<!-- unified-payment-template: 1.0.4 -->

支付依赖与恢复 / Payment runtime and recovery

运行时需要 Node.js 20+ 和宿主的支付宝官方 alipay-payment-skill、alipay-bot。宿主不同不代表钱包授权可以搬运。正常第一条支付宝业务命令是官方 buyer-pay 或原单查询，不能加通用 check-wallet 前检。

只有真实业务命令无法找到/执行 alipay-bot 时，才加载官方技能的 references/command-recovery.md：取得外部安装授权，核对指定版本 @alipay/agent-payment@1.0.23 的官方完整性后安装，再重试原命令一次。不能每次调用都安装 latest，不能把卖家部署工具当作买方依赖；已启动但业务失败时原样展示并停止。

English: Use the current host's official Alipay buyer runtime. Only an actual command-not-found failure enters the official pinned-version installation recovery. Do not reinstall on every call, precheck wallets generically, or install merchant tooling in the buyer path.

仅在上述恢复条件成立且已获外部安装授权时执行下列两步。先查询完整性，必须逐字符等于下面的指定值；不一致或查不到则停止，不能继续安装：

npm view '@alipay/agent-payment@1.0.23' dist.integrity --registry 'https://registry.npmjs.org'

sha512-7OGSHhPnuKsyENpivpY60NgE77ktKtWTP8UBtmizeB1Et44KHFFIjDcSRIFpitEdKAC7uMBx3Mp1Zg/wbYmYCQ==

核对一致后才执行安装，并仅重试原先无法执行的命令一次：

npx -y --registry=https://registry.npmjs.org @alipay/agent-payment@1.0.23 install

这里的命令是依赖恢复说明，不是正常付款前置；官方技能版本更新时须重新对照其 command-recovery.md，不沿用过期完整性值。

本包现行支付流程 / Registered checkout

本包支付配置为 payment-contract.json：资源 test-gap-analysis-free、单价 ¥0.10 / CNY、支付宝服务 ID API_FC3B91AF109D47C8、完整服务地址 https://fwskillpay-api.cn/v1/pay/skills/test-gap-analysis-free/invoke。配置与 SKILL/助手哈希不符即停止。平台展示价须在提交后单独回读，不能从本包检查推定平台价已经一致。

1. 调用前披露输入范围、接收方、用途、留存及 ¥0.10，取得本次数据传输和该金额的付款授权。已有授权不再二次询问；价格一致也不能代替授权。
2. 在包外私有目录准备 payload.json，按本 Skill 的输入契约执行 probe。400、503、429、未知网络状态或未付款的 200 都停止，不能本地代做付费结果。
3. 只核对网关公开 JSON 摘要中的金额、币种、商户订单号、资源 ID、服务 ID 和有效期；任一字段缺失、类型错误、过期或与登记不符都停止，不进入 pay。不解码 Payment-Needed 或 amtPaymentLink，不自行验签；公开摘要不能证明签名、实际付款或到账。
4. 本次唯一非空 amtPaymentLink 优先，并原样交给官方 --amt-payment-link，不写付款材料文件；链接缺失才使用原值保存的 Payment-Needed 文件。空、多个或歧义链接停止，两种参数互斥，不能补造或从历史输出补齐。
5. 已有该金额授权时立即准备 pay，宿主在返回的 workingDirectory 实际用 executable 与参数数组运行官方 buyer-pay。参数 JSON 不算弹码。会话按下表取值，保持本次原请求与幂等键。
6. 原样输出当前官方对客文本一次，完整展示全部 MEDIA 图片；不复用旧图、不绘制替代二维码。链接生成、success:true、OPEN_LINK_CREATED 不代表付款或交付。
7. 宿主把刚执行的官方对客文本保存在包外私有文件，用本次 handoffId 执行 record-official。只从“订单号/查询单号/交易号”标签提取标识；拒绝原始 JSON、其他交接或冲突标识。观察分类由宿主依据真实输出选择，不是 helper 验付。
8. 用户表示付好或要求查询时，complete 按已绑定标识查询原单：有效 32 位、11–14 位为 8282 的查询号优先；否则用本次交易号。查询不附加 session-id、账单文件或付款链接。未绑定原单停止，不能猜测。
9. 只交付官方实际返回的非空验付后资源。成功交付、业务失败、资源为空、身份不符或查询失败后停止；仅命令超时/网络失败允许按官方规则重试原命令一次。不能从 success 字样认定收款。

English: Obtain data-transfer and price authorization before probe. Compare the public checkout summary while passing payment material unchanged to the official runtime. A unique amtPaymentLink takes priority over an opaque Payment-Needed file. Actually execute the returned argument array, show all current official media, then bind the current official customer-facing output to its handoff. Query only the bound original order. Deliver only actual nonempty official resources. Offline helper checks and host observations are not proof of payment or settlement.

当前会话 / Current session

取首个非空来源，高优先级不能被低优先级覆盖：

不能生成会话 ID，不能用订单号、交易号、用户/钱包 ID、URL、测试名或历史会话代替；陈旧环境变量不能覆盖当前显式会话。官方订单号形状（32 位数字且第 11–14 位为 8282）只用于查询，任何符合该形状的串都不是会话，宿主号码仍按逐级取值。全部为空则停止。The current runtime identity takes precedence over inherited environment values.

