Environment

• CP version: v0.9.4 (f925e5f6); measured with gcov (C unit + integration suites) and go test -coverprofile; mutation testing with a source-level C mutator and gremlins (Go)

Description

A coverage + mutation run over the current test suites found areas where tests pass but do not actually verify the behaviour. Tracking them here so they can be picked up individually:

1. The control-socket dispatcher is never executed. unix-manager.c::unix_command_execute has 0% coverage. tests/unit/unix_control.c calls the ping/info handlers directly, and the reload tests use SIGHUP, so handshake parsing, unknown commands and malformed JSON are untested over the real socket.
2. Wire bytes are not verified. Every GRE/VXLAN/ZMQ integration case (testdata/cases/*/verify.json) uses packet_count_only/packet_count_range. No test checks the VXLAN header/VNI, the GRE protocol field, or the ZMQ batch/record/packet-header layout in docs/ZMQ-WIRE-FORMAT.md §3–§6 (only the heartbeat record is byte-checked).
3. Checksum tests are round-trips. The TCP/UDP (IPv4 + IPv6) checksum tests compute a checksum and then verify it with the same code, so a wrong pseudo-header sum still passes: 26 surviving mutants in calculate_pseudo_header_sum/cksum_accumulate. Known-answer vectors are needed (only the IPv4 header has the RFC 1071 example).
4. parse_packet boundaries. 34 surviving mutants, e.g. caplen < offset + ip_hdr_len → <= is undetected (no frame with caplen exactly equal to the header length), and there are no IPv6 extension-header cases.
5. Untested features with no test at all: req_pattern_judge_pkt_direction on real packets (only the expression grammar is tested), rotating_file output, ZMQ batch flush rules (§8), corrupt/truncated pcap input to pcap_file, numeric config range checks (see [cpworker] Out-of-range numeric config silently clamped by cJSON (snaplen/buffer_size_mb/timeout_ms/ring_size) #234/[cpworker] zmq.hwm=0 means an unbounded queue and is not validated #235), and live libpcap capture fidelity (reload tests drive libpcap on lo but only assert log lines).
6. Go: gremlins test efficacy is 53% for cpdaemon/pkg/cpm (63 surviving mutants, mostly syncer.go, worker_mgr.go, synclog.go) and 74% for cpgolib/cpworker (handshake recv-error and invalid-JSON branches, arguments omitted when empty).

Expected

Each area has at least one test derived from its spec (RFC / docs/*.md) that fails when the behaviour is wrong.