mutation gate: kill the holes mutmut 3.8.0 exposed, and take #673 by hand

[LetsGetToWorkBro]

two things from the post-vacation sweep: the last dependabot item, and the mutation gate the triage loop flagged in #637.

the mutation gate went red on unchanged code, and it was right to

#637 caught it: mutation.yml failed 09-14 against the same commit that passed 09-07, and since that job isn't a PR gate every PR since showed a full row of green.

mutmut 3.8.0 (released 09-12) is the whole explanation. it fixed "methods of decorated classes are not mutated" and added ternary-condition mutation, so the net widened by 37 mutants. reproduced both versions locally before touching a ceiling — 3.7.0 gives exactly the documented 229/15/1, 3.8.0 gives 245/22/1.

the 23 new survivors were 20 dataclass __str__ mutants and 3 ternary ones. seven came back no tests — never executed by anything. the reason is CLAUDE.md #1 wearing a new hat:

assert isinstance(rep, FlashReport) and rep.ok, str(rep)

that's the only str(rep) in the killer suites, and it's an assert message — python evaluates it only when the assert fails. on every green run it never ran. so FlashReport.__str__, which renders "FLASH-SAFE" if self.ok else "FLASH RISK" — the eye-safety verdict a human reads — had no guard at all.

21 of the 23 are killed, not accommodated:

• test_report_strings.py executes all three __str__ methods and asserts both directions of every verdict. heads pinned with startswith and violation lines by equality, not in — an in check passes on [XXFLASH-SAFEXX] and on a report joined with "XX\nXX".
• the third ternary mutant was a real hole: (t.target == SELF) or True collapses every timeout hop into a self-loop, and a ring of equal scenes can't see it (2 emits/2s reads like 1 emit/1s). an asymmetric cycle can — one fast emitting scene + one slow silent one sustains 1 emit per 10.1s, under the 1/s budget, while the fast scene alone as a self-loop is 10/s. the mutant invents a flood in a figment that has none. mutation-verified per CLAUDE.md feat(reality-compiler): NL → Halo behavior pipeline (intent parser, codegen, emulator, validator) #2: committed first, applied it, confirmed exactly that test fails, restored from the repo root.

so flash_safety returns to its original 15 and budgets lands at 231, not 245. the two accepted are itemized in place with why each is equivalent.

also corrected: privacy's ceiling had been passing on PrivacyGate.__init__'s _incognito = None while the comment named set_incognito's bool(on) — right reasoning, wrong line.

ran the workflow's own gate logic against the measured results: all-OK, exit 0.

#673: insightface 2.0

dependabot couldn't relock, so the lock-freshness gate blocked it as designed. the bump needed no proving because CI had already proved it unnoticed: real-models.yml installed insightface unpinned while the face extra capped it at <2, so when 2.0 shipped 09-08 the weekly job silently began exercising a forbidden version — run 34837133098 installed insightface-2.0, ran every real_model test with zero skips against the real buffalo_l model, and passed.

read the 2.0 wheel to confirm the adapter survives: providers is no longer a named param of FaceAnalysis.__init__ but is still honoured via **kwargs; prepare()/get() unchanged.

every entry on that install line now carries its bound — the comment above it has claimed "with the project's own bounds" all along and insightface was the one entry with none. the lock takes 2.0 so bound, lock and tested version finally agree, and it shrinks the graph: easydict and prettytable drop out, the duplicate albumentations/albucore forks collapse, 473 → 469 packages.

---

ruff + mypy clean (843 files). local suite has 42 failures from missing optional wheels in this container (c2pa, keyring, zeroconf) — verified identical on origin/main with these commits absent, so they're environmental, not from this change. CI has the full set.

---

Generated by Claude Code