助手调用 / Helper calls

node scripts/skill-paid.mjs probe --state-dir "<包外私有目录>" --payload-file "<包外私有目录>/payload.json" --confirm-data-transfer
node scripts/skill-paid.mjs pay --state-dir "<同一目录>" --session-id "<当前真实会话>" --intent-summary "原始请求：<本次业务目的摘要>" --confirm-payment
node scripts/skill-paid.mjs record-official --state-dir "<同一目录>" --handoff-id "<刚输出的交接ID>" --official-output-file "<刚执行的官方对客文本文件>" --confirm-current-output --outcome pending
node scripts/skill-paid.mjs complete --state-dir "<同一目录>"

链接分支 pay 额外带 --amt-payment-link "<本次 probe 原样返回的值>"；不能从扫码图片或用户操作链接取替代值。每次实际官方命令后都记录本次 handoff。官方资源文件只存私有目录；资源已交付时可记录 resource_delivered。ack_failed 还须同次真实输出明确回执失败、非空资源文件和已交付确认。无把握时记录 unknown 并停止。

大输入、中断及回执 / Large inputs and recovery

大载荷只走同域 /stage 短引用，失败停止，不把大 JSON 塞回命令行。原文恢复副本存在包外私有目录。只有绑定的本次官方输出明确报告引用过期，用户在后续要求恢复并同意再次传输时，才可 restage --confirm-ref-expired --confirm-data-transfer --confirm-recovery-requested 一次；核对原文 SHA-256，保留原订单和幂等键，之后只恢复原单。

正常官方资源交付会自动处理回执。独立 ACK 只恢复已绑定的同次回执失败，且用户后续要求恢复；不重新请求资源。助手使用单次交接标记和锁拒绝重复/并发 ACK。没有真实证据不填确认标志。

付款启动未知不能删状态、换幂等键或再付一笔。已付款但业务失败保留原单，联系运营者核对恢复或退款；退款没有公开命令时不能自行构造。需要官方反馈时加载 alipay-payment-skill 的 references/feedback.md，先向用户确认脱敏内容后提交，不自动发送。

Windows 的文件 mode 不能保证 ACL；宿主须使用当前用户私有目录并核对访问范围。付款材料、当前官方文本、业务原文、资源文件、Cookie 和钱包凭据都不进入发布包或跨宿主同步。

• Service URL：https://fwskillpay-api.cn/v1/pay/skills/test-gap-analysis-free/invoke

依赖技能 / Dependencies

中文：买方侧的 402 支付由支付宝官方能力处理。使用前先确认宿主是否已具备；缺少时通过宿主自带的官方 Skill 安装器补齐——不要自行实现支付逻辑、不要手写 402 客户端、不要在本包内安装任何组件：

• alipay-payment-skill —— 官方买家支付技能：发起请求、解析 402 账单、唤起支付宝付款、携 Payment-Proof 重试并完成履约
• @alipay/agent-payment —— 官方买家侧安装包，由宿主提供，用于得到上述官方能力（本包不含安装命令）
• alipay-bot —— 官方买方命令行工具，随官方买家侧安装包提供

旧版兼容名（宿主仍是旧版组件时使用，能力等价）：
- alipay-pay-for-402-service —— 解析账单、发起支付、携凭证重试、发送履约回执
- alipay-authenticate-wallet —— 钱包未授权时完成授权
- alipay-payment-feedback —— 支付流程异常时的兜底反馈

English: The buyer side of the 402 flow is handled by Alipay's official capability. Confirm the host already provides it; if not, the host's own official Skill installer supplies it — never hand-roll payment logic or a 402 client, and never install components from inside this package:

• alipay-payment-skill — the official buyer payment skill: send the request, parse the 402 bill, trigger the Alipay payment, retry with Payment-Proof, complete fulfillment
• @alipay/agent-payment — the official buyer-side package the host provides (no install command is shipped here)
• alipay-bot — the official buyer CLI, provided with the official buyer-side package

Legacy names (equivalent capability, for hosts still on older components):
- alipay-pay-for-402-service — parse the bill, pay, retry with proof, send the fulfillment receipt
- alipay-authenticate-wallet — authorize the wallet when required
- alipay-payment-feedback — fallback feedback when the payment flow fails

请不要把商户私钥、买家凭证或长期 Token 写入本 Skill；服务端验付也不得以「客户端是否安装组件」为前提。

Never embed merchant private keys, buyer credentials, or long-lived tokens in this skill; server-side verification must not depend on whether the client installed any component.

