**4ms**; D3 slowest=**2ms**
+  on a 3000-char hostile path vs messy adjacent-param templates; D4 crashes=0.
+
+### Cycle outcome
+- Broke? **no** → proceed to a confirmation cycle with fresh seeds + an end-to-end integration attack.
+
+---
+
+## Confirmation cycle — fresh seeds + CLI integration
+
+### Plan
+- E0 `run` exit code on an empty target; E5 end-to-end capture-chain + secret redaction through the
+  real `runCommand` against temp collection files.
+
+### Findings
+
+- [BUG-D] CLI/`run` — exits 0 when zero requests are found → silent green CI gate | severity **low-medium**
+  - Repro (`_qa_scratch.test.ts` E0): `runCommand([emptyDir])` → **exit 0** with only a warning.
+  - Evidence: `[E0] exit code for empty dir = 0`.
+  - Root cause: `return result.ok ? 0 : 1`, and `result.ok = results.every(r => r.ok)` — `[].every()`
+    is `true`. A misconfigured path / uncommitted files / bad glob (zero requests) therefore passes the
+    gate. `run` is documented as a CI gate ("non-zero exit on failure"); a green build when nothing ran
+    is the worst false-positive for a gate. (jest/pytest/go test all fail on "no tests found".)
+  - Fix: `packages/cli/src/commands/run.ts` — treat zero requests as a failure: emit an **Error** (was
+    Warning) and `return result.ok && !noRequests ? 0 : 1`. **Behavior change** (flagged for the
+    maintainer): an empty run now exits 1. Scoped to `run` only — `contract` is documented as
+    conformance-only (it delegates "untested" gating to `coverage`/`drift`), and `coverage`/`drift`
+    already fail loudly on an empty collection (0% / all-added), so they need no change.
+  - Regression test: `packages/cli/test/run.test.ts` → updated the prior "warns and exits 0 when no
+    requests are found" (which asserted the buggy behavior) to "exits 1 (fails the CI gate) when no
+    requests are found". This corrects a test that encoded the defect — a *strengthening*, not a
+    weakened assertion.
+  - Suite after fix: **PASS — 227 tests, typecheck 7/7, 0 regressions.**
+
+### Attacks that held (confirmation)
+- E5 end-to-end: capture-chaining propagated `Authorization: Bearer chaintoken999` to the second
+  request, and secret redaction masked the declared `apiKey` in the `--json` output (no raw secret
+  leaked, `***` present). The full pipeline (env/secret resolution → folder inheritance → chaining →
+  redaction → reporters) is correct.
+- **Real-world smoke (built binary + mock):** the README's documented blog flow produced exactly the
+  advertised results with all fixes applied — `run` **3 passed/0 failed**, `drift` flags
+  `GET /users/{id}`, `coverage` **75% (3/4)**. No false positives from the stricter validator on real
+  specs (the shipped example specs use no composition keywords).
+
+### Cycle outcome
+- Broke? **yes** (BUG-D low-medium, found during confirmation) → fixed + test corrected → suite green
+  (227). A break during confirmation resets the loop → restart at Cycle 5.
+
+---
+
+## Cycle 5 — fresh-seed fuzz + untrusted `.tspec.yaml` parse robustness — CLEAN
+
+### Plan
+- 5 fresh seeds (distinct from Cycle 4). F1 `parse.request` on ~30k random YAML/structured inputs
+  (incl. `__proto__`, infinite-loop scripts, malformed YAML, control chars) — process must survive;
+  F2 resolve query-survives-fragment; F3 validator/mock termination & ReDoS guards.
+
+### Findings
+- **No new failures.** F1 process survived all ~30k inputs (no crash/hang; parseable inputs round-trip);
+  F2 crashes=0 lostParams=0; F3 validator crashes=0 slowest=**3ms**, mock regex slowest=**2ms**.
+
+### Cycle outcome
+- Broke? **no** → proceed to a final confirmation cycle with a 6th seed set + harder shapes.
+
+---
+
+## FINAL confirmation cycle — 6th seed set, harder shapes
+
+### Plan
+- G1 validator over a web of mutually-recursive schemas (every composition keyword + siblings +
+  `additionalProperties:false`) × deep/cyclic values; G2 combined resolve + mock + **importers**
+  (Postman + Bruno) round-trip under fresh seeds.
+
+### Findings
+
+- [BUG-E] importers/postman — `importPostman` crashes on a Postman item with an empty `name` | severity **medium**
+  - How found: G2's combined importer round-trip reported **2215 failures** across ~9k iterations (G1 and
+    the resolve/mock guards were all clean). Isolated to the Postman path with `name: ""`.
+  - Repro: `importPostman({ item: [{ name: "", request: { method: "GET", url: "http://x" } }] })` →
+    **throws** an uncaught Zod error and aborts the entire import. (`name: "***"` is fine — non-empty
+    passes `min(1)`, and `slug` falls back to `request` for the filename.)
+  - Root cause: `convertRequest` set `name = String(item.name ?? "Request")`; the `?? "Request"` fallback
+    only fires for null/undefined, NOT for an empty string. The request schema requires `name.min(1)`
+    (`schema.ts:118`), so serializing a `name: ""` request throws out of `importPostman` — and Postman
+    exports legitimately contain empty request names, so `truspec import postman` crashes on real files.
+  - Fix: `packages/core/src/importers/postman.ts` — `String(item.name ?? "Request") || "Request"` (the
+    `|| "Request"` catches the empty-string result of any coercion: `""`, empty array, etc.). Applied the
+    same guard to the imported folder-config name (`|| "Imported"`) for consistency. (Bruno was already
+    safe: its name default uses a truthy guard, confirmed by the fuzz.)
+  - Regression test: `packages/core/test/importers-variants.test.ts` → "an empty request name imports
+    with a default instead of crashing the whole import".
+  - Suite after fix: **PASS — 228 tests (was 227, +1), typecheck 7/7, 0 regressions.**
+
+### Attacks that held (final confirmation)
+- G1 validator: 30k iterations over mutually-recursive `A`/`B` schemas (allOf+$ref+required siblings,
+  oneOf/anyOf cycles, `additionalProperties:false`) × deep/cyclic values — **crashes=0, slowest 12ms**.
+  The conjunction fix (BUG-C) introduced no hang or false behavior under adversarial recursion.
+- G2 resolve/mock: crashes=0, lostParams=0, mock regex slowest 2ms on a 5000-char hostile path.
+
+### Cycle outcome
+- Broke? **yes** (BUG-E medium, found in final confirmation) → fixed at root + regression test → suite
+  green (228). A break during confirmation resets the loop → restart at Cycle 6.
+
+---
+
+## Cycle 6 — importer hard fuzz + broad sweep (7th seeds) — CLEAN
+
+### Plan
+- Hammer the importers (where BUG-E lived) with adversarial names (empty/whitespace/symbol/non-string
+  types: number, null, false, `[]`, `{}`, `__proto__`), nested folders, hostile urls/bodies/auth, plus
+  a broad resolve/validator/mock sweep.
+
+### Findings
+- **No new failures.** H1 importPostman ~10k iters: **THROWS=0, UNPARSEABLE=0** (BUG-E fix robust to all
+  name types/structures). H2 bruToRequest ~15k: THROWS=0, round-trip=0. H3 sweep: resolve lostParams=0,
+  validator crashes=0 slowest=12ms, mock regex slowest=17ms (bounded; a JIT/GC blip, re-measured below).
+
+### Cycle outcome
+- Broke? **no** → final confirmation cycle with an 8th seed set + an explicit ReDoS-linearity proof.
+
+---
+
+## FINAL confirmation #2 — 8th seeds + linearity proof — CLEAN
+
+### Plan
+- I1: prove the mock regex scales LINEARLY (10 adjacent params, 50×`test()` batches at path lengths
+  1k→16k). I2: 8th-seed importer + validator + resolve sweep.
+
+### Findings
+- **No new failures.** I1: regex `^/x/[^/]+/?$`; 50×-batch timings `(1k,0ms)(2k,1ms)(4k,0ms)(8k,2ms)
+  (16k,3ms)` — linear in length, O(n^k) gone for good. I2: postman parseFail=0, bruno parseFail=0,
+  resolve lostParams=0, validator crashes=0 slowest=2ms.
+
+### Cycle outcome
+- Broke? **no.** Cycle 6 AND this confirmation both produced **zero new failures** across two distinct
+  fresh seed sets → **STOP condition met.**
+
+---
+
+# CAMPAIGN 2 — FINAL SUMMARY
+
+**Verdict.** Restarted the adversarial loop on the already-hardened (Campaign-1) engine and still found
+**5 real, root-caused bugs**, each fixed with a regression test, plus a documented behavior change. They
+cluster in the surfaces Campaign 1 probed least: request building, the mock matcher, the contract
+validator's *correctness* (vs. its already-hardened *termination*), the CLI gate, and the Postman
+importer. Final state: `pnpm test` **228 passed** (25 files; +10 over this campaign's 218 baseline, +22
+over the project's original 206), `pnpm typecheck`/build **7/7**, and the README's documented blog flow
+runs exactly as advertised in the built binary (`run` 3/3, `drift` flags `GET /users/{id}`, `coverage`
+75%). Confidence: **high** for the core engine and CLI; the web/MCP network surfaces were hardened in
+Campaign 1 and were not re-attacked here (noted as a gap).
+
+**Cycles:** 6 attack cycles + 2 confirmation cycles (one per "clean" run, each interrupted by a tail bug
+until the last). Bugs by area/severity:
+- Request building (silent data loss) — **1, medium**: BUG-A (query params swallowed by a URL `#fragment`;
+  also drops an `apikey in: query` auth param → request sent unauthenticated).
+- Mock matcher (DoS) — **1, medium-high**: BUG-B (`pathToRegex` adjacent params → O(n^k) ReDoS on
+  attacker-controlled request paths; 6 params + 64 chars already 1.9s).
+- Contract validator (false-negative) — **1, medium**: BUG-C (composition keywords treated as mutually
+  exclusive, not conjunctive → sibling `required`/`properties`/`type` skipped; the common
+  `allOf:[{$ref}]`+own-`required` shape passed any response).
+- CLI gate (silent pass) — **1, low-medium**: BUG-D (`run` exits 0 when zero requests found).
+- Importer robustness (crash) — **1, medium**: BUG-E (`importPostman` throws on an empty request name).
+
+**Top fixes (root causes).**
+1. **Query lost to the fragment** (BUG-A) — appended the query string to the end of the URL, after any
+   `#fragment`; now inserted before the fragment. `runner/resolve.ts`.
+2. **Mock ReDoS** (BUG-B) — emitted a separate greedy `([^/]+)` per param; adjacent ones backtracked
+   catastrophically. Now non-capturing and adjacent params collapse to one `[^/]+` → linear. `mock/engine.ts`.
+3. **Validator false-negative** (BUG-C) — `allOf`/`anyOf`/`oneOf` short-circuited with `return`; removed
+   so they accumulate and fall through to the conjunctive sibling type-dispatch. `spec/validate-response.ts`.
+4. **Silent green gate** (BUG-D) — `[].every()` is `true`; `run` now treats zero requests as exit 1.
+   `cli/commands/run.ts`. *(Behavior change — flagged for maintainer review.)*
+5. **Importer crash on empty name** (BUG-E) — `?? "Request"` missed `""`; now `… || "Request"`. `importers/postman.ts`.
+
+**Coverage table.**
+| Category | Status | Strongest attack survived |
+|---|---|---|
+| Functional / spec-sync engine | Tested | full unit suite (228) + README blog flow in built binary |
+| Input / fuzzing | Tested | ~250k randomized iterations across 8 seed sets (validator/resolve/mock/jsonpath/interpolate/parse) |
+| Parser robustness (untrusted bytes) | Tested | ~35k Postman + ~30k Bruno + ~30k `.tspec.yaml` adversarial inputs — 0 crashes, 0 unparseable emits |
+| Algorithmic-complexity DoS | Tested | mock `pathToRegex` proven linear to 16k-char paths; validator linear under recursive `$ref` |
+| Contract correctness (false neg/pos) | Tested | conjunctive composition now enforced; no false positives on real specs |
+| Request building correctness | Tested | fragment/query/apikey survival proven over 60k+ resolve iterations |
+| CLI gate semantics / exit codes | Tested | empty/missing-env/bad-arg/failure exit codes all asserted |
+| End-to-end integration | Tested | capture-chaining + secret redaction through the real `runCommand` |
+| Concurrency / races | Not tested | engine is single-shot per request; capture-chaining is sequential by design |
+| Load / stress / soak / chaos | Not applicable | local-first CLI/library, not a hosted service |
+| Web `serve` / MCP network surfaces | Not re-tested | hardened in Campaign 1 (path traversal, DNS-rebinding, write confinement); out of scope this pass |
+
+**Residual risk & gaps.**
+- **BUG-D is a behavior change** (empty `run` now fails). Intentional and conventional (jest/pytest/go),
+  but a maintainer who relied on empty-passes-green should review. Scoped to `run`; `contract` left as-is
+  (documented conformance-only).
+- The Campaign-1 residuals still stand: `additionalProperties`-as-schema unenforced; `< 6 char` secrets
+  unmasked; `MAX_DEPTH=100` schema-recursion cutoff; chunked-body request detection in the mock.
+- Web `serve` and the MCP server were **not** re-attacked this campaign (relied on Campaign 1). A future
+  pass should fuzz the web save endpoint's body-size handling and the MCP tool error paths.
+- Concurrency/load/chaos remain out of scope for a local-first CLI.
+
+**Hardening recommendations.**
+- Keep all new regression tests in CI (they encode: query-survives-fragment, mock-regex-linearity,
+  validator-conjunction, empty-run-fails, importer-empty-name).
+- Port the seeded property-fuzzes (resolve/validator/mock/importers) into a bounded, fixed-seed CI job —
+  they found BUG-E in a single combined pass after targeted unit probes missed it.
+- Consider enforcing `additionalProperties`-as-schema and OpenAPI `2XX` status wildcards to close the
+  remaining contract false-negatives.
+
+**Artifacts.**
+- Fixes: `packages/core/src/runner/resolve.ts` (A), `packages/core/src/mock/engine.ts` (B),
+  `packages/core/src/spec/validate-response.ts` (C), `packages/cli/src/commands/run.ts` (D),
+  `packages/core/src/importers/postman.ts` (E).
+- Regression tests: `packages/core/test/runner.test.ts` (+3), `mock.test.ts` (+2),
+  `validate-response.test.ts` (+4), `importers-variants.test.ts` (+1),
+  `packages/cli/test/run.test.ts` (corrected 1).
+- Repro/fuzz harnesses were scratch vitest files under `packages/*/test/_qa_scratch.test.ts`
+  (8 seed sets, ~250k iterations); removed after each cycle — their invariants live on in the
+  regression tests above.
+- This log: `QA_LOG.md`.
+
+---
+---
+
+# CAMPAIGN 3 — third adversarial pass (branch `qa/adversarial-cycle-2`)
+
+Re-entered the loop ("be skeptical of your own done"). Campaign 2 flagged honest gaps — the web `serve`
+server, MCP tools, `scaffold`, the `--live` probe, and schema edge cases were NOT re-attacked. Campaign 3
+aims there. Baseline re-verified: `pnpm test` **228 passed**.
+
+## Cycle 1 — code-gen surfaces (scaffold / gen / MCP scaffold)
+
+### Plan
+- `scaffoldFromSpec`: hostile specs, colliding operationId/key slugs, filename safety.
+- `confinePath` (web + MCP write confinement): symlink escape. `live.ts` SSRF surface.
+
+### Findings
+
+- [BUG-F] spec/scaffold — colliding filenames silently overwrite operations | severity **medium**
+  - Repro (`_qa_repro.test.ts`): a 4-operation spec with case-variant operationIds (`getUser`/`GetUser`)
+    and separator-variant paths (`/a-b` vs `/a/b`) → `scaffoldFromSpec` returns 4 file entries but only
+    **2 distinct paths** (`getuser.tspec.yaml` ×2, `post-a-b.tspec.yaml` ×2).
+  - Evidence: `[SCAFFOLD] files generated: 4 … COLLIDING filenames: ["getuser.tspec.yaml","post-a-b.tspec.yaml"]`.
+  - Root cause: `scaffoldFromSpec` built `${slug(id)}.tspec.yaml` with no uniqueness tracking; distinct
+    operations slug to the same base. `writeScaffold` then writes by name, so the second file overwrites
+    the first on disk — silently dropping operations from a per-operation scaffold and making downstream
+    `coverage`/`drift` wrong. Reachable via `truspec gen` and `truspec_scaffold_from_spec` (MCP).
+    (The Postman importer already dedupes; scaffold didn't.)
+  - Fix: `packages/core/src/spec/scaffold.ts` — track a `used` count per base slug and suffix `-2`/`-3`/…
+    on collision, mirroring the importer.
+  - Regression test: `packages/core/test/scaffold.test.ts` → "gives colliding slugs unique filenames so
+    no operation is silently overwritten" (+ a baseline one-stub-per-op test).
+  - Suite after fix: **PASS — 230 tests (was 228, +2), typecheck 7/7, 0 regressions.**
+
+### Attacks that held (Cycle 1)
+- `confinePath` follows symlinks via `realpathSync` (checks the deepest existing ancestor for not-yet-
+  existing write paths) — a link inside the workspace can't point outside. Web write + MCP write confined.
+- `live.ts` probe sends only GET/HEAD to the operator-supplied `--live` base (no mutation/injection).
+- MCP read/run tools (`runCollectionTool`/`driftTool`/…) use bare `resolve()` (not confined) — a
+  **defensible design choice** (an agent legitimately works across a user's projects; confining would
+  break cross-dir use), unlike the web server which serves a single `dir`. Noted, not "fixed".
+
+### Cycle outcome
+- Broke? **yes** (BUG-F medium) → fixed at root + 2 regression tests → suite green (230). Restart Cycle 2.
+
+## Cycle 2 — format schema strictness / contract conformance
+
+### Plan
+- Probe nested schema strictness (Body/Auth/Assertion/SpecLink) vs CLAUDE.md's "unknown keys are
+  rejected" rule; numeric edges (`order` = NaN/±Inf; assertion numeric fields).
+
+### Findings
+
+- [BUG-G] format/schema — nested objects silently strip unknown keys (typos don't surface) | severity **low-medium**
+  - Repro (`_qa_repro.test.ts`):
+    - P1 `spec: { operatonId: getPet }` → parses to an empty `{}` spec link (typo stripped). `{}` is
+      truthy, so the request is treated as spec-linked-to-nothing → `drift` mis-reports it as **stale**
+      and `coverage` counts it uncovered — a silent mislink in the flagship spec-sync feature.
+    - P2 `{ type: jsonpath, path: "$.id", exits: true }` → strips `exits`, leaving a condition-less
+      assertion that silently **always fails**.
+    - P5 control: top-level typos ARE rejected — confirming the inconsistency (top strict, nested not).
+  - Root cause: `RequestSchema`/`FolderConfigSchema`/`EnvironmentSchema` are `.strict()`, but the nested
+    `Body`/`Auth`/`Assertion`/`SpecLink` discriminated-union objects were not — so optional-key typos
+    were silently stripped instead of rejected, contradicting CLAUDE.md's hard rule. Notably the PUBLISHED
+    JSON Schema already declared `additionalProperties:false` on these objects (an editor/agent would
+    flag the typo), so the Zod runtime was **out of sync with its own published contract**.
+  - Fix: `packages/core/src/format/schema.ts` — add `.strict()` to every nested Body/Auth/Assertion
+    member and to `SpecLink`. Regenerated the JSON Schema (`pnpm gen:schema`) → **no diff** (the published
+    schema was already strict; this fix makes the runtime match it). (P3: required-field typos were
+    already caught. P4: `order` rejects `.nan`; accepts `±.inf` which sorts deterministically — no fix.)
+  - Regression test: `packages/core/test/format.test.ts` → "rejects unknown keys in NESTED objects too
+    (assertion/spec/auth/body typos surface)".
+  - Suite after fix: **PASS — 231 tests (was 230, +1), typecheck 7/7, JSON Schema unchanged, 0 regressions.**
+
+### Cycle outcome
+- Broke? **yes** (BUG-G low-medium) → fixed at root + regression test → suite green (231). Restart Cycle 3.
+
+## Cycle 3 — broad fresh-seed sweep (9th seeds) — CLEAN
+
+### Plan
+- J1 `scaffoldFromSpec` over ~6k random hostile specs (collision-freeness, every stub parses);
+  J2 strict-schema fuzz (~15k: nested typos rejected, valid requests still parse);
+  J3 regression sweep (validator/resolve/mock under fresh seeds).
+
+### Findings
+- **No new failures.** J1 filename collisions=0, parseFailures=0; J2 crashes=0, acceptedNestedTypo=0,
+  rejectedValid=0; J3 resolve lostParams=0, validator crashes=0 slowest=11ms, mock slowest=28ms (GC blip;
+  regex is the collapsed `[^/]+`, proven linear in Campaign 2).
+
+### Cycle outcome
+- Broke? **no** → final confirmation cycle with a 10th seed set + a scaffold count-invariant.
+
+## FINAL confirmation — 10th seeds + real-binary smoke — CLEAN
+
+### Plan
+- K1 scaffold count invariant (#files == #non-skipped ops, all distinct, all parse) over ~9k specs;
+  K2 combined strict-schema/validator/resolve/importer sweep; plus a built-binary `gen`/`run`/`coverage`
+  smoke (the strict-schema change must not break real example collections).
+
+### Findings
+- **No new failures.** K1 invariant violations=0; K2 typoAccepted=0, validRejected=0, validatorCrash=0
+  slowest=3ms, resolveLost=0, importerFail=0. Built binary: `gen` on petstore → **3 distinct files**;
+  blog `run` → **3 passed**; `coverage` → **75%**. No regression from the BUG-F/BUG-G fixes.
+
+### Cycle outcome
+- Broke? **no.** Cycle 3 AND this confirmation both produced **zero new failures** across two distinct
+  fresh seed sets → **STOP condition met.**
+
+---
+
+# CAMPAIGN 3 — FINAL SUMMARY
+
+**Verdict.** A third pass over the (twice-hardened) engine, aimed at Campaign 2's honest gaps (scaffold,
+schema strictness, web/MCP confinement, the `--live` probe). Found **2 more real bugs**, both root-caused
+and regression-tested. Final state: `pnpm test` **231 passed** (26 files; +3 this campaign over its 228
+baseline, +25 over the project's original 206), `typecheck`/build **7/7**, JSON Schema regenerated with
+**no diff** (the runtime now matches the already-strict published contract), and the README blog flow +
+`gen` run exactly as advertised in the built binary. Confidence: **high** for the core engine, CLI, and
+code-gen; the web/MCP HTTP/protocol layers were *reviewed* (confinement confirmed sound) but not load-
+fuzzed (noted).
+
+**Cycles:** 3 attack + 1 confirmation. Bugs by area/severity:
+- Code-gen (silent data loss) — **1, medium**: BUG-F (`scaffoldFromSpec` colliding filenames overwrite
+  operations on disk).
+- Schema contract conformance (silent typo-stripping) — **1, low-medium**: BUG-G (nested Body/Auth/
+  Assertion/SpecLink objects weren't `.strict()`, so optional-key typos were dropped instead of rejected —
+  diverging from the published JSON Schema and yielding mislinked specs / no-op assertions).
+
+**Top fixes (root causes).**
+1. **Scaffold collisions** (BUG-F) — `scaffoldFromSpec` wrote `${slug}.tspec.yaml` with no uniqueness
+   counter; distinct ops that slug alike overwrote each other. Now suffixes `-2`/`-3`/… like the importer.
+   `spec/scaffold.ts`.
+2. **Nested typo-stripping** (BUG-G) — `.strict()` added to every nested discriminated-union object and
+   `SpecLink`, so typos surface as parse errors per CLAUDE.md's rule and the runtime matches the published
+   JSON Schema. `format/schema.ts`.
+
+**Coverage table (this campaign; see Campaigns 1–2 for the rest).**
+| Category | Status | Strongest attack survived |
+|---|---|---|
+| Code-gen / scaffold | Tested | ~15k random hostile specs — 0 collisions, count invariant holds, every stub parses |
+| Schema / contract conformance | Tested | ~30k fuzz — all nested typos rejected, no valid request falsely rejected; JSON Schema in sync |
+| Path confinement (web + MCP write) | Reviewed | `confinePath` realpath-follows symlinks; deepest-ancestor check for writes |
+| `--live` SSRF surface | Reviewed | GET/HEAD only to the operator-supplied base; no injection |
+| Output formatters | Reviewed | JUnit escapes name/classname/message + strips C0; human/json over trusted data |
+| Web `serve` / MCP load-fuzz | Not tested | reviewed only; would need a running-server harness (carried gap) |
+
+**Residual risk & gaps.**
+- MCP read/run tools are intentionally **not** path-confined (agents work across projects); the web API
+  `POST /api/run` `env` name is likewise unconfined (loopback-only, local user) — both noted as design,
+  not fixed.
+- Web `serve` and MCP protocol layers were reviewed, not load/fuzz-tested (no server harness this pass).
+- All Campaign 1–2 residuals stand (`additionalProperties`-as-schema, `<6`-char secrets, `MAX_DEPTH=100`).
+- BUG-D's behavior change (empty `run` exits 1) still warrants maintainer review.
+
+**Hardening recommendations.**
+- Keep the new regression tests in CI (scaffold uniqueness, nested-key strictness).
+- Add a CI check that `pnpm gen:schema` produces no diff (catches future Zod-vs-published-schema drift —
+  exactly the class BUG-G fell into).
+- A future campaign should stand up a web/MCP server harness and fuzz the live HTTP/protocol surface.
+
+**Artifacts.**
+- Fixes: `packages/core/src/spec/scaffold.ts` (F), `packages/core/src/format/schema.ts` (G).
+- Regression tests: `packages/core/test/scaffold.test.ts` (+2), `packages/core/test/format.test.ts` (+1).
+- This log: `QA_LOG.md`.
+
+---
+---
+
+# CAMPAIGN 4 — live-server pass (branch `qa/adversarial-cycle-2`)
+
+Closed the gap every prior campaign deferred: **stood up the real running servers** (mock HTTP, web
+`serve`, MCP) and attacked them live, instead of only reviewing them. Baseline: `pnpm test` **231 passed**.
+
+## Cycle 1 — live mock HTTP server
+
+### Plan
+- Start the real `startMockServer` and fire: a route whose spec status is out of HTTP range; malformed
+  raw request targets; concurrent requests.
+
+### Findings
+
+- [BUG-H] mock server — uncaught exception / process crash on an out-of-range spec status | severity **med-high**
+  - Repro (`_qa_scratch.test.ts` L0/L1): a spec response keyed `"20000"` → `respond()` returns
+    `status: 20000`; a live `GET /bad` then **hangs the client** and throws an uncaught
+    `Invalid status code: 20000` on the server (`res.writeHead(20000)` — Node only allows 100–999).
+  - Evidence: `[L1] uncaughtException on server: Invalid status code: 20000`; the fetch times out.
+  - Root cause: (1) `pickResponse` did `Number(chosen)` for any `/^\d+$/` status with no range check;
+    (2) `mock/server.ts`'s handler — including its `setTimeout`-delayed `send` — had **no try/catch**
+    (unlike `web/server/index.ts`), so the throw was uncaught → in production the process dies.
+    Reachable via `truspec mock` and the `truspec_mock_start` MCP tool (agent/third-party specs).
+  - Fix: `packages/core/src/mock/engine.ts` — clamp the status to 100–999, else fall back to 200.
+    `packages/core/src/mock/server.ts` — wrap `new URL` and the (possibly delayed) `send` in try/catch,
+    replying 400/500 instead of throwing, so no single request can crash the long-running process.
+  - Regression test: `packages/core/test/mock.test.ts` → "mock server resilience (out-of-range status
+    code)" (unit: status clamped to 200; live: server responds 200 + stays alive + no uncaughtException).
+  - Suite after fix: **PASS — 233 tests (was 231, +2), typecheck 7/7, 0 regressions.**
+
+### Attacks that held (Cycle 1)
+- Malformed raw targets (`/%ZZ`, `/a%2`, `OPTIONS *`, `//evil.com/x`, backslashes) → `new URL` with a
+  base normalizes them; server stays alive (the crash vector was the status code, not URL parsing).
+
+### Cycle outcome
+- Broke? **yes** (BUG-H med-high) → fixed at root + handler hardening + 2 regression tests → green (233).
+  Restart Cycle 2.
+
+## Cycle 2 — live web `serve` server + MCP tools
+
+### Plan
+- Web: 40 concurrent same-path saves (corruption); hostile API (bad JSON, traversal path, oversized
+  body, wrong methods, env traversal); DNS-rebinding via raw sockets. MCP: hostile tool args.
+
+### Findings
+
+- [BUG-I] discovery — one malformed `.tspec.yaml` aborts the entire listing (undiagnosable) | severity **medium**
+  - Repro (`_qa_scratch.test.ts` M4): `listCollections` over a dir containing one garbage `.tspec.yaml`
+    **throws** `Nested mappings are not allowed…` — the whole listing fails and the error names no file.
+  - Root cause: `listCollections` (MCP `truspec_list_collections`) and `buildState` (web `/api/state`)
+    both `map(parse.request.parse(readFileSync(file)))` over all files with no per-file isolation. One
+    typo'd file → the agent/UI can't list ANY request to even find the broken one, and the error carries
+    no filename (an undiagnosable failure — itself a defect).
+  - Fix: `packages/mcp-server/src/tools.ts` + `packages/web/server/api.ts` — per-file try/catch; valid
+    requests still list, bad files become `errors: [{ path, error }]` entries (named, diagnosable).
+  - Regression test: `packages/mcp-server/test/tools.test.ts` → "a malformed file does not abort the
+    listing…"; `packages/web/test/api.test.ts` → "a malformed request file does not 500 /api/state…".
+  - Suite after fix: **PASS — 235 tests (was 233, +2), typecheck 7/7, 0 regressions.**
+
+### Attacks that held (Cycle 2)
+- **Web server, comprehensive:** 40 concurrent saves to the same path → final file valid & complete, no
+  corruption, no uncaught. Hostile API → traversal-path/folder-path/invalid-content/no-spec all return
+  clean confined errors; wrong methods → 404; oversized 6MB body → cap enforced (server stays alive).
+  **DNS-rebinding (raw sockets):** `Host: evil.com`/`8.8.8.8`/no-Host → **403**, loopback → 200.
+- **MCP write/scaffold tools:** createRequest/updateRequest with traversal paths → confined (no escape
+  to /etc or /tmp); invalid schema → clean `{ok:false}`; scaffold dedups colliding slugs (BUG-F holds).
+
+### Cycle outcome
+- Broke? **yes** (BUG-I medium) → fixed at root + 2 regression tests → green (235). Restart Cycle 3.
+
+## Cycle 3 — live mock fuzz + core regression sweep
+
+### Plan
+- Fuzz the live mock server with adversarial status codes / shapes; sweep validator/scaffold/parse.
+
+### Findings
+
+- [BUG-J] spec/scaffold — crash on an operation with an empty-string operationId | severity **medium**
+  - How found: the Cycle-3 sweep's `scaffoldFromSpec` call (not wrapped) threw on a generated spec.
+    Isolated repro: `operationId: ""`.
+  - Repro: `scaffoldFromSpec('… /x: { get: { operationId: "", responses: {…} } }')` → **throws** a Zod
+    `name.min(1)` error, crashing `truspec gen` / `truspec_scaffold_from_spec` on the whole spec.
+  - Root cause: `name: op.operationId ?? op.key` — `??` keeps an empty-string operationId, and an empty
+    request `name` fails the schema. Same anti-pattern as BUG-E (Postman empty name).
+  - Fix: `packages/core/src/spec/scaffold.ts` — `const label = op.operationId || op.key` for both the
+    name and the filename slug; omit an empty operationId from the spec link
+    (`operationId: op.operationId || undefined`). Audited the rest of the codebase for the same
+    `?? ""`-feeds-`min(1)` pattern — no other instances (other `??` fallbacks feed no-min fields:
+    auth, headers, display labels; the Bruno importer already uses a truthy guard).
+  - Regression test: `packages/core/test/scaffold.test.ts` → "does not crash on an operation with an
+    empty-string operationId (falls back to the key)".
+  - Suite after fix: **PASS — 236 tests (was 235, +1), typecheck 7/7, 0 regressions.**
+
+### Attacks that held (Cycle 3)
+- Live mock servers with adversarial statuses ("20000"/"99"/"0"/"1000"/"default") → every route returns
+  a writeHead-valid status, responds, and the server stays alive; no uncaughtException (BUG-H fix holds).
+- Validator/parse-strictness/scaffold-dedup all clean under fresh seeds.
+
+### Cycle outcome
+- Broke? **yes** (BUG-J medium) → fixed at root + regression test + codebase audit → green (236).
+  Restart Cycle 4.
+
+## Cycle 4 — broad confirmation (5th seed set) — found an INCOMPLETE fix
+
+### Plan
+- Re-sweep every Campaign-1..4 surface under fresh seeds: scaffold (incl. empty/symbol operationIds),
+  live mock servers with random statuses, importers, validator, strict-schema, resolve.
+
+### Findings
+
+- [BUG-K] mock server — a 1xx interim status served as the final response hangs clients (BUG-H fix was
+  INCOMPLETE) | severity **medium**
+  - How found: the live-mock sweep (O2/O2b) — refining the check to separate *fetch failures* from
+    benign >599 statuses showed exactly one code, `"100"`, produced **fetchFailures=1** with no
+    crash. `statusesSeen` was missing the 100 entry: the client hung until the 2s timeout.
+  - Repro: a spec with response `"100"` (or `"101"`/any 1xx) → the mock sends `res.writeHead(100)` as
+    the FINAL response; HTTP clients treat 1xx as interim and wait for the real response → `fetch` times
+    out. (`"600"` returned fine — the fault is specific to 1xx, not the >599 range.)
+  - Root cause: BUG-H's clamp used `[100, 999]` (Node's `writeHead` validity) — which still admits 1xx
+    *interim* codes. A mock sends one COMPLETE response, so the valid range is the FINAL-status range
+    `[200, 599]`; a 1xx is never a valid final response.
+  - Fix: `packages/core/src/mock/engine.ts` — clamp to `[200, 599]`, else fall back to 200. Fixes both
+    the writeHead crash (BUG-H) and the 1xx hang in one rule.
+  - Regression test: `packages/core/test/mock.test.ts` → resilience block extended to assert 1xx
+    (100/101/199) AND out-of-range (20000/99/0) all clamp to 200, a real 404 is preserved, and a live
+    server with "20000" or "100" responds 200 (no crash, no hang).
+  - Suite after fix: **PASS — 236 tests, typecheck 7/7, 0 regressions.**
+
+### Attacks that held (Cycle 4, after the BUG-K fix)
+- O1 scaffold (~7.5k specs, empty/symbol operationIds): THREW=0, collisions=0, parseFail=0.
+- O2b live mock (13 adversarial statuses): fetchFailures=0, writeHead-invalid=0, uncaught=none.
+- O3 importers/validator/resolve/strict-schema: importerFail=0, validatorCrash=0, resolveLost=0,
+  typoAccepted=0, validRejected=0.
+
+### Cycle outcome
+- Broke? **yes** (BUG-K medium, an incomplete BUG-H fix surfaced in confirmation) → fixed at root +
+  regression test → green (236). Restart Cycle 5.
+
+## Cycle 5 — fresh-seed full sweep (6th seeds) — CLEAN
+
+### Plan / Findings
+- P1 mock engine over 27 status classes → invalid-final-status=0. P2 live mock over 12 status classes
+  (1xx/6xx/20000/0/default) → fetchFailures=0, uncaught=none. P3 scaffold/importer/validator/resolve/
+  strict-schema (~10k) → all zero. **No new failures.**
+
+### Cycle outcome
+- Broke? **no** → final confirmation with a 7th seed set.
+
+## FINAL confirmation — 7th seeds + recursive-schema live mocks — CLEAN
+
+### Plan / Findings
+- Q1: 18 live mock servers under random {status × recursive/$ref schema}, draining each body →
+  failures=0, uncaught=none (recursive-schema examples stay finite; no crash/hang). Q2: combined
+  scaffold/importers/validator/resolve/strict sweep (~15k) → all zero. **No new failures.**
+
+### Cycle outcome
+- Broke? **no.** Cycle 5 AND this confirmation both produced **zero new failures** across two distinct
+  fresh seed sets → **STOP condition met.**
+
+---
+
+# CAMPAIGN 4 — FINAL SUMMARY
+
+**Verdict.** Closed the standing gap from Campaigns 1–3: **stood up the real running servers** (mock
+HTTP, web `serve`, MCP) and attacked them live instead of reviewing them. That immediately paid off —
+**4 more real bugs**, including a crash-the-process DoS and a client-hang, all root-caused and
+regression-tested. Final state: `pnpm test` **236 passed** (26 files; +5 this campaign over its 231
+baseline, +30 over the project's original 206), `typecheck`/build **7/7 / 5/5**, and the built binary
+serves a hostile-status spec without crashing. Confidence: **high** across the engine, CLI, code-gen,
+and now the live HTTP/MCP surfaces.
+
+**Cycles:** 5 attack + 1 confirmation (BUG-K surfaced as an incomplete fix during confirmation, resetting
+the loop). Bugs by area/severity:
+- Mock HTTP server (crash + hang DoS) — **2**: BUG-H *med-high* (out-of-range status → uncaught
+  `Invalid status code` → process crash) and BUG-K *med* (1xx interim status → client hang; BUG-H's
+  clamp was incomplete).
+- Discovery/observability — **1, med**: BUG-I (one malformed `.tspec.yaml` aborts the whole listing in
+  `truspec_list_collections` / web `/api/state`, with no filename in the error).
+- Code-gen robustness — **1, med**: BUG-J (`scaffoldFromSpec` crashes on an empty-string operationId —
+  a sibling of Campaign-2's BUG-E).
+
+**Top fixes (root causes).**
+1. **Mock status crash + hang** (BUG-H/K) — `pickResponse` emitted any `Number(code)`; clamped to the
+   valid FINAL range `[200,599]` (rejects out-of-range crashers AND 1xx interim hangers). Also wrapped
+   the mock handler + its delayed `send` in try/catch so no single request can crash the process.
+   `mock/engine.ts`, `mock/server.ts`.
+2. **Listing aborts on one bad file** (BUG-I) — per-file try/catch in `listCollections` + `buildState`;
+   valid requests still list, bad files become named `errors[]` entries. `mcp-server/tools.ts`, `web/api.ts`.
+3. **Scaffold empty-operationId crash** (BUG-J) — `op.operationId || op.key` (not `??`); empty link omitted.
+   `spec/scaffold.ts`.
+
+**Coverage table (this campaign).**
+| Category | Status | Strongest attack survived |
+|---|---|---|
+| Live mock HTTP server | Tested | ~30 live servers across every status class (1xx/2xx/3xx/4xx/5xx/6xx/20000/0/neg) + recursive schemas + raw malformed targets — no crash, no hang |
+| Live web `serve` server | Tested | 40 concurrent same-path saves (no corruption); traversal/oversized/wrong-method API; DNS-rebinding via raw sockets (403) |
+| MCP tools | Tested | traversal-confined writes; malformed-file listing resilience; invalid-schema clean errors |
+| Concurrency (same-file writes) | Tested | 40 parallel POSTs → final file valid & complete |
+| Observability / diagnosability | Tested | malformed file now surfaces with its path instead of an anonymous throw |
+| Code-gen robustness | Tested | empty/symbol/missing operationIds + colliding slugs over ~25k specs |
+| Load/soak (sustained high RPS, p99) | Not tested | no perf harness; would need k6/autocannon against a long-running instance |
+
+**Residual risk & gaps.**
+- **Oversized request body** to the web API returns a client connection-reset rather than a clean 413
+  (server cap works and stays alive; cosmetic — `req.destroy()` races the 413 flush). Noted, not fixed.
+- MCP read/run tools remain intentionally un-path-confined (cross-project agent use); web `/api/run`
+  `env` name is unconfined (loopback-only). Design, not fixed.
+- True **load/soak/p99** testing still not done (no perf harness) — the servers were correctness- and
+  crash-fuzzed, not throughput-measured.
+- All Campaign 1–3 residuals stand (`additionalProperties`-as-schema, `<6`-char secrets, BUG-D behavior
+  change).
+
+**Hardening recommendations.**
+- Keep the new live-server regression tests in CI (mock status resilience, listing resilience).
+- Add a scheduled load/soak job (autocannon) against `truspec serve` and `truspec mock` to catch leaks
+  and throughput regressions the correctness fuzz can't.
+- Consider a shared `safeHandler` wrapper for both HTTP servers so the try/catch posture can't drift
+  apart again (BUG-H existed because the mock handler lacked the web server's guard).
+
+**Artifacts.**
+- Fixes: `mock/engine.ts` + `mock/server.ts` (H, K), `mcp-server/src/tools.ts` + `web/server/api.ts` (I),
+  `spec/scaffold.ts` (J).
+- Regression tests: `core/test/mock.test.ts` (+ resilience block), `mcp-server/test/tools.test.ts` (+1),
+  `web/test/api.test.ts` (+1), `core/test/scaffold.test.ts` (+1).
+- This log: `QA_LOG.md`.
+
+---
+---
+
+# CAMPAIGN 5 — load/soak + runner HTTP-layer pass (branch `qa/adversarial-cycle-2`)
+
+Closed the last category Campaign 4 deferred — **load / soak / leak** — and attacked the runner's HTTP
+layer under adversarial *responses* (decompression bombs, slow-loris, resets). Baseline: **236 passed**.
+
+## Cycle 1 — load/soak/leak + runner response handling
+
+### Plan
+- Load/soak the live mock + web servers (30k / 10k requests), watch RSS + handles for leaks.
+- Runner vs hostile responses: gzip bomb, oversized body, slow-loris, mid-body reset, huge header.
+- Functional: can a request observe a 3xx redirect?
+
+### Findings
+
+- [BUG-L] runner — auto-follows redirects → 3xx responses untestable & silently mis-reported | severity **medium**
+  - Repro (`_qa_repro.test.ts`): a server returns `302 Location: /final`; `runRequest` reports
+    **status 200** (the followed target), no `location` header → `assertions: [{status equals 302},
+    {header location exists}]` both FAIL. A user "cannot test redirects", and `truspec contract`/
+    `run --spec` can never validate a 3xx operation the spec declares (the flagship feature is blind
+    to redirect responses).
+  - Root cause: Node `fetch` defaults to `redirect: "follow"`, so the runner observes the redirect
+    TARGET's response, not the response the requested URL actually returned.
+  - Fix: `packages/core/src/runner/run.ts` — set `redirect: "manual"` in the fetch init. Node returns
+    the real 3xx (status + `Location`), unlike a browser's opaque response (verified). Correct for a
+    contract tool (matches curl's default). **Behavior change** (flagged for maintainer review): a
+    collection that relied on auto-follow now sees the 3xx and its downstream assertions fail LOUDLY
+    (not silently wrong) — a future per-request `followRedirects` opt-in could restore following.
+  - Regression test: `packages/core/test/runner.test.ts` → "does not auto-follow redirects — a 3xx is
+    observable and assertable" (asserts the runner passes `redirect:"manual"` and reports/asserts 302).
+  - Suite after fix: **PASS — 237 tests (was 236, +1), typecheck 7/7, 0 regressions.**
+
+### Attacks that held (Cycle 1)
+- **Load/soak/leak — mock server:** 30k requests @ ~791 rps → heap stable (16→17-21MB, ~1MB growth, no
+  monotonic leak), server responsive, no uncaught. 6k concurrent *delayed* (5ms) requests → 0 failures,
+  no timer/handle leak. **Web server:** 10k `/api/state` + 200 concurrent same-path saves → no
+  corruption, no crash, no leak; all failures under 64-concurrency were graceful client timeouts (0
+  resets/errors).
+- **Runner vs hostile responses:** an 80MB gzip **decompression bomb** is capped on the DECOMPRESSED
+  stream (heap stayed 13MB — no OOM); oversized uncompressed body capped; **slow-loris body aborted at
+  the timeout** (no unhandledRejection); mid-body connection reset → clean error; 200KB header → undici
+  rejects cleanly. All return `ok:false` with a clean message; nothing crashes or hangs.
+
+### Non-bug finding (documented, not fixed — honest call)
+- **`/api/state` is O(collection-size) synchronous, event-loop-blocking work per request** (no cache):
+  10 files→2ms, 500→205ms, 2000→468ms. Under 64-concurrency ~10% of requests hit the 5s client timeout
+  (graceful — no crash/corruption/leak/reset). Realistic single-user use (≤100 files) is fine. The fix
+  (cache parsed state + invalidate on write, and/or async fs) carries cache-staleness risk, so per
+  "real fixes only / don't make it worse" it's recorded as a hardening recommendation, not forced.
+
+### Cycle outcome
+- Broke? **yes** (BUG-L medium) → fixed at root + regression test → green (237). Restart Cycle 2.
+
+## Cycle 2 — broad confirmation (fresh seeds) — CLEAN
+
+### Plan / Findings
+- S1 runner observes every 3xx (301/302/303/307/308 → observed, not 200) — BUG-L holds. S2/S2b mock
+  server 8k+24k requests with FORCED GC → heap stable 17MB (growth −1MB) = **no leak** (the un-GC'd
+  100MB was just garbage). S3 broad core fuzz (validator/scaffold/importer/resolve/strict, ~12.5k) →
+  all zero. **No new failures.**
+
+### Cycle outcome
+- Broke? **no** → final confirmation with fresh seeds.
+
+## FINAL confirmation — fresh seeds + runner HTTP re-attack — CLEAN
+
+### Plan / Findings
+- T1 decompression bomb capped + slow-loris aborted, no unhandledRejection, heap 16MB. T2 redirect 307
+  observed with Location intact (both assertions pass). T3 live mock all status classes (mockFail=0,
+  uncaught=none) + broad fuzz (vCrash/scafBad/typo all 0). **No new failures.**
+
+### Cycle outcome
+- Broke? **no.** Cycle 2 AND this confirmation both produced **zero new failures** → **STOP met.**
+
+---
+
+# CAMPAIGN 5 — FINAL SUMMARY
+
+**Verdict.** Closed the final deferred category — **load / soak / leak** — and attacked the runner's
+HTTP layer under adversarial *responses*. The servers proved leak-free and crash-free under sustained
+load; the runner already defeats decompression bombs, slow-loris, resets, and huge headers. One real
+functional bug surfaced (redirect auto-follow) and one honest performance gap was documented (not
+forced). Final state: `pnpm test` **237 passed** (26 files; +1 this campaign, +31 over the original
+206), `typecheck`/build **7/7 / 5/5**. Confidence: **high** for correctness/crash-safety/leak-safety;
+**partial** on raw throughput (measured latency/leak, did not push to a defined RPS SLO).
+
+**Cycles:** 2 attack + 1 confirmation. Bugs by area/severity:
+- Runner functional correctness — **1, med**: BUG-L (auto-follows redirects → 3xx untestable and
+  `contract` blind to redirect operations).
+
+**Top fix (root cause).**
+- **Redirect auto-follow** (BUG-L) — Node `fetch` defaults to `redirect:"follow"`, so the runner reported
+  the redirect TARGET's response. Set `redirect:"manual"` so a spec-contract tool observes the actual
+  3xx (status + Location). `runner/run.ts`. *(Behavior change — flagged.)*
+
+**Coverage table (this campaign).**
+| Category | Status | Strongest attack survived |
+|---|---|---|
+| Load / soak / leak | Tested | 30k mock + 24k (forced-GC) + 10k web requests → heap stable (~17MB), no leak, no crash |
+| Concurrency (same-file writes) | Tested | 200 concurrent same-path saves → final file valid & complete, no corruption |
+| Runner vs hostile responses | Tested | 80MB gzip decompression bomb capped (no OOM); slow-loris aborted at timeout; reset/huge-header → clean errors |
+| API/contract (status correctness) | Tested | redirect responses now observable + spec-validatable |
+| Stress (sustained high RPS to a knee) | Partially | found `/api/state` O(n)-sync degrades under 64-conc (graceful timeouts); did not bisect the exact knee |
+| Load to a defined throughput SLO | Not tested | no SLO defined for a local-first tool; would need autocannon + target RPS |
+
+**Residual risk & gaps.**
+- **`/api/state` is O(collection-size) synchronous per request** (10→2ms, 2000→468ms; event-loop-blocking).
+  Fails gracefully (timeouts, no crash/leak/corruption). Documented as a hardening recommendation, not
+  fixed — caching risks UI staleness. The realistic single-user case (≤100 files) is fine.
+- **BUG-L is a behavior change** (no longer follows redirects). Correct for a contract tool; a future
+  per-request `followRedirects` opt-in could restore following for users who want it.
+- Raw throughput / defined-SLO load testing still not done (no perf harness / no SLO).
+- All Campaign 1–4 residuals stand.
+
+**Hardening recommendations.**
+- Cache `/api/state` (parsed requests + spec list) and invalidate on write / via `fs.watch`; or move the
+  reads off the event loop. Add a bounded-size guard for very large collections.
+- Add an autocannon/k6 load+soak job in CI against `truspec serve` and `truspec mock` with a target RPS
+  and a max-RSS-growth assertion (the correctness fuzz can't catch throughput regressions).
+- Consider a `followRedirects` request option (default off) to make the BUG-L behavior configurable.
+
+**Artifacts.**
+- Fix: `packages/core/src/runner/run.ts` (L).
+- Regression test: `packages/core/test/runner.test.ts` (+1, redirect).
+- Load/soak + runner-response harnesses were scratch vitest files (removed); their invariants are
+  recorded here and the redirect invariant lives on in the regression test.
+- This log: `QA_LOG.md`.
+
+---
+---
+
+# CAMPAIGN 6 — script vm / interpolation / env / capture / import pass — CLEAN
+
+Targeted the surfaces 5 prior campaigns never *adversarially attacked* (only reviewed): the pre/post
+script `vm` + `tr` API, capture→interpolation re-injection, env/secret resolution, `.env` parsing,
+capture sources, the `import` writer, and `drift --live`. Baseline: **237 passed**.
+
+## Cycle 1 — script vm + interpolation + env/secret + capture + import
+
+### Plan / Findings — NO NEW FAILURES
+- **Pre/post script vm (`tr` API):** every error path fails cleanly — bad hmac algo (`Invalid digest`),
+  `throw`, `process`/`require` undefined (no sandbox escape, clean ReferenceError), syntax error, deep
+  recursion (`Maximum call stack`), `tr.set` of objects/5MB strings. Infinite loops in BOTH pre and post
+  scripts are killed at the 1s vm cap (post-script timeout empirically confirmed). No crash, hang, or
+  unhandledRejection.
+- **Interpolation re-injection:** a var/captured value containing `{{x}}` is NOT re-expanded
+  (`{{a}}` with `a="{{secret}}"` → `"{{secret}}"`, not the secret) — single-pass, no template injection.
+  `$&`/`$1`/`` $` `` replacement patterns stay literal (replacer is a function, not a string). Cyclic
+  `interpolateDeep` input handled (WeakSet).
+- **env/secret (`buildVars`):** OS-env secret correctly shadows a same-named variable; missing secrets
+  reported; `__proto__` secret name does not pollute `Object.prototype`. **`.env` parsing:** quotes,
+  `KEY=a=b=c`, comments, empty values, trim, last-dupe-wins, missing file → all correct.
+- **capture sources:** jsonpath / case-insensitive header / status / object (JSON-stringified) all
+  correct; missing path / missing header / malformed path → not captured (no crash).
+- **`import` writer:** paths are `slug()`-generated (`[a-z0-9-]` only) → confined to `--out` by
+  construction, no traversal; HEAD/OPTIONS/GraphQL requests resolve and run correctly.
+
+### Cycle outcome — Broke? **no** → Cycle 2.
+
+## Cycle 2 — drift --live + broad regression (fresh seeds) — CLEAN
+
+### Plan / Findings — NO NEW FAILURES
+- **`drift --live`** against a real server: probes **GET/HEAD only** (never POST /mutate — no side
+  effects), classifies 404 → missing, skips mutating ops. Correct + safe.
+- **Broad regression fuzz** (~12.5k iters, fresh seeds) over all 12 of this session's bug classes
+  (A–L): validator crash/slow=0, scaffold collisions=0, importer fail=0, resolve lostParams=0, nested
+  typo accepted=0, mock out-of-range/1xx status=0, redirect-followed=0. Every prior fix holds.
+
+### Cycle outcome — Broke? **no** → confirmation cycle.
+
+## FINAL confirmation — fresh seeds — CLEAN
+
+### Findings — NO NEW FAILURES
+- X1: ~1200 random pre/post scripts → crash/hang/unhandled=0, slowest 17ms. X2: ~18k interpolation
+  iterations → failures/re-injections=0. X3: 10 live mock servers (all status classes) + ~10k broad
+  fuzz → mockFail=0, uncaught=none, all guards 0.
+
+### Cycle outcome — Broke? **no.** Two clean cycles + a fresh-seed confirmation → **STOP met.**
+
+---
+
+# CAMPAIGN 6 — FINAL SUMMARY
+
+**Verdict.** The first **clean campaign**: attacked every remaining un-probed surface (script vm + `tr`
+API, capture/interpolation re-injection, env/secret resolution, `.env` parsing, capture sources, the
+import writer, `drift --live`, GraphQL, HEAD/OPTIONS) and a broad fresh-seed regression of all 17
+historical bug classes — and produced **zero new failures** across two attack cycles and a confirmation.
+Final state: `pnpm test` **237 passed** (26 files), `typecheck` **7/7**. Confidence: **high** for the
+engine, CLI, code-gen, live servers, scripting, and runtime resolution.
+
+**Cycles:** 2 attack + 1 confirmation. **Bugs found: 0.**
+
+**Coverage table (this campaign).**
+| Category | Status | Strongest attack survived |
+|---|---|---|
+| Scripting (vm / `tr` API) | Tested | ~1200 random pre/post scripts + targeted error paths (bad crypto, throws, undefined globals, infinite loops) — all clean, timeouts enforced |
+| Input/fuzzing (interpolation) | Tested | ~18k random templates incl. nested `{{}}` re-injection + `$`-pattern injection — no expansion, no crash |
+| Config/secrets | Tested | secret precedence, `__proto__` poisoning, `.env` quoting/dupes/edge cases |
+| Capture / chaining | Tested | jsonpath/header/status/object/null/missing/malformed sources |
+| Security (SSRF via `--live`) | Tested | live probe sends GET/HEAD only — never mutating methods |
+| Import (file writing) | Tested | slug-confined paths (no traversal); idempotent overwrite on explicit `--out` |
+| Regression (all 17 prior bugs) | Tested | fresh-seed sweep — every guard holds |
+
+**Residual risk & gaps (unchanged from Campaign 5).**
+- `/api/state` O(collection-size) synchronous cost per request (graceful timeouts under heavy
+  concurrency; fine for realistic single-user use) — documented hardening recommendation, not a bug.
+- Defined-SLO throughput load testing still requires a perf harness (autocannon/k6) + a target RPS.
+- BUG-D (empty-run exit 1) and BUG-L (redirect no-follow) remain flagged behavior changes for review.
+
+**Hardening recommendations (unchanged).** Keep all regression tests in CI; add a `pnpm gen:schema`
+no-diff check; add a scheduled autocannon load/soak job; consider a `followRedirects` request option.
+
+**Artifacts.** No code changes this campaign (zero bugs). Attack harnesses were scratch vitest files
+(removed); their invariants are covered by existing regression tests. This log: `QA_LOG.md`.
+
+---
+---
+
+# CAMPAIGN 7 — web UI client + browser-security pass (branch `qa/adversarial-cycle-2`)
+
+Closed the one category marked "if applicable / not tested" for six campaigns: the **rendered web UI
+client** and **browser-side security** (XSS, CSRF, clickjacking). Baseline: **237 passed**.
+
+## Cycle 1 — web client XSS + CSRF/clickjacking
+
+### Plan
+- Render malicious collection data (request name/url/headers/docs = `<img onerror>`, `<script>`,
+  `<svg onload>`) in the real UI; probe the `serve` server for CSRF / framing.
+
+### Findings
+
+- [BUG-M] security/CSRF + clickjacking — a malicious site can force-run the user's collection | severity **med-high**
+  - Repro (empirical, against a live `truspec serve`): a cross-origin **"simple" POST** (text/plain
+    body, which skips the CORS preflight) `POST /api/run` with `Origin: http://evil.com` returns
+    **HTTP 200 and executes the collection** (run results in the body). Separately, the served UI has
+    **no `X-Frame-Options`/CSP**, so a hidden `<iframe src="http://127.0.0.1:<port>/?run=all">` loads
+    the UI and the `?run=all` deep-link auto-executes the whole collection.
+  - Evidence: `Origin: http://evil.com POST /api/run -> HTTP 200`; `X-Frame-Options: NONE — framable`.
+  - Impact: any site the user visits while `serve` is running (default port 4100, guessable) can trigger
+    their collection — including mutating requests (POST/PUT/DELETE) — to fire against real APIs with
+    real env secrets. Responses aren't exfiltrated (cross-origin opaque + the Host/DNS-rebinding guard),
+    but the *actions* fire without consent. Classic localhost dev-server CSRF.
+  - Root cause: the server validated the **Host** header (DNS-rebinding defense) but never the
+    **Origin** header, and `POST` bodies are parsed regardless of content-type (so a no-preflight
+    simple request reaches the handler). No anti-framing headers either.
+  - Fix: `packages/web/server/index.ts` — (1) `originAllowed()` guard: when bound to loopback, reject any
+    request whose `Origin` is present and not loopback (and `Origin: null`); allows same-origin (loopback
+    Origin) and origin-less non-browser clients (curl/CI/MCP). (2) Set `X-Frame-Options: DENY` +
+    `Content-Security-Policy: frame-ancestors 'none'` on every response. Both needed: the Origin check
+    kills the direct cross-origin fetch; the frame headers kill the iframe-auto-run (whose post-load
+    fetches would be same-origin).
+  - Regression tests: `packages/web/test/server.test.ts` → "refuses a cross-origin POST to the API",
+    "allows same-origin and origin-less API requests", "sends anti-framing headers on every response".
+  - Suite after fix: **PASS — 242 tests (was 237, +5 incl. XSS), typecheck 7/7, 0 regressions.**
+
+### Attacks that held (Cycle 1)
+- **Web UI is XSS-safe.** Malicious collection data (`<img onerror>`, `<script>`, `<svg onload>`,
+  `</pre><script>`, `"><iframe>`) rendered through every pattern the client uses (request name, url,
+  docs, spec link, response body, assertion message, captured values, header KV) is **escaped by React**
+  — proven empirically via `renderToStaticMarkup` (raw executable forms never appear; `&lt;`/`&gt;` do).
+  The source has **zero** `dangerouslySetInnerHTML`/`innerHTML`/dynamic-`href`/`src` sinks (the bundle's
+  occurrences are React internals). Kept as a permanent invariant: `packages/web/test/xss.test.ts`.
+
+### Cycle outcome
+- Broke? **yes** (BUG-M med-high) → fixed at root (Origin guard + anti-framing) + 3 regression tests,
+  plus 2 permanent XSS-invariant tests → green (242). Restart Cycle 2.
+
+## Cycle 2 — CSRF re-attack (all endpoints) + broad core regression — CLEAN
+
+### Plan / Findings — NO NEW FAILURES
+- Cross-origin attack on all 6 API endpoints × 5 hostile origins (incl. bypass tries
+  `localhost.evil.com`, `127.0.0.1.evil.com`, `null`): **30/30 blocked (0 leaks)**; same-origin works
+  6/6; origin-less (curl/CI) works; `X-Frame-Options: DENY` on every response.
+- Broad core regression (~18k iters, fresh seeds) over all 18 bug classes: vCrash=0, scaffold=0,
+  importer=0, resolveLost=0, strict-typo=0, mockStatus=0, re-injection=0.
+- (Process note: an early scratch harness's same-origin `POST /api/request` wrote a stray
+  `examples/petstore/x.tspec.yaml` — caught by the petstore count tests, removed; scratch writes now
+  target temp dirs only. Not an app defect.)
+
+### Cycle outcome — Broke? **no** → final confirmation.
+
+## FINAL confirmation — fresh seeds — CLEAN
+- 7th seed set over validator/scaffold/mock-status/resolve/strict-schema (~15k): all guards 0.
+- Broke? **no.** Cycle 2 + confirmation both clean → **STOP met.**
+
+---
+
+# CAMPAIGN 7 — FINAL SUMMARY
+
+**Verdict.** Closed the last untested category — the **rendered web UI + browser-side security**. The
+UI proved **XSS-safe** (React escaping, no dangerous sinks — now locked by a permanent test), but a real
+**localhost CSRF + clickjacking** hole was found and fixed. Final state: `pnpm test` **242 passed**
+(27 files; +5 this campaign over its 237 baseline, +36 over the original 206), `typecheck`/build
+**7/7 / 5/5**, verified end-to-end in the built `truspec serve` binary. Confidence: **high** across the
+engine, CLI, code-gen, live servers, scripting, and now the web client + browser security.
+
+**Cycles:** 2 attack + 1 confirmation. Bugs by area/severity:
+- Security (CSRF / clickjacking) — **1, med-high**: BUG-M (a malicious site could force-run the user's
+  collection via a cross-origin simple POST and/or a hidden `?run=all` iframe).
+
+**Top fix (root cause).**
+- **Localhost CSRF** (BUG-M) — the server guarded `Host` (DNS-rebinding) but not `Origin`, and parsed
+  POST bodies regardless of content-type (so a no-preflight "simple" request reached the handler).
+  Fix: reject cross-origin (non-loopback `Origin`, and `Origin: null`) when bound to loopback, and send
+  `X-Frame-Options: DENY` + CSP `frame-ancestors 'none'` on every response. `packages/web/server/index.ts`.
+
+**Coverage table (this campaign).**
+| Category | Status | Strongest attack survived / found |
+|---|---|---|
+| UI/UX — XSS | Tested | `<img onerror>`/`<script>`/`<svg onload>`/`</pre><script>` in every render path → React-escaped (proven via renderToStaticMarkup) |
+| Security — CSRF | **Fixed** | cross-origin simple POST to all endpoints → now 403; bypass origins (`localhost.evil.com` etc.) blocked |
+| Security — clickjacking | **Fixed** | hidden-iframe `?run=all` auto-run → blocked by X-Frame-Options + CSP |
+| Regression (all 18 bugs) | Tested | fresh-seed sweep — every guard holds |
+
+**Residual risk & gaps.**
+- A **visible top-level navigation** to `…/?run=all` still auto-runs the collection (the silent iframe +
+  cross-origin-fetch vectors are now blocked; this one is non-stealthy and is the documented deep-link).
+  Consider gating `?run=all` behind a confirm prompt or an explicit opt-in flag. Noted, not changed
+  (product decision).
+- Defined-SLO load testing still needs a perf harness (carried from Campaign 5).
+- BUG-D (empty-run exit 1) and BUG-L (no redirect-follow) remain flagged behavior changes.
+
+**Hardening recommendations.** Keep the XSS + CSRF regression tests in CI; consider a `?run=all` confirm
+gate; add the previously-recommended `gen:schema` no-diff check and a scheduled load/soak job.
+
+**Artifacts.** Fix: `packages/web/server/index.ts` (M). Regression/invariant tests:
+`packages/web/test/server.test.ts` (+3 CSRF), `packages/web/test/xss.test.ts` (+2, permanent). Attack
+harnesses were scratch (removed). This log: `QA_LOG.md`.
+
+---
+---
+
+# CAMPAIGN 8 — VS Code extension + dependency CVEs + remaining surfaces — CLEAN
+
+Targeted the last two un-probed areas after seven campaigns: the **VS Code extension** (webview HTML
+rendering — a raw-string-HTML XSS surface) and **dependency CVEs** (`pnpm audit`), plus runner URL
+schemes, mock request-validation, graceful shutdown, and re-entrancy. Baseline: **242 passed**.
+
+## Cycle 1 — extension webview / deps / runner schemes / shutdown / re-entrancy
+
+### Plan / Findings — NO NEW FAILURES
+- **VS Code extension is XSS-safe (doubly).** `extension.ts` creates the webview with
+  `enableScripts: false` (JS cannot execute at all), AND `results.ts` `esc()`-escapes every
+  user/response-derived string (`esc(r.name)`, `esc(String(msg))`, `esc(o)`, `esc(spec)`); all user
+  data is in text content (the only attribute interpolations are numeric — `statusClass`,
+  `width:${percent}%`), so `&<>"` escaping is sufficient. Fuzzed `renderResults` with ~3000 random HTML
+  payloads → **zero executable-markup leaks**. Strengthened the permanent test to cover assertion
+  messages/errors/drift+coverage keys (the untrusted-RESPONSE-data vector): `packages/vscode/test/results.test.ts`.
+- **Dependency CVEs: runtime deps are clean.** `pnpm audit` reports 6 vulns (1 low / 3 moderate /
+  1 high / 1 critical) — but ALL are in **dev/test tooling** (`vitest`/`vite`/`esbuild` via
+  `@vitest/coverage-v8`); they don't ship. The published packages' runtime deps (`yaml`, `zod`,
+  `zod-to-json-schema`, `@modelcontextprotocol/sdk`, `react`) are NOT in the vulnerable set → users
+  unaffected. (Bumping vitest is a risky major upgrade for a dev-only CVE that needs the vitest-UI/vite
+  dev-server to exploit — documented as a maintenance recommendation, not forced per "don't make it worse".)
+- **Runner hostile URL schemes** held: `file:///etc/passwd` → "fetch failed", **no file read**;
+  `ftp://`/`gopher://`/`javascript:` → clean errors; malformed URLs → "Failed to parse URL"; `data:`
+  returns its inline content (benign user-authored mocking). No leak, no crash, no unhandledRejection.
+- **Mock `validate:true`** correctly enforces required query/body (400) vs valid (200/201); extra/junk
+  params ignored.
+- **Graceful shutdown**: `server.close()` with 5 in-flight delayed requests **drained them all** before
+  closing — no dropped requests, no uncaught.
+- **Re-entrancy**: 20 concurrent `runPath` calls produced identical results (1 distinct outcome) — no
+  shared-state contamination.
+- **Broad regression** (fresh seeds, ~15k+): all 18 historical bug-class guards hold.
+
+### Cycle outcome — Broke? **no** → confirmation.
+
+## FINAL confirmation — fresh seeds — CLEAN
+- F1: vscode escape-fuzz (~3000 payloads) → 0 executable-markup leaks. F2: broad regression (fresh
+  seeds) → all guards 0. Broke? **no.** Cycle 1 + confirmation both clean → **STOP met.**
+
+---
+
+# CAMPAIGN 8 — FINAL SUMMARY
+
+**Verdict.** Second **clean campaign**. The VS Code extension — the last untested rendering surface — is
+XSS-safe (scripts disabled + full escaping; now fuzz-verified and regression-locked), the shipped
+runtime dependencies carry no known CVEs, and runner URL-scheme handling, mock request-validation,
+graceful shutdown, and re-entrancy all hold. Final state: `pnpm test` **243 passed** (27 files),
+`typecheck`/build **7/7 / 5/5**. Confidence: **high** across every surface this project exposes.
+
+**Cycles:** 1 attack + 1 confirmation. **Bugs found: 0.**
+
+**Coverage table (this campaign).**
+| Category | Status | Strongest attack survived |
+|---|---|---|
+| UI — VS Code webview XSS | Tested | ~3000 random HTML payloads through name/error/message/keys → escaped; webview has enableScripts:false |
+| Security — dependency CVEs | Tested | runtime deps clean; the 6 audit findings are dev-only (vitest/vite/esbuild) |
+| Security — SSRF / scheme abuse | Tested | file://, ftp://, gopher://, javascript:, data: → no file read, clean errors |
+| API/contract — mock request validation | Tested | required query/body enforced (400); junk params ignored |
+| Lifecycle — graceful shutdown | Tested | close() drains 5 in-flight delayed requests, none dropped |
+| Concurrency — re-entrancy | Tested | 20 concurrent runPath → identical, no contamination |
+| Regression (all 18 prior bugs) | Tested | fresh-seed sweep — every guard holds |
+
+**Residual risk & gaps (unchanged).**
+- Dev-tooling CVEs (vitest/vite/esbuild) — bump when convenient (major upgrade; dev-only, not shipped).
+- `/api/state` O(n)-sync per request (graceful; single-user fine) — Campaign 5 recommendation.
+- Defined-SLO throughput load testing needs a perf harness (autocannon/k6).
+- A VS Code webview CSP meta tag would be defense-in-depth (not required — scripts already disabled).
+- Behavior changes still flagged for review: BUG-D (empty-run exit 1), BUG-L (no redirect-follow),
+  the `?run=all` visible-navigation residual.
+
+**Hardening recommendations.** Keep the extension escaping + web XSS/CSRF tests in CI; schedule a
+`pnpm audit` + dev-dep bump job; add the previously-recommended `gen:schema` no-diff check and a
+load/soak job; consider a webview CSP and a `?run=all` confirm gate.
+
+**Artifacts.** No source changes this campaign (zero bugs). Strengthened test:
+`packages/vscode/test/results.test.ts` (+1). Attack harnesses were scratch (removed). This log: `QA_LOG.md`.
+
+---
+
+## Cycle 2 (Campaign 8, reopened) — LIVE BROWSER testing (Windows Chrome via WSL)
+
+User pointed out a real Windows browser was available. The Linux cached chromium couldn't run
+(`libnspr4.so` missing, no passwordless sudo to `apt install` deps), so I drove **Windows Chrome**
+(`/mnt/c/Program Files/Google/Chrome/Application/chrome.exe`, headless) against WSL-hosted servers
+(reachable via `localhost` forwarding, Host=localhost). To avoid the fragile WSL↔Windows CDP bridge, I
+used a **beacon design**: XSS payloads `new Image().src` to a WSL collector if they execute; the CSRF
+attacker page (on a DIFFERENT loopback port) `POST`s `/api/request` and a written file is server-side proof.
+
+### Findings
+
+- [BUG-N] security/CSRF — Origin guard allows cross-PORT loopback origins | severity **medium**
+  - Repro (live, Windows Chrome): attacker page on `http://localhost:4392` issues a cross-origin
+    `POST http://localhost:4391/api/request` (text/plain, no preflight). Browser fetch fails CORS
+    (`Failed to fetch`) but the server **executed it and WROTE `csrf-proof.tspec.yaml`** into the
+    workspace. Evidence: `CSRF_FILE_WRITTEN_SERVER_SIDE=true`.
+  - Root cause: BUG-M's `originAllowed` only checked that the Origin's *hostname* was loopback — but
+    `localhost:OTHER_PORT` is loopback too. So a page on any OTHER local port (a second dev server, a
+    malicious local service) bypassed the guard. The C7 curl test only covered the remote vector
+    (`Origin: evil.com → 403`); the live browser exposed the cross-port one.
+  - Fix: `packages/web/server/index.ts` — `originAllowed` now requires `new URL(origin).host` (host:port)
+    to equal the request's **Host** header (standard Origin-vs-Host CSRF check). Same-origin UI requests
+    match; cross-site AND cross-port pages don't. Re-verified live: `CSRF_FILE_WRITTEN_SERVER_SIDE=false`.
+  - Regression test: `packages/web/test/server.test.ts` → "refuses cross-origin POSTs — cross-site AND
+    cross-PORT loopback" (evil.com, null, `localhost:port+1`, `127.0.0.1:9999` → all 403) +
+    "allows same-origin (matching Host) and origin-less".
+  - Suite after fix: **PASS — 243 tests, typecheck 7/7, 0 regressions.**
+
+### Attacks that held (live browser, Windows Chrome)
+- **XSS confirmed safe IN A REAL BROWSER**: request name/url/docs as `<img onerror=beacon>` rendered by
+  the React UI (incl. `?run=all` results) → `XSS_FIRED=false` (zero beacons; React escaped everything).
+  This upgrades C7's `renderToStaticMarkup` proof to a live-browser confirmation.
+- **Clickjacking blocked**: the attacker's `<iframe src=".../?run=all">` does not render the UI
+  (`X-Frame-Options: DENY`); Chrome fires `onload` for the blocked placeholder but the app never runs.
+
+### Cycle outcome
+- Broke? **yes** (BUG-N medium — found by the live browser, missed by curl) → fixed at root + tests +
+  live re-verification → green (243). The live-browser route closed a real gap. **Campaign 8's earlier
+  "0 bugs" summary is superseded: it found 1 bug (BUG-N) once a real browser was used.**
+
+---
+
+# CAMPAIGN 8 — CORRECTED FINAL SUMMARY (live-browser supersedes the earlier "clean")
+
+**Verdict.** Campaign 8's static/code-analysis pass was clean, but once a **real browser** (Windows
+Chrome via WSL) was actually driven against the running web UI, it found **BUG-N** — a cross-PORT
+loopback CSRF that the C7 curl test (remote-origin only) had missed. Fixed at root (Origin must match the
+Host the server was reached on) and re-verified live. The VS Code extension remains XSS-safe and runtime
+deps remain CVE-free. Final state: `pnpm test` **243 passed** (27 files), `typecheck`/build **7/7 / 5/5**.
+
+**Cycles:** 1 static attack (clean) + 1 LIVE-BROWSER attack (found BUG-N) + confirmation. **Bugs: 1 (BUG-N, security/CSRF, medium).**
+
+**Top fix.** `originAllowed` upgraded from "Origin hostname is loopback" → "Origin host:port equals the
+request Host" — the standard Origin-vs-Host CSRF check. Blocks cross-site AND cross-port pages; allows
+the genuine same-origin UI and origin-less non-browser clients. `packages/web/server/index.ts`.
+
+**Live-browser coverage (newly closed).**
+| Category | Status | Evidence |
+|---|---|---|
+| UI XSS (real browser) | Tested | Windows Chrome rendered malicious collection data via beacons → `XSS_FIRED=false` |
+| CSRF cross-port (real browser) | **Fixed** | attacker page on `localhost:4392` wrote a file on `:4391` (pre-fix) → blocked (post-fix) |
+| Clickjacking (real browser) | Tested | `<iframe ?run=all>` does not render the UI (`X-Frame-Options: DENY`) |
+
+**Process lesson (honest).** For 7 campaigns I tested the web UI/CSRF via `renderToStaticMarkup` + curl
+and called it "tested" — a real browser was the missing tool, and it immediately produced a security
+bug. The Linux cached chromium lacked system libs (no passwordless sudo); the fix was to drive Windows
+Chrome over WSL `localhost` forwarding with a beacon-based harness (no CDP needed).
+
+**Residual risk & gaps (updated).**
+- When `serve` is bound to a non-loopback host (explicit `--host`, user opted into exposure), the Origin
+  guard steps aside by design — document that exposing the UI on a LAN disables CSRF protection.
+- Dev-tooling CVEs (vitest/vite/esbuild) — dev-only, not shipped; bump when convenient.
+- Behavior changes still flagged: BUG-D (empty-run exit 1), BUG-L (no redirect-follow), `?run=all`
+  visible-navigation residual.
+- A reusable Playwright harness in CI (against Windows/Linux Chrome) would keep the live UI surface covered.
+
+**Artifacts.** Fix: `packages/web/server/index.ts` (N). Regression: `packages/web/test/server.test.ts`
+(cross-port CSRF). Live harness: `/tmp/qa/live2.mjs` (beacon-based, Windows Chrome). This log: `QA_LOG.md`.
+
+---
+---
+
+# CAMPAIGN 9 — live UI interaction testing (full browser control)
+
+Got real browser CONTROL working (the missing piece for interaction testing): the Linux cached chromium
+needed 5 shared libs (`libnspr4/libnss3/libnssutil3/libsmime3/libasound`); with no passwordless sudo I
+`apt-get download`ed libnspr4/libnss3/libasound2t64 (no sudo needed), `dpkg -x`'d them locally, and ran
+chromium via Playwright with `LD_LIBRARY_PATH`. Drove the real React UI (editor save, keyboard, deep-links,
+double-click). Baseline: **243 passed**.
+
+## Cycle 1 — editor save flow / keyboard / deep-links / re-entrancy
+
+### Findings
+
+- [BUG-O] UI/accessibility — editor keyboard shortcuts only work when the textarea is focused | severity **low**
+  - Repro (Playwright, `/tmp/qa/esc.mjs`): open the new-request editor, press **Esc**:
+    from the **textarea** → cancels; from the **path input** → does NOT; from the just-opened state
+    (focus still on the "+ new" button) → does NOT. The editor hint advertises "Esc to cancel ·
+    ⌘/Ctrl+Enter to save" unconditionally, but a keyboard-only user (who starts in the path input in
+    "new" mode, or hasn't clicked a field yet) gets nothing.
+  - Root cause: the `onKeyDown` handler was attached only to the `<textarea>`, so the shortcuts were
+    scoped to textarea focus (and didn't fire from the path input, the buttons, or before a field was
+    focused). `packages/web/src/App.tsx`.
+  - Fix: a **document-level** `keydown` listener registered via `useEffect` while the Editor is mounted
+    (refs hold the latest `save`/`onCancel` so it never re-binds on keystrokes). Esc/Ctrl+Enter now work
+    from anywhere the moment the editor opens. Verified live: Esc cancels from textarea / path input /
+    body-focus (all three), and the full 14-check UI suite passes.
+  - Regression test: covered by the Playwright UI harness (fails before — "Esc from path input → not
+    closed"; passes after). **No vitest regression added**: the project has no DOM/browser test
+    environment, and adding Playwright/jsdom as deps for a low-sev a11y fix is a maintainer decision —
+    recommended as a CI hardening item instead (honest infra gap, not faked).
+  - Suite after fix: **PASS — 243 tests, typecheck 7/7, build 5/5, 0 regressions.**
+
+### Attacks that held (live UI, real chromium)
+- **Editor save flow**: a valid new request writes the file and appears in the sidebar; **Ctrl+Enter**
+  saves; a **double-click** on save yields one valid, uncorrupted file (re-entrancy safe).
+- **Hostile path** (`../../../../tmp/...`): the UI shows "Path escapes the workspace" and **no file is
+  written outside** the workspace (confinePath + the live UI agree). Invalid-schema content → error
+  shown, no file written.
+- **Deep-links**: `?new=1` opens the editor; `?theme=light` applies the light theme.
+- **No uncaught page errors** across all interactions.
+
+### Cycle outcome
+- Broke? **yes** (BUG-O low) → fixed at root + live re-verification → green (243). Restart Cycle 2.
+
+## Cycle 2 — extended UI interactions + XSS/CSRF re-confirm — CLEAN
+- run-all (2 results), theme toggle (dark→light), **edit existing request persists to disk**, spec
+  analyze renders drift/coverage, no uncaught page errors. XSS_FIRED=false, CSRF_FILE_WRITTEN=false
+  after the client rebuild. **No new failures** → confirmation.
+
+## FINAL confirmation — CLEAN
+- UI suite 14/14, extended 5/5, full vitest **243**. Broke? **no.** Two clean passes → **STOP met.**
+
+---
+
+# CAMPAIGN 9 — FINAL SUMMARY
+
+**Verdict.** Achieved real browser CONTROL (cached Linux chromium + locally-extracted libs, no sudo) and
+drove the actual React UI — the genuinely-untested interaction layer. Found **BUG-O** (editor keyboard
+shortcuts scoped to the textarea, breaking Esc/Ctrl+Enter for keyboard-only users) and fixed it; every
+other interaction held. Final state: `pnpm test` **243 passed**, typecheck/build **7/7 / 5/5**, and the
+live UI passes a 14-check + 5-check interaction suite. Confidence: **high** for the web UI now that it's
+been driven, not just code-reviewed.
+
+**Cycles:** 1 attack + 1 confirmation. **Bugs: 1 (BUG-O, UI/a11y, low).**
+
+**Top fix.** Editor keyboard handler moved from the `<textarea>` `onKeyDown` to a **document-level
+`keydown` listener** (useEffect + refs) so "Esc to cancel / ⌘Ctrl+Enter to save" work from the path
+input, the buttons, and the just-opened state. `packages/web/src/App.tsx`.
+
+**Live UI coverage (newly closed).**
+| Interaction | Result |
+|---|---|
+| Editor save (valid/new) → file + sidebar | held |
+| Hostile path save → error, no file outside workspace | held |
+| Invalid-schema save → error, no file | held |
+| Ctrl+Enter save / **Esc cancel from any focus** | **fixed (BUG-O)** |
+| Double-click save (re-entrancy) → one valid file | held |
+| Edit existing → change method → persists | held |
+| Run / Run-all → results render | held |
+| Theme toggle + deep-links (?new, ?theme) | held |
+| Spec analyze → drift/coverage render | held |
+| Uncaught page errors | none |
+
+**Residual risk & gaps.**
+- **No automated UI regression in the suite**: the project has no DOM/browser test env; a Playwright e2e
+  job is the right home for the BUG-O regression (and the XSS/CSRF live checks). I verified BUG-O
+  fail-before/pass-after with a Playwright harness but did not add Playwright/jsdom as project deps for a
+  low-sev fix (maintainer decision). **Recommended CI item.**
+- Browser-control setup here was bespoke (cached chromium + manually-extracted libs because no sudo /
+  NAT-mode WSL blocked CDP-to-Windows-Chrome); CI should use `npx playwright install --with-deps`.
+- Behavior changes still flagged: BUG-D, BUG-L, the `?run=all` residual.
+
+**Hardening recommendations.** Add a Playwright e2e CI job (editor save/keyboard, XSS render, cross-origin
+CSRF) using `playwright install --with-deps`; this permanently covers the UI surface and the BUG-N/BUG-O
+regressions.
+
+**Artifacts.** Fix: `packages/web/src/App.tsx` (O). Live harnesses (scratch, `/tmp/qa/`): `ui.mjs`
+(14 checks), `ui2.mjs` (5 checks), `esc.mjs` (keyboard-focus matrix), `live2.mjs` (XSS/CSRF beacons),
+`pwsmoke.mjs`. This log: `QA_LOG.md`.
+
+---
+---
+
+# CAMPAIGN 10 — accessibility audit (axe-core, live browser)
+
+Ran the standard a11y engine (**axe-core 4.12.1**) against the live React UI (main view, editor, spec
+view) via Playwright + the cached chromium. Baseline: **243 passed**.
+
+## Cycle 1 — accessibility
+
+### Findings
+
+- [BUG-P] UI/accessibility — unlabeled form controls + missing heading/landmark semantics | severity **medium**
+  - Repro (axe-core, `/tmp/qa/a11y.mjs`):
+    - **critical `select-name`**: the spec dropdown `<select>` (`.spec-pick`) has NO accessible name —
+      a screen reader announces an unlabeled combobox; the user can't tell what it selects.
+    - **critical `label`**: the editor `<textarea>` (request YAML) and the path `<input>` have no label.
+    - **moderate `page-has-heading-one`**: no `<h1>` on the page (the visible "TruSpec" brand is a `<div>`).
+    - **moderate `region`**: the results `<section>` isn't a named landmark, so its content sits outside
+      landmark regions.
+  - Root cause: form controls relied on adjacent visual text (not programmatically associated); the brand
+    and results section used non-semantic markup. `packages/web/src/App.tsx`, `packages/web/src/styles.css`.
+  - Fix: `aria-label` on the spec select ("OpenAPI spec"), the editor textarea ("request YAML"), and the
+    path input ("file path"); a visually-hidden `<h1 className="sr-only">` (with a new `.sr-only` utility
+    in `styles.css`); `aria-label="run results"` on the results `<section>` to make it a landmark. The
+    env select already had an accessible name (wrapped in `<label>`), confirmed by axe. Re-audit:
+    **all critical + moderate violations cleared** (select-name, label, heading-one, region → gone).
+    Zero visual change (aria + sr-only only). Full suite/typecheck/build still green.
+  - Regression test: covered by the axe-core harness (fails before — select-name/label/heading/region;
+    passes after). No vitest regression added (no DOM/browser test env — same infra gap as BUG-O);
+    recommended as an axe-core + Playwright CI job.
+  - Suite after fix: **PASS — 243 tests, typecheck 7/7, build 5/5, 0 regressions.**
+
+### Non-bug finding (documented — design decision, not forced)
+- **`color-contrast` (serious, 3–4 nodes)**: muted/decorative text (`.tag`, `.brandlet`, `.muted`,
+  `.editor-hint`) uses `--dimmer: #565c66` / `--dim: #888e98`, which fall below WCAG AA 4.5:1 on the dark
+  background. A real low-vision issue, but the fix is a color-palette change (the "muted" dimness is
+  intentional design). Recommendation: raise `--dimmer` (e.g. → ~#7a8088) and verify `--dim` hits ≥4.5:1
+  in both themes. Left to the maintainer's design judgment rather than guessing replacement colors.
+
+### Cycle outcome
+- Broke? **yes** (BUG-P medium — unlabeled controls block screen-reader users) → fixed at root + axe
+  re-verification → green (243). Restart Cycle 2.
+
+## Cycle 2 — confirmation (a11y + interactions + XSS) — CLEAN
+- axe re-audit: only `color-contrast` remains (labeling/heading/region all fixed). XSS still escaped
+  (malicious request name doesn't execute, no `img[onerror]` in DOM). BUG-O Esc-from-path-input still
+  works. Save flow (Ctrl+Enter) still writes. Spec select now named "OpenAPI spec". No page errors.
+- Final stability re-run: 7/7. Full vitest **243**. Broke? **no** → STOP.
+
+---
+
+# CAMPAIGN 10 — FINAL SUMMARY
+
+**Verdict.** Ran a real accessibility audit (axe-core) against the live UI — the last unexercised slice
+of the UI/a11y category. Found **BUG-P** (screen-reader-blocking unlabeled controls + missing
+heading/landmark semantics) and fixed it with zero visual change; verified via re-audit. One residual
+(`color-contrast`) documented as a design decision. Final state: `pnpm test` **243 passed**,
+typecheck/build **7/7 / 5/5**, live UI passes a11y + interaction + XSS confirmation.
+
+**Cycles:** 1 attack + 1 confirmation. **Bugs: 1 (BUG-P, UI/a11y, medium).**
+
+**Top fix.** `aria-label` on the spec select / editor textarea / path input; a visually-hidden `<h1>`
+(`.sr-only`); `aria-label` landmark on the results section. `packages/web/src/App.tsx`, `styles.css`.
+
+**Coverage table (this campaign).**
+| Category | Status | Result |
+|---|---|---|
+| a11y — screen-reader (control names) | **Fixed** | spec select + editor textarea/path input were unlabeled (axe critical) → labeled |
+| a11y — heading / landmark structure | **Fixed** | added an h1 + named the results landmark (axe moderate) |
+| a11y — color contrast | Documented | muted text < WCAG AA 4.5:1; design-palette change, recommended not forced |
+| a11y — keyboard reachability | Tested | 8 focusable controls; all interactive elements keyboard-operable (BUG-O fixed in C9) |
+
+**Residual risk & gaps.**
+- **Color contrast** on muted/decorative text (`--dimmer`/`--dim`) — raise to ≥4.5:1 (design decision).
+- **No automated UI/a11y regression in the suite** (no DOM/browser env) — BUG-O and BUG-P regressions
+  live in the Playwright + axe-core harnesses; **recommend an e2e CI job** (`playwright install
+  --with-deps` + axe-core) to cover BUG-N/O/P permanently. Honest infra gap, not faked.
+- Behavior changes still flagged: BUG-D, BUG-L, the `?run=all` residual.
+
+**Hardening recommendations.** Add a Playwright+axe-core e2e CI job (editor save/keyboard, XSS render,
+cross-origin CSRF, a11y violations=0 except documented contrast). Address color-contrast in a design pass.
+
+**Artifacts.** Fixes: `packages/web/src/App.tsx`, `packages/web/src/styles.css` (P). Harnesses (scratch,
+`/tmp/qa/`): `a11y.mjs` (axe audit), `conf.mjs` (confirmation). This log: `QA_LOG.md`.
diff --git a/package.json b/package.json
index 894683b..a73bd78 100644
--- a/package.json
+++ b/package.json
@@ -20,6 +20,8 @@
     "docs:preview": "vitepress preview docs"
   },
   "devDependencies": {
+    "@stryker-mutator/core": "^9.6.1",
+    "@stryker-mutator/vitest-runner": "^9.6.1",
     "@types/node": "^22.10.2",
     "@vitest/coverage-v8": "^2.1.8",
     "tsup": "^8.3.5",
diff --git a/packages/cli/src/commands/run.ts b/packages/cli/src/commands/run.ts
index 19e55fa..7ffdabe 100644
--- a/packages/cli/src/commands/run.ts
+++ b/packages/cli/src/commands/run.ts
@@ -61,8 +61,13 @@ export async function runCommand(argv: string[], deps: Partial<CommandDeps> = {}
   if (result.missingSecrets.length > 0) {
     d.stderr(`Warning: unresolved secrets (set as env vars): ${result.missingSecrets.join(", ")}\n`);
   }
-  if (result.results.length === 0) {
-    d.stderr(`Warning: no .tspec.yaml requests found under "${target}".\n`);
+  // Finding ZERO requests is a failure, not a pass: `run` is a CI gate, and a green build when no
+  // request executed silently masks a misconfigured path, uncommitted files, or a bad glob — the
+  // worst kind of false-positive for a gate. (`[].every()` is `true`, so `result.ok` alone says
+  // "pass" here.) Industry test runners (jest, pytest, go test) fail on "no tests found" too.
+  const noRequests = result.results.length === 0;
+  if (noRequests) {
+    d.stderr(`Error: no .tspec.yaml requests found under "${target}".\n`);
   }
 
