🧪 test(app): close coverage gaps across store, triggers, watchers, and api

- Add regression tests for store/update-operation, internal-self-update,
  self-update-operation, self-update-controller, self-update-finalize,
  update-runtime-context, request-update, Trigger digest/batch buffers,
  Docker lifecycle rollback, docker-helpers, AgentClient, container
  handlers/list, container-actions, webhook, trigger, and coverage
  provider shared helpers
- Drop unreachable null guards in store/update-operation and trailing
  throws in vitest coverage-provider shared read/write helpers
- Include api/internal-self-update.ts in the core-api-routes mutation
  mutate set so Stryker exercises the new endpoint

Author: s-b-e-n-s-o-n

.github/workflows/quality-mutation-monthly.yml

@@ -65,7 +65,7 @@ jobs:
             package: app
             incremental_file: reports/stryker-incremental-app-core-api-routes.json
             mutate: >-
-              api/agent.ts,api/api.ts,api/app.ts,api/audit*.ts,api/backup.ts,api/component.ts,api/debug.ts,api/docker-trigger.ts,api/error-response.ts,api/group.ts,api/header-value.ts,api/health.ts,api/helpers.ts,api/icons.ts,api/icons/**/*.ts,api/index.ts,api/log.ts,api/notification.ts,api/pagination-links.ts,api/preview.ts,api/prometheus.ts,api/rate-limit-key.ts,api/registry.ts,api/server.ts,api/settings.ts,api/store.ts,api/trigger.ts,api/ui.ts,api/watcher.ts,!**/*.d.ts,!**/*.test.ts,!**/*.fuzz.test.ts,!**/*.typecheck.ts,!test/**,!dist/**,!coverage/**
+              api/agent.ts,api/api.ts,api/app.ts,api/audit*.ts,api/backup.ts,api/component.ts,api/debug.ts,api/docker-trigger.ts,api/error-response.ts,api/group.ts,api/header-value.ts,api/health.ts,api/helpers.ts,api/icons.ts,api/icons/**/*.ts,api/index.ts,api/internal-self-update.ts,api/log.ts,api/notification.ts,api/pagination-links.ts,api/preview.ts,api/prometheus.ts,api/rate-limit-key.ts,api/registry.ts,api/server.ts,api/settings.ts,api/store.ts,api/trigger.ts,api/ui.ts,api/watcher.ts,!**/*.d.ts,!**/*.test.ts,!**/*.fuzz.test.ts,!**/*.typecheck.ts,!test/**,!dist/**,!coverage/**
           - name: app-core-domain-support
             package: app
             incremental_file: reports/stryker-incremental-app-core-domain-support.json

app/agent/AgentClient.test.ts

@@ -1159,6 +1159,228 @@ describe('AgentClient', () => {
       expect(storeContainer.deleteContainer).toHaveBeenCalledWith('c1');
     });
 
