test(jsoniter): a real oracle for the scanner prefix property — 77 → 58 survivors in +5 test lines

[kryptt]

Merge order: this must merge AFTER #105 (fix/nominal-resolution-onto-main), which is its base. If #105 lands first, rebase this onto main.

improve-test-leverage, jsoniter module. Measured with stryker4s, diffed by
mutant key (file, line, column, mutator, replacement).

	baseline	after
Killed	309	328
Survived	77	58
Timeout	4	4
Ignored	30	30
spec blocks	8	6
net test lines	—	+5

19 kills for 5 net lines (0.26 lines/kill), 0 regressions, 2 fewer tests.

The actual problem

JsonScannerRobustnessSpec's prefix property already drove all 69 of
JsonPathScanner's surviving end-of-input guards — every prefix of a generated
document, five paths, both surfaces. Its oracle was
Try(JsonPathScanner.find(prefix, p)).isSuccess: "did not throw". Every one
of those mutants turns a Miss into a wrong-but-non-throwing Span, so the oracle
was structurally blind to all of them. This was an oracle bug, not a coverage
gap — which is why the fix is a replacement rather than an addition.

What changed

1. The prefix property, rewritten in place. The generator now returns the
rendered children alongside the document, so the oracle has three parts:

• absolute — find(full, Nil) == Span(0, n), and each top-level step's span
  text equals the known child. Not optional: a purely differential oracle
  compares two runs of the same mutated code, so a uniformly-wrong scanner
  (skipObject returning -1 for {} on prefix and full alike) passes it.
• bounds — 0 <= start <= end <= len on both find and findAll.
• differential — R1 a prefix hit is a truncation of the full hit; R2 when
  the full span fits inside the prefix, the prefix answer is the full answer;
  R3 findAll agrees on every span ending strictly inside the prefix.

R2 is one-way on purpose. "The span must be a Miss otherwise" is false here —
the scanner is permissive about truncated numbers, so find("{\"k0\":12", $.k0)
returns the Hit 1.

Two generator changes carry specific mutants: members join with ", " (the
post-comma space is the only way a cut can leave skipObjectLoop at a position
whose whitespace run reaches end-of-input — line 264 advances without a
skipWs, unlike line 181), and child counts are frequency-weighted so {}/[]
occur in value position.

Dropping the Try wrappers means an exception now fails the property directly,
so the original no-throw guarantee is kept for free.

2. Nine malformed constants for guards no document generator can reach —
each is a byte layout whose broken syntax is followed by bytes that accidentally
spell the probed member, so a dropped guard mis-parses onto the target instead
of being caught by a later one. 1"target":2 (a step applied to a non-container
value), {"a":} (a value position holding no value), {Xk0":1} (dropped key-quote
check makes skipString find the closing quote, so the compared key really is
k0), {"k0"1 2}, and the nested twins of the last two. The existing malformed
block's oracle widened from !find(...).isHit to also require
findAll(...) == Nil — that widening is what makes the walkAll guards
observable, and it covers the six pre-existing rows at no extra lines.

3. Deletions, all measured. The valid/truncated literalCases rows, three of
the four small examples clauses, and — verified by a second full stryker run at
328K/58S, identical — the entire object-count and array-index sweeps (61
lines, 2 properties). The absolute clause subsumes them exactly.

The 58 remaining survivors are mostly equivalent

51 of JsonPathScanner's and all of PathParser's are defence-in-depth guards
where a later guard in the same function rejects the same input identically
(51:8, 62:8, 130:8, 159:8, 206:8, …), or >= → == on an index that
skipWs/skipValue guarantee never exceeds the bound. JsoniterPrism.scala:130:8
is equivalent too: the else arm calls readFromSubArray(bytes, -1, -1), whose
ArrayIndexOutOfBoundsException is caught two lines below into the same
Affine.Miss. JsoniterTraversal 56/170/171 all fall through to a general path
that hands a 0- or n-length array to PSVec.unsafeWrap, which normalises by
length. Chasing these would add lines without adding kill capacity.

One bonus kill the plan had mis-classified as equivalent: 254:13 >= → >.
With > the guard is dead-false on the left, so bytes(kpos) is evaluated at
kpos == bytes.length — the post-comma-space cut throws.

🤖 Generated with Claude Code

https://claude.ai/code/session_0194EHFR4NamCpTHiqy7B74V

[kryptt]

Superseded by #111, which cherry-picks this branch's commits unchanged and adds the core artifacts, a consolidation fold and the QA-page equivalent-mutant documentation. Close this one unmerged rather than merging both — #111 is based on the same fix/nominal-resolution-onto-main and must merge after #105.

[kryptt]

Superseded by #111, which carries these commits unchanged and is now rebased onto main. Closing unmerged: this PR's base fix/nominal-resolution-onto-main was squash-merged as #105 (75c7eaa) and is no longer an ancestor of main, so merging here would land nothing on main.