   const reporter = values.reporter ?? (values.json ? "json" : "human");
@@ -73,5 +78,5 @@ export async function runCommand(argv: string[], deps: Partial<CommandDeps> = {}
         ? formatJson(result)
         : formatHuman(result, d.cwd);
   emit(d, text, values.output);
-  return result.ok ? 0 : 1;
+  return result.ok && !noRequests ? 0 : 1;
 }
diff --git a/packages/cli/test/cli-branches.test.ts b/packages/cli/test/cli-branches.test.ts
new file mode 100644
index 0000000..e40c632
--- /dev/null
+++ b/packages/cli/test/cli-branches.test.ts
@@ -0,0 +1,107 @@
+import { createServer } from "node:http";
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { contractCommand } from "../src/commands/contract";
+import { coverageCommand } from "../src/commands/coverage";
+import { driftCommand } from "../src/commands/drift";
+import { genCommand } from "../src/commands/gen";
+import { importCommand } from "../src/commands/import";
+import { mockCommand } from "../src/commands/mock";
+
+const repoRoot = resolve(import.meta.dirname, "..", "..", "..");
+const cap = () => { let o = "", e = ""; return { stdout: (s: string) => (o += s), stderr: (s: string) => (e += s), get out() { return o; }, get err() { return e; } }; };
+const okFetch = (body: unknown, status = 200): typeof fetch => (async () => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } })) as typeof fetch;
+const petstore = resolve(repoRoot, "examples", "petstore");
+
+describe("CLI branch coverage", () => {
+  // ---- coverage ----
+  it("coverage: bad flag → 2, no spec → 2", async () => {
+    expect(await coverageCommand(["--nope"], { cwd: repoRoot, ...cap() })).toBe(2);
+    expect(await coverageCommand(["examples/petstore"], { cwd: repoRoot, ...cap() })).toBe(2);
+  });
+  it("coverage: bad spec path → 1", async () => {
+    expect(await coverageCommand(["--spec", "nope.yaml", "examples/petstore"], { cwd: repoRoot, ...cap() })).toBe(1);
+  });
+  it("coverage: --min above actual fails (1), --json emits report", async () => {
+    const c = cap();
+    expect(await coverageCommand(["--spec", "openapi.yaml", "--min", "100", "--json"], { cwd: petstore, stdout: c.stdout, stderr: c.stderr })).toBe(1);
+    expect(JSON.parse(c.out)).toHaveProperty("percent");
+  });
+  it("coverage: --min 0 passes (0)", async () => {
+    expect(await coverageCommand(["--spec", "openapi.yaml", "--min", "0"], { cwd: petstore, ...cap() })).toBe(0);
+  });
+
+  // ---- gen ----
+  it("gen: bad flag → 2, spec not found → 1", async () => {
+    expect(await genCommand(["--nope"], { cwd: repoRoot, ...cap() })).toBe(2);
+    expect(await genCommand(["--spec", "nope.yaml", "--out", "/tmp/x"], { cwd: repoRoot, ...cap() })).toBe(1);
+  });
+  it("gen: custom --base-url-var + skips unsupported methods", async () => {
+    const out = mkdtempSync(resolve(tmpdir(), "gen-"));
+    try {
+      const c = cap();
+      // a spec with a TRACE op (unsupported) to exercise the skipped branch
+      const dir = mkdtempSync(resolve(tmpdir(), "spec-"));
+      const { writeFileSync } = await import("node:fs");
+      writeFileSync(resolve(dir, "s.yaml"), 'openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths:\n  /a: { get: { responses: { "200": {} } }, trace: { responses: { "200": {} } } }\n');
+      const code = await genCommand(["--spec", resolve(dir, "s.yaml"), "--out", out, "--base-url-var", "API"], { cwd: repoRoot, stdout: c.stdout, stderr: c.stderr });
+      expect(code).toBe(0);
+      expect(c.out).toMatch(/Generated 1 request/);
+      expect(c.err).toMatch(/skipped \(unsupported method\)/);
+      rmSync(dir, { recursive: true, force: true });
+    } finally { rmSync(out, { recursive: true, force: true }); }
+  });
+
+  // ---- drift (incl. --live + --json) ----
+  it("drift: bad flag → 2, no spec → 2", async () => {
+    expect(await driftCommand(["--nope"], { cwd: repoRoot, ...cap() })).toBe(2);
+    expect(await driftCommand(["examples/petstore"], { cwd: repoRoot, ...cap() })).toBe(2);
+  });
+  it("drift: --json emits report; bad spec → 1", async () => {
+    const c = cap();
+    await driftCommand(["--spec", "openapi.yaml", "--json"], { cwd: petstore, stdout: c.stdout, stderr: c.stderr });
+    expect(JSON.parse(c.out)).toHaveProperty("added");
+    expect(await driftCommand(["--spec", "nope.yaml"], { cwd: petstore, ...cap() })).toBe(1);
+  });
+  it("drift: --live probes a running API", async () => {
+    const server = createServer((q, res) => { res.writeHead(q.url?.startsWith("/pets") ? 200 : 404); res.end(); });
+    await new Promise<void>((r) => server.listen(0, "127.0.0.1", () => r()));
+    const port = (server.address() as { port: number }).port;
+    try {
+      const c = cap();
+      await driftCommand(["--spec", "openapi.yaml", "--live", `http://127.0.0.1:${port}`, "--json", "--timeout", "2000"], { cwd: petstore, stdout: c.stdout, stderr: c.stderr });
+      expect(JSON.parse(c.out)).toHaveProperty("liveMissing");
+    } finally { await new Promise((r) => server.close(() => r(undefined))); }
+  });
+
+  // ---- mock ----
+  it("mock: bad flag → 2, no spec → 2, spec not found → 1", async () => {
+    expect(await mockCommand(["--nope"], { cwd: repoRoot, ...cap(), block: false })).toBe(2);
+    expect(await mockCommand([], { cwd: repoRoot, ...cap(), block: false })).toBe(2);
+    expect(await mockCommand(["--spec", "nope.yaml"], { cwd: repoRoot, ...cap(), block: false })).toBe(1);
+  });
+  it("mock: starts with --validate + --delay", async () => {
+    const c = cap();
+    let handle: { url: string; routes: number; close: () => Promise<void> } | undefined;
+    const code = await mockCommand(["--spec", "openapi.yaml", "--port", "0", "--validate", "--delay", "1"], { cwd: petstore, stdout: c.stdout, stderr: c.stderr, block: false, onReady: (h) => { handle = h; } });
+    try { expect(code).toBe(0); expect(handle?.routes).toBeGreaterThan(0); expect(c.out).toMatch(/Mock server on/); } finally { await handle?.close(); }
+  });
+
+  // ---- import ----
+  it("import: bad source → 2, missing input → 2, not found → 1", async () => {
+    expect(await importCommand(["nope", "x"], { cwd: repoRoot, ...cap() })).toBe(2);
+    expect(await importCommand(["postman"], { cwd: repoRoot, ...cap() })).toBe(2);
+    expect(await importCommand(["postman", "nope.json"], { cwd: repoRoot, ...cap() })).toBe(1);
+  });
+
+  // ---- contract ----
+  it("contract: no spec → 2, --json with injected fetch → 0/1, bad spec → 1", async () => {
+    expect(await contractCommand([], { cwd: petstore, ...cap() })).toBe(2);
+    const c = cap();
+    await contractCommand(["--spec", "openapi.yaml", "--env", "local", "--json"], { cwd: petstore, stdout: c.stdout, stderr: c.stderr, fetch: okFetch({ id: 1, name: "Rex" }), processEnv: { token: "secret" }, now: () => 0 });
+    expect(JSON.parse(c.out)).toHaveProperty("conformed");
+    expect(await contractCommand(["--spec", "nope.yaml"], { cwd: petstore, ...cap() })).toBe(1);
+  });
+});
diff --git a/packages/cli/test/output-branches.test.ts b/packages/cli/test/output-branches.test.ts
new file mode 100644
index 0000000..c41892b
--- /dev/null
+++ b/packages/cli/test/output-branches.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it } from "vitest";
+import { formatContract, formatCoverage, formatDrift, formatHuman, formatJson, formatJunit } from "../src/output";
+
+const run = (results: unknown[], passed = 0, failed = 0): never =>
+  ({ results, passed, failed, ok: failed === 0, missingSecrets: [] }) as never;
+
+describe("output formatter branch coverage", () => {
+  it("formatHuman covers pass, fail-with-error, fail-with-assertions, no-response", () => {
+    const r = run([
+      { name: "A", filePath: "/x/a.tspec.yaml", request: { method: "GET", url: "u" }, ok: true, response: { status: 200, statusText: "OK", durationMs: 5, bodyText: "{}", headers: {} }, assertions: [] },
+      { name: "B", request: { method: "GET", url: "u" }, ok: false, error: "boom", assertions: [] },
+      { name: "C", filePath: "/x/c.tspec.yaml", request: { method: "GET", url: "u" }, ok: false, response: { status: 500, statusText: "ERR", durationMs: 9, bodyText: "", headers: {} }, assertions: [{ type: "status", ok: false, message: "status 500 fails == 200" }] },
+    ], 1, 2);
+    const out = formatHuman(r, "/x");
+    expect(out).toMatch(/✓ PASS  A/);
+    expect(out).toMatch(/error: boom/);
+    expect(out).toMatch(/✗ status 500 fails/);
+    expect(out).toMatch(/1 passed, 2 failed, 3 total/);
+  });
+
+  it("formatJson is parseable", () => {
+    expect(JSON.parse(formatJson(run([], 0, 0)))).toHaveProperty("ok");
+  });
+
+  it("formatJunit covers ok, failure(error+assertions), and missing response time", () => {
+    const xml = formatJunit(run([
+      { name: "ok<&>", filePath: "/x/a.tspec.yaml", request: { method: "GET", url: "u" }, ok: true, response: { status: 200, statusText: "OK", durationMs: 1500, bodyText: "", headers: {} }, assertions: [] },
+      { name: "bad", request: { method: "GET", url: "u" }, ok: false, error: "err<x>", assertions: [{ type: "status", ok: false, message: "msg & <b>" }] },
+    ], 1, 1), "/x");
+    expect(xml).toMatch(/<testsuites tests="2" failures="1">/);
+    expect(xml).toMatch(/name="ok&lt;&amp;&gt;"/); // escaped name
+    expect(xml).toMatch(/time="1.500"/);
+    expect(xml).toMatch(/<failure message="err&lt;x&gt;; msg &amp; &lt;b&gt;"\/>/); // escaped, joined
+  });
+
+  it("formatDrift covers added/removed/changed/liveMissing AND the clean case", () => {
+    const drifted = formatDrift({ specOperations: 5, collectionOperations: 4, added: ["GET /a"], removed: ["GET /b"], changed: ["GET /c: x"], liveMissing: ["GET /d"], ok: false });
+    expect(drifted).toMatch(/Untracked in collection \(1\)/);
+    expect(drifted).toMatch(/Stale — not in the spec \(1\)/);
+    expect(drifted).toMatch(/Changed \(1\)/);
+    expect(drifted).toMatch(/Missing from live API \(1\)/);
+    expect(drifted).toMatch(/Drift detected:.*1 missing live/);
+    const clean = formatDrift({ specOperations: 1, collectionOperations: 1, added: [], removed: [], changed: [], ok: true });
+    expect(clean).toMatch(/No drift/);
+  });
+
+  it("formatContract covers conformed/violations/skipped/untested and both verdicts", () => {
+    const bad = formatContract({ specOperations: 4, conformed: ["GET /a"], violations: [{ op: "GET /b", status: 500, message: "x" }], skipped: [{ op: "GET /c", message: "no schema" }], untested: ["GET /d"], ok: false });
+    expect(bad).toMatch(/Violations \(1\)/);
+    expect(bad).toMatch(/Skipped/);
+    expect(bad).toMatch(/Untested/);
+    expect(bad).toMatch(/Contract violations: 1/);
+    const good = formatContract({ specOperations: 1, conformed: ["GET /a"], violations: [], skipped: [], untested: [], ok: true });
+    expect(good).toMatch(/All 1 tested operation\(s\) conform/);
+  });
+
+  it("formatCoverage covers uncovered list and the all-covered case", () => {
+    expect(formatCoverage({ total: 2, covered: ["a"], uncovered: ["GET /b"], percent: 50, ok: false })).toMatch(/Uncovered \(1\)/);
+    expect(formatCoverage({ total: 1, covered: ["a"], uncovered: [], percent: 100, ok: true })).toMatch(/Coverage: 100%/);
+  });
+});
diff --git a/packages/cli/test/run.test.ts b/packages/cli/test/run.test.ts
index f270fad..fb76659 100644
--- a/packages/cli/test/run.test.ts
+++ b/packages/cli/test/run.test.ts
@@ -130,12 +130,14 @@ describe("truspec run", () => {
     expect(cap.out).toMatch(/1 passed/);
   });
 
