[devjerry0]

Summary

Checks whether the unit/feature tests catch selected broken safety rules by deliberately changing one rule at a time. This optional tooling adds no runtime behavior or dependencies.

Stack 6/6, split from closed #891. Depends on feat/composer-link-previews. This PR is in the fork to keep the review diff limited to this layer; open it upstream after its dependency lands.

Changes

Diff against this PR's base: 7 files, +450/-4. 97% of changed lines are tests, fixtures, or test support.

• Run an unchanged control before each source family, then require each selected broken variant to fail the existing tests. Assert every replacement still matches its source.
• 40 selected checks cover URL/network boundaries, header verification, playback/retry rules, and worker/publication protections. This is not a whole-codebase mutation score.
• Add explicit Composer/Bun scripts and a CI step. Keep the normal unit/feature tests in their implementation PRs.

Visual explanation

flowchart TD
    O["Original source"] --> C["Control tests must pass"]
    C --> M["Break one selected safety rule"]
    M --> T["Run the existing tests again"]
    T --> R{"Did a test fail?"}
    R -- Yes --> K["Mutation detected; continue"]
    R -- No --> F["Mutation survived; fail the gate"]

Loading

Stack and merge order

1. Fetch boundaries and service contract — upstream
2. External GIF verification
3. Inline GIF playback
4. Cached, queued draft API
5. Composer link previews
6. Optional mutation checks

Layers 2–6 target their immediate predecessor in the fork. Submit them upstream in order after their dependency lands; each review diff contains only its layer.

Validation

PreviewLink now lives under App\Contracts\Services (namespace-only follow-up, head 4dcca0fa13deabbf362643681e40b99c98dc2cc0). Focused fetching/verification suites and the final stack’s required checks passed after the move; the earlier per-layer results and implementation review below remain the baseline.

Container checks passed on PHP 8.5.12: 4,650 PHP tests / 25,764 assertions, 100% PHP coverage and type coverage, 223 Node tests, and 662 component tests across 53 files. PHPStan, TypeScript, lint, and production build pass (19 lint warnings, no errors). All 40 selected mutations were detected.

Commands: composer test:lint, composer test:types, composer test:type-coverage, full parallel Pest CI coverage at exactly 100%, bun run test:unit, and bun run build. Also composer test:mutations.

No UI or mobile interaction changes in this layer.

Independent review

Independent code review: PASS, base b541a6cb256d955ff6e93d891e6188fc70d317c7, head 9902e0ad912198be2f8c2a8d7975df21b44ca37b. Visual review is inapplicable to this backend/tooling-only layer.

Limitations

Hosted CI has not been verified for this new PR. The gate covers selected hand-written mutations, not every possible mutation.

Codex-Thread: 01a15b08-d4ad-7e72-8725-b3ea1fde71ce