Close the review-batch coverage gaps with mutation-verified suites
Two new native suites and four extended ones, 59 tests, every one
verified to fail against a deliberately broken source line:
- test_touch_auth_entry_ui (NEW, 29): the touch unlock controller had
zero host coverage while carrying the review's security-critical
behaviors. An amalgam TU (vault-harness precedent) compiles the
device-only controller on the host behind a fake pointer/canvas/board
seam; pins numeric auto-submit, the inert under-length OK key, reveal
auto-hide via the clock hook, secret zeroization on every exit path,
layer transitions, and the zone-button double-fire guard. Adds a
host-side LayoutContext::fromActiveDisplay test seam (device branch
untouched).
- test_pin_policy (NEW, 11): isValidPinLength/clampPinLength (the guard
that keeps PROVISION from creating unlockable-by-nobody vaults) and
clampSecretKind's fail-closed coercion of unknown persisted bytes.
- test_vault_rekey/import/meta/store_facade (+8): rekey carries the
authenticated secretKind forward verbatim, staged-import accessors
fall back to defaults on abort/truncation/no-stage, and the
provisioned kind survives a simulated reboot (invalidate + remount)
for both kinds.
- test_header_component/menu_list/settings_timer_clamp (+11): title-
subtitle leading in headerHeight and baseline placement, value-band
slack boundaries (exact fit / one-glyph overflow / two-line reserve),
and the kTimerNeverMs sentinel vs finite-deadline branches of the
relock policy.
Claude-Session: https://claude.ai/code/session_01XBVa8G5jrkprye4gVAkQSU