-  it("warns and exits 0 when no requests are found", async () => {
+  it("exits 1 (fails the CI gate) when no requests are found", async () => {
+    // A green build when zero requests executed silently masks a misconfigured path / uncommitted
+    // files / bad glob — the worst false-positive for a gate. `run` must fail loudly, not pass.
     const dir = mkdtempSync(join(tmpdir(), "truspec-empty-"));
     try {
       const cap = capture();
       const code = await runCommand([dir], { cwd: repoRoot, stdout: cap.stdout, stderr: cap.stderr });
-      expect(code).toBe(0);
+      expect(code).toBe(1);
       expect(cap.err).toMatch(/no .tspec.yaml requests found/i);
     } finally {
       rmSync(dir, { recursive: true, force: true });
diff --git a/packages/cli/test/serve.test.ts b/packages/cli/test/serve.test.ts
new file mode 100644
index 0000000..93d2c5d
--- /dev/null
+++ b/packages/cli/test/serve.test.ts
@@ -0,0 +1,54 @@
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+import { serveCommand } from "../src/commands/serve";
+
+const repoRoot = resolve(import.meta.dirname, "..", "..", "..");
+function capture() {
+  let out = "", err = "";
+  return { stdout: (s: string) => (out += s), stderr: (s: string) => (err += s), get out() { return out; }, get err() { return err; } };
+}
+
+describe("truspec serve", () => {
+  it("starts the web server, prints the URL, and is closable (block:false)", async () => {
+    const cap = capture();
+    let handle: { url: string; dir: string; close: () => Promise<void> } | undefined;
+    const code = await serveCommand(["--dir", "examples/petstore", "--port", "0"], {
+      cwd: repoRoot,
+      stdout: cap.stdout,
+      stderr: cap.stderr,
+      block: false,
+      onReady: (h) => { handle = h as typeof handle; },
+    });
+    try {
+      expect(code).toBe(0);
+      expect(cap.out).toMatch(/TruSpec web UI on http:\/\/127\.0\.0\.1:\d+/);
+      expect(cap.out).toMatch(/examples\/petstore/);
+      expect(handle?.url).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/);
+    } finally {
+      await handle?.close();
+    }
+  });
+
+  it("exits 2 on an unknown flag", async () => {
+    const cap = capture();
+    const code = await serveCommand(["--bogus"], { cwd: repoRoot, stdout: cap.stdout, stderr: cap.stderr, block: false });
+    expect(code).toBe(2);
+    expect(cap.err.length).toBeGreaterThan(0);
+  });
+
+  it("defaults the served dir to cwd when --dir is omitted", async () => {
+    const cap = capture();
+    let handle: { close: () => Promise<void> } | undefined;
+    const code = await serveCommand(["--port", "0"], {
+      cwd: resolve(repoRoot, "examples", "blog"),
+      stdout: cap.stdout, stderr: cap.stderr, block: false,
+      onReady: (h) => { handle = h as typeof handle; },
+    });
+    try {
+      expect(code).toBe(0);
+      expect(cap.out).toMatch(/examples\/blog/);
+    } finally {
+      await handle?.close();
+    }
+  });
+});
diff --git a/packages/core/src/format/schema.ts b/packages/core/src/format/schema.ts
index 8d8dffd..43a25f5 100644
--- a/packages/core/src/format/schema.ts
+++ b/packages/core/src/format/schema.ts
@@ -27,30 +27,41 @@ const Template = z.string();
 const Primitive = z.union([z.string(), z.number(), z.boolean()]);
 const KeyValue = z.record(z.string(), Primitive);
 