+    test('should ignore watcher-cycle cleanup for invalid container ids', () => {
+      (client as any).pendingWatcherCycleReports.set(
+        'watcher',
+        new Map([
+          [
+            'c1',
+            {
+              container: {
+                id: 'c1',
+                name: 'test',
+                watcher: 'watcher',
+              },
+              changed: true,
+            },
+          ],
+        ]),
+      );
+
+      (client as any).clearPendingWatcherCycleReportByContainerId('');
+
+      expect((client as any).pendingWatcherCycleReports.get('watcher')?.has('c1')).toBe(true);
+    });
+
+    test('should clear watcher-cycle reports when the last container in a watcher is removed', () => {
+      (client as any).pendingWatcherCycleReports.set(
+        'watcher',
+        new Map([
+          [
+            'c1',
+            {
+              container: {
+                id: 'c1',
+                name: 'test',
+                watcher: 'watcher',
+              },
+              changed: true,
+            },
+          ],
+        ]),
+      );
+
+      (client as any).clearPendingWatcherCycleReportByContainerId('c1');
+
+      expect((client as any).pendingWatcherCycleReports.has('watcher')).toBe(false);
+    });
+
+    test('should ignore watcher-cycle reports that do not have a resolvable container key', () => {
+      const beforeSize = (client as any).pendingWatcherCycleReports.size;
+
+      (client as any).rememberPendingWatcherCycleReport({
+        container: {
+          watcher: 'watcher',
+        },
+        changed: true,
+      });
+
+      expect((client as any).pendingWatcherCycleReports.size).toBe(beforeSize);
+    });
+
+    test('should ignore invalid watcher-cycle lookups before taking a pending report', () => {
+      const report = {
+        container: {
+          id: 'c1',
+          name: 'test',
+          watcher: 'watcher',
+        },
+        changed: true,
+      };
+      (client as any).pendingWatcherCycleReports.set('watcher', new Map([['c1', report]]));
+
+      expect((client as any).takePendingWatcherCycleReport('', report.container)).toBeUndefined();
+      expect(
+        (client as any).takePendingWatcherCycleReport('watcher', { watcher: 'watcher' } as any),
+      ).toBeUndefined();
+      expect(
+        (client as any).takePendingWatcherCycleReport('watcher', {
+          ...report.container,
+          id: 'missing',
+        }),
+      ).toBeUndefined();
+      expect((client as any).takePendingWatcherCycleReport('watcher', report.container)).toBe(
+        report,
+      );
+    });
+
+    test('should return undefined when deriving a watcher-cycle key from a non-container', () => {
+      expect((client as any).getPendingWatcherCycleContainerKey(undefined)).toBeUndefined();
+      expect((client as any).getPendingWatcherCycleContainerKey(null)).toBeUndefined();
+    });
+
+    test('should fall back to watcher:name when id is missing', () => {
+      expect(
+        (client as any).getPendingWatcherCycleContainerKey({
+          name: 'test',
+          watcher: 'watcher',
+        }),
+      ).toBe('watcher:test');
+    });
+
+    test('should remove the watcher bucket after taking the last pending watcher-cycle report', () => {
+      const report = {
+        container: {
+          id: 'c1',
+          name: 'test',
+          watcher: 'watcher',
+        },
+        changed: true,
+      };
+      (client as any).pendingWatcherCycleReports.set('watcher', new Map([['c1', report]]));
+
+      expect((client as any).takePendingWatcherCycleReport('watcher', report.container)).toBe(
+        report,
+      );
+      expect((client as any).pendingWatcherCycleReports.has('watcher')).toBe(false);
+    });
+
+    test('should keep the watcher bucket after taking one report when others remain', () => {
+      const firstReport = {
+        container: {
+          id: 'c1',
+          name: 'test',
+          watcher: 'watcher',
+        },
+        changed: true,
+      };
+      const secondReport = {
+        container: {
+          id: 'c2',
+          name: 'test-2',
+          watcher: 'watcher',
+        },
+        changed: true,
+      };
+      (client as any).pendingWatcherCycleReports.set(
+        'watcher',
+        new Map([
+          ['c1', firstReport],
+          ['c2', secondReport],
+        ]),
+      );
+
+      expect((client as any).takePendingWatcherCycleReport('watcher', firstReport.container)).toBe(
+        firstReport,
+      );
+      expect((client as any).pendingWatcherCycleReports.has('watcher')).toBe(true);
+      expect((client as any).pendingWatcherCycleReports.get('watcher')?.has('c2')).toBe(true);
+    });
+
+    test('should remove the watcher bucket when clearing the last pending watcher-cycle report by id', () => {
+      const report = {
+        container: {
+          id: 'c1',
+          name: 'test',
+          watcher: 'watcher',
+        },
+        changed: true,
+      };
+      (client as any).pendingWatcherCycleReports.set('watcher', new Map([['c1', report]]));
+
+      (client as any).clearPendingWatcherCycleReportByContainerId('c1');
+
+      expect((client as any).pendingWatcherCycleReports.has('watcher')).toBe(false);
+    });
+
+    test('should keep the watcher bucket when clearing one watcher-cycle container id and others remain', () => {
+      (client as any).pendingWatcherCycleReports.set(
+        'watcher',
+        new Map([
+          [
+            'c1',
+            {
+              container: {
+                id: 'c1',
+                name: 'test',
+                watcher: 'watcher',
+              },
+              changed: true,
+            },
+          ],
+          [
+            'c2',
+            {
+              container: {
+                id: 'c2',
+                name: 'test-2',
+                watcher: 'watcher',
+              },
+              changed: true,
+            },
+          ],
+        ]),
+      );
+
+      (client as any).clearPendingWatcherCycleReportByContainerId('c1');
+
+      expect((client as any).pendingWatcherCycleReports.has('watcher')).toBe(true);
+      expect((client as any).pendingWatcherCycleReports.get('watcher')?.has('c2')).toBe(true);
+    });
+
+    test('should remove the watcher bucket after clearing the last watcher-cycle container id', () => {
+      (client as any).pendingWatcherCycleReports.set(
+        'watcher',
+        new Map([
+          [
+            'c1',
+            {
+              container: {
+                id: 'c1',
+                name: 'test',
+                watcher: 'watcher',
+              },
+              changed: true,
+            },
+          ],
+        ]),
+      );
+
+      (client as any).clearPendingWatcherCycleReportByContainerId('c1');
+
+      expect((client as any).pendingWatcherCycleReports.has('watcher')).toBe(false);
+    });
+
     test('should emit update-applied when agent sends dd:update-applied', async () => {
       await client.handleEvent('dd:update-applied', 'local_nginx');