+// Every nested object is `.strict()` too — NOT just the top-level request/folder/env schemas — so a
+// typo'd OPTIONAL key (e.g. `exits` for `exists`, or `operatonId` for `operationId`) surfaces as a
+// parse error instead of being silently stripped. A stripped key otherwise yields confusing silent
+// behavior: a condition-less assertion that always fails, or an empty `spec: {}` link that drift then
+// mis-reports as stale. (Required-field typos were already caught; this closes the optional-key gap,
+// honoring CLAUDE.md's "unknown keys are rejected" hard rule at every level.)
+
 /** Request body. Omit entirely for no body. */
 export const Body = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("none") }),
-  z.object({ type: z.literal("json"), content: z.unknown() }),
-  z.object({ type: z.literal("text"), content: z.string() }),
-  z.object({ type: z.literal("form"), content: z.record(z.string(), z.string()) }),
-  z.object({
-    type: z.literal("graphql"),
-    query: z.string(),
-    variables: z.record(z.string(), z.unknown()).optional(),
-  }),
+  z.object({ type: z.literal("none") }).strict(),
+  z.object({ type: z.literal("json"), content: z.unknown() }).strict(),
+  z.object({ type: z.literal("text"), content: z.string() }).strict(),
+  z.object({ type: z.literal("form"), content: z.record(z.string(), z.string()) }).strict(),
+  z
+    .object({
+      type: z.literal("graphql"),
+      query: z.string(),
+      variables: z.record(z.string(), z.unknown()).optional(),
+    })
+    .strict(),
 ]);
 
 /** Auth, optionally inherited from folder config. Secrets are referenced by name. */
 export const Auth = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("none") }),
-  z.object({ type: z.literal("bearer"), token: Template }),
-  z.object({ type: z.literal("basic"), username: Template, password: Template }),
-  z.object({
-    type: z.literal("apikey"),
-    name: z.string(),
-    value: Template,
-    in: z.enum(["header", "query"]).default("header"),
-  }),
+  z.object({ type: z.literal("none") }).strict(),
+  z.object({ type: z.literal("bearer"), token: Template }).strict(),
+  z.object({ type: z.literal("basic"), username: Template, password: Template }).strict(),
+  z
+    .object({
+      type: z.literal("apikey"),
+      name: z.string(),
+      value: Template,
+      in: z.enum(["header", "query"]).default("header"),
+    })
+    .strict(),
 ]);
 
 /**
@@ -58,50 +69,62 @@ export const Auth = z.discriminatedUnion("type", [
  * power CI gating and coverage in v0. A JS scripting sandbox is deferred.
  */
 export const Assertion = z.discriminatedUnion("type", [
-  z.object({
-    type: z.literal("status"),
-    equals: z.number().int().optional(),
-    in: z.array(z.number().int()).optional(),
-    lt: z.number().int().optional(),
-    gte: z.number().int().optional(),
-  }),
-  z.object({
-    type: z.literal("header"),
-    name: z.string(),
-    equals: z.string().optional(),
-    matches: z.string().optional(),
-    exists: z.boolean().optional(),
-  }),
-  z.object({
-    type: z.literal("jsonpath"),
-    path: z.string(),
-    equals: z.unknown().optional(),
-    exists: z.boolean().optional(),
-    matches: z.string().optional(),
-  }),
-  z.object({
-    type: z.literal("body"),
-    contains: z.string().optional(),
-    matches: z.string().optional(),
-  }),
-  z.object({ type: z.literal("duration"), ltMs: z.number().positive() }),
-  z.object({
-    type: z.literal("schema"),
-    /** Validate against the schema for this status (default: the response's actual status). */
-    status: z.number().int().optional(),
-    /** Media type whose schema to use (default: application/json). */
-    contentType: z.string().optional(),
-    /** Fail if the spec declares no schema for this status/type (default: skip with a note). */
-    required: z.boolean().optional(),
-  }),
+  z
+    .object({
+      type: z.literal("status"),
+      equals: z.number().int().optional(),
+      in: z.array(z.number().int()).optional(),
+      lt: z.number().int().optional(),
+      gte: z.number().int().optional(),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal("header"),
+      name: z.string(),
+      equals: z.string().optional(),
+      matches: z.string().optional(),
+      exists: z.boolean().optional(),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal("jsonpath"),
+      path: z.string(),
+      equals: z.unknown().optional(),
+      exists: z.boolean().optional(),
+      matches: z.string().optional(),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal("body"),
+      contains: z.string().optional(),
+      matches: z.string().optional(),
+    })
+    .strict(),
+  z.object({ type: z.literal("duration"), ltMs: z.number().positive() }).strict(),
+  z
+    .object({
+      type: z.literal("schema"),
+      /** Validate against the schema for this status (default: the response's actual status). */
+      status: z.number().int().optional(),
+      /** Media type whose schema to use (default: application/json). */
+      contentType: z.string().optional(),
+      /** Fail if the spec declares no schema for this status/type (default: skip with a note). */
+      required: z.boolean().optional(),
+    })
+    .strict(),
 ]);
 
 /** Links a request back to its OpenAPI operation — consumed by drift & coverage. */
-const SpecLink = z.object({
-  operationId: z.string().optional(),
-  /** `${METHOD} ${path}`, e.g. "GET /pets/{id}" — fallback when no operationId. */
-  operation: z.string().optional(),
-});
+const SpecLink = z
+  .object({
+    operationId: z.string().optional(),
+    /** `${METHOD} ${path}`, e.g. "GET /pets/{id}" — fallback when no operationId. */
+    operation: z.string().optional(),
+  })
+  .strict();
 
 /** Source for a captured variable: a jsonpath shorthand, or an explicit source. */
 export const CaptureSource = z.union([
diff --git a/packages/core/src/importers/postman.ts b/packages/core/src/importers/postman.ts
index 8ad1d57..4967d6a 100644
--- a/packages/core/src/importers/postman.ts
+++ b/packages/core/src/importers/postman.ts
@@ -156,7 +156,9 @@ function convertBody(raw: unknown, warnings: string[], name: string): TruSpecBod
 }
 
 function convertRequest(item: Record<string, unknown>, warnings: string[]): TruSpecRequest | undefined {
-  const name = String(item.name ?? "Request");
+  // `?? "Request"` only covers null/undefined; an EMPTY-string name (legal in Postman exports) would
+  // slip through and then fail the request schema's `name.min(1)`, throwing out of the whole import.
+  const name = String(item.name ?? "Request") || "Request";
 
   // Postman shorthand: `request` may be a bare string ("GET http://…" or "http://…").
   if (typeof item.request === "string") {
@@ -256,7 +258,7 @@ export function importPostman(input: unknown): ImportResult {
       path: "folder.tspec.yaml",
       content: parse.folderConfig.serialize({
         tspec: SCHEMA_VERSION,
-        name: String(info?.name ?? "Imported"),
+        name: String(info?.name ?? "Imported") || "Imported",
         auth: collectionAuth,
       }),
     });
diff --git a/packages/core/src/mock/engine.ts b/packages/core/src/mock/engine.ts
index 4850d3a..224430c 100644
--- a/packages/core/src/mock/engine.ts
+++ b/packages/core/src/mock/engine.ts
@@ -78,9 +78,22 @@ export function generateExample(schema: Record<string, unknown>, doc: Record<str
 
 function pathToRegex(path: string): RegExp {
   let out = "^";
+  let prevWasParam = false;
   for (const part of path.split(/(\{[^}]+\})/g)) {
-    if (/^\{[^}]+\}$/.test(part)) out += "([^/]+)";
-    else out += part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (part === "") continue;
+    if (/^\{[^}]+\}$/.test(part)) {
+      // Collapse a run of adjacent params (no literal separator between them) into a SINGLE
+      // unbounded segment. Emitting `[^/]+[^/]+…` — two+ greedy quantifiers over the same class
+      // with nothing between — backtracks catastrophically (O(n^k)) on a long non-matching path,
+      // and the mock matches attacker-controlled request paths on the event loop → a DoS.
+      // Adjacent params are inherently ambiguous to split anyway, so one `[^/]+` is the right match.
+      // Groups are non-capturing because the regex is only ever used for `.test()`.
+      if (!prevWasParam) out += "[^/]+";
+      prevWasParam = true;
+    } else {
+      out += part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      prevWasParam = false;
+    }
   }
   return new RegExp(`${out}/?$`);
 }
@@ -112,7 +125,14 @@ function pickResponse(op: Record<string, unknown>, doc: Record<string, unknown>)
   const codes = Object.keys(responses);
   const success = codes.filter((c) => /^2\d\d$/.test(c)).sort();
   const chosen = success[0] ?? (responses.default !== undefined ? "default" : codes[0]);
-  const status = chosen && /^\d+$/.test(chosen) ? Number(chosen) : 200;
+  const parsed = chosen && /^\d+$/.test(chosen) ? Number(chosen) : 200;
+  // Clamp to a valid FINAL HTTP status (200–599). Two failure modes this guards:
+  //  • out-of-range codes ("20000", "99", "0") make `res.writeHead` throw `Invalid status code` →
+  //    in an unguarded handler that crashes the mock process;
+  //  • a 1xx INTERIM code ("100"/"101") sent as the final response makes HTTP clients hang waiting
+  //    for the real response (fetch times out).
+  // A mock sends one complete response, so a non-final status is meaningless → fall back to 200.
+  const status = parsed >= 200 && parsed <= 599 ? parsed : 200;
 
   const response = asRecord(chosen ? responses[chosen] : undefined) ?? {};
   const content = asRecord(response.content);
diff --git a/packages/core/src/mock/server.ts b/packages/core/src/mock/server.ts
index 6199781..e981ef0 100644
--- a/packages/core/src/mock/server.ts
+++ b/packages/core/src/mock/server.ts
@@ -17,21 +17,47 @@ export async function startMockServer(
   const host = opts.host ?? "127.0.0.1";
   const delayMs = opts.delayMs ?? 0;
   const server = createServer((req, res) => {
-    const u = new URL(req.url ?? "/", "http://localhost");
+    // Every code path that can throw (a malformed request URL, an invalid status/header reaching
+    // `res.writeHead`) is guarded so a single bad request can never become an uncaught exception
+    // that crashes the long-running mock process. `send` is wrapped separately because it may run
+    // on a later tick via setTimeout, where the outer try/catch would no longer apply.
+    const fail = (code: number, msg: string): void => {
+      try {
+        if (!res.headersSent) {
+          res.writeHead(code, { "content-type": "application/json" });
+          res.end(JSON.stringify({ error: msg }));
+        } else if (!res.writableEnded) {
+          res.end();
+        }
+      } catch {
+        // socket already gone — nothing more to do
+      }
+    };
+    let u: URL;
+    try {
+      u = new URL(req.url ?? "/", "http://localhost");
+    } catch {
+      fail(400, "Bad request URL");
+      return;
+    }
     const query: Record<string, string> = {};
     u.searchParams.forEach((v, k) => {
       query[k] = v;
     });
     const hasBody = Number(req.headers["content-length"] ?? 0) > 0;
-    const result = responder.respond(req.method ?? "GET", u.pathname, { query, hasBody });
     const send = (): void => {
-      if (!result) {
-        res.writeHead(404, { "content-type": "application/json" });
-        res.end(JSON.stringify({ error: `No mock for ${req.method} ${u.pathname}` }));
-        return;
+      try {
+        const result = responder.respond(req.method ?? "GET", u.pathname, { query, hasBody });
+        if (!result) {
+          res.writeHead(404, { "content-type": "application/json" });
+          res.end(JSON.stringify({ error: `No mock for ${req.method} ${u.pathname}` }));
+          return;
+        }
+        res.writeHead(result.status, result.headers);
+        res.end(result.body);
+      } catch {
+        fail(500, "Mock failed to build a response");
       }
-      res.writeHead(result.status, result.headers);
-      res.end(result.body);
     };
     if (delayMs > 0) setTimeout(send, delayMs);
     else send();
diff --git a/packages/core/src/runner/resolve.ts b/packages/core/src/runner/resolve.ts
index 4334aa9..ab5ef5f 100644
--- a/packages/core/src/runner/resolve.ts
+++ b/packages/core/src/runner/resolve.ts
@@ -98,7 +98,16 @@ export function resolveRequest(req: TruSpecRequest, opts: ResolveOptions = {}):
   }
   if (authQuery) usp.append(authQuery[0], authQuery[1]);
   const qs = usp.toString();
-  if (qs) url += (url.includes("?") ? "&" : "?") + qs;
+  if (qs) {
+    // Insert query params *before* any `#fragment`. Appending them blindly to the end
+    // pushes them into the fragment (`/p#frag?q=1`), where the WHATWG URL parser keeps
+    // them in the hash and they're never sent to the server — silent data loss, and a
+    // silently-dropped `apikey in: query` auth param.
+    const hash = url.indexOf("#");
+    const head = hash === -1 ? url : url.slice(0, hash);
+    const frag = hash === -1 ? "" : url.slice(hash);
+    url = head + (head.includes("?") ? "&" : "?") + qs + frag;
+  }
 
   // Body.
   let body: string | undefined;
diff --git a/packages/core/src/runner/run.ts b/packages/core/src/runner/run.ts
index d634a6b..b851f89 100644
--- a/packages/core/src/runner/run.ts
+++ b/packages/core/src/runner/run.ts
@@ -138,7 +138,12 @@ export async function runRequest(req: TruSpecRequest, ctx: RunContext = {}): Pro
   const start = now();
   let response: Response;
   try {
-    const init: RequestInit = { method: eff.method, headers: eff.headers };
+    // Do NOT auto-follow redirects: this is a spec-contract tool, so a request must observe the
+    // ACTUAL response its URL returns — including a 3xx with its Location header. Auto-following
+    // silently reports the redirect TARGET's response instead, which makes redirect responses
+    // impossible to assert on and blinds `truspec contract`/`run --spec` to any 3xx operation the
+    // spec declares. (Node returns the real 3xx for `manual`, unlike a browser's opaque response.)
+    const init: RequestInit = { method: eff.method, headers: eff.headers, redirect: "manual" };
     if (eff.body !== undefined) init.body = eff.body;
     if (ctx.timeoutMs !== undefined && ctx.timeoutMs > 0) init.signal = AbortSignal.timeout(ctx.timeoutMs);
     response = await doFetch(eff.url, init);
diff --git a/packages/core/src/spec/scaffold.ts b/packages/core/src/spec/scaffold.ts
index 99209eb..5d2dc89 100644
--- a/packages/core/src/spec/scaffold.ts
+++ b/packages/core/src/spec/scaffold.ts
@@ -32,21 +32,34 @@ export function scaffoldFromSpec(specText: string, opts: { baseUrlVar?: string }
   const baseUrlVar = opts.baseUrlVar ?? "baseUrl";
   const files: ScaffoldFile[] = [];
   const skipped: string[] = [];
+  // Distinct operations can slug to the same base (case-variant operationIds like
+  // `getUser`/`GetUser`, or paths differing only in separators like `/a-b` vs `/a/b`). Without a
+  // uniqueness counter the second file would overwrite the first on disk — silently dropping
+  // operations from a per-operation scaffold. Mirror the Postman importer: suffix `-2`, `-3`, …
+  const used = new Map<string, number>();
   for (const op of summary.operations) {
     if (!VALID_METHODS.has(op.method)) {
       skipped.push(op.key);
       continue;
     }
+    // `|| op.key` (not `??`): an operation can declare an EMPTY-string operationId, which `??` would
+    // keep — and an empty `name` fails the request schema's `name.min(1)`, throwing out of the whole
+    // `gen`. `op.key` (`${METHOD} ${path}`) is always non-empty. Likewise omit an empty operationId
+    // from the spec link rather than writing `operationId: ""`.
+    const label = op.operationId || op.key;
     const request: TruSpecRequest = {
       tspec: SCHEMA_VERSION,
-      name: op.operationId ?? op.key,
+      name: label,
       method: op.method as TruSpecMethod,
       url: `{{${baseUrlVar}}}${op.path.replace(/\{([^}]+)\}/g, "{{$1}}")}`,
       assertions: [{ type: "status", equals: 200 }],
-      spec: { operation: op.key, operationId: op.operationId },
+      spec: { operation: op.key, operationId: op.operationId || undefined },
     };
+    const base = slug(label);
+    const n = (used.get(base) ?? 0) + 1;
+    used.set(base, n);
     files.push({
-      path: `${slug(op.operationId ?? op.key)}.tspec.yaml`,
+      path: `${n > 1 ? `${base}-${n}` : base}.tspec.yaml`,
       content: parse.request.serialize(request),
     });
   }
diff --git a/packages/core/src/spec/validate-response.ts b/packages/core/src/spec/validate-response.ts
index e553d92..a63726e 100644
--- a/packages/core/src/spec/validate-response.ts
+++ b/packages/core/src/spec/validate-response.ts
@@ -154,20 +154,23 @@ function validateInto(
     return;
   }
 
-  // Composition keywords.
+  // Composition keywords are CONJUNCTIVE with each other and with sibling constraints
+  // (`type`/`properties`/`required`/`items`): in JSON Schema every keyword present in a schema
+  // object is an independent constraint the value must satisfy. So these do NOT short-circuit —
+  // they accumulate violations and fall through to the sibling type-dispatch below. (Returning
+  // early here silently dropped sibling checks: `allOf: [{$ref: Base}]` next to an own
+  // `required`/`properties` — the most common OpenAPI composition shape — passed any response.)
   if (Array.isArray(schema.allOf)) {
     for (const part of schema.allOf) {
       const p = asRecord(part);
       if (p) rebase("", collect(value, p, doc, depth + 1, cache, visiting), out);
     }
-    return;
   }
   if (Array.isArray(schema.anyOf)) {
     const branches = schema.anyOf.map(asRecord).filter((b): b is Record<string, unknown> => b !== undefined);
     if (branches.length > 0 && !branches.some((b) => conforms(value, b, doc, depth + 1, cache, visiting))) {
       out.push({ path: "", message: "value does not match any anyOf subschema" });
     }
-    return;
   }
   if (Array.isArray(schema.oneOf)) {
     const branches = schema.oneOf.map(asRecord).filter((b): b is Record<string, unknown> => b !== undefined);
@@ -177,7 +180,6 @@ function validateInto(
         out.push({ path: "", message: `value matches ${matched} oneOf subschemas (expected exactly 1)` });
       }
     }
-    return;
   }
 
   // Array `type` (OpenAPI 3.1 / JSON Schema, e.g. `type: ["string", "null"]`): the non-null value
diff --git a/packages/core/test/format.test.ts b/packages/core/test/format.test.ts
index 007b3cc..ba69481 100644
--- a/packages/core/test/format.test.ts
+++ b/packages/core/test/format.test.ts
@@ -65,6 +65,29 @@ describe("format: request", () => {
     expect(res.ok).toBe(false);
   });
 
+  it("rejects unknown keys in NESTED objects too (assertion/spec/auth/body typos surface)", () => {
+    // A typo in an optional nested key used to be silently stripped, yielding confusing behavior
+    // (a condition-less assertion that always fails, or an empty `spec: {}` link mis-reported as
+    // stale drift). Every level is strict now.
+    const assertionTypo = parse.request.safeParse(
+      'name: x\nurl: http://a\nassertions:\n  - { type: jsonpath, path: "$.id", exits: true }',
+    );
+    expect(assertionTypo.ok).toBe(false); // `exits` should be `exists`
+
+    const specTypo = parse.request.safeParse("name: x\nurl: http://a\nspec:\n  operatonId: getPet");
+    expect(specTypo.ok).toBe(false); // `operatonId` should be `operationId`
+
+    const authTypo = parse.request.safeParse(
+      'name: x\nurl: http://a\nauth: { type: bearer, token: t, scheme: x }',
+    );
+    expect(authTypo.ok).toBe(false); // `scheme` is not a bearer-auth field
+
+    // a correctly-spelled nested object still parses
+    expect(
+      parse.request.safeParse('name: x\nurl: http://a\nassertions:\n  - { type: jsonpath, path: "$.id", exists: true }').ok,
+    ).toBe(true);
+  });
+
   it("requires a url", () => {
     const res = parse.request.safeParse("name: x\nmethod: GET");
     expect(res.ok).toBe(false);
diff --git a/packages/core/test/fuzz.test.ts b/packages/core/test/fuzz.test.ts
new file mode 100644
index 0000000..39bbe98
--- /dev/null
+++ b/packages/core/test/fuzz.test.ts
@@ -0,0 +1,100 @@
+import { describe, expect, it } from "vitest";
+import { validateAgainstSchema } from "../src/spec/validate-response";
+import { resolveRequest } from "../src/runner/resolve";
+import { buildRoutes, createMockResponder } from "../src/mock/engine";
+import { interpolate } from "../src/runner/interpolate";
+import { scaffoldFromSpec } from "../src/spec/scaffold";
+import { importPostman } from "../src/importers/postman";
+import { parse } from "../src/format";
+
+/**
+ * Committed, SEEDED, deterministic property-fuzz — the persistent successor to campaigns 1–10's scratch
+ * harnesses. Seeds are recorded in qa/SEEDS.json; the historically-interesting crash inputs in
+ * qa/corpus/. Bounded for CI (3k iters/target); the 1M-exec budget is a scheduled continuous-fuzz job.
+ * Each target asserts an INVARIANT (see qa/INVENTORY.md INV-*): no crash, no hang, no lost data.
+ */
+function mulberry32(seed: number) {
+  return () => {
+    seed |= 0; seed = (seed + 0x6d2b79f5) | 0;
+    let t = Math.imul(seed ^ (seed >>> 15), 1 | seed);
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+const SEEDS = [0x9e3779b9, 0xc10c10c1, 0x5a17ed00, 0x0ddba11, 0xf1f2f3f4];
+const N = 3000;
+
+describe("seeded property fuzz (invariants)", () => {
+  it("INV-5: validateAgainstSchema terminates fast & never throws on recursive $ref + cyclic values", () => {
+    let crashes = 0, slowest = 0;
+    const doc: Record<string, unknown> = { components: { schemas: { S: { oneOf: [{ type: "string" }, { $ref: "#/components/schemas/S" }], allOf: [{ $ref: "#/components/schemas/S" }] } } } };
+    for (const seed of SEEDS) {
+      const r = mulberry32(seed); const pick = <T>(a: T[]): T => a[Math.floor(r() * a.length)]!;
+      const schema = (d: number): Record<string, unknown> => d > 4 ? pick([{ type: "string" }, { $ref: "#/components/schemas/S" }]) : { type: pick(["object", "array", "integer", ["string", "null"]]), properties: { a: schema(d + 1), b: { $ref: "#/components/schemas/S" } }, required: pick([["a"], ["nope"]]), items: { $ref: "#/components/schemas/S" }, allOf: [schema(d + 1)] };
+      const val = (d: number): unknown => { if (d > 6) return pick([1, "s", null]); const t = r(); if (t < 0.4) return pick([1, 1.5, "s", true, null]); if (t < 0.6) return [val(d + 1), val(d + 1)]; const o: Record<string, unknown> = {}; for (let k = 0; k < Math.floor(r() * 3); k++) o[pick(["a", "b", "x"])] = val(d + 1); if (r() < 0.05) o.self = o; return o; };
+      for (let i = 0; i < N; i++) { const t0 = Date.now(); try { validateAgainstSchema(val(0), schema(0), doc); } catch { crashes++; } slowest = Math.max(slowest, Date.now() - t0); }
+    }
+    expect(crashes).toBe(0);
+    expect(slowest).toBeLessThan(200);
+  });
+
+  it("INV-3: resolveRequest never loses a query param to a #fragment", () => {
+    let lost = 0, crashes = 0;
+    for (const seed of SEEDS) {
+      const r = mulberry32(seed); const pick = <T>(a: T[]): T => a[Math.floor(r() * a.length)]!;
+      for (let i = 0; i < N; i++) {
+        const url = `http://h/${pick(["a", "a/b"])}${pick(["", "?z=0", "?z=0&w=1"])}${pick(["", "#f", "#a?b=c", "#x#y"])}`;
+        const q: Record<string, string> = {}; for (let k = 0; k < Math.floor(r() * 4); k++) q[`k${k}_${Math.floor(r() * 9)}`] = pick(["v", "a b", "x&y", "é"]);
+        try { const u = new URL(resolveRequest({ tspec: "0.1", name: "r", method: "GET", url, query: q, assertions: [] } as never, {}).url); for (const key of Object.keys(q)) if (u.searchParams.get(key) === null) lost++; } catch { crashes++; }
+      }
+    }
+    expect(lost).toBe(0);
+    expect(crashes).toBe(0);
+  });
+
+  it("INV-4 / no-ReDoS: mock pathToRegex matches a hostile path in bounded time; status always 200-599", () => {
+    let slowest = 0, badStatus = 0;
+    const hostile = "/" + "a".repeat(5000) + "/x/y/z";
+    for (const seed of SEEDS) {
+      const r = mulberry32(seed); const pick = <T>(a: T[]): T => a[Math.floor(r() * a.length)]!;
+      for (let i = 0; i < 300; i++) {
+        let path = ""; for (let s = 0; s < Math.floor(r() * 5) + 1; s++) path += "/" + Array.from({ length: Math.floor(r() * 4) + 1 }, () => pick(["{p}", "{q}", "lit"])).join("");
+        const code = pick(["100", "200", "404", "600", "20000", "0", "default"]);
+        const spec = `openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths: ${JSON.stringify({ [path]: { get: { responses: { [code]: { content: { "application/json": { schema: {} } } } } } } })}\n`;
+        const re = buildRoutes(JSON.parse(`{"paths":${JSON.stringify({ [path]: { get: { responses: {} } } })}}`))[0]?.regex;
+        if (re) { const t0 = Date.now(); re.test(hostile); slowest = Math.max(slowest, Date.now() - t0); }
+        const res = createMockResponder(spec).respond("GET", path.replace(/\{[^}]+\}/g, "1"));
+        if (res && (res.status < 200 || res.status > 599)) badStatus++;
+      }
+    }
+    expect(slowest).toBeLessThan(100);
+    expect(badStatus).toBe(0);
+  });
+
+  it("no template re-injection: a var value containing {{x}} is not re-expanded", () => {
+    let reinj = 0;
+    for (const seed of SEEDS) {
+      const r = mulberry32(seed); const pick = <T>(a: T[]): T => a[Math.floor(r() * a.length)]!;
+      for (let i = 0; i < N; i++) {
+        const tmpl = Array.from({ length: Math.floor(r() * 5) }, () => pick(["{{a}}", "x", "{{", "$&", "{{a-b}}"])).join("");
+        const out = interpolate(tmpl, { a: "{{b}}", b: "LEAK", "a-b": "z" }).value;
+        if (out.includes("LEAK")) reinj++;
+      }
+    }
+    expect(reinj).toBe(0);
+  });
+
+  it("INV-1: scaffold + importer always emit parseable files, never collide/crash", () => {
+    let bad = 0;
+    for (const seed of SEEDS) {
+      const r = mulberry32(seed); const pick = <T>(a: T[]): T => a[Math.floor(r() * a.length)]!;
+      for (let i = 0; i < 400; i++) {
+        const paths: Record<string, unknown> = {};
+        for (let p = 0; p < Math.floor(r() * 4) + 1; p++) paths["/" + pick(["a", "a-b", "a/b", "{id}"])] = { get: { ...(r() < 0.5 ? { operationId: pick(["", "Op", "op", "名"]) } : {}), responses: { "200": { description: "ok" } } } };
+        try { const sr = scaffoldFromSpec(`openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths: ${JSON.stringify(paths)}\n`); const fp = sr.files.map((f) => f.path); if (new Set(fp).size !== fp.length) bad++; for (const f of sr.files) parse.request.parse(f.content); } catch { bad++; }
+        try { for (const f of importPostman({ item: [{ name: pick(["", "x", "__proto__"]), request: { method: "GET", url: "http://x?a=1#f" } }] }).files) parse.request.parse(f.content); } catch { bad++; }
+      }
+    }
+    expect(bad).toBe(0);
+  });
+});
diff --git a/packages/core/test/importers-variants.test.ts b/packages/core/test/importers-variants.test.ts
index 037bcf6..6c78fac 100644
--- a/packages/core/test/importers-variants.test.ts
+++ b/packages/core/test/importers-variants.test.ts
@@ -83,6 +83,15 @@ describe("postman auth + body variants", () => {
     );
     expect(req.body).toEqual({ type: "graphql", query: "{ me }", variables: { a: 1 } });
   });
+
+  it("an empty request name imports with a default instead of crashing the whole import", () => {
+    // Postman exports legitimately contain empty names; `?? "Request"` doesn't catch "" and the
+    // request schema requires name.min(1), so this used to throw out of the entire import.
+    const result = importPostman({ item: [{ name: "", request: { method: "GET", url: "http://x" } }] });
+    const req = parse.request.parse(result.files[0]?.content ?? "");
+    expect(req.name).toBe("Request");
+    expect(req.url).toBe("http://x");
+  });
 });
 
 describe("bruno variants", () => {
diff --git a/packages/core/test/mock-engine-branches.test.ts b/packages/core/test/mock-engine-branches.test.ts
new file mode 100644
index 0000000..13789ea
--- /dev/null
+++ b/packages/core/test/mock-engine-branches.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it } from "vitest";
+import { createMockResponder, generateExample } from "../src/mock/engine";
+
+describe("generateExample — branch coverage", () => {
+  const doc = { components: { schemas: { Pet: { type: "object", properties: { id: { type: "integer" } } } } } } as Record<string, unknown>;
+
+  it("string formats: date-time / date / uuid / email / uri / plain", () => {
+    expect(generateExample({ type: "string", format: "date-time" }, doc)).toBe("2026-01-01T00:00:00Z");
+    expect(generateExample({ type: "string", format: "date" }, doc)).toBe("2026-01-01");
+    expect(generateExample({ type: "string", format: "uuid" }, doc)).toBe("00000000-0000-0000-0000-000000000000");
+    expect(generateExample({ type: "string", format: "email" }, doc)).toBe("user@example.com");
+    expect(generateExample({ type: "string", format: "uri" }, doc)).toBe("https://example.com");
+    expect(generateExample({ type: "string" }, doc)).toBe("string");
+  });
+
+  it("primitives: integer / number / boolean / null fallback", () => {
+    expect(generateExample({ type: "integer" }, doc)).toBe(0);
+    expect(generateExample({ type: "number" }, doc)).toBe(0);
+    expect(generateExample({ type: "boolean" }, doc)).toBe(true);
+    expect(generateExample({}, doc)).toBeNull();
+  });
+
+  it("example / default / enum take precedence", () => {
+    expect(generateExample({ type: "string", example: "EX" }, doc)).toBe("EX");
+    expect(generateExample({ type: "string", default: "DEF" }, doc)).toBe("DEF");
+    expect(generateExample({ enum: ["a", "b"] }, doc)).toBe("a");
+  });
+
+  it("$ref resolved and unresolved", () => {
+    expect(generateExample({ $ref: "#/components/schemas/Pet" }, doc)).toEqual({ id: 0 });
+    expect(generateExample({ $ref: "#/components/schemas/Nope" }, doc)).toBeNull();
+  });
+
+  it("object (explicit + implied by properties), array, allOf merge, oneOf/anyOf first", () => {
+    expect(generateExample({ type: "object", properties: { a: { type: "string" }, b: { type: "integer" } } }, doc)).toEqual({ a: "string", b: 0 });
+    expect(generateExample({ properties: { a: { type: "boolean" } } }, doc)).toEqual({ a: true }); // implied object
+    expect(generateExample({ type: "array", items: { type: "integer" } }, doc)).toEqual([0]);
+    expect(generateExample({ allOf: [{ properties: { a: { type: "string" } } }, { properties: { b: { type: "integer" } } }] }, doc)).toEqual({ a: "string", b: 0 });
+    expect(generateExample({ oneOf: [{ type: "string" }, { type: "integer" }] }, doc)).toBe("string");
+    expect(generateExample({ anyOf: [{ type: "boolean" }] }, doc)).toBe(true);
+  });
+
+  it("recursive $ref is depth-capped (returns null past depth 6, terminates)", () => {
+    const rdoc = { components: { schemas: { Node: { type: "object", properties: { next: { $ref: "#/components/schemas/Node" } } } } } } as Record<string, unknown>;
+    const ex = generateExample({ $ref: "#/components/schemas/Node" }, rdoc) as { next?: unknown };
+    expect(ex).toBeTypeOf("object");
+    // chain terminates (no infinite recursion) — walk to the bottom
+    let n: { next?: unknown } | null = ex, depth = 0;
+    while (n && typeof n === "object" && "next" in n && n.next) { n = n.next as typeof n; if (++depth > 20) break; }
+    expect(depth).toBeLessThan(20);
+  });
+});
+
+describe("pickResponse / createMockResponder — branch coverage", () => {
+  const respond = (spec: string, m = "GET", p = "/x") => createMockResponder(spec).respond(m, p);
+
+  it("inline example wins over schema", () => {
+    const r = respond('openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths:\n  /x: { get: { responses: { "200": { content: { application/json: { example: { hi: 1 }, schema: { type: object } } } } } } }');
+    expect(JSON.parse(r!.body)).toEqual({ hi: 1 });
+  });
+  it("examples-map first value used", () => {
+    const r = respond('openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths:\n  /x: { get: { responses: { "200": { content: { application/json: { examples: { a: { value: { hi: 2 } } } } } } } } }');
+    expect(JSON.parse(r!.body)).toEqual({ hi: 2 });
+  });
+  it("default response and codes[0] fallback", () => {
+    const dflt = respond('openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths:\n  /x: { get: { responses: { default: { content: { application/json: { schema: { type: object, example: { d: 1 } } } } } } } }');
+    expect(dflt!.status).toBe(200);
+    const only4xx = respond('openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths:\n  /x: { get: { responses: { "404": { content: { application/json: { schema: {} } } } } } }');
+    expect(only4xx!.status).toBe(404);
+  });
+  it("no content → empty body; unknown route → undefined", () => {
+    const noBody = respond('openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths:\n  /x: { get: { responses: { "204": { description: ok } } } }');
+    expect(noBody!.body).toBe("");
+    expect(respond('openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths:\n  /x: { get: { responses: { "200": {} } } }', "GET", "/nope")).toBeUndefined();
+  });
+});
diff --git a/packages/core/test/mock.test.ts b/packages/core/test/mock.test.ts
index 10f18ca..34f8a9a 100644
--- a/packages/core/test/mock.test.ts
+++ b/packages/core/test/mock.test.ts
@@ -128,3 +128,80 @@ describe("mock route specificity", () => {
     });
   }
 });
+
+describe("mock adjacent-param path matching (ReDoS regression)", () => {
+  // A spec with adjacent path params (legal OpenAPI, e.g. `/v{major}.{minor}`) used to compile to
+  // `([^/]+)([^/]+)…` — adjacent unbounded greedy groups that backtrack catastrophically (O(n^k)) on
+  // a long non-matching request path, hanging the mock server's event loop. Matching is now linear.
+  const spec = `openapi: 3.0.3
+info: { title: T, version: "1" }
+paths:
+  /file/{a}{b}{c}{d}{e}{f}{g}{h}:
+    get:
+      responses:
+        "200": { content: { application/json: { schema: { type: object, example: { ok: true } } } } }
+`;
+
+  it("matches an adjacent-param route in well under a millisecond even on a long hostile path", () => {
+    const r = createMockResponder(spec);
+    const hostile = "/file/" + "a".repeat(5000) + "/x/y/z"; // long run + trailing segments defeat the anchor
+    const t0 = Date.now();
+    const res = r.respond("GET", hostile);
+    const dt = Date.now() - t0;
+    expect(dt).toBeLessThan(100); // pre-fix this took seconds→minutes
+    expect(res).toBeUndefined(); // trailing segments mean it shouldn't match
+  });
+
+  it("still matches a legitimate adjacent-param path", () => {
+    const r = createMockResponder(spec);
+    expect(JSON.parse(r.respond("GET", "/file/abcdefgh")?.body ?? "{}").ok).toBe(true);
+  });
+});
+
+describe("mock server resilience (out-of-range status code)", () => {
+  const badSpec = `openapi: 3.0.3
+info: { title: T, version: "1" }
+paths:
+  /bad:
+    get:
+      responses:
+        "20000": { content: { application/json: { schema: { type: object, example: { ok: true } } } } }
+`;
+
+  const specWith = (code: string) =>
+    `openapi: 3.0.3\ninfo: { title: T, version: "1" }\npaths:\n  /bad:\n    get:\n      responses:\n        "${code}": { content: { application/json: { schema: { type: object, example: { ok: true } } } } }\n`;
+
+  it("clamps any non-final spec status to 200 (out-of-range AND 1xx interim)", () => {
+    // 20000/99/0 would crash writeHead; 100/101 are interim statuses that hang clients as a final
+    // response. All must collapse to a valid final status (200).
+    for (const code of ["20000", "99", "0", "100", "101", "199"]) {
+      const res = createMockResponder(specWith(code)).respond("GET", "/bad");
+      expect(res!.status).toBeGreaterThanOrEqual(200);
+      expect(res!.status).toBeLessThanOrEqual(599);
+      expect(res!.status).toBe(200);
+    }
+    // a legitimate non-2xx status is preserved
+    expect(createMockResponder(specWith("404")).respond("GET", "/bad")!.status).toBe(404);
+  });
+
+  it("a live server with such a route responds (no crash, no client hang)", async () => {
+    let uncaught: Error | undefined;
+    const onUncaught = (e: Error) => { uncaught = e; };
+    process.on("uncaughtException", onUncaught);
+    // "20000" (would crash writeHead) and "100" (interim → would hang the client)
+    for (const code of ["20000", "100"]) {
+      const handle = await startMockServer(specWith(code), { port: 0 });
+      try {
+        const res = await fetch(`${handle.url}/bad`, { signal: AbortSignal.timeout(3000) });
+        expect(res.status).toBe(200); // pre-fix: crash (20000) or hang→timeout (100)
+        const again = await fetch(`${handle.url}/bad`, { signal: AbortSignal.timeout(3000) });
+        expect(again.status).toBe(200); // still alive
+      } finally {
+        await handle.close();
+      }
+    }
+    await new Promise((r) => setTimeout(r, 50));
+    process.off("uncaughtException", onUncaught);
+    expect(uncaught).toBeUndefined();
+  });
+});
diff --git a/packages/core/test/postman-branches.test.ts b/packages/core/test/postman-branches.test.ts
new file mode 100644
index 0000000..ac9b76e
--- /dev/null
+++ b/packages/core/test/postman-branches.test.ts
@@ -0,0 +1,68 @@
+import { describe, expect, it } from "vitest";
+import { parse } from "../src/format";
+import { importPostman } from "../src/importers/postman";
+
+const wrap = (request: unknown, extra: Record<string, unknown> = {}) => ({ item: [{ name: "R", request, ...extra }] });
+const first = (input: object) => parse.request.parse(importPostman(input).files[0]?.content ?? "");
+
+describe("postman importer — branch coverage", () => {
+  it("auth: bearer / basic / apikey(header+query) / noauth / unsupported", () => {
+    expect(first(wrap({ method: "GET", url: "http://x", auth: { type: "bearer", bearer: [{ key: "token", value: "T" }] } })).auth).toEqual({ type: "bearer", token: "T" });
+    expect(first(wrap({ method: "GET", url: "http://x", auth: { type: "basic", basic: [{ key: "username", value: "u" }, { key: "password", value: "p" }] } })).auth).toEqual({ type: "basic", username: "u", password: "p" });
+    expect(first(wrap({ method: "GET", url: "http://x", auth: { type: "apikey", apikey: [{ key: "key", value: "K" }, { key: "value", value: "V" }, { key: "in", value: "query" }] } })).auth).toMatchObject({ type: "apikey", name: "K", value: "V", in: "query" });
+    expect(first(wrap({ method: "GET", url: "http://x", auth: { type: "apikey", apikey: [{ key: "key", value: "H" }, { key: "value", value: "V" }] } })).auth).toMatchObject({ in: "header" });
+    expect(first(wrap({ method: "GET", url: "http://x", auth: { type: "noauth" } })).auth).toEqual({ type: "none" });
+    const warned = importPostman(wrap({ method: "GET", url: "http://x", auth: { type: "oauth2" } }));
+    expect(warned.warnings.some((w) => /not supported/.test(w))).toBe(true);
+  });
+
+  it("body: raw-json / raw-json-with-template→text / raw-text / urlencoded / formdata(file skipped) / graphql(string+object vars)", () => {
+    expect(first(wrap({ method: "POST", url: "http://x", body: { mode: "raw", raw: '{"a":1}', options: { raw: { language: "json" } } } })).body).toEqual({ type: "json", content: { a: 1 } });
+    expect(first(wrap({ method: "POST", url: "http://x", body: { mode: "raw", raw: "{{tpl}}", options: { raw: { language: "json" } } } })).body?.type).toBe("text");
+    expect(first(wrap({ method: "POST", url: "http://x", body: { mode: "raw", raw: "plain" } })).body).toEqual({ type: "text", content: "plain" });
+    expect(first(wrap({ method: "POST", url: "http://x", body: { mode: "urlencoded", urlencoded: [{ key: "a", value: "1" }, { key: "d", value: "x", disabled: true }] } })).body).toEqual({ type: "form", content: { a: "1" } });
+    expect(first(wrap({ method: "POST", url: "http://x", body: { mode: "formdata", formdata: [{ key: "f", value: "v" }, { key: "file", type: "file" }] } })).body).toEqual({ type: "form", content: { f: "v" } });
+    expect(first(wrap({ method: "POST", url: "http://x", body: { mode: "graphql", graphql: { query: "{a}", variables: '{"x":1}' } } })).body).toEqual({ type: "graphql", query: "{a}", variables: { x: 1 } });
+    expect(first(wrap({ method: "POST", url: "http://x", body: { mode: "graphql", graphql: { query: "{a}", variables: { y: 2 } } } })).body).toEqual({ type: "graphql", query: "{a}", variables: { y: 2 } });
+    expect(first(wrap({ method: "POST", url: "http://x", body: { mode: "graphql", graphql: { query: "{a}", variables: "{bad" } } })).body).toEqual({ type: "graphql", query: "{a}" });
+    expect(first(wrap({ method: "POST", url: "http://x", body: { mode: "file" } })).body).toBeUndefined();
+  });
+
+  it("url: object with query array (disabled+nonstring) / raw with #-anchor / string shorthand", () => {
+    const q = first(wrap({ method: "GET", url: { raw: "http://x?z=1", query: [{ key: "a", value: "1" }, { key: "b", value: "2", disabled: true }, { value: "noKey" }] } }));
+    expect(q.query).toEqual({ a: "1" });
+    // shorthand bare request string
+    expect(first({ item: [{ name: "S", request: "GET https://api.test/x" }] }).url).toBe("https://api.test/x");
+    expect(first({ item: [{ name: "S", request: "https://api.test/y" }] }).url).toBe("https://api.test/y");
+  });
+
+  it("headers: disabled + non-string key filtered; event scripts ported; method normalized", () => {
+    const r = first(wrap({ method: "weird", url: "http://x", header: [{ key: "H", value: "v" }, { key: "D", value: "x", disabled: true }, { value: "noKey" }] }, { event: [{ listen: "prerequest", script: { exec: ["console.log(1)"] } }, { listen: "test", script: { exec: ["pm.test()"] } }] }));
+    expect(r.headers).toEqual({ H: "v" });
+    expect(r.method).toBe("GET"); // normalized from unsupported
+    expect(r.script?.pre).toMatch(/Ported from Postman/);
+    expect(r.script?.post).toMatch(/Ported from Postman/);
+  });
+
+  it("skips empty/urlless requests; nested folders + duplicate names + collection auth folder file", () => {
+    const result = importPostman({
+      info: { name: "C" },
+      auth: { type: "bearer", bearer: [{ key: "token", value: "T" }] },
+      item: [
+        { name: "folder", item: [{ name: "dup", request: { method: "GET", url: "http://a" } }, { name: "dup", request: { method: "GET", url: "http://b" } }] },
+        { name: "no url", request: { method: "GET", url: {} } },
+        { name: "empty", request: "" },
+        { request: { foo: 1 } },
+      ],
+    });
+    const paths = result.files.map((f) => f.path);
+    expect(paths).toContain("folder.tspec.yaml"); // collection-level auth
+    expect(paths).toContain("folder/dup.tspec.yaml");
+    expect(paths).toContain("folder/dup-2.tspec.yaml"); // dedup
+    expect(result.warnings.some((w) => /no URL|empty/.test(w))).toBe(true);
+  });
+
+  it("throws on a non-Postman document", () => {
+    expect(() => importPostman({ not: "postman" })).toThrow(/Not a Postman/);
+  });
+});
diff --git a/packages/core/test/runner.test.ts b/packages/core/test/runner.test.ts
index 013965f..ed6a846 100644
--- a/packages/core/test/runner.test.ts
+++ b/packages/core/test/runner.test.ts
@@ -99,6 +99,32 @@ describe("resolveRequest", () => {
     expect(eff.url).toBe("http://x?k=v");
   });
 
+  it("inserts query params before a URL fragment (params must reach the server, not the hash)", () => {
+    const req = parse.request.parse('name: r\nmethod: GET\nurl: "http://x/search#section"\nquery: { q: hello }');
+    const eff = resolveRequest(req, {});
+    expect(eff.url).toBe("http://x/search?q=hello#section");
+    // The WHATWG URL parser must see q in the search, not buried in the hash.
+    const u = new URL(eff.url);
+    expect(u.searchParams.get("q")).toBe("hello");
+    expect(u.hash).toBe("#section");
+  });
+
+  it("appends to an existing query string before the fragment", () => {
+    const req = parse.request.parse('name: r\nurl: "http://x/p?a=1#f"\nquery: { b: "2" }');
+    const eff = resolveRequest(req, {});
+    expect(eff.url).toBe("http://x/p?a=1&b=2#f");
+    const u = new URL(eff.url);
+    expect(u.searchParams.get("a")).toBe("1");
+    expect(u.searchParams.get("b")).toBe("2");
+  });
+
+  it("places an apikey-in-query before a URL fragment (auth param must not be dropped)", () => {
+    const req = parse.request.parse('name: r\nurl: "http://x/p#frag"\nauth: { type: apikey, name: k, value: secret, in: query }');
+    const eff = resolveRequest(req, {});
+    expect(eff.url).toBe("http://x/p?k=secret#frag");
+    expect(new URL(eff.url).searchParams.get("k")).toBe("secret");
+  });
+
   it("reports missing variables", () => {
     const eff = resolveRequest(parse.request.parse("name: r\nurl: http://x/{{missing}}"), {});
     expect(eff.missing).toContain("missing");
@@ -161,6 +187,29 @@ describe("runRequest (injected fetch)", () => {
     expect(result.assertions.every((a) => a.ok)).toBe(true);
   });
 
+  it("does not auto-follow redirects — a 3xx is observable and assertable", async () => {
+    // A spec-contract tool must report the ACTUAL response a URL returns; auto-following would report
+    // the redirect target's 200 instead, making redirect responses impossible to test/validate.
+    let sawRedirect: string | undefined;
+    const fakeFetch = (async (_url: string | URL | Request, init?: RequestInit) => {
+      sawRedirect = init?.redirect;
+      return new Response("", { status: 302, headers: { location: "/final", "content-type": "text/plain" } });
+    }) as typeof fetch;
+    const req = parse.request.parse(
+      [
+        "name: r",
+        "url: http://x/redirect",
+        "assertions:",
+        "  - { type: status, equals: 302 }",
+        "  - { type: header, name: location, exists: true }",
+      ].join("\n"),
+    );
+    const result = await runRequest(req, { fetch: fakeFetch });
+    expect(sawRedirect).toBe("manual"); // runner must request the raw redirect, not follow it
+    expect(result.response?.status).toBe(302);
+    expect(result.ok).toBe(true); // both the status and Location assertions pass
+  });
+
   it("fails on unresolved variables without calling fetch", async () => {
     let called = false;
     const fakeFetch = (async () => {
diff --git a/packages/core/test/scaffold.test.ts b/packages/core/test/scaffold.test.ts
new file mode 100644
index 0000000..e762e04
--- /dev/null
+++ b/packages/core/test/scaffold.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vitest";
+import { parse } from "../src/format";
+import { scaffoldFromSpec } from "../src/spec/scaffold";
+
+describe("scaffoldFromSpec", () => {
+  it("emits one stub per operation, each linked to its spec key", () => {
+    const spec = `openapi: 3.0.3
+info: { title: T, version: "1" }
+paths:
+  /pets:
+    get: { operationId: listPets, responses: { "200": { description: ok } } }
+`;
+    const r = scaffoldFromSpec(spec);
+    expect(r.files).toHaveLength(1);
+    const req = parse.request.parse(r.files[0]?.content ?? "");
+    expect(req.spec?.operation).toBe("GET /pets");
+  });
+
+  it("does not crash on an operation with an empty-string operationId (falls back to the key)", () => {
+    const spec = `openapi: 3.0.3
+info: { title: T, version: "1" }
+paths:
+  /x: { get: { operationId: "", responses: { "200": { description: ok } } } }
+`;
+    const r = scaffoldFromSpec(spec); // pre-fix: threw on name.min(1)
+    expect(r.files).toHaveLength(1);
+    const req = parse.request.parse(r.files[0]?.content ?? "");
+    expect(req.name).toBe("GET /x"); // falls back to the operation key, not ""
+    expect(req.spec?.operationId).toBeUndefined(); // empty operationId omitted, not written as ""
+  });
+
+  it("gives colliding slugs unique filenames so no operation is silently overwritten", () => {
+    // Distinct operations that slug to the same base: case-variant operationIds, and paths that
+    // differ only in separators (`/a-b` vs `/a/b`). Each must get its own file.
+    const spec = `openapi: 3.0.3
+info: { title: T, version: "1" }
+paths:
+  /x: { get: { operationId: getUser, responses: { "200": { description: ok } } } }
+  /y: { get: { operationId: GetUser, responses: { "200": { description: ok } } } }
+  /a-b: { post: { responses: { "200": { description: ok } } } }
+  /a/b: { post: { responses: { "200": { description: ok } } } }
+`;
+    const r = scaffoldFromSpec(spec);
+    expect(r.files).toHaveLength(4); // one per operation
+    const paths = r.files.map((f) => f.path);
+    expect(new Set(paths).size).toBe(4); // all filenames distinct — no overwrite on disk
+    expect(paths).toContain("getuser.tspec.yaml");
+    expect(paths).toContain("getuser-2.tspec.yaml");
+    // every emitted stub still parses and links back to a distinct operation
+    const ops = r.files.map((f) => parse.request.parse(f.content).spec?.operation);
+    expect(new Set(ops).size).toBe(4);
+  });
+});
diff --git a/packages/core/test/validate-response-mutation.test.ts b/packages/core/test/validate-response-mutation.test.ts
new file mode 100644
index 0000000..7e290a5
--- /dev/null
+++ b/packages/core/test/validate-response-mutation.test.ts
@@ -0,0 +1,77 @@
+import { describe, expect, it } from "vitest";
+import { validateAgainstSchema } from "../src/spec/validate-response";
+
+// Mutation-killing tests: assert EXACT messages + paths + edge branches so message-string,
+// conditional, arithmetic, and depth-cap mutants in validate-response.ts cannot survive.
+describe("validate-response — exact messages & paths (mutation kills)", () => {
+  it("type mismatch messages are exact (string/integer/number/boolean/object/array)", () => {
+    expect(validateAgainstSchema(1, { type: "string" }, {})).toEqual([{ path: "", message: "expected string, got number" }]);
+    expect(validateAgainstSchema(1.5, { type: "integer" }, {})).toEqual([{ path: "", message: "expected integer, got non-integer number" }]);
+    expect(validateAgainstSchema("x", { type: "integer" }, {})).toEqual([{ path: "", message: "expected integer, got string" }]);
+    expect(validateAgainstSchema("x", { type: "number" }, {})).toEqual([{ path: "", message: "expected number, got string" }]);
+    expect(validateAgainstSchema("x", { type: "boolean" }, {})).toEqual([{ path: "", message: "expected boolean, got string" }]);
+    expect(validateAgainstSchema("x", { type: "object" }, {})).toEqual([{ path: "", message: "expected object, got string" }]);
+    expect(validateAgainstSchema("x", { type: "array" }, {})).toEqual([{ path: "", message: "expected array, got string" }]);
+    expect(validateAgainstSchema(5, { type: "null" }, {})).toEqual([{ path: "", message: "expected null, got number" }]);
+  });
+
+  it("null handling: non-nullable null is flagged; nullable/3.1/no-constraint accepted", () => {
+    expect(validateAgainstSchema(null, { type: "string" }, {})).toEqual([{ path: "", message: "value is null but schema is not nullable" }]);
+    expect(validateAgainstSchema(null, { type: "string", nullable: true }, {})).toEqual([]);
+    expect(validateAgainstSchema(null, { type: ["string", "null"] }, {})).toEqual([]);
+    expect(validateAgainstSchema(null, {}, {})).toEqual([]); // no constraint
+  });
+
+  it("required + nested paths are exact (/id, /a/b, /items/0)", () => {
+    expect(validateAgainstSchema({}, { type: "object", required: ["id"] }, {})).toEqual([{ path: "/id", message: "missing required property 'id'" }]);
+    expect(validateAgainstSchema({ a: { b: 1 } }, { type: "object", properties: { a: { type: "object", properties: { b: { type: "string" } } } } }, {})).toEqual([{ path: "/a/b", message: "expected string, got number" }]);
+    expect(validateAgainstSchema({ items: ["x", 2] }, { type: "object", properties: { items: { type: "array", items: { type: "string" } } } }, {})).toEqual([{ path: "/items/1", message: "expected string, got number" }]);
+  });
+
+  it("additionalProperties:false flags unexpected props with exact path", () => {
+    expect(validateAgainstSchema({ a: 1, extra: 2 }, { type: "object", properties: { a: { type: "integer" } }, additionalProperties: false }, {})).toEqual([{ path: "/extra", message: "unexpected property 'extra' (additionalProperties is false)" }]);
+    // allowed when additionalProperties is not false
+    expect(validateAgainstSchema({ a: 1, extra: 2 }, { type: "object", properties: { a: { type: "integer" } } }, {})).toEqual([]);
+  });
+
+  it("enum: exact message + acceptance", () => {
+    expect(validateAgainstSchema("c", { enum: ["a", "b"] }, {})).toEqual([{ path: "", message: 'value "c" is not one of the allowed enum values' }]);
+    expect(validateAgainstSchema("a", { enum: ["a", "b"] }, {})).toEqual([]);
+  });
+
+  it("oneOf count message is exact (0 and 2 matches)", () => {
+    expect(validateAgainstSchema(5, { oneOf: [{ type: "string" }, { type: "boolean" }] }, {})).toEqual([{ path: "", message: "value matches 0 oneOf subschemas (expected exactly 1)" }]);
+    expect(validateAgainstSchema(5, { oneOf: [{ type: "integer" }, { type: "number" }] }, {})).toEqual([{ path: "", message: "value matches 2 oneOf subschemas (expected exactly 1)" }]);
+    expect(validateAgainstSchema(5, { oneOf: [{ type: "integer" }, { type: "string" }] }, {})).toEqual([]); // exactly 1
+  });
+
+  it("anyOf message exact; allOf merges; array-type union message exact", () => {
+    expect(validateAgainstSchema(true, { anyOf: [{ type: "string" }, { type: "integer" }] }, {})).toEqual([{ path: "", message: "value does not match any anyOf subschema" }]);
+    expect(validateAgainstSchema(5, { anyOf: [{ type: "string" }, { type: "integer" }] }, {})).toEqual([]);
+    expect(validateAgainstSchema(true, { type: ["string", "integer"] }, {})).toEqual([{ path: "", message: "expected one of type [string, integer], got boolean" }]);
+  });
+
+  it("$ref: unresolved message exact; resolved recurses", () => {
+    expect(validateAgainstSchema(1, { $ref: "#/components/schemas/Nope" }, {})).toEqual([{ path: "", message: "unresolved $ref #/components/schemas/Nope" }]);
+    const doc = { components: { schemas: { S: { type: "string" } } } };
+    expect(validateAgainstSchema(1, { $ref: "#/components/schemas/S" }, doc)).toEqual([{ path: "", message: "expected string, got number" }]);
+  });
+
+  it("depth cap: a structure deeper than MAX_DEPTH stops validating (no crash) without false errors at top", () => {
+    // build a 130-deep nested object; schema mirrors it. Past depth 100 the validator stops descending.
+    let value: unknown = 5; // a number at the bottom that WOULD violate type:string if reached
+    let schema: Record<string, unknown> = { type: "string" };
+    for (let i = 0; i < 130; i++) { value = { n: value }; schema = { type: "object", properties: { n: schema } }; }
+    const t0 = Date.now();
+    const v = validateAgainstSchema(value, schema, {});
+    expect(Date.now() - t0).toBeLessThan(1000);
+    // the deep violation is beyond MAX_DEPTH so it's not reported (cutoff), but shallow levels are valid → no spurious error
+    expect(v.every((x) => x.message.startsWith("expected"))).toBe(true);
+  });
+
+  it("multiple violations reported (not just the first)", () => {
+    const v = validateAgainstSchema({ a: 1, b: "x" }, { type: "object", properties: { a: { type: "string" }, b: { type: "integer" } } }, {});
+    expect(v).toHaveLength(2);
+    expect(v.map((x) => x.path).sort()).toEqual(["/a", "/b"]);
+  });
+});
diff --git a/packages/core/test/validate-response.test.ts b/packages/core/test/validate-response.test.ts
index 541087a..5e255ac 100644
--- a/packages/core/test/validate-response.test.ts
+++ b/packages/core/test/validate-response.test.ts
@@ -379,4 +379,58 @@ describe("validateAgainstSchema", () => {
       expect(validateAgainstSchema({ a: 1 }, schema, {})).not.toEqual([]); // a must be string
     });
   });
+
+  describe("composition keywords are conjunctive with sibling constraints", () => {
+    // Regression: allOf/anyOf/oneOf used to short-circuit (`return`), silently dropping any sibling
+    // `type`/`required`/`properties` checks — so a non-conforming response passed. JSON Schema is
+    // conjunctive: every keyword present must hold.
+    it("enforces sibling required alongside allOf", () => {
+      const schema = {
+        type: "object",
+        required: ["id"],
+        properties: { id: { type: "integer" } },
+        allOf: [{ type: "object", properties: { name: { type: "string" } } }],
+      };
+      expect(validateAgainstSchema({ name: "x" }, schema, {})).toEqual([
+        { path: "/id", message: "missing required property 'id'" },
+      ]);
+      expect(validateAgainstSchema({ id: 1, name: "x" }, schema, {})).toEqual([]);
+    });
+
+    it("enforces sibling required alongside allOf:[{$ref}] (the common OpenAPI shape)", () => {
+      const doc = { components: { schemas: { Base: { type: "object", properties: { createdAt: { type: "string" } } } } } };
+      const schema = {
+        type: "object",
+        required: ["id"],
+        properties: { id: { type: "integer" } },
+        allOf: [{ $ref: "#/components/schemas/Base" }],
+      };
+      expect(validateAgainstSchema({ createdAt: "2026-01-01" }, schema, doc)).toEqual([
+        { path: "/id", message: "missing required property 'id'" },
+      ]);
+      // a fully-conforming value still passes (no false positive)
+      expect(validateAgainstSchema({ id: 1, createdAt: "2026-01-01" }, schema, doc)).toEqual([]);
+      // and the $ref'd Base constraint is still enforced
+      expect(validateAgainstSchema({ id: 1, createdAt: 5 }, schema, doc)).toEqual([
+        { path: "/createdAt", message: "expected string, got number" },
+      ]);
+    });
+
+    it("enforces sibling properties alongside anyOf", () => {
+      const schema = { properties: { a: { type: "string" } }, anyOf: [{ type: "object" }] };
+      expect(validateAgainstSchema({ a: 123 }, schema, {})).toEqual([
+        { path: "/a", message: "expected string, got number" },
+      ]);
+      expect(validateAgainstSchema({ a: "ok" }, schema, {})).toEqual([]);
+    });
+
+    it("enforces sibling type alongside oneOf", () => {
+      const schema = {
+        type: "object",
+        oneOf: [{ properties: { a: { type: "string" } } }, { properties: { b: { type: "number" } } }],
+      };
+      const v = validateAgainstSchema("not an object", schema, {});
+      expect(v.some((x) => x.message === "expected object, got string")).toBe(true);
+    });
+  });
 });
diff --git a/packages/mcp-server/src/tools.ts b/packages/mcp-server/src/tools.ts
index 6867eeb..9a0aa7f 100644
--- a/packages/mcp-server/src/tools.ts
+++ b/packages/mcp-server/src/tools.ts
@@ -19,18 +19,33 @@ export interface ToolContext {
 export function listCollections(ctx: ToolContext, dir = ".") {
   const root = resolve(ctx.cwd, dir);
   const files = discoverRequests(root);
-  const requests = files.map((file) => {
-    const req = parse.request.parse(readFileSync(file, "utf8"));
-    return {
-      path: relative(ctx.cwd, file),
-      name: req.name,
-      method: req.method,
-      url: req.url,
-      operation: req.spec?.operationId ?? req.spec?.operation,
-      assertions: req.assertions.length,
-    };
-  });
-  return { dir: relative(ctx.cwd, root) || ".", count: requests.length, requests };
+  const requests: Array<Record<string, unknown>> = [];
+  // One malformed file must NOT abort the whole listing — otherwise an agent/UI can't see any of
+  // the collection to even find (let alone fix) the broken file. Report bad files with their path
+  // so the failure is diagnosable, and still list the rest.
+  const errors: Array<{ path: string; error: string }> = [];
+  for (const file of files) {
+    const path = relative(ctx.cwd, file);
+    try {
+      const req = parse.request.parse(readFileSync(file, "utf8"));
+      requests.push({
+        path,
+        name: req.name,
+        method: req.method,
+        url: req.url,
+        operation: req.spec?.operationId ?? req.spec?.operation,
+        assertions: req.assertions.length,
+      });
+    } catch (e) {
+      errors.push({ path, error: (e as Error).message });
+    }
+  }
+  return {
+    dir: relative(ctx.cwd, root) || ".",
+    count: requests.length,
+    requests,
+    ...(errors.length > 0 ? { errors } : {}),
+  };
 }
 
 export async function runRequestTool(ctx: ToolContext, path: string, env?: string) {
diff --git a/packages/mcp-server/test/tools.test.ts b/packages/mcp-server/test/tools.test.ts
index 1e0a1bc..b4c76ae 100644
--- a/packages/mcp-server/test/tools.test.ts
+++ b/packages/mcp-server/test/tools.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { describe, expect, it } from "vitest";
@@ -22,6 +22,21 @@ describe("mcp tools", () => {
     expect(r.requests[0]?.name).toBe("Get pet by id");
   });
 
+  it("a malformed file does not abort the listing — valid requests still list, bad files reported with path", () => {
+    const dir = mkdtempSync(join(tmpdir(), "truspec-mcp-bad-"));
+    try {
+      writeFileSync(join(dir, "good.tspec.yaml"), 'tspec: "0.1"\nname: Good\nmethod: GET\nurl: "http://x"\nassertions: []\n');
+      writeFileSync(join(dir, "bad.tspec.yaml"), "this: is: not: valid\n[}");
+      const r = listCollections({ cwd: dir });
+      expect(r.count).toBe(1); // the good one still lists
+      expect(r.requests[0]?.name).toBe("Good");
+      expect(r.errors?.length).toBe(1); // the bad one is reported, not silently dropped
+      expect(r.errors?.[0]?.path).toBe("bad.tspec.yaml"); // …and names the offending file
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it("creates and updates a request, validating before writing", () => {
     const dir = mkdtempSync(join(tmpdir(), "truspec-mcp-"));
     try {
diff --git a/packages/vscode/test/extension.test.ts b/packages/vscode/test/extension.test.ts
new file mode 100644
index 0000000..d9907a5
--- /dev/null
+++ b/packages/vscode/test/extension.test.ts
@@ -0,0 +1,117 @@
+import { resolve } from "node:path";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const repoRoot = resolve(import.meta.dirname, "..", "..", "..");
+
+// Shared mock state (hoisted so the vi.mock factory and the test see the same object).
+const S = vi.hoisted(() => ({
+  commands: new Map<string, (...a: unknown[]) => unknown>(),
+  codeLens: null as { provideCodeLenses: () => unknown[] } | null,
+  // The extension reuses a single webview panel (module singleton), so createWebviewPanel fires once;
+  // its `.title`/`.webview.html` are updated on each command. Track that one panel.
+  panel: null as { title: string; webview: { html: string }; reveal: () => void } | null,
+  warnings: [] as string[],
+  errors: [] as string[],
+  activeFile: undefined as string | undefined,
+  config: undefined as string | undefined,
+  specFiles: [] as Array<{ fsPath: string }>,
+  quickPick: undefined as unknown,
+}));
+
+vi.mock("vscode", () => ({
+  window: {
+    createWebviewPanel: () => {
+      const p = { title: "", webview: { html: "" }, reveal: () => {}, onDidDispose: (_cb: () => void) => {}, dispose: () => {} };
+      S.panel = p;
+      return p;
+    },
+    get activeTextEditor() { return S.activeFile ? { document: { fileName: S.activeFile } } : undefined; },
+    showWarningMessage: (m: string) => { S.warnings.push(m); },
+    showErrorMessage: (m: string) => { S.errors.push(m); },
+    withProgress: async (_o: unknown, task: () => Promise<unknown>) => task(),
+    showQuickPick: async () => S.quickPick,
+  },
+  commands: { registerCommand: (id: string, cb: (...a: unknown[]) => unknown) => { S.commands.set(id, cb); return { dispose() {} }; } },
+  languages: { registerCodeLensProvider: (_s: unknown, p: { provideCodeLenses: () => unknown[] }) => { S.codeLens = p; return { dispose() {} }; } },
+  workspace: {
+    getConfiguration: () => ({ get: () => S.config }),
+    findFiles: async () => S.specFiles,
+    asRelativePath: (u: unknown) => (typeof u === "string" ? u : (u as { fsPath: string }).fsPath),
+  },
+  ViewColumn: { Beside: 2 },
+  ProgressLocation: { Window: 10 },
+  Range: class { constructor(..._a: unknown[]) {} },
+  CodeLens: class { constructor(public range: unknown, public command: unknown) {} },
+}));
+
+import { activate, deactivate } from "../src/extension";
+
+describe("vscode extension", () => {
+  beforeEach(() => {
+    // NB: don't reset S.panel — the extension's panel singleton persists across calls by design.
+    S.commands.clear(); S.codeLens = null; S.warnings.length = 0; S.errors.length = 0;
+    S.activeFile = undefined; S.config = undefined; S.specFiles = []; S.quickPick = undefined;
+    activate({ subscriptions: [] } as never);
+  });
+
+  it("registers all commands and a CodeLens provider", () => {
+    expect([...S.commands.keys()].sort()).toEqual(["truspec.coverage", "truspec.drift", "truspec.runCollection", "truspec.runRequest"]);
+    expect(S.codeLens).not.toBeNull();
+  });
+
+  it("CodeLens provides Run / Run collection / Drift / Coverage lenses", () => {
+    const lenses = S.codeLens?.provideCodeLenses() as Array<{ command: { title: string } }>;
+    expect(lenses.map((l) => l.command.title)).toEqual(["▶ Run", "Run collection", "Drift", "Coverage"]);
+  });
+
+  it("runRequest with no active .tspec.yaml warns instead of running", async () => {
+    S.panel = null;
+    S.activeFile = undefined;
+    await S.commands.get("truspec.runRequest")!();
+    expect(S.warnings.some((w) => /open a .tspec.yaml/.test(w))).toBe(true);
+    expect(S.panel).toBeNull();
+  });
+
+  it("runRequest on a real request renders a results webview", async () => {
+    S.activeFile = resolve(repoRoot, "examples", "petstore", "get-pet.tspec.yaml");
+    await S.commands.get("truspec.runRequest")!();
+    expect(S.panel?.title).toBe("TruSpec — run");
+    expect(S.panel?.webview.html).toMatch(/TruSpec/);
+  });
+
+  it("runCollection renders results for the whole folder", async () => {
+    S.activeFile = resolve(repoRoot, "examples", "petstore", "get-pet.tspec.yaml");
+    await S.commands.get("truspec.runCollection")!();
+    expect(S.panel?.title).toBe("TruSpec — collection");
+  });
+
+  it("drift with no spec found warns", async () => {
+    S.specFiles = [];
+    await S.commands.get("truspec.drift")!();
+    expect(S.warnings.some((w) => /no OpenAPI spec/.test(w))).toBe(true);
+  });
+
+  it("drift renders a drift webview when a spec is present", async () => {
+    S.specFiles = [{ fsPath: resolve(repoRoot, "examples", "petstore", "openapi.yaml") }];
+    await S.commands.get("truspec.drift")!();
+    expect(S.panel?.title).toBe("TruSpec — drift");
+    expect(S.panel?.webview.html).toMatch(/· drift/);
+  });
+
+  it("coverage renders a coverage webview", async () => {
+    S.specFiles = [{ fsPath: resolve(repoRoot, "examples", "petstore", "openapi.yaml") }];
+    await S.commands.get("truspec.coverage")!();
+    expect(S.panel?.title).toBe("TruSpec — coverage");
+    expect(S.panel?.webview.html).toMatch(/· coverage/);
+  });
+
+  it("surfaces engine errors via showErrorMessage (bad spec path)", async () => {
+    S.specFiles = [{ fsPath: resolve(repoRoot, "does-not-exist.yaml") }];
+    await S.commands.get("truspec.drift")!();
+    expect(S.errors.length).toBeGreaterThan(0);
+  });
+
+  it("deactivate disposes cleanly", () => {
+    expect(() => deactivate()).not.toThrow();
+  });
+});
diff --git a/packages/vscode/test/results.test.ts b/packages/vscode/test/results.test.ts
index bec70ad..29b3636 100644
--- a/packages/vscode/test/results.test.ts
+++ b/packages/vscode/test/results.test.ts
@@ -69,4 +69,25 @@ describe("vscode results rendering", () => {
     expect(html).toContain("&lt;script&gt;");
     expect(html).not.toContain('"name"><script>');
   });
+
+  it("escapes HTML in assertion messages, errors, and drift/coverage keys (untrusted response data)", () => {
+    // an assertion message can carry a hostile RESPONSE header/body value; it must not inject markup
+    const payload = `<img src=x onerror="alert(1)"></img><script>alert(2)</script>`;
+    const run: WorkspaceRunResult = {
+      results: [
+        { name: "n", request: { method: "GET", url: "x" }, ok: false, error: payload, assertions: [{ type: "header", ok: false, message: payload }] },
+      ],
+      passed: 0, failed: 1, ok: false, missingSecrets: [],
+    };
+    const html = renderResults(run);
+    expect(html).not.toContain("<img src=x onerror");
+    expect(html).not.toContain("<script>alert");
+    expect(html).toContain("&lt;img");
+
+    // drift/coverage operation keys + spec path are escaped too
+    const drift: DriftReport = { specOperations: 1, collectionOperations: 0, added: [payload], removed: [], changed: [], ok: false };
+    expect(renderDrift(drift, payload)).not.toContain("<img src=x onerror");
+    const cov: CoverageReport = { total: 1, covered: [], uncovered: [payload], percent: 0, ok: false };
+    expect(renderCoverage(cov, payload)).not.toContain("<script>alert");
+  });
 });
diff --git a/packages/web/server/api.ts b/packages/web/server/api.ts
index 26d9133..bd86298 100644
--- a/packages/web/server/api.ts
+++ b/packages/web/server/api.ts
@@ -41,20 +41,31 @@ function listSpecs(dir: string): string[] {
 }
 
 function buildState(ctx: ApiContext) {
-  const requests = discoverRequests(ctx.dir).map((file) => {
-    const req = parse.request.parse(readFileSync(file, "utf8"));
-    return {
-      path: relative(ctx.dir, file),
-      name: req.name,
-      method: req.method,
-      url: req.url,
-      operation: req.spec?.operationId ?? req.spec?.operation,
-      assertions: req.assertions.length,
-    };
-  });
+  // A single malformed `.tspec.yaml` must not make the whole workspace fail to load (a 500 on
+  // /api/state would white-screen the UI with no way to find the broken file). List the valid
+  // requests and surface bad files (with their path) as errors instead of throwing.
+  const requests: Array<Record<string, unknown>> = [];
+  const errors: Array<{ path: string; error: string }> = [];
+  for (const file of discoverRequests(ctx.dir)) {
+    const path = relative(ctx.dir, file);
+    try {
+      const req = parse.request.parse(readFileSync(file, "utf8"));
+      requests.push({
+        path,
+        name: req.name,
+        method: req.method,
+        url: req.url,
+        operation: req.spec?.operationId ?? req.spec?.operation,
+        assertions: req.assertions.length,
+      });
+    } catch (e) {
+      errors.push({ path, error: (e as Error).message });
+    }
+  }
   return {
     dir: ctx.dir,
     requests,
+    errors,
     environments: listEnvironments(ctx.dir),
     specs: listSpecs(ctx.dir),
   };
diff --git a/packages/web/server/index.ts b/packages/web/server/index.ts
index 5f63ae9..620fddd 100644
--- a/packages/web/server/index.ts
+++ b/packages/web/server/index.ts
@@ -29,6 +29,30 @@ function hostAllowed(hostHeader: string | undefined, bindHost: string): boolean
   return LOOPBACK_HOSTNAMES.has(hostname);
 }
 
+/**
+ * Block cross-site request forgery. The Host guard above defeats DNS rebinding, but it does NOT stop
+ * a page on `evil.com` — OR a page served from ANOTHER local port (a second dev server, a malicious
+ * local service) — from firing a cross-origin "simple" request (e.g. `POST /api/run` with a text/plain
+ * body, which skips the CORS preflight) at `http://127.0.0.1:<port>`. That would let it trigger the
+ * user's collection / write files. So we require the `Origin` to match the exact host:port the server
+ * was reached on (its `Host` header): a genuine same-origin request from the UI does; a cross-site OR
+ * cross-PORT page does not. (A bare loopback check is NOT enough — `localhost:OTHER` is loopback too.)
+ * A non-browser client (curl/CI/MCP) sends no Origin → allowed; `Origin: null` (opaque) is refused.
+ * When the user explicitly binds a non-loopback host they've opted into exposure, so the guard steps aside.
+ */
+function originAllowed(originHeader: string | undefined, hostHeader: string | undefined, bindHost: string): boolean {
+  if (!LOOPBACK_BINDS.has(bindHost)) return true;
+  if (originHeader === undefined) return true;
+  if (originHeader === "null") return false;
+  try {
+    // `URL.host` is `hostname:port` (port omitted only for the scheme default). It must equal the
+    // Host header the request arrived on — same scheme-host-port = same origin.
+    return new URL(originHeader).host === hostHeader;
+  } catch {
+    return false;
+  }
+}
+
 const MIME: Record<string, string> = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript",
@@ -93,11 +117,21 @@ export async function startWebServer(opts: WebServerOptions = {}): Promise<WebSe
 
   const server = createServer((req, res) => {
     void (async () => {
+      // Never allow the local UI to be framed by another site (clickjacking + the `?run=all`
+      // deep-link auto-executing inside a hidden iframe). Set before any writeHead so it merges
+      // into every response.
+      res.setHeader("X-Frame-Options", "DENY");
+      res.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
       if (!hostAllowed(req.headers.host, host)) {
         res.writeHead(403, { "content-type": "text/plain" });
         res.end("Forbidden: unexpected Host header");
         return;
       }
+      if (!originAllowed(req.headers.origin, req.headers.host, host)) {
+        res.writeHead(403, { "content-type": "text/plain" });
+        res.end("Forbidden: cross-origin request refused");
+        return;
+      }
       // A malformed request URL (e.g. a bad %-escape) makes `new URL`/decodeURIComponent
       // throw; without this guard the throw becomes an unhandledRejection that hangs the
       // socket and crashes the process. Answer with 400 instead.
diff --git a/packages/web/src/App.tsx b/packages/web/src/App.tsx
index 8d6e287..3ce49d8 100644
--- a/packages/web/src/App.tsx
+++ b/packages/web/src/App.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import {
   coverage as apiCoverage,
   drift as apiDrift,
@@ -201,6 +201,8 @@ export function App() {
   return (
     <div className="app">
       <header className="topbar">
+        {/* The visible brand is decorative styling; this is the document's real top-level heading. */}
+        <h1 className="sr-only">TruSpec — local-first API client</h1>
         <div className="brand">
           <span className="logo">◢◤</span>
           <span className="word">
@@ -267,7 +269,7 @@ export function App() {
             spec <span className="count">{state?.specs.length ?? 0}</span>
           </div>
           <div className="spec-pick">
-            <select value={spec} onChange={(e) => setSpec(e.target.value)}>
+            <select aria-label="OpenAPI spec" value={spec} onChange={(e) => setSpec(e.target.value)}>
               <option value="">(choose spec)</option>
               {state?.specs.map((s) => (
                 <option key={s} value={s}>
@@ -318,7 +320,7 @@ export function App() {
           )}
         </main>
 
-        <section className="results">
+        <section className="results" aria-label="run results">
           <div className="rail-head">
             results
             {result && (
@@ -443,6 +445,28 @@ function Editor({
     const p = path.trim();
     if (p) onSave(p, text);
   };
+  // "Esc to cancel" / "⌘/Ctrl+Enter to save" (per the hint) must work the moment the editor is open —
+  // not only when the textarea happens to be focused. A keydown handler scoped to the textarea misses
+  // the path input, the buttons, and the just-opened state (focus still on the "+ new" button). A
+  // document-level listener covers all of those; refs keep it calling the latest save/cancel without
+  // re-binding on every keystroke.
+  const saveRef = useRef(save);
+  saveRef.current = save;
+  const cancelRef = useRef(onCancel);
+  cancelRef.current = onCancel;
+  useEffect(() => {
+    const onKey = (e: KeyboardEvent): void => {
+      if (e.key === "Escape") {
+        e.preventDefault();
+        cancelRef.current();
+      } else if ((e.metaKey || e.ctrlKey) && e.key === "Enter") {
+        e.preventDefault();
+        saveRef.current();
+      }
+    };
+    document.addEventListener("keydown", onKey);
+    return () => document.removeEventListener("keydown", onKey);
+  }, []);
   return (
     <div className="editor">
       <div className="editor-bar">
@@ -450,6 +474,7 @@ function Editor({
         {mode === "new" ? (
           <input
             className="path-input"
+            aria-label="file path"
             value={path}
             spellCheck={false}
             placeholder="folder/name.tspec.yaml"
@@ -468,14 +493,10 @@ function Editor({
       </div>
       <textarea
         className="editor-text"
+        aria-label="request YAML"
         value={text}
         spellCheck={false}
         onChange={(e) => setText(e.target.value)}
-        // Cmd/Ctrl+Enter saves; Esc cancels.
-        onKeyDown={(e) => {
-          if ((e.metaKey || e.ctrlKey) && e.key === "Enter") save();
-          else if (e.key === "Escape") onCancel();
-        }}
       />
       {err ? <div className="editor-err">{err}</div> : <div className="editor-hint muted">validated against the schema on save · ⌘/Ctrl+Enter to save · Esc to cancel</div>}
     </div>
diff --git a/packages/web/src/styles.css b/packages/web/src/styles.css
index e50a4b7..a456baa 100644
--- a/packages/web/src/styles.css
+++ b/packages/web/src/styles.css
@@ -1,3 +1,16 @@
+/* Visually hidden but exposed to assistive tech (screen-reader-only). */
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border: 0;
+}
+
 :root {
   --mono: "IBM Plex Mono", ui-monospace, "SF Mono", Menlo, monospace;
   --sans: "IBM Plex Sans", system-ui, sans-serif;
diff --git a/packages/web/test/api-client.test.ts b/packages/web/test/api-client.test.ts
new file mode 100644
index 0000000..415a6c7
--- /dev/null
+++ b/packages/web/test/api-client.test.ts
@@ -0,0 +1,56 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { coverage, drift, getRequest, getState, run, saveRequest } from "../src/api";
+
+// The client api.ts is browser code but uses the global fetch, so it's unit-testable in node
+// with a stub. We assert the URL + method + body each helper sends, and the error path.
+function stub(impl: (url: string, init?: RequestInit) => Response): { calls: Array<[string, RequestInit | undefined]> } {
+  const calls: Array<[string, RequestInit | undefined]> = [];
+  vi.stubGlobal("fetch", (async (url: string, init?: RequestInit) => { calls.push([String(url), init]); return impl(String(url), init); }) as typeof fetch);
+  return { calls };
+}
+const ok = (body: unknown): Response => new Response(JSON.stringify(body), { status: 200, headers: { "content-type": "application/json" } });
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe("web client api", () => {
+  it("getState GETs /api/state", async () => {
+    const s = stub(() => ok({ dir: "/x", requests: [], environments: [], specs: [] }));
+    const r = await getState();
+    expect(r.dir).toBe("/x");
+    expect(s.calls[0][0]).toBe("/api/state");
+  });
+
+  it("getRequest encodes the path query param", async () => {
+    const s = stub(() => ok({ name: "n", method: "GET", url: "u" }));
+    await getRequest("a b/c.tspec.yaml");
+    expect(s.calls[0][0]).toBe("/api/request?path=a%20b%2Fc.tspec.yaml");
+  });
+
+  it("run POSTs target+env to /api/run", async () => {
+    const s = stub(() => ok({ results: [], passed: 0, failed: 0, ok: true, missingSecrets: [] }));
+    await run("dir", "local");
+    expect(s.calls[0][0]).toBe("/api/run");
+    expect(s.calls[0][1]?.method).toBe("POST");
+    expect(JSON.parse(String(s.calls[0][1]?.body))).toEqual({ target: "dir", env: "local" });
+  });
+
+  it("drift and coverage POST the spec", async () => {
+    const s = stub((url) => ok(url.includes("drift") ? { specOperations: 1, collectionOperations: 0, added: [], removed: [], changed: [], ok: true } : { total: 1, covered: [], uncovered: [], percent: 0, ok: false }));
+    await drift("openapi.yaml");
+    await coverage("openapi.yaml");
+    expect(s.calls.map((c) => c[0])).toEqual(["/api/drift", "/api/coverage"]);
+    expect(JSON.parse(String(s.calls[0][1]?.body))).toEqual({ spec: "openapi.yaml" });
+  });
+
+  it("saveRequest POSTs path+content", async () => {
+    const s = stub(() => ok({ ok: true, path: "x.tspec.yaml" }));
+    const r = await saveRequest("x.tspec.yaml", "name: x");
+    expect(r.ok).toBe(true);
+    expect(JSON.parse(String(s.calls[0][1]?.body))).toEqual({ path: "x.tspec.yaml", content: "name: x" });
+  });
+
+  it("throws on a non-ok HTTP status", async () => {
+    stub(() => new Response("nope", { status: 500 }));
+    await expect(getState()).rejects.toThrow(/HTTP 500/);
+  });
+});
diff --git a/packages/web/test/api.test.ts b/packages/web/test/api.test.ts
index 6dc6989..2a668f4 100644
--- a/packages/web/test/api.test.ts
+++ b/packages/web/test/api.test.ts
@@ -17,6 +17,23 @@ describe("web server api", () => {
     expect(s.environments).toContain("local");
   });
 
+  it("a malformed request file does not 500 /api/state — valid requests load, bad files reported", async () => {
+    const { mkdtempSync, writeFileSync, rmSync } = await import("node:fs");
+    const dir = mkdtempSync(join(tmpdir(), "truspec-web-state-"));
+    try {
+      writeFileSync(join(dir, "good.tspec.yaml"), 'tspec: "0.1"\nname: Good\nmethod: GET\nurl: "http://x"\nassertions: []\n');
+      writeFileSync(join(dir, "broken.tspec.yaml"), "this: is: not: valid\n[}");
+      const r = await handleApi("GET", "/api/state", noQuery, undefined, { dir });
+      expect(r.status).toBe(200); // pre-fix: parse threw → 500, the UI couldn't load at all
+      const s = r.json as { requests: { name: string }[]; errors: { path: string }[] };
+      expect(s.requests.length).toBe(1);
+      expect(s.requests[0].name).toBe("Good");
+      expect(s.errors.map((e) => e.path)).toContain("broken.tspec.yaml");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it("computes drift and coverage", async () => {
     const drift = await handleApi("POST", "/api/drift", noQuery, { spec: "openapi.yaml" }, ctx);
     expect((drift.json as { added: string[] }).added).toContain("GET /pets");
diff --git a/packages/web/test/server.test.ts b/packages/web/test/server.test.ts
index f4e5633..414f1cd 100644
--- a/packages/web/test/server.test.ts
+++ b/packages/web/test/server.test.ts
@@ -64,6 +64,42 @@ describe("web server host guard (DNS-rebinding defense)", () => {
     expect((await post(handle.port, "/api/run", {})).status).toBe(200);
   });
 
+  // CSRF / clickjacking: a malicious site the user visits must not be able to trigger their
+  // collection to run, nor frame the local UI.
+  function reqWith(port: number, method: string, path: string, headers: Record<string, string>): Promise<{ status: number; headers: Record<string, string | string[] | undefined> }> {
+    return new Promise((res, rej) => {
+      // default Host = the real host:port a browser would send (so Origin-vs-Host matching is exercised)
+      const r = httpRequest({ host: "127.0.0.1", port, path, method, headers: { host: `localhost:${port}`, ...headers } }, (resp) => {
+        resp.resume();
+        resp.on("end", () => res({ status: resp.statusCode ?? 0, headers: resp.headers }));
+      });
+      r.on("error", rej);
+      r.end(method === "POST" ? "{}" : undefined);
+    });
+  }
+
+  it("refuses cross-origin POSTs — cross-site AND cross-PORT loopback (CSRF defense)", async () => {
+    const p = handle.port;
+    // a 'simple' cross-origin request (text/plain skips preflight) must be rejected before it runs
+    expect((await reqWith(p, "POST", "/api/run", { origin: "http://evil.com", "content-type": "text/plain" })).status).toBe(403);
+    expect((await reqWith(p, "POST", "/api/run", { origin: "null", "content-type": "text/plain" })).status).toBe(403);
+    // a page on ANOTHER LOCAL PORT is still cross-origin — a bare loopback check would wrongly allow it
+    expect((await reqWith(p, "POST", "/api/run", { origin: `http://localhost:${p + 1}`, "content-type": "text/plain" })).status).toBe(403);
+    expect((await reqWith(p, "POST", "/api/run", { origin: "http://127.0.0.1:9999", "content-type": "text/plain" })).status).toBe(403);
+  });
+
+  it("allows same-origin (matching Host) and origin-less (curl/CI/MCP) API requests", async () => {
+    const p = handle.port;
+    expect((await reqWith(p, "POST", "/api/run", { origin: `http://localhost:${p}`, "content-type": "application/json" })).status).toBe(200);
+    expect((await reqWith(p, "POST", "/api/run", { "content-type": "application/json" })).status).toBe(200); // no Origin
+  });
+
+  it("sends anti-framing headers on every response (clickjacking defense)", async () => {
+    const r = await reqWith(handle.port, "GET", "/", {});
+    expect(r.headers["x-frame-options"]).toBe("DENY");
+    expect(String(r.headers["content-security-policy"])).toMatch(/frame-ancestors 'none'/);
+  });
+
   it("survives a POST aborted mid-body without an unhandledRejection", async () => {
     const seen: unknown[] = [];
     const onRej = (e: unknown): void => {
diff --git a/packages/web/test/xss.test.ts b/packages/web/test/xss.test.ts
new file mode 100644
index 0000000..ca3757a
--- /dev/null
+++ b/packages/web/test/xss.test.ts
@@ -0,0 +1,46 @@
+import { createElement as h } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it } from "vitest";
+
+const prettyBody = (text: string): string => { try { return JSON.stringify(JSON.parse(text), null, 2); } catch { return text; } };
+const PAYLOADS = [
+  `<img src=x onerror="document.title='X'">`,
+  `<script>document.title='X'</script>`,
+  `<svg onload="alert(1)"></svg>`,
+  `"><iframe src=javascript:alert(1)>`,
+  `</pre><img src=y onerror=alert(1)>`,
+];
+
+describe("QA C7 — web UI XSS: React escapes all collection data", () => {
+  it("name/url/docs/body/assert/captured/KV render escaped, never executable", () => {
+    for (const p of PAYLOADS) {
+      const html = renderToStaticMarkup(
+        h("div", null,
+          h("span", { className: "rname" }, p),
+          h("code", { className: "url" }, p),
+          h("p", { className: "docs" }, p),
+          h("div", { className: "speclink" }, "spec ▸ ", p),
+          h("pre", { className: "body" }, prettyBody(p)),
+          h("span", { className: "amsg" }, p),
+          h("div", { className: "captured" }, "captured: ", `k=${p}`),
+          h("span", { className: "kv-k" }, p),
+          h("span", { className: "kv-v" }, String(p)),
+          h("code", { className: "assert-def" }, JSON.stringify({ type: "body", contains: p })),
+        ),
+      );
+      expect(html).not.toContain("<img src=x onerror");
+      expect(html).not.toContain("<img src=y onerror");
+      expect(html).not.toContain("<script>document.title");
+      expect(html).not.toContain("<svg onload");
+      expect(html).not.toContain("<iframe");
+      expect(html).toMatch(/&lt;|&gt;/);
+    }
+  });
+
+  it("a JSON response body containing HTML stays inside the escaped <pre>", () => {
+    const body = JSON.stringify({ note: `</pre><script>document.title='PWNED'</script>` });
+    const html = renderToStaticMarkup(h("pre", { className: "body" }, prettyBody(body)));
+    expect(html).not.toContain("</pre><script>");
+    expect(html).not.toContain("<script>document.title");
+  });
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d8154e8..d596e82 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -8,6 +8,12 @@ importers:
 
   .:
     devDependencies:
+      '@stryker-mutator/core':
+        specifier: ^9.6.1
+        version: 9.6.1(@types/node@22.19.21)
+      '@stryker-mutator/vitest-runner':
+        specifier: ^9.6.1
+        version: 9.6.1(@stryker-mutator/core@9.6.1(@types/node@22.19.21))(vitest@2.1.9(@types/node@22.19.21))
       '@types/node':
         specifier: ^22.10.2
         version: 22.19.21
@@ -202,14 +208,28 @@ packages:
     resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/helper-annotate-as-pure@7.29.7':
+    resolution: {integrity: sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/helper-compilation-targets@7.29.7':
     resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/helper-create-class-features-plugin@7.29.7':
+    resolution: {integrity: sha512-IY3ZD9Tmooqr3TUhc3DUWxiuo8xx1DWLhd5M7hQ+ZWJamqM2BbalrBJb2MisSLoYorOj75U03qULCxQTY9r3hg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
   '@babel/helper-globals@7.29.7':
     resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/helper-member-expression-to-functions@7.29.7':
+    resolution: {integrity: sha512-j+7JYmk1JYDtACIGj0QJqqWZjoUpMoEikQGADMaHgCMCSDqd2+P32rfcibUNrGOMWrlzK1WJBdxrB3JJQZwWtg==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/helper-module-imports@7.29.7':
     resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
     engines: {node: '>=6.9.0'}
@@ -220,10 +240,24 @@ packages:
     peerDependencies:
       '@babel/core': ^7.0.0
 
+  '@babel/helper-optimise-call-expression@7.29.7':
+    resolution: {integrity: sha512-+kmGVjcT9RGYzoDwdwEqEvGgKe3BYq+O1iGzjFubaNgZHwYHP6lsF2Yghf4kEuv9BV7tYDZ913aBW9am6YKong==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/helper-plugin-utils@7.29.7':
     resolution: {integrity: sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/helper-replace-supers@7.29.7':
+    resolution: {integrity: sha512-atfGXWSeCiF4DnKZIfmJfQRkSw9b9gNNXR1kqKjbhG4pGYCOnkp8OcTB8E3NXjBu8NpheSnOeNKz8KT7UNFTmQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-skip-transparent-expression-wrappers@7.29.7':
+    resolution: {integrity: sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/helper-string-parser@7.29.7':
     resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
     engines: {node: '>=6.9.0'}
@@ -245,6 +279,48 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
 
+  '@babel/plugin-proposal-decorators@7.29.7':
+    resolution: {integrity: sha512-EtU0Hi3GvrTqD56xKmZvV/uCXK2ZbwVNPNLAquVItcAZpUhkXwWlo3Fmj0c2LxgSf2I8IDULeAepwNP1OefLXg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-decorators@7.29.7':
+    resolution: {integrity: sha512-9MTTLbF39X6sqM92JPEsoI7++26hjZvzkxKZy64aMhWLH2mPkJ/Q3AV4QLmls3R14FpSpkOwQQfUh962JGQxxg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-jsx@7.29.7':
+    resolution: {integrity: sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-typescript@7.29.7':
+    resolution: {integrity: sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-destructuring@7.29.7':
+    resolution: {integrity: sha512-iPX8aD6H9zV5s7ZsqTdNocPN/MGQ5sSMnElKrktxjJRMnB2jN/1p2+R7GkfD6CAYoVFqy5A4XnSIUeGgJzIWpg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-explicit-resource-management@7.29.7':
+    resolution: {integrity: sha512-Rstj7coNz8sE+7Ju7ihpHLI564lsK5pUpNNlvptCIC/16E/S5hbl6n3kESPKdNRmqEWlpn5xpS5Q2dvXBsySLw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-modules-commonjs@7.29.7':
+    resolution: {integrity: sha512-j0vCldybPC5b5dwCQOJ21uKtHzt7hxLygJTg9eF1ScfaikEDNfzn94XoW5Fi+seBR0nCyL23xaBFFkq7dTM8XQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
   '@babel/plugin-transform-react-jsx-self@7.29.7':
     resolution: {integrity: sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==}
     engines: {node: '>=6.9.0'}
@@ -257,6 +333,18 @@ packages:
     peerDependencies:
       '@babel/core': ^7.0.0-0
 
+  '@babel/plugin-transform-typescript@7.29.7':
+    resolution: {integrity: sha512-jK52h8LaLc7JarhQV2ofeFMts4H7vnOXnqZNA6fYglBTZewRBE51KWt3BUltW1P+KoPsYkHoJeXePuz4zo2LMw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/preset-typescript@7.28.5':
+    resolution: {integrity: sha512-+bQy5WOI2V6LJZpPVxY+yp66XdZ2yifu0Mc1aP5CQKgjn4QM5IN2i5fAZ4xKop47pr8rpVhiAeu+nDQa12C8+g==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
   '@babel/template@7.29.7':
     resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
     engines: {node: '>=6.9.0'}
@@ -763,6 +851,140 @@ packages:
   '@iconify/types@2.0.0':
     resolution: {integrity: sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==}
 
+  '@inquirer/ansi@2.0.7':
+    resolution: {integrity: sha512-3eTuUO1vH2cZm2ZKHeQxnOqlTi9EfZDGgIe3BL3I4u+rJHocr9Fz86M4fjYABPvFnQG/gGK551HqDiIcETwU6Q==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/checkbox@5.2.1':
+    resolution: {integrity: sha512-b6xmA/VlTe0ZgDQHDui+Nav470u7u49nRd8/iuhOcQPO9Ch7lGuogydhi2VOmNlZ+zXcM8IcPuNSwQcdJaF/kw==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/confirm@6.1.1':
+    resolution: {integrity: sha512-eb8DBZcz/2qHWQda4rk2JiQk5h9QV/cVHi1yjt0f69WFZMRFn0sJTye3EAP8icut8UDMjQPsaH5KbcOogefrFQ==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/core@11.2.1':
+    resolution: {integrity: sha512-Qd6GJT1yVyrZZCfN8W2qKF5ApmqryXRhRKCuip8h01x2w/esJQ2XIYc6f9abMIHgKQdBfFTSOdbHRLAhuM09UA==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/editor@5.2.2':
+    resolution: {integrity: sha512-ZRVd/oD+sYsUd5zVm0NflqEzlqfYCyHNsqkHl2oWXEUHs12tCbcSFi+wVFEvD8+LGRaMUsVrE7qeo6lSG/S1Vg==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/expand@5.1.1':
+    resolution: {integrity: sha512-YmQpenjbFSHAK3sOd44puHh3V1KXXr+JiNpUztoSQ4drLh2rTVzTap/YtlAVu/5xavifIlBfNEzJ/neZJ1a/1g==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/external-editor@3.0.3':
+    resolution: {integrity: sha512-6thf5I8q7lZwzGLAxPaaGEREEkZ3nyePPDQ1oyobblxmEE8mqTLguScP7pDjUTAibiyb4hfXl+qjUEJ+di/aNA==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/figures@2.0.7':
+    resolution: {integrity: sha512-aJ8TBPOGB6f/2qziPfElISTCEd5XOYTFckA2SGjhNmiKzfK/u4ot3v0DUzGVdUnKjN10EqnnEPck36BkyfLnJw==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/input@5.1.2':
+    resolution: {integrity: sha512-9K/DDBSQpOyZSkt6sOVP9Vo0TR7atX2kuILsUu0x3wVcVbe97lJwIJKMLdMw25tDYuXl/qp6erT0Xs1rfmcfZg==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/number@4.1.1':
+    resolution: {integrity: sha512-XF4IXAbPnGPgw0wsbC/i2tPcyfdZgDpUlhsqU0SfT4IRIGWha6Xm9VRgN5yYxJq+jnyXlfXI/nQ3ulfk0iEICA==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/password@5.1.1':
+    resolution: {integrity: sha512-3XBfF7DAsp5qeDsvN5Rd1HmbNokVvEQoUM0QLrRcybC9nX96w3Pbmu7qUsb3IT3J3jBvs2+mTXaKHOUsgHMLzg==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/prompts@8.5.2':
+    resolution: {integrity: sha512-IYR/3C/paEVVQYQvdDlFZVjRCJVYHHON0XXMH91KO9GSxs0TdKYWlUdvfQl2EfAHDxUaN3IBffkE/BDTh5nJ6g==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/rawlist@5.3.1':
+    resolution: {integrity: sha512-QqdTqQddL3qPX/PPrjobpsO25NZ4dWXgTLenrR445L2ptLEYE6Z+PD5c5CNDJNx4ugRgELAIpSIJxZaO2jJ2Og==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/search@4.2.1':
+    resolution: {integrity: sha512-xJj8QWKRSrfKoBIITLZK61dD3zwo0Rz11fgDImku30/Oe81zMdIdGgrLY2h6RkJ+KZ/GhNYIRMKnH/62qBTA5g==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/select@5.2.1':
+    resolution: {integrity: sha512-FlDndEUww8m7BfukO2nJa25vhD+H5jxxCv4oGioKqzyWz3nPHhhw4LKdYRSlXuAx7DsdWia7iyaBPKKS95Evfw==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/type@4.0.7':
+    resolution: {integrity: sha512-t28inv14nMQ1PhKpsJPY+kEs/c00qzeCOS2gTNRyTjG5d6qsVA2fItxW4hkvGZ5lvanGLdtCzVIx5dwdRpN1+g==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
   '@isaacs/cliui@8.0.2':
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
     engines: {node: '>=12'}
@@ -929,6 +1151,9 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@sec-ant/readable-stream@0.4.1':
+    resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==}
+
   '@shikijs/core@2.5.0':
     resolution: {integrity: sha512-uu/8RExTKtavlpH7XqnVYBrfBkUc20ngXiX9NSrBhOVZYv/7XQRKUyhtkeflY5QsxC0GbJThCerruZfsUaSldg==}
 
@@ -953,6 +1178,33 @@ packages:
   '@shikijs/vscode-textmate@10.0.2':
     resolution: {integrity: sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==}
 
+  '@sindresorhus/merge-streams@4.0.0':
+    resolution: {integrity: sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
+    engines: {node: '>=18'}
+
+  '@stryker-mutator/api@9.6.1':
+    resolution: {integrity: sha512-g8VNoFWQWbx0pdal3Vt8jVCZW+v3sc3gi94iI0GVtVgUGTqphAjJF6EAruPTx0lqvtonsaAxn5TD36hcG1d6Wg==}
+    engines: {node: '>=20.0.0'}
+
+  '@stryker-mutator/core@9.6.1':
+    resolution: {integrity: sha512-WMgnvf+Wyh/yiruhNZwc8w8DlzmmjXhPjSn5MR8RhAXzlnWji8TQrUYgBUkHk9bEgSaIlB3KZHm37iiU5Q2cLQ==}
+    engines: {node: '>=20.0.0'}
+    hasBin: true
+
+  '@stryker-mutator/instrumenter@9.6.1':
+    resolution: {integrity: sha512-5K8wH4Pthly25c2uKKik4Dfcoeou7sbJdFS6u3QIYHlulgFVDJwtEMWTZGkZfs7IiUEXIDNa0keRACq5jn5AvA==}
+    engines: {node: '>=20.0.0'}
+
+  '@stryker-mutator/util@9.6.1':
+    resolution: {integrity: sha512-Lk/ALVctJjFv1vvwR+CFoKzDCWvsBlq7flDUnmnpuwTrGbm156EdZD1Jjq4o8KdOap0ezUZqQNE9OAI1m2+pUQ==}
+
+  '@stryker-mutator/vitest-runner@9.6.1':
+    resolution: {integrity: sha512-eyUHTCf3Ui+SUn/tpFJwzw6MV391kyBLZk/cDHFUfKFELqKMLbvd7e81axArlApKqO6cOnLfrxlwED+2SRN0ow==}
+    engines: {node: '>=14.18.0'}
+    peerDependencies:
+      '@stryker-mutator/core': 9.6.1
+      vitest: '>=2.0.0'
+
   '@turbo/darwin-64@2.9.18':
     resolution: {integrity: sha512-9f27peFu16ur8c0v9nUFUEyBnbKuuFsUTjHFWfmwGfzySBXbHwzU44QhZon6Mznz0cHsIr3984NQj/bVrnGSRw==}
     cpu: [x64]
@@ -1195,6 +1447,9 @@ packages:
       ajv:
         optional: true
 
+  ajv@8.18.0:
+    resolution: {integrity: sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==}
+
   ajv@8.20.0:
     resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
 
@@ -1202,6 +1457,10 @@ packages:
     resolution: {integrity: sha512-af+rI+tUVeS9KWHPAZQHIHPOIC3StPRR6IwQu2nz1aQoTL6Gs5Ty3KsHCgbXMHOpoh9QqSjq8F3KJ8xmaCZSBA==}
     engines: {node: '>= 14.0.0'}
 
+  angular-html-parser@10.4.0:
+    resolution: {integrity: sha512-++nLNyZwRfHqFh7akH5Gw/JYizoFlMRz0KRigfwfsLqV8ZqlcVRb1LkPEWdYvEKDnbktknM2J4BXaYUGrQZPww==}
+    engines: {node: '>= 14'}
+
   ansi-regex@5.0.1:
     resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
     engines: {node: '>=8'}
@@ -1288,12 +1547,19 @@ packages:
     resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==}
     engines: {node: '>=18'}
 
+  chalk@5.6.2:
+    resolution: {integrity: sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==}
+    engines: {node: ^12.17.0 || ^14.13 || >=16.0.0}
+
   character-entities-html4@2.1.0:
     resolution: {integrity: sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==}
 
   character-entities-legacy@3.0.0:
     resolution: {integrity: sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==}
 
+  chardet@2.2.0:
+    resolution: {integrity: sha512-rddelWYNPRrXq6PtNEN2S3f6t9ILzvqaN5pVgi4kqt9jHQaXIial9PznB5iSPVlQSLNaaH22ItWz3EJtQ10+OA==}
+
   check-error@2.1.3:
     resolution: {integrity: sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==}
     engines: {node: '>= 16'}
@@ -1302,6 +1568,10 @@ packages:
     resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
     engines: {node: '>= 14.16.0'}
 
+  cli-width@4.1.0:
+    resolution: {integrity: sha512-ouuZd4/dm2Sw5Gmqy6bGyNNNe1qt9RpmxveLSO7KcgsTnU7RXfsw+/bukWGo1abgBiMAic068rclZsO4IWmmxQ==}
+    engines: {node: '>= 12'}
+
   color-convert@2.0.1:
     resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
     engines: {node: '>=7.0.0'}
@@ -1312,6 +1582,10 @@ packages:
   comma-separated-tokens@2.0.3:
     resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==}
 
+  commander@14.0.3:
+    resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
+    engines: {node: '>=20'}
+
   commander@4.1.1:
     resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
     engines: {node: '>= 6'}
@@ -1382,9 +1656,15 @@ packages:
     resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
     engines: {node: '>=6'}
 
+  des.js@1.1.0:
+    resolution: {integrity: sha512-r17GxjhUCjSRy8aiJpr8/UadFIzMzJGexI3Nmz4ADi9LYSFx4gTBp80+NaX/YsXWWLhpZ7v/v/ubEc/bCNfKwg==}
+
   devlop@1.1.0:
     resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
 
+  diff-match-patch@1.0.5:
+    resolution: {integrity: sha512-IayShXAgj/QMXgB0IWmKx+rOPuGMhqm5w6jvFxmVenXKIzRqTAAsbBPT3kWQeGANj3jGgvcvv4yK6SxqYmikgw==}
+
   dunder-proto@1.0.1:
     resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
     engines: {node: '>= 0.4'}
@@ -1401,6 +1681,9 @@ packages:
   emoji-regex-xs@1.0.0:
     resolution: {integrity: sha512-LRlerrMYoIDrT6jgpeZ2YYl/L8EulRTt5hQcYjy5AInh7HWXKimpqx68aknBFpGL2+/IcogTcaydJEgaTmOpDg==}
 
+  emoji-regex@10.6.0:
+    resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
+
   emoji-regex@8.0.0:
     resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
 
@@ -1470,6 +1753,10 @@ packages:
     resolution: {integrity: sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==}
     engines: {node: '>=18.0.0'}
 
+  execa@9.6.1:
+    resolution: {integrity: sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA==}
+    engines: {node: ^18.19.0 || >=20.5.0}
+
   expect-type@1.3.0:
     resolution: {integrity: sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==}
     engines: {node: '>=12.0.0'}
@@ -1487,9 +1774,18 @@ packages:
   fast-deep-equal@3.1.3:
     resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
 
+  fast-string-truncated-width@3.0.3:
+    resolution: {integrity: sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g==}
+
+  fast-string-width@3.0.2:
+    resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
+
   fast-uri@3.1.2:
     resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}
 
+  fast-wrap-ansi@0.2.2:
+    resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
+
   fdir@6.5.0:
     resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
     engines: {node: '>=12.0.0'}
@@ -1499,6 +1795,10 @@ packages:
       picomatch:
         optional: true
 
+  figures@6.1.0:
+    resolution: {integrity: sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg==}
+    engines: {node: '>=18'}
+
   finalhandler@2.1.1:
     resolution: {integrity: sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==}
     engines: {node: '>= 18.0.0'}
@@ -1541,6 +1841,10 @@ packages:
     resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
     engines: {node: '>= 0.4'}
 
+  get-stream@9.0.1:
+    resolution: {integrity: sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA==}
+    engines: {node: '>=18'}
+
   glob@10.5.0:
     resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==}
     deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
@@ -1585,6 +1889,10 @@ packages:
     resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
     engines: {node: '>= 0.8'}
 
+  human-signals@8.0.1:
+    resolution: {integrity: sha512-eKCa6bwnJhvxj14kZk5NCPc6Hb6BdsU9DZcOnmQKSnO1VKrfV0zCvtttPZUsBvjmNDn8rpcJfpwSYnHBjc95MQ==}
+    engines: {node: '>=18.18.0'}
+
   iconv-lite@0.7.2:
     resolution: {integrity: sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==}
     engines: {node: '>=0.10.0'}
@@ -1604,9 +1912,21 @@ packages:
     resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
     engines: {node: '>=8'}
 
+  is-plain-obj@4.1.0:
+    resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==}
+    engines: {node: '>=12'}
+
   is-promise@4.0.0:
     resolution: {integrity: sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==}
 
+  is-stream@4.0.1:
+    resolution: {integrity: sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A==}
+    engines: {node: '>=18'}
+
+  is-unicode-supported@2.1.0:
+    resolution: {integrity: sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ==}
+    engines: {node: '>=18'}
+
   is-what@5.5.0:
     resolution: {integrity: sha512-oG7cgbmg5kLYae2N5IVd3jm2s+vldjxJzK1pcu9LfpGuQ93MQSzo0okvRna+7y5ifrD+20FE8FvjusyGaz14fw==}
     engines: {node: '>=18'}
@@ -1640,6 +1960,9 @@ packages:
     resolution: {integrity: sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==}
     engines: {node: '>=10'}
 
+  js-md4@0.3.2:
+    resolution: {integrity: sha512-/GDnfQYsltsjRswQhN9fhv3EMw2sCpUdrdxyWDOUK7eyD++r3gRhzgiQgc/x4MAv2i1iuQ4lxO5mvqM3vj4bwA==}
+
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
@@ -1648,6 +1971,9 @@ packages:
     engines: {node: '>=6'}
     hasBin: true
 
+  json-rpc-2.0@1.7.1:
+    resolution: {integrity: sha512-JqZjhjAanbpkXIzFE7u8mE/iFblawwlXtONaCvRqI+pyABVz7B4M1EUNpyVW+dZjqgQ2L5HFmZCmOCgUKm00hg==}
+
   json-schema-traverse@1.0.0:
     resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
 
@@ -1670,6 +1996,9 @@ packages:
     resolution: {integrity: sha512-IXO6OCs9yg8tMKzfPZ1YmheJbZCiEsnBdcB03l0OcfK9prKnJb96siuHCr5Fl37/yo9DnKU+TLpxzTUspw9shg==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
+  lodash.groupby@4.6.0:
+    resolution: {integrity: sha512-5dcWxm23+VAoz+awKmBaiBvzox8+RqMgFhi7UvX9DHZr2HdxHXM/Wrf8cfKpsW37RNrvtPn6hSwNqurSILbmJw==}
+
   loose-envify@1.4.0:
     resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
     hasBin: true
@@ -1734,6 +2063,9 @@ packages:
     resolution: {integrity: sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==}
     engines: {node: '>=18'}
 
+  minimalistic-assert@1.0.1:
+    resolution: {integrity: sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==}
+
   minimatch@10.2.5:
     resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
     engines: {node: 18 || 20 || >=22}
@@ -1758,6 +2090,23 @@ packages:
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
+  mutation-server-protocol@0.4.1:
+    resolution: {integrity: sha512-SBGK0j8hLDne7bktgThKI8kGvGTx3rY3LAeQTmOKZ5bVnL/7TorLMvcVF7dIPJCu5RNUWhkkuF53kurygYVt3g==}
+    engines: {node: '>=18'}
+
+  mutation-testing-elements@3.7.3:
+    resolution: {integrity: sha512-SMeIPxngJpfjfNYctFpYQQtlBlZaVO0aoB3FKdwrI8Ee/2bkyUuCZzAOCLv1U9fnmfA37dPFq0Owduoxs2XgGQ==}
+
+  mutation-testing-metrics@3.7.3:
+    resolution: {integrity: sha512-B8QrP0ZomErzTPNlhrzKWPNBln+3afwBZPHv0Q7N8wZZTYxMptzb/Gdm3ExXVmioVYrtZAtsDs7W/T/b2AixOQ==}
+
+  mutation-testing-report-schema@3.7.3:
+    resolution: {integrity: sha512-BHm3MYq+ckO+t5CtlG8zpqxc75rdJCkxVlE+fGuGJM3F7tNCQ/OW2N+TQVHN3BHsYa84+BFc6g3AwDYkUsw2MA==}
+
+  mute-stream@3.0.0:
+    resolution: {integrity: sha512-dkEJPVvun4FryqBmZ5KhDo0K9iDXAwn08tMLDinNdRBNPcYEDiWYysLcc6k3mjTMlbP9KyylvRpd4wFtwrT9rw==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
   mz@2.7.0:
     resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
 
@@ -1774,6 +2123,10 @@ packages:
     resolution: {integrity: sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==}
     engines: {node: '>=18'}
 
+  npm-run-path@6.0.0:
+    resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
+    engines: {node: '>=18'}
+
   object-assign@4.1.1:
     resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
     engines: {node: '>=0.10.0'}
@@ -1795,6 +2148,10 @@ packages:
   package-json-from-dist@1.0.1:
     resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
 
+  parse-ms@4.0.0:
+    resolution: {integrity: sha512-TXfryirbmq34y8QBwgqCVLi+8oA3oWx2eAnSn62ITyEhEYaWRlVZ2DvMM9eZbMs/RfxPu/PK/aBLyGj4IrqMHw==}
+    engines: {node: '>=18'}
+
   parseurl@1.3.3:
     resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
     engines: {node: '>= 0.8'}
@@ -1803,6 +2160,10 @@ packages:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
 
+  path-key@4.0.0:
+    resolution: {integrity: sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==}
+    engines: {node: '>=12'}
+
   path-scurry@1.11.1:
     resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
     engines: {node: '>=16 || 14 >=14.18'}
@@ -1866,6 +2227,14 @@ packages:
   preact@10.29.2:
     resolution: {integrity: sha512-7tNmwg/7mzzAoB/8kSg6Hl37JraAZw3Z3A0JSY7VXlZwo82Xn0G7wKbNNs2qoF4ZEEsQGTwDAroNdqKs1ofJxQ==}
 
+  pretty-ms@9.3.0:
+    resolution: {integrity: sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ==}
+    engines: {node: '>=18'}
+
+  progress@2.0.3:
+    resolution: {integrity: sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==}
+    engines: {node: '>=0.4.0'}
+
   property-information@7.2.0:
     resolution: {integrity: sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==}
 
@@ -1873,6 +2242,10 @@ packages:
     resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
     engines: {node: '>= 0.10'}
 
+  qs@6.15.1:
+    resolution: {integrity: sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==}
+    engines: {node: '>=0.6'}
+
   qs@6.15.2:
     resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==}
     engines: {node: '>=0.6'}
@@ -1931,6 +2304,9 @@ packages:
     resolution: {integrity: sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==}
     engines: {node: '>= 18'}
 
+  rxjs@7.8.2:
+    resolution: {integrity: sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==}
+
   safer-buffer@2.1.2:
     resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
 
@@ -1944,6 +2320,11 @@ packages:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
+  semver@7.7.4:
+    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
   semver@7.8.4:
     resolution: {integrity: sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==}
     engines: {node: '>=10'}
@@ -2038,6 +2419,10 @@ packages:
     resolution: {integrity: sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==}
     engines: {node: '>=12'}
 
+  strip-final-newline@4.0.0:
+    resolution: {integrity: sha512-aulFJcD6YK8V1G7iRB5tigAP4TsHBZZrOV8pjV++zdUwmeV8uzbY7yn6h9MswN62adStNZFuCIx4haBnRuMDaw==}
+    engines: {node: '>=18'}
+
   sucrase@3.35.1:
     resolution: {integrity: sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==}
     engines: {node: '>=16 || 14 >=14.17'}
@@ -2101,6 +2486,9 @@ packages:
   ts-interface-checker@0.1.13:
     resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
 
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
   tsup@8.5.1:
     resolution: {integrity: sha512-xtgkqwdhpKWr3tKPmCkvYmS9xnQK3m3XgxZHwSUjvfTjp7YfXe5tT3GgWi0F2N+ZSMsOeWeZFh7ZZFg5iPhing==}
     engines: {node: '>=18'}
@@ -2120,6 +2508,10 @@ packages:
       typescript:
         optional: true
 
+  tunnel@0.0.6:
+    resolution: {integrity: sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==}
+    engines: {node: '>=0.6.11 <=0.7.0 || >=0.7.3'}
+
   turbo@2.9.18:
     resolution: {integrity: sha512-bwabv6PupzeavybzEoArBAkwq5fnzwf8OFnRtpHwnviFWuwJPFxtyH+aVp36TmIqK3aYYgtTJ3J0m2ysxxSzQg==}
     hasBin: true
@@ -2128,6 +2520,14 @@ packages:
     resolution: {integrity: sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==}
     engines: {node: '>= 18'}
 
+  typed-inject@5.0.0:
+    resolution: {integrity: sha512-0Ql2ORqBORLMdAW89TQKZsb1PQkFGImFfVmncXWe7a+AA3+7dh7Se9exxZowH4kbnlvKEFkMxUYdHUpjYWFJaA==}
+    engines: {node: '>=18'}
+
+  typed-rest-client@2.3.1:
+    resolution: {integrity: sha512-k4kX5Up6qA68D0Cby2AK+6+vM5k3qTxe+/3FqhnHRExjY5cfbOnzjQZbP/LXleF8hVoDvDqxlgk9KK83HoBZlQ==}
+    engines: {node: '>= 16.0.0'}
+
   typescript@5.9.3:
     resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
     engines: {node: '>=14.17'}
@@ -2136,9 +2536,16 @@ packages:
   ufo@1.6.4:
     resolution: {integrity: sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==}
 
+  underscore@1.13.8:
+    resolution: {integrity: sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==}
+
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
+  unicorn-magic@0.3.0:
+    resolution: {integrity: sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==}
+    engines: {node: '>=18'}
+
   unist-util-is@6.0.1:
     resolution: {integrity: sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g==}
 
@@ -2295,6 +2702,9 @@ packages:
       typescript:
         optional: true
 
+  weapon-regex@1.3.6:
+    resolution: {integrity: sha512-wsf1m1jmMrso5nhwVFJJHSubEBf3+pereGd7+nBKtYJ18KoB/PWJOHS3WRkwS04VrOU0iJr2bZU+l1QaTJ+9nA==}
+
   which@2.0.2:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
     engines: {node: '>= 8'}
@@ -2324,6 +2734,10 @@ packages:
     engines: {node: '>= 14.6'}
     hasBin: true
 
+  yoctocolors@2.1.2:
+    resolution: {integrity: sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug==}
+    engines: {node: '>=18'}
+
   zod-to-json-schema@3.25.2:
     resolution: {integrity: sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==}
     peerDependencies:
@@ -2332,6 +2746,9 @@ packages:
   zod@3.25.76:
     resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
 
+  zod@4.4.3:
+    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
+
   zwitch@2.0.4:
     resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==}
 
@@ -2490,6 +2907,10 @@ snapshots:
       '@jridgewell/trace-mapping': 0.3.31
       jsesc: 3.1.0
 
+  '@babel/helper-annotate-as-pure@7.29.7':
+    dependencies:
+      '@babel/types': 7.29.7
+
   '@babel/helper-compilation-targets@7.29.7':
     dependencies:
       '@babel/compat-data': 7.29.7
@@ -2498,8 +2919,28 @@ snapshots:
       lru-cache: 5.1.1
       semver: 6.3.1
 
+  '@babel/helper-create-class-features-plugin@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-annotate-as-pure': 7.29.7
+      '@babel/helper-member-expression-to-functions': 7.29.7
+      '@babel/helper-optimise-call-expression': 7.29.7
+      '@babel/helper-replace-supers': 7.29.7(@babel/core@7.29.7)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.29.7
+      '@babel/traverse': 7.29.7
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/helper-globals@7.29.7': {}
 
+  '@babel/helper-member-expression-to-functions@7.29.7':
+    dependencies:
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/helper-module-imports@7.29.7':
     dependencies:
       '@babel/traverse': 7.29.7
@@ -2516,8 +2957,28 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@babel/helper-optimise-call-expression@7.29.7':
+    dependencies:
+      '@babel/types': 7.29.7
+
   '@babel/helper-plugin-utils@7.29.7': {}
 
+  '@babel/helper-replace-supers@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-member-expression-to-functions': 7.29.7
+      '@babel/helper-optimise-call-expression': 7.29.7
+      '@babel/traverse': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-skip-transparent-expression-wrappers@7.29.7':
+    dependencies:
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/helper-string-parser@7.29.7': {}
 
   '@babel/helper-validator-identifier@7.29.7': {}
@@ -2533,6 +2994,54 @@ snapshots:
     dependencies:
       '@babel/types': 7.29.7
 
+  '@babel/plugin-proposal-decorators@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-create-class-features-plugin': 7.29.7(@babel/core@7.29.7)
+      '@babel/helper-plugin-utils': 7.29.7
+      '@babel/plugin-syntax-decorators': 7.29.7(@babel/core@7.29.7)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-syntax-decorators@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/plugin-transform-destructuring@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+      '@babel/traverse': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-explicit-resource-management@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+      '@babel/plugin-transform-destructuring': 7.29.7(@babel/core@7.29.7)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-modules-commonjs@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
+      '@babel/helper-plugin-utils': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/plugin-transform-react-jsx-self@7.29.7(@babel/core@7.29.7)':
     dependencies:
       '@babel/core': 7.29.7
@@ -2543,6 +3052,28 @@ snapshots:
       '@babel/core': 7.29.7
       '@babel/helper-plugin-utils': 7.29.7
 
+  '@babel/plugin-transform-typescript@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-annotate-as-pure': 7.29.7
+      '@babel/helper-create-class-features-plugin': 7.29.7(@babel/core@7.29.7)
+      '@babel/helper-plugin-utils': 7.29.7
+      '@babel/helper-skip-transparent-expression-wrappers': 7.29.7
+      '@babel/plugin-syntax-typescript': 7.29.7(@babel/core@7.29.7)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/preset-typescript@7.28.5(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+      '@babel/helper-validator-option': 7.29.7
+      '@babel/plugin-syntax-jsx': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-modules-commonjs': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-typescript': 7.29.7(@babel/core@7.29.7)
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/template@7.29.7':
     dependencies:
       '@babel/code-frame': 7.29.7
@@ -2834,6 +3365,125 @@ snapshots:
 
   '@iconify/types@2.0.0': {}
 
+  '@inquirer/ansi@2.0.7': {}
+
+  '@inquirer/checkbox@5.2.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/ansi': 2.0.7
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/figures': 2.0.7
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/confirm@6.1.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/core@11.2.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/ansi': 2.0.7
+      '@inquirer/figures': 2.0.7
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+      cli-width: 4.1.0
+      fast-wrap-ansi: 0.2.2
+      mute-stream: 3.0.0
+      signal-exit: 4.1.0
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/editor@5.2.2(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/external-editor': 3.0.3(@types/node@22.19.21)
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/expand@5.1.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/external-editor@3.0.3(@types/node@22.19.21)':
+    dependencies:
+      chardet: 2.2.0
+      iconv-lite: 0.7.2
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/figures@2.0.7': {}
+
+  '@inquirer/input@5.1.2(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/number@4.1.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/password@5.1.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/ansi': 2.0.7
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/prompts@8.5.2(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/checkbox': 5.2.1(@types/node@22.19.21)
+      '@inquirer/confirm': 6.1.1(@types/node@22.19.21)
+      '@inquirer/editor': 5.2.2(@types/node@22.19.21)
+      '@inquirer/expand': 5.1.1(@types/node@22.19.21)
+      '@inquirer/input': 5.1.2(@types/node@22.19.21)
+      '@inquirer/number': 4.1.1(@types/node@22.19.21)
+      '@inquirer/password': 5.1.1(@types/node@22.19.21)
+      '@inquirer/rawlist': 5.3.1(@types/node@22.19.21)
+      '@inquirer/search': 4.2.1(@types/node@22.19.21)
+      '@inquirer/select': 5.2.1(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/rawlist@5.3.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/search@4.2.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/figures': 2.0.7
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/select@5.2.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/ansi': 2.0.7
+      '@inquirer/core': 11.2.1(@types/node@22.19.21)
+      '@inquirer/figures': 2.0.7
+      '@inquirer/type': 4.0.7(@types/node@22.19.21)
+    optionalDependencies:
+      '@types/node': 22.19.21
+
+  '@inquirer/type@4.0.7(@types/node@22.19.21)':
+    optionalDependencies:
+      '@types/node': 22.19.21
+
   '@isaacs/cliui@8.0.2':
     dependencies:
       string-width: 5.1.2
@@ -2966,6 +3616,8 @@ snapshots:
   '@rollup/rollup-win32-x64-msvc@4.62.0':
     optional: true
 
+  '@sec-ant/readable-stream@0.4.1': {}
+
   '@shikijs/core@2.5.0':
     dependencies:
       '@shikijs/engine-javascript': 2.5.0
@@ -3006,6 +3658,75 @@ snapshots:
 
   '@shikijs/vscode-textmate@10.0.2': {}
 
+  '@sindresorhus/merge-streams@4.0.0': {}
+
+  '@stryker-mutator/api@9.6.1':
+    dependencies:
+      mutation-testing-metrics: 3.7.3
+      mutation-testing-report-schema: 3.7.3
+      tslib: 2.8.1
+      typed-inject: 5.0.0
+
+  '@stryker-mutator/core@9.6.1(@types/node@22.19.21)':
+    dependencies:
+      '@inquirer/prompts': 8.5.2(@types/node@22.19.21)
+      '@stryker-mutator/api': 9.6.1
+      '@stryker-mutator/instrumenter': 9.6.1
+      '@stryker-mutator/util': 9.6.1
+      ajv: 8.18.0
+      chalk: 5.6.2
+      commander: 14.0.3
+      diff-match-patch: 1.0.5
+      emoji-regex: 10.6.0
+      execa: 9.6.1
+      json-rpc-2.0: 1.7.1
+      lodash.groupby: 4.6.0
+      minimatch: 10.2.5
+      mutation-server-protocol: 0.4.1
+      mutation-testing-elements: 3.7.3
+      mutation-testing-metrics: 3.7.3
+      mutation-testing-report-schema: 3.7.3
+      npm-run-path: 6.0.0
+      progress: 2.0.3
+      rxjs: 7.8.2
+      semver: 7.8.4
+      source-map: 0.7.6
+      tree-kill: 1.2.2
+      tslib: 2.8.1
+      typed-inject: 5.0.0
+      typed-rest-client: 2.3.1
+    transitivePeerDependencies:
+      - '@types/node'
+      - supports-color
+
+  '@stryker-mutator/instrumenter@9.6.1':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/plugin-proposal-decorators': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-explicit-resource-management': 7.29.7(@babel/core@7.29.7)
+      '@babel/preset-typescript': 7.28.5(@babel/core@7.29.7)
+      '@stryker-mutator/api': 9.6.1
+      '@stryker-mutator/util': 9.6.1
+      angular-html-parser: 10.4.0
+      semver: 7.7.4
+      tslib: 2.8.1
+      weapon-regex: 1.3.6
+    transitivePeerDependencies:
+      - supports-color
+
+  '@stryker-mutator/util@9.6.1': {}
+
+  '@stryker-mutator/vitest-runner@9.6.1(@stryker-mutator/core@9.6.1(@types/node@22.19.21))(vitest@2.1.9(@types/node@22.19.21))':
+    dependencies:
+      '@stryker-mutator/api': 9.6.1
+      '@stryker-mutator/core': 9.6.1(@types/node@22.19.21)
+      '@stryker-mutator/util': 9.6.1
+      semver: 7.8.4
+      tslib: 2.8.1
+      vitest: 2.1.9(@types/node@22.19.21)
+
   '@turbo/darwin-64@2.9.18':
     optional: true
 
@@ -3272,6 +3993,13 @@ snapshots:
     optionalDependencies:
       ajv: 8.20.0
 
+  ajv@8.18.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-uri: 3.1.2
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
@@ -3296,6 +4024,8 @@ snapshots:
       '@algolia/requester-fetch': 5.55.0
       '@algolia/requester-node-http': 5.55.0
 
+  angular-html-parser@10.4.0: {}
+
   ansi-regex@5.0.1: {}
 
   ansi-regex@6.2.2: {}
@@ -3379,16 +4109,22 @@ snapshots:
       loupe: 3.2.1
       pathval: 2.0.1
 
+  chalk@5.6.2: {}
+
   character-entities-html4@2.1.0: {}
 
   character-entities-legacy@3.0.0: {}
 
+  chardet@2.2.0: {}
+
   check-error@2.1.3: {}
 
   chokidar@4.0.3:
     dependencies:
       readdirp: 4.1.2
 
+  cli-width@4.1.0: {}
+
   color-convert@2.0.1:
     dependencies:
       color-name: 1.1.4
@@ -3397,6 +4133,8 @@ snapshots:
 
   comma-separated-tokens@2.0.3: {}
 
+  commander@14.0.3: {}
+
   commander@4.1.1: {}
 
   confbox@0.1.8: {}
@@ -3442,10 +4180,17 @@ snapshots:
 
   dequal@2.0.3: {}
 
+  des.js@1.1.0:
+    dependencies:
+      inherits: 2.0.4
+      minimalistic-assert: 1.0.1
+
   devlop@1.1.0:
     dependencies:
       dequal: 2.0.3
 
+  diff-match-patch@1.0.5: {}
+
   dunder-proto@1.0.1:
     dependencies:
       call-bind-apply-helpers: 1.0.2
@@ -3460,6 +4205,8 @@ snapshots:
 
   emoji-regex-xs@1.0.0: {}
 
+  emoji-regex@10.6.0: {}
+
   emoji-regex@8.0.0: {}
 
   emoji-regex@9.2.2: {}
@@ -3580,6 +4327,21 @@ snapshots:
     dependencies:
       eventsource-parser: 3.1.0
 
+  execa@9.6.1:
+    dependencies:
+      '@sindresorhus/merge-streams': 4.0.0
+      cross-spawn: 7.0.6
+      figures: 6.1.0
+      get-stream: 9.0.1
+      human-signals: 8.0.1
+      is-plain-obj: 4.1.0
+      is-stream: 4.0.1
+      npm-run-path: 6.0.0
+      pretty-ms: 9.3.0
+      signal-exit: 4.1.0
+      strip-final-newline: 4.0.0
+      yoctocolors: 2.1.2
+
   expect-type@1.3.0: {}
 
   express-rate-limit@8.5.2(express@5.2.1):
@@ -3622,12 +4384,26 @@ snapshots:
 
   fast-deep-equal@3.1.3: {}
 
+  fast-string-truncated-width@3.0.3: {}
+
+  fast-string-width@3.0.2:
+    dependencies:
+      fast-string-truncated-width: 3.0.3
+
   fast-uri@3.1.2: {}
 
+  fast-wrap-ansi@0.2.2:
+    dependencies:
+      fast-string-width: 3.0.2
+
   fdir@6.5.0(picomatch@4.0.4):
     optionalDependencies:
       picomatch: 4.0.4
 
+  figures@6.1.0:
+    dependencies:
+      is-unicode-supported: 2.1.0
+
   finalhandler@2.1.1:
     dependencies:
       debug: 4.4.3
@@ -3683,6 +4459,11 @@ snapshots:
       dunder-proto: 1.0.1
       es-object-atoms: 1.1.2
 
+  get-stream@9.0.1:
+    dependencies:
+      '@sec-ant/readable-stream': 0.4.1
+      is-stream: 4.0.1
+
   glob@10.5.0:
     dependencies:
       foreground-child: 3.3.1
@@ -3736,6 +4517,8 @@ snapshots:
       statuses: 2.0.2
       toidentifier: 1.0.1
 
+  human-signals@8.0.1: {}
+
   iconv-lite@0.7.2:
     dependencies:
       safer-buffer: 2.1.2
@@ -3748,8 +4531,14 @@ snapshots:
 
   is-fullwidth-code-point@3.0.0: {}
 
+  is-plain-obj@4.1.0: {}
+
   is-promise@4.0.0: {}
 
+  is-stream@4.0.1: {}
+
+  is-unicode-supported@2.1.0: {}
+
   is-what@5.5.0: {}
 
   isexe@2.0.0: {}
@@ -3785,10 +4574,14 @@ snapshots:
 
   joycon@3.1.1: {}
 
+  js-md4@0.3.2: {}
+
   js-tokens@4.0.0: {}
 
   jsesc@3.1.0: {}
 
+  json-rpc-2.0@1.7.1: {}
+
   json-schema-traverse@1.0.0: {}
 
   json-schema-typed@8.0.2: {}
@@ -3801,6 +4594,8 @@ snapshots:
 
   load-tsconfig@0.2.5: {}
 
+  lodash.groupby@4.6.0: {}
+
   loose-envify@1.4.0:
     dependencies:
       js-tokens: 4.0.0
@@ -3870,6 +4665,8 @@ snapshots:
     dependencies:
       mime-db: 1.54.0
 
+  minimalistic-assert@1.0.1: {}
+
   minimatch@10.2.5:
     dependencies:
       brace-expansion: 5.0.6
@@ -3893,6 +4690,20 @@ snapshots:
 
   ms@2.1.3: {}
 
+  mutation-server-protocol@0.4.1:
+    dependencies:
+      zod: 4.4.3
+
+  mutation-testing-elements@3.7.3: {}
+
+  mutation-testing-metrics@3.7.3:
+    dependencies:
+      mutation-testing-report-schema: 3.7.3
+
+  mutation-testing-report-schema@3.7.3: {}
+
+  mute-stream@3.0.0: {}
+
   mz@2.7.0:
     dependencies:
       any-promise: 1.3.0
@@ -3905,6 +4716,11 @@ snapshots:
 
   node-releases@2.0.47: {}
 
+  npm-run-path@6.0.0:
+    dependencies:
+      path-key: 4.0.0
+      unicorn-magic: 0.3.0
+
   object-assign@4.1.1: {}
 
   object-inspect@1.13.4: {}
@@ -3925,10 +4741,14 @@ snapshots:
 
   package-json-from-dist@1.0.1: {}
 
+  parse-ms@4.0.0: {}
+
   parseurl@1.3.3: {}
 
   path-key@3.1.1: {}
 
+  path-key@4.0.0: {}
+
   path-scurry@1.11.1:
     dependencies:
       lru-cache: 10.4.3
@@ -3973,6 +4793,12 @@ snapshots:
 
   preact@10.29.2: {}
 
+  pretty-ms@9.3.0:
+    dependencies:
+      parse-ms: 4.0.0
+
+  progress@2.0.3: {}
+
   property-information@7.2.0: {}
 
   proxy-addr@2.0.7:
@@ -3980,6 +4806,10 @@ snapshots:
       forwarded: 0.2.0
       ipaddr.js: 1.9.1
 
+  qs@6.15.1:
+    dependencies:
+      side-channel: 1.1.1
+
   qs@6.15.2:
     dependencies:
       side-channel: 1.1.1
@@ -4064,6 +4894,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  rxjs@7.8.2:
+    dependencies:
+      tslib: 2.8.1
+
   safer-buffer@2.1.2: {}
 
   scheduler@0.23.2:
@@ -4074,6 +4908,8 @@ snapshots:
 
   semver@6.3.1: {}
 
+  semver@7.7.4: {}
+
   semver@7.8.4: {}
 
   send@1.2.1:
@@ -4191,6 +5027,8 @@ snapshots:
     dependencies:
       ansi-regex: 6.2.2
 
+  strip-final-newline@4.0.0: {}
+
   sucrase@3.35.1:
     dependencies:
       '@jridgewell/gen-mapping': 0.3.13
@@ -4248,6 +5086,8 @@ snapshots:
 
   ts-interface-checker@0.1.13: {}
 
+  tslib@2.8.1: {}
+
   tsup@8.5.1(postcss@8.5.15)(typescript@5.9.3)(yaml@2.9.0):
     dependencies:
       bundle-require: 5.1.0(esbuild@0.27.7)
@@ -4276,6 +5116,8 @@ snapshots:
       - tsx
       - yaml
 
+  tunnel@0.0.6: {}
+
   turbo@2.9.18:
     optionalDependencies:
       '@turbo/darwin-64': 2.9.18
@@ -4291,12 +5133,26 @@ snapshots:
       media-typer: 1.1.0
       mime-types: 3.0.2
 
+  typed-inject@5.0.0: {}
+
+  typed-rest-client@2.3.1:
+    dependencies:
+      des.js: 1.1.0
+      js-md4: 0.3.2
+      qs: 6.15.1
+      tunnel: 0.0.6
+      underscore: 1.13.8
+
   typescript@5.9.3: {}
 
   ufo@1.6.4: {}
 
+  underscore@1.13.8: {}
+
   undici-types@6.21.0: {}
 
+  unicorn-magic@0.3.0: {}
+
   unist-util-is@6.0.1:
     dependencies:
       '@types/unist': 3.0.3
@@ -4474,6 +5330,8 @@ snapshots:
     optionalDependencies:
       typescript: 5.9.3
 
+  weapon-regex@1.3.6: {}
+
   which@2.0.2:
     dependencies:
       isexe: 2.0.0
@@ -4501,10 +5359,14 @@ snapshots:
 
   yaml@2.9.0: {}
 
+  yoctocolors@2.1.2: {}
+
   zod-to-json-schema@3.25.2(zod@3.25.76):
     dependencies:
       zod: 3.25.76
 
   zod@3.25.76: {}
 
+  zod@4.4.3: {}
+
   zwitch@2.0.4: {}
diff --git a/qa/COVERAGE.json b/qa/COVERAGE.json
new file mode 100644
index 0000000..97b0936
--- /dev/null
+++ b/qa/COVERAGE.json
@@ -0,0 +1,131 @@
+{
+  "_comment": "Objective convergence state for the measured QA loop. Updated every RECOMPUTE step.",
+  "thresholds": {
+    "lines": 90,
+    "branches": 85,
+    "mutationScore": 80,
+    "fuzzExecsPerTarget": 1000000,
+    "fuzzMinutesPerTarget": 30
+  },
+  "baseline": {
+    "timestamp": "2026-06-23",
+    "tool": "vitest v2.1.9 + v8",
+    "tests": 243,
+    "lines": {
+      "total": 3116,
+      "covered": 2709,
+      "pct": 86.93
+    },
+    "branches": {
+      "total": 1256,
+      "covered": 993,
+      "pct": 79.06
+    },
+    "functions": {
+      "total": 160,
+      "covered": 154,
+      "pct": 96.25
+    }
+  },
+  "current": {
+    "timestamp": "2026-06-23",
+    "tests": 312,
+    "lines": {
+      "pct": 95.18,
+      "covered": 2966,
+      "total": 3116
+    },
+    "branches": {
+      "pct": 86.52,
+      "covered": 1220,
+      "total": 1410
+    },
+    "functions": {
+      "pct": 98.27
+    },
+    "mutationScore": 85.4,
+    "thresholdsMet": {
+      "lines": true,
+      "branches": true,
+      "mutation": "85.4% validate-response.ts >=80",
+      "fuzz": "committed seeded fuzz (5 invariants) + cumulative ~505k execs; 1M/30min = scheduled job",
+      "nonFunctional": "load/soak/leak met (campaign 5); throughput-SLO not measured"
+    }
+  },
+  "frontier": {
+    "_comment": "Lowest-covered files selected for attack (highest line/branch deficit first).",
+    "zeroPct": [
+      "vscode/src/extension.ts (121L)",
+      "cli/src/commands/serve.ts (56L)",
+      "web/src/api.ts (16L)"
+    ],
+    "typeOnlyExcludable": [
+      "core/src/format/types.ts",
+      "core/src/importers/types.ts (has runtime — not excludable)"
+    ],
+    "lowBranch": [
+      "cli/commands/coverage.ts 44%",
+      "cli/commands/gen.ts 55%",
+      "cli/commands/mock.ts 54%",
+      "cli/commands/drift.ts 61%",
+      "spec/report.ts 63%",
+      "cli/output.ts 65%",
+      "mock/server.ts 65%"
+    ]
+  },
+  "mutation": {
+    "tool": "Stryker 9.6.1 + vitest-runner",
+    "scope": "packages/core/src/spec/validate-response.ts (most security-critical; full-repo = scheduled CI job per stryker.config _mutateNote)",
+    "score": 85.4,
+    "killed": 300,
+    "survived": 52,
+    "timeout": 10,
+    "noCoverage": 1,
+    "survivorsJustified": "~18 equivalent (memoization L75-83 cache identity, depth-arithmetic that does not change observable output, jsonType default L27); remainder = low-value boundary + unasserted-message conditionals near the depth>100 cutoff"
+  },
+  "fuzz": {
+    "_comment": "Seeded property fuzz from campaigns 1-10; corpus + seeds persisted under qa/. Counts are cumulative across prior campaigns.",
+    "targets": {
+      "validateAgainstSchema": {
+        "execs": 150000,
+        "lastResult": "0 crashes/hangs (linear, cycle-guarded)"
+      },
+      "resolveRequest_query_fragment": {
+        "execs": 100000,
+        "lastResult": "0 lost params"
+      },
+      "mock_pathToRegex": {
+        "execs": 50000,
+        "lastResult": "linear, no ReDoS"
+      },
+      "importPostman_roundtrip": {
+        "execs": 40000,
+        "lastResult": "0 unparseable emits"
+      },
+      "bruToRequest_roundtrip": {
+        "execs": 30000,
+        "lastResult": "0 round-trip failures"
+      },
+      "parse_request_untrusted": {
+        "execs": 30000,
+        "lastResult": "no crash/hang"
+      },
+      "scaffoldFromSpec": {
+        "execs": 25000,
+        "lastResult": "0 collisions, 0 crashes"
+      },
+      "interpolate": {
+        "execs": 50000,
+        "lastResult": "no ReDoS, no re-injection"
+      },
+      "jsonpath": {
+        "execs": 30000,
+        "lastResult": "no crash"
+      }
+    }
+  },
+  "nonFunctional": {
+    "loadSoak": "mock server 30k req @ ~791rps, heap stable (no leak, forced-GC verified); web 10k req graceful timeouts under 64-conc; runner defeats gzip-bomb/slow-loris (campaign 5).",
+    "slo": "no formal SLO defined for a local-first CLI; throughput-to-a-target-RPS NOT measured (gap)."
+  }
+}
\ No newline at end of file
diff --git a/qa/INVENTORY.md b/qa/INVENTORY.md
new file mode 100644
index 0000000..5fa39bf
--- /dev/null
+++ b/qa/INVENTORY.md
@@ -0,0 +1,106 @@
+# qa/INVENTORY.md — exhaustive testable inventory (Phase 0)
+
+Code-derived. Each item has a stable ID, its inputs/branches, and the attack categories that must hit it.
+Status: `done` = every applicable category exercised AND inside coverage/mutation thresholds; `partial`
+= some categories or below threshold; `gap` = untested.
+
+Legend for categories: F=functional, FZ=fuzz/input, C=concurrency, L=load, S=security, A=api/contract,
+ST=state/lifecycle, U=ui/a11y, O=observability.
+
+## ENTRY POINTS
+
+### CLI (`packages/cli/src`) — `truspec <cmd>`
+| ID | Entry | Inputs | Branches/edges | Categories | Status |
+|----|-------|--------|----------------|------------|--------|
+| CLI-run | `run <path>` | path, --env, --spec, --json, --reporter(junit/json/human), --output, --timeout | bad args→2, no path→2, env-missing→1, 0 reqs→1, ok→0/1, reporter switch | F,FZ,A,S,O | partial (91% L / 90% B) |
+| CLI-drift | `drift <dir> --spec [--live] [--json]` | dir, spec, --live, --json, --min | no spec→2, drift→1, --live probe, --json | F,A,O | partial (77% L / 61% B) |
+| CLI-coverage | `coverage <dir> --spec [--min] [--json]` | dir, spec, --min, --json | no spec→2, below-min→1, --json | F,A,O | partial (73% L / 44% B) |
+| CLI-contract | `contract <dir> --spec [--env] [--json]` | dir, spec, env, timeout, --json | no spec→2, violations→1, error→1 | F,A | partial (85% L / 75% B) |
+| CLI-gen | `gen --spec --out [--base-url-var]` | spec, out, baseUrlVar | missing args→2, write files | F,FZ,A | partial (75% L / 55% B) |
+| CLI-import | `import <postman\|bruno> <path> [--out] [--dry-run]` | source, path, out, dry-run | bad source→2, not-found→1, dry-run, write | F,FZ | partial (75% L / 73% B) |
+| CLI-mock | `mock --spec [--port] [--delay] [--validate]` | spec, port, delay, validate | start server, errors | F,A,S | partial (72% L / 54% B) |
+| CLI-serve | `serve [--dir] [--port] [--host]` | dir, port, host | start web server | F,S,U | **gap (0%)** |
+| CLI-output | junit/json/human formatters | RunResult | XML escape, status class | F,S(xss/inj),O | partial (85% L / 65% B) |
+| CLI-deps | arg helpers (`num`, `emit`, `resolveDeps`) | argv, deps | NaN timeout, output file | F | partial (92% L / 64% B) |
+
+### Core library (`packages/core/src`) — exported functions
+| ID | Function | Inputs | Invariants | Categories | Status |
+|----|----------|--------|------------|------------|--------|
+| CORE-parse | `parse.request/folderConfig/environment .parse/serialize/validate/safeParse` | YAML text / object | strict (unknown keys reject at every level), round-trip stable | F,FZ,A | done (98% L / 87% B) |
+| CORE-validate | `validateAgainstSchema(value,schema,doc)` | untrusted JSON × OpenAPI subset | terminates linear (memo+cycle guard), no false neg on supported keywords | F,FZ,A,L(dos) | partial (93% L / 87% B) |
+| CORE-resolve | `resolveRequest(req,opts)` | url/headers/query/body/auth + vars | query params reach server (before #frag), apikey-in-query preserved | F,FZ,S | done (99% L / 95% B) |
+| CORE-run | `runRequest(req,ctx)` | req + fetch + timeout + maxBytes | never throws; redirect:manual; body cap streams; timeout aborts | F,FZ,C,L,S | done (99% L / 92% B) |
+| CORE-assert | `evaluateAssertions(list,res,contract)` | status/header/jsonpath/body/duration/schema | invalid regex→clean fail (try/catch) | F,FZ,A | done (96% L / 90% B) |
+| CORE-capture | `evaluateCaptures(map,res)` | jsonpath/header/status sources | missing→undefined (not captured) | F,FZ | partial (82% L / 77% B) |
+| CORE-interpolate | `interpolate / interpolateDeep` | `{{var}}` templates, depth/cycles | single-pass (no re-injection), depth cap 256, own-prop guard | F,FZ,S | done (100%) |
+| CORE-jsonpath | `jsonpath(root,path)` | `$.k['k'][n][*].*` | always terminates, own-prop guard | F,FZ | partial (90% L / 79% B) |
+| CORE-script | pre/post `tr` vm | source + vars/response | 1s timeout both; not a security sandbox (trusted) | F,FZ,ST | done (98% L / 88% B) |
+| CORE-openapi | `parseOpenApi / responseSchemaFor / resolveRef` | OpenAPI YAML/JSON | hostile doc→clean throw/skip | F,FZ,A | partial (100% L / 78% B) |
+| CORE-drift | `computeDrift / refMatchesOp / normalizeKey` | spec ops × collection ops | unlinked excluded; operationId/key match | F,A | partial (95% L / 84% B) |
+| CORE-coverage | `computeCoverage` | ops × colOps, minPercent | 0 ops→100%; round | F,A | partial (100% L / 85% B) |
+| CORE-collection | `collectionOperations / requestQueryParams` | parsed requests | `!req.spec` excluded | F | partial (100% L / 71% B) |
+| CORE-live | `probeLiveOperations` | ops, baseUrl, fetch | GET/HEAD only (no mutation), 404/405/0→missing | F,S(ssrf) | partial (93% L / 76% B) |
+| CORE-scaffold | `scaffoldFromSpec / writeScaffold` | spec text → request stubs | unique filenames (dedup), name=key||id non-empty | F,FZ,A | partial (93% L / 84% B) |
+| CORE-report | `driftReport / coverageReport / contractReport` | dir + spec | aggregate; empty handling | F,A,O | partial (79% L / 63% B) |
+| CORE-mock-engine | `createMockResponder / generateExample / pathToRegex / pickResponse` | OpenAPI text → routes | status clamp 200–599, route specificity, depth-6 example cap, no ReDoS | F,FZ,A,L(dos) | partial (87% L / 72% B) |
+| CORE-mock-server | `startMockServer` | OpenAPI text, port, delay, validate | handler try/catch (no crash), drains in-flight | F,FZ,C,L,S | partial (74% L / 65% B) |
+| CORE-importers | `importPostman / bruToRequest / importBrunoDir / writeImport` | Postman json / .bru text | never throw past guard; emits parse-able files; slug-confined paths | F,FZ,S | partial (89% L / 70% B) |
+| CORE-workspace | `runPath / discoverRequests / loadFolderChain / buildVars / loadDotenv` | dir + env + secrets | re-entrant (no cross-call state); secret precedence (OS>env); redact ≥6ch | F,FZ,C,S,ST | partial (93% L / 87% B) |
+| CORE-confine | `confinePath / walkDirSafe` | cwd + target | realpath-confined; symlink-cycle safe; escaped-root not traversed | F,S | partial (100% L / 83% B) |
+
+### MCP server (`packages/mcp-server/src`)
+| ID | Tool | Inputs | Trust boundary | Categories | Status |
+|----|------|--------|----------------|------------|--------|
+| MCP-tools | 11 tools (list/run/create/update/drift/coverage/contract/scaffold/mock start·stop) | tool args (untrusted from LLM) | writes confinePath; reads/runs un-confined (cross-project by design) | F,FZ,S,A | partial (96% L / 88% B) |
+| MCP-server | `createServer` tool dispatch | MCP protocol | stdio (not browser → no CSRF) | F,A | partial (100% L / 60% B) |
+
+### Web server (`packages/web/server`) — `truspec serve`
+| ID | Route | Inputs | Trust boundary | Categories | Status |
+|----|-------|--------|----------------|------------|--------|
+| WEB-state | GET /api/state | — | loopback Host + Origin==Host guard; resilient to bad files | F,S,O | done (api 100% L) |
+| WEB-getreq | GET /api/request?path | path | confinePath | F,S | done |
+| WEB-savereq | POST /api/request | path,content | confinePath + schema validate; no folder.tspec; CSRF-guarded | F,FZ,C,S | done (concurrency tested) |
+| WEB-run | POST /api/run | target,env | confinePath target; env unconfined (loopback only) | F,S | done |
+| WEB-drift/cov | POST /api/drift,/api/coverage | spec | confinePath | F,A | done |
+| WEB-static | GET /* | path | decode→normalize→confine; SPA fallback; MIME | F,S | partial (server.ts 74% L) |
+| WEB-guards | host/origin/frame | Host, Origin headers | DNS-rebinding + CSRF + X-Frame-Options/CSP | S | done (live-browser verified) |
+| WEB-client | React UI (App.tsx) | user interaction | XSS-escaped (react); a11y labeled; keyboard | U,S | partial (Playwright+axe; no DOM unit env) |
+| WEB-client-api | `web/src/api.ts` fetch wrappers | — | same-origin | F | **gap (0%)** |
+
+### VS Code extension (`packages/vscode/src`)
+| ID | Item | Inputs | Categories | Status |
+|----|------|--------|------------|--------|
+| VSC-ext | `activate` + 4 commands + CodeLens | active file, config, picks | F,S | **gap (0%)** |
+| VSC-render | `renderResults/Drift/Coverage` | run/drift/cov reports | S(xss),F | done (esc() + enableScripts:false) |
+
+## STATES & TRANSITIONS
+- ST-run: pre-script → resolve → fetch (redirect:manual) → read(capped) → assert → capture → post-script → result. Each stage error-isolated (never throws).
+- ST-chain: capture(req N) → vars → req N+1 (ordered by `order` then path). Re-entrant per runPath.
+- ST-mockserver: listen → respond(per request, guarded) → close(drains in-flight).
+- ST-webserver: listen → (host/origin guard → route) → close.
+- ST-editor (UI): closed → new/edit → draft → save(ok→refresh / err→stay) / cancel(Esc). Keyboard: Ctrl+Enter, Esc (document-level).
+
+## EXTERNAL DEPENDENCIES & FAILURE MODES
+- DEP-fetch (undici): timeout, reset, slow-loris body, decompression bomb, huge header, bad scheme → all caught→clean error (campaign 5).
+- DEP-fs: missing/partial/symlink/traversal → confinePath/walkDirSafe; ENOENT→{}; bad parse→reported.
+- DEP-yaml: hostile/anchors/`__proto__` → no pollution (Zod fresh objects).
+- DEP-clock: injectable `now`; mock date-time examples are fixed strings (no tz drift).
+- DEP-vscode: only in extension host (test gap).
+
+## DATA INVARIANTS
+- INV-1: a written .tspec.yaml always parses (serialize validates).
+- INV-2: declared secrets (≥6ch) masked in all reported output fields.
+- INV-3: query params authored by the user reach the server (not lost to #fragment).
+- INV-4: mock always replies a valid final HTTP status (200–599).
+- INV-5: validator terminates in time bounded by distinct (value,schema) pairs.
+- INV-6: confinePath never resolves outside cwd (realpath).
+- INV-7: cross-origin browser requests to the web API are refused (Origin==Host).
+
+## CONFIG / ENV / FLAGS
+- env files, project `.env`, OS env (precedence OS>.env>vars); `truspec.environment` (vscode); --host loopback vs exposed (guards step aside when non-loopback — documented).
+
+## TRUST BOUNDARIES
+- TB-1: collection files + specs + imported files + HTTP responses = untrusted bytes (parsers hardened).
+- TB-2: scripts (pre/post) = trusted (your own collection; vm is not a sandbox — documented).
+- TB-3: web UI = loopback-only; cross-origin/cross-port refused; not framable.
+- TB-4: MCP tool args = semi-trusted (LLM, possibly prompt-injected); writes confined.
diff --git a/qa/QA_LOG.md b/qa/QA_LOG.md
new file mode 100644
index 0000000..2095f84
--- /dev/null
+++ b/qa/QA_LOG.md
@@ -0,0 +1,89 @@
+# qa/QA_LOG.md — measured QA loop (v2)
+
+This is the v2 (measurement-driven) continuation. The exhaustive narrative history of **10 prior
+adversarial campaigns (16 bugs A–P found and fixed, 206→243 tests)** lives in the repo-root
+[`QA_LOG.md`](../QA_LOG.md). This file logs the v2 cycles that drive objective convergence
+(coverage / mutation / fuzz thresholds) on top of that already-hardened baseline.
+
+Persistent state (read on startup, write on every RECOMPUTE):
+- `qa/INVENTORY.md` — code-derived testable inventory (Phase 0).
+- `qa/COVERAGE.json` — line/branch/mutation/fuzz state vs thresholds.
+- `qa/TRIED.jsonl` — append-only ledger of executed attacks (never repeat a passing entry).
+- `qa/SEEDS.json` — every PRNG seed used (reproducibility).
+- `qa/corpus/` — persisted fuzz corpus (grows across runs).
+
+## Starting point (this run)
+- Baseline coverage measured: **lines 86.93% (target 90), branches 79.06% (target 85)**, functions 96.25%.
+- 243 tests green, deterministic. Build 5/5, typecheck 7/7.
+- Frontier = the 0%/low-branch files (see COVERAGE.json `frontier`). Bugs A–P already fixed with
+  regression tests, so the engine/runner/spec modules are already 90%+; the deficit is concentrated in
+  the **CLI command wrappers, the serve command, the web client api, and the VS Code extension entry**.
+
+## Cycle v2-1 — close the coverage frontier
+(in progress — see entries below)
+
+### Findings (cycle v2-1)
+- **No new product bugs** — the engine was already hardened by campaigns 1–10 (16 bugs A–P). This cycle
+  is about *measured* coverage of the tests themselves, and it surfaced **test gaps**, not code bugs.
+- **Coverage frontier closed** (+69 tests, 243→312):
+  - 0%→covered: `vscode/src/extension.ts` (vscode-mock test, 10 cases), `cli/src/commands/serve.ts`
+    (3), `web/src/api.ts` (6 fetch-stub).  Excluded pure-type `format/types.ts` (justified).
+  - branch lifts: CLI commands (13 error/flag/--json/--live/--min tests), output formatters (6),
+    Postman importer (6, all auth/body/url variants), mock `generateExample`/`pickResponse` (10).
+  - Result: **lines 86.93→95.18%**, **branch 79.06→86.52%** — both ≥ threshold.
+- **Mutation (Stryker 9.6.1) on the contract validator**: first run 74.9% (incl. 37 no-coverage) with
+  54 survivors → added 10 exact-message/path/edge tests (`validate-response-mutation.test.ts`) →
+  **85.4%** (300 killed, 52 survived, noCov 37→1). Survivors reviewed: ~18 equivalent (memoization &
+  depth-arithmetic that don't change observable output), rest low-value boundary/message conditionals.
+- **Fuzz persisted**: committed `packages/core/test/fuzz.test.ts` (5 seeded invariant targets,
+  deterministic, ~11s) replaces the campaigns' scratch harnesses; seeds in `SEEDS.json`, historical
+  crash inputs in `qa/corpus/crashes.jsonl`.
+
+### Cycle outcome — coverage + mutation thresholds MET. Confirmation: seeded fuzz green; deterministic.
+
+---
+
+# FINAL SUMMARY (v2 — measured)
+
+**Verdict.** On top of 10 prior adversarial campaigns (16 bugs fixed), this run made the suite
+**measurably strong** and **resumable**. Confidence: high for the core engine/CLI/spec/mock/runner
+(coverage + mutation proven); the web UI and load/SLO surfaces are partially measured (browser e2e +
+throughput need CI infra).
+
+**Measured numbers (qa/COVERAGE.json):**
+- Tests: **312** (was 243), deterministic, 36 files green; build 5/5, typecheck 7/7.
+- **Line/Statement coverage: 95.18%** (2966/3116) — threshold 90 ✓
+- **Branch coverage: 86.52%** (1220/1410) — threshold 85 ✓
+- **Mutation score: 85.4%** on `validate-response.ts` (the most security-critical module; 300 killed /
+  52 survived) — threshold 80 ✓. Full-repo mutation = scheduled CI job (796 mutants for 3 modules alone).
+- **Fuzz:** 5 committed seeded invariant targets (no crash/hang/data-loss) + ~505k cumulative campaign
+  execs; corpus persisted. 1M-exec/30-min budget = scheduled continuous-fuzz job (honest gap inline).
+
+**Bugs found this cycle:** 0 product bugs (engine already hardened). Found & fixed **test/coverage
+gaps** (un-exercised CLI error paths, importer variants, the entire VS Code extension entry, the web
+client api) — i.e. the suite was *decorative* over those areas; it now exercises them.
+
+**Top systemic improvement:** the VS Code extension (`activate` + all commands + CodeLens) went from
+**0% → 90%+** via a `vscode` module mock — previously a completely untested public surface.
+
+**Residual risk & honest gaps:**
+- **Mutation measured on 1 module**, not the whole repo (time). The validator is the riskiest; the rest
+  rely on coverage + the fuzz invariants. → scheduled full-repo Stryker job (config ready, `ignoreStatic`).
+- **Continuous fuzzing** to 1M execs/target not run inline (vitest isn't a coverage-guided fuzzer). →
+  scheduled libFuzzer/jazzer-style job seeded from `qa/corpus/`.
+- **Throughput-to-SLO load test** not run (no SLO defined for a local-first CLI). Load/soak/leak *were*
+  verified (campaign 5). → if an SLO is set, add a k6/autocannon gate.
+- **Web UI** unit-coverage excluded (`.tsx` not in coverage; no DOM env). Verified via Playwright+axe
+  (campaigns 7–10, BUG-M/N/O/P). → Playwright e2e CI job.
+- Remaining validator mutants (52): ~18 equivalent (justified), rest low-value.
+
+**Why a re-run is cheap:** `qa/INVENTORY.md` (full testable map), `qa/COVERAGE.json` (thresholds + current
+state), `qa/TRIED.jsonl` (28 executed attacks — never repeated), `qa/SEEDS.json` (all seeds),
+`qa/corpus/` (crash regressions). A re-run loads these, sees thresholds met, and exits at the frontier.
+
+**CI gates to enforce (so regressions can't reintroduce fixes):**
+- Coverage gate: lines ≥ 90, branches ≥ 85 (vitest --coverage, fail under).
+- Mutation gate: Stryker on `packages/core/src/**` weekly, score ≥ 80; block PRs that drop it.
+- `pnpm gen:schema` no-diff check (catches the BUG-G class).
+- Playwright + axe-core e2e (covers BUG-M/N/O/P regressions live).
+- The committed `fuzz.test.ts` on every run + a scheduled deep-fuzz from `qa/corpus/`.
diff --git a/qa/SEEDS.json b/qa/SEEDS.json
new file mode 100644
index 0000000..7cc4b4a
--- /dev/null
+++ b/qa/SEEDS.json
@@ -0,0 +1,16 @@
+{
+  "_comment": "Registry of every PRNG seed used by the property-fuzz harnesses, so runs are reproducible/resumable. mulberry32(seed).",
+  "validator_and_engine_fuzz": [
+    "0x9e3779b9", "0x1234567", "0xdeadbeef", "0xcafef00d", "0x0badc0de", "0x5eed5eed",
+    "0x13572468", "0x0c0ffee5", "0x11111111", "0xa5a5a5a5", "0x33445566", "0xbeefcafe"
+  ],
+  "campaign_seed_sets": {
+    "c2_confirm": ["0x9e3779b9"],
+    "c4_broad": ["0x11111111", "0xa5a5a5a5", "0xdeadbeef", "0x0badf00d", "0xc0ffee99"],
+    "c5_fresh": ["0x2b2b2b2b", "0xfeedface", "0x9e3779b9", "0x1a2b3c4d", "0x77777777"],
+    "c6_final": ["0x33445566", "0xbeefcafe", "0x01234567", "0xfacefeed", "0x8badf00d", "0x5a5a5a5a"],
+    "c7_8th": ["0x0fedcba9", "0x88aa99bb", "0x13572468", "0xdeadfa11", "0x60bb1e5c", "0x11335577"],
+    "c8_9th": ["0xa1b2c3d4", "0x5e6f7a8b", "0xc0ffee42", "0x13371337", "0xf00dbabe"]
+  },
+  "next_unused_seeds": ["0xc10c10c1", "0x5a17ed00", "0x0ddba11", "0xf1f2f3f4", "0xab12cd34"]
+}
diff --git a/qa/TRIED.jsonl b/qa/TRIED.jsonl
new file mode 100644
index 0000000..d4e3664
--- /dev/null
+++ b/qa/TRIED.jsonl
@@ -0,0 +1,28 @@
+{"id":"BUG-1","category":"dos/algorithmic","target":"spec/validate-response.ts","input":"recursive $ref oneOf/anyOf over deep value","result":"FIXED+regression(memoize)","cycle":"c1"}
+{"id":"BUG-2","category":"api/contract","target":"mock/engine.ts","input":"/users/{id} before /users/me","result":"FIXED+regression(specificity)","cycle":"c1"}
+{"id":"BUG-3","category":"api/contract","target":"spec/validate-response.ts","input":"type:[string,null] vs number","result":"FIXED+regression(array type)","cycle":"c2"}
+{"id":"BUG-4","category":"dos/algorithmic","target":"spec/validate-response.ts","input":"recursive allOf direct path","result":"FIXED+regression(collect memo)","cycle":"c1"}
+{"id":"BUG-5","category":"dos/algorithmic","target":"spec/validate-response.ts","input":"primitive/cyclic value vs $ref-cycle","result":"FIXED+regression(visiting guard)","cycle":"c1"}
+{"id":"BUG-A","category":"correctness/data-loss","target":"runner/resolve.ts","input":"url with #fragment + query","result":"FIXED+regression(query before fragment)","cycle":"c2"}
+{"id":"BUG-B","category":"dos/redos","target":"mock/engine.ts","input":"/x/{a}{b}{c}{d}{e}{f} adjacent params","result":"FIXED+regression(collapse to [^/]+)","cycle":"c2"}
+{"id":"BUG-C","category":"api/contract","target":"spec/validate-response.ts","input":"allOf/anyOf/oneOf sibling of required/properties","result":"FIXED+regression(conjunctive)","cycle":"c3"}
+{"id":"BUG-D","category":"cli/exit-code","target":"cli/commands/run.ts","input":"empty dir run","result":"FIXED+test(exit 1 on 0 requests) [behavior change]","cycle":"c2"}
+{"id":"BUG-E","category":"parser/crash","target":"importers/postman.ts","input":"item name=''","result":"FIXED+regression(|| Request)","cycle":"c2"}
+{"id":"BUG-F","category":"codegen/data-loss","target":"spec/scaffold.ts","input":"colliding operationId slugs","result":"FIXED+regression(dedup -2)","cycle":"c3"}
+{"id":"BUG-G","category":"schema/contract","target":"format/schema.ts","input":"nested optional-key typos (exits/operatonId)","result":"FIXED+regression(.strict nested)","cycle":"c3"}
+{"id":"BUG-H","category":"crash/dos","target":"mock/engine.ts+server.ts","input":"spec status 20000 -> writeHead crash","result":"FIXED+regression(clamp+handler try/catch)","cycle":"c4"}
+{"id":"BUG-I","category":"observability","target":"mcp/tools.ts+web/api.ts","input":"one malformed .tspec.yaml aborts listing","result":"FIXED+regression(per-file errors[])","cycle":"c4"}
+{"id":"BUG-J","category":"codegen/crash","target":"spec/scaffold.ts","input":"operationId=''","result":"FIXED+regression(|| key)","cycle":"c4"}
+{"id":"BUG-K","category":"hang/dos","target":"mock/engine.ts","input":"spec status 1xx interim -> client hang","result":"FIXED+regression(clamp 200-599)","cycle":"c4"}
+{"id":"BUG-L","category":"correctness","target":"runner/run.ts","input":"3xx auto-followed, untestable","result":"FIXED+regression(redirect:manual) [behavior change]","cycle":"c5"}
+{"id":"BUG-M","category":"security/csrf","target":"web/server/index.ts","input":"cross-origin simple POST /api/run","result":"FIXED+regression(Origin guard+XFO/CSP)","cycle":"c7"}
+{"id":"BUG-N","category":"security/csrf","target":"web/server/index.ts","input":"cross-PORT loopback origin (live browser)","result":"FIXED+regression(Origin==Host)","cycle":"c8"}
+{"id":"BUG-O","category":"ui/a11y/keyboard","target":"web/src/App.tsx","input":"Esc/Ctrl+Enter only from textarea (live browser)","result":"FIXED(document listener) [no DOM test env]","cycle":"c9"}
+{"id":"BUG-P","category":"ui/a11y/screenreader","target":"web/src/App.tsx+styles.css","input":"unlabeled select/textarea, no h1/landmark (axe-core)","result":"FIXED(aria-label+sr-only h1) [no DOM test env]","cycle":"c10"}
+{"id":"FUZZ-validator","category":"fuzz","target":"validateAgainstSchema","input":"~150k iters 12 seeds recursive $ref","result":"PASS 0 crash/hang slowest~12ms","cycle":"c1-c8"}
+{"id":"FUZZ-resolve","category":"fuzz","target":"resolveRequest","input":"~100k iters url/query/fragment","result":"PASS 0 lost params","cycle":"c4-c8"}
+{"id":"FUZZ-mock-regex","category":"fuzz","target":"pathToRegex","input":"~50k adjacent-param templates","result":"PASS linear","cycle":"c2-c8"}
+{"id":"FUZZ-importers","category":"fuzz","target":"importPostman/bruToRequest","input":"~70k hostile json/.bru","result":"PASS 0 unparseable/round-trip-fail","cycle":"c1-c8"}
+{"id":"HELD-xss","category":"security/xss","target":"web client + vscode webview","input":"img/script/svg payloads (renderToStaticMarkup + live browser + axe)","result":"HELD react-escaped; vscode esc()+enableScripts:false","cycle":"c7-c10"}
+{"id":"HELD-traversal","category":"security/path","target":"confinePath web+mcp+live UI save","input":"../../../etc raw/encoded/null-byte","result":"HELD realpath-confined no escape","cycle":"c1-c9"}
+{"id":"HELD-script-vm","category":"sandbox","target":"runner/script.ts","input":"~1200 random pre/post scripts incl infinite loops","result":"HELD timeout 1s, no crash/unhandled","cycle":"c6"}
diff --git a/qa/corpus/crashes.jsonl b/qa/corpus/crashes.jsonl
new file mode 100644
index 0000000..eda6261
--- /dev/null
+++ b/qa/corpus/crashes.jsonl
@@ -0,0 +1,10 @@
+{"target":"validateAgainstSchema","bug":"BUG-1/4/5","input":"recursive $ref oneOf/anyOf/allOf over deep or cyclic value","was":"exponential / non-terminating","now":"linear (memo+cycle guard)"}
+{"target":"resolveRequest","bug":"BUG-A","input":{"url":"{{baseUrl}}/search#section","query":{"q":"hello"}},"was":"q lost to fragment","now":"q before fragment"}
+{"target":"pathToRegex","bug":"BUG-B","input":"/x/{a}{b}{c}{d}{e}{f}","was":"O(n^k) ReDoS 1886ms","now":"linear [^/]+"}
+{"target":"validateAgainstSchema","bug":"BUG-C","input":{"schema":{"allOf":[{"$ref":"#/Base"}],"required":["id"]},"value":{}},"was":"false-negative (siblings skipped)","now":"conjunctive"}
+{"target":"importPostman","bug":"BUG-E","input":{"item":[{"name":"","request":{"method":"GET","url":"http://x"}}]},"was":"crash name.min(1)","now":"|| Request"}
+{"target":"scaffoldFromSpec","bug":"BUG-F/J","input":"operationId='' or colliding slugs getUser/GetUser","was":"crash / overwrite","now":"|| key + dedup"}
+{"target":"createMockResponder","bug":"BUG-H/K","input":{"responses":{"20000":{},"100":{}}},"was":"writeHead crash / 1xx client hang","now":"clamp 200-599"}
+{"target":"runRequest","bug":"BUG-L","input":"302 redirect server","was":"auto-followed (untestable 3xx)","now":"redirect:manual"}
+{"target":"originAllowed","bug":"BUG-M/N","input":{"Origin":"http://evil.com OR http://localhost:OTHERPORT"},"was":"CSRF executed","now":"Origin==Host"}
+{"target":"interpolate","bug":"re-injection guard","input":{"tmpl":"{{a}}","vars":{"a":"{{b}}","b":"LEAK"}},"expect":"{{b}} not LEAK"}
diff --git a/stryker.config.json b/stryker.config.json
new file mode 100644
index 0000000..a75a23a
--- /dev/null
+++ b/stryker.config.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "./node_modules/@stryker-mutator/core/schema/stryker-schema.json",
+  "_comment": "Scoped to the highest-risk pure-logic modules. Full-repo mutation is left to a scheduled CI job (too slow inline). qa/COVERAGE.json tracks the score.",
+  "packageManager": "pnpm",
+  "testRunner": "vitest",
+  "plugins": ["@stryker-mutator/vitest-runner"],
+  "vitest": { "configFile": "vitest.config.ts" },
+  "coverageAnalysis": "perTest",
+  "reporters": ["clear-text", "json"],
+  "jsonReporter": { "fileName": "qa/mutation-report.json" },
+  "tempDirName": "qa/.stryker-tmp",
+  "concurrency": 4,
+  "timeoutMS": 20000,
+  "ignoreStatic": true,
+  "thresholds": { "high": 90, "low": 80, "break": 80 },
+  "_mutateNote": "Scoped to the most security-critical module (the contract validator) for an inline run; measured 85.4%. A scheduled CI job should expand `mutate` to resolve.ts, mock/engine.ts, runner/run.ts, importers/* (796+ mutants for 3 modules alone — too slow inline).",
+  "mutate": [
+    "packages/core/src/spec/validate-response.ts"
+  ]
+}
diff --git a/vitest.config.ts b/vitest.config.ts
index ff8671d..dcfb33a 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -22,8 +22,13 @@ export default defineConfig({
     coverage: {
       provider: "v8",
       include: ["packages/*/src/**/*.ts"],
-      exclude: ["**/index.ts"],
+      // index.ts = re-export barrels; format/types.ts = pure `z.infer` type aliases (no runtime code,
+      // validated by typecheck). Neither has anything executable to cover.
+      exclude: ["**/index.ts", "packages/core/src/format/types.ts"],
       reporter: ["text-summary"],
+      // CI gate: `pnpm test:coverage` fails if coverage regresses below these. Current: lines 95.18%,
+      // branches 86.52%, functions 98.27% (see qa/COVERAGE.json).
+      thresholds: { lines: 90, branches: 85, functions: 90, statements: 90 },
     },
   },
 });