<!-- buyer-prerequisites v3 -->

前置检查 / Prerequisites

中文：本技能除编排示例 买方宿主的支付宝官方组件 外不分发其他可执行文件，且不含任何安装脚本与安装命令。调用前只做能力确认，不做本地安装动作：

1. 宿主须已具备官方支付宝买方支付能力（见「依赖技能 / Dependencies」列出的三个官方技能）；缺少时由宿主自身的官方 Skill 安装器补齐，本包不提供安装命令。
2. 钱包须处于已授权状态；未授权时先完成授权，再发起业务请求。
3. 若宿主既无法提供买方支付组件，也无法完成钱包授权，在支付前停止并如实向用户说明限制，不得改用本地生成结果。

English: Apart from the orchestration example 买方宿主的支付宝官方组件, this package ships no executables, install scripts, or install commands. Before calling, only confirm capability:

1. The host must already provide the official Alipay buyer-side payment capability (see Dependencies); if missing, the host's own official Skill installer supplies it — this package provides no install commands.
2. The wallet must be authorized; complete authorization first if it is not.
3. If the host can neither provide the buyer components nor authorize the wallet, stop before payment and tell the user the limitation honestly — never fall back to local generation.

<!-- payment-flow v2 -->

触发与调用摘要 / Triggers & usage summary

测试缺口与行为盲点分析 / Test Gap Analysis for Behaviour Blind Spots

一句话结果承诺 / Outcome promise

中文：指出哪些真实行为根本没有测试在守护，并按「漏了会出事」的程度排序。
English: Show which real behaviours no test is guarding, ranked by how badly it hurts when they break.

输入示例 / Input example

中文

输入：源码目录 + 现有测试目录 + 测试运行结果
可选：覆盖率报告（作为参考，不作为结论）
已知：最常出问题的模块（如订单状态机）

English

Input: source directory + existing test directory + test run output
Optional: coverage report (as reference, not as the conclusion)
Known: the modules that break most often (e.g. the order state machine)

处理步骤 / Processing steps

中文
1. 设定范围：确定本次分析覆盖哪些模块。
2. 建立唯一基线：固定一次测试运行结果，后续均以它为参照。
3. 盘点公开行为：列出对外可观测的行为与状态转换。
4. 只接纳可观测候选：无法从外部观测的候选项不予采纳。
5. 排序与分类：按影响 × 发生概率排序。
6. 不制造假阳性：不把等价的实现细节当作缺口。
7. 仅在被要求时才补测试。

English
1. Set scope: decide which modules this pass covers.
2. Establish one baseline: freeze a single test run as the reference for everything that follows.
3. Inventory public outcomes: list externally observable behaviours and state transitions.
4. Admit observable candidates only: anything not externally observable is rejected.
5. Rank and classify: by impact x likelihood.
6. Do not create false positives: equivalent implementation details are not gaps.
7. Close gaps only when asked.

输出文件 / 字段示例 / Output example

中文
- 缺口清单：行为 / 现状（无测试·弱断言·仅冒烟）/ 影响 / 优先级 / 建议验证方式
- 基线记录：本次分析依据的测试运行（时间、通过数、跳过数）
- 排除项说明：被判定为不可观测或等价实现而未列为缺口的项

English
- Gap list: behaviour / current state (untested, weak assertion, smoke only) / impact / priority / suggested verification
- Baseline record: the test run this analysis rests on (time, pass count, skip count)
- Exclusions: items judged unobservable or equivalent and therefore not counted as gaps

成功验收标准 / Acceptance criteria

中文
- 每条缺口都描述一个可观测的行为，而非"这里没有测试"这类空话。
- 每条缺口都给出建议的验证方式。
- 基线测试运行被明确记录；运行结果变化时结论需重算。
- 未生成假阳性：被排除项有书面理由。
- 覆盖率数字仅作参考，未被当作缺口的唯一判据。

English
- Every gap describes an observable behaviour, not an empty statement like "there is no test here".
- Every gap suggests a concrete way to verify it.
- The baseline test run is explicitly recorded; if it changes, the conclusions must be recomputed.
- No false positives: every exclusion has a written reason.
- Coverage figures are reference only and are never the sole basis for calling something a gap.

适用场景与边界 / Scope and boundaries

中文
- 适用：测试补齐前的缺口盘点；重构前的回归保护评估。
- 不适用：性能测试设计；安全测试；端到端测试环境搭建。
- 不自动生成测试代码，除非明确要求。

English
- In scope: gap inventory ahead of test backfill; regression-protection assessment before refactors.
- Out of scope: performance test design; security testing; end-to-end environment setup.
- Test code is not generated automatically unless explicitly requested.

依赖、隐私与失败处理 / Dependencies, privacy, failure handling

中文
- 依赖：无外部 API、无账号、无密钥。
- 隐私：代码与测试仅在本地读取。
- 失败处理：无法运行现有测试时，仍可做静态缺口分析，但必须标注"未以实跑结果为基线"。

English
- Dependencies: no external API, no account, no key.
- Privacy: code and tests are read locally only.
- Failure handling: without a runnable test suite, static gap analysis is still possible but must be labelled "not baselined on a real run".

版本与更新时间 / Version and update

中文：v1.0.1。缺口判定与基线规则自发布起未变。
English: v1.0.1. Gap criteria and baseline rules unchanged since publication.

变更记录 / Changelog

1.0.1

• H1 改为中英双语；补齐处理步骤/验收标准等标准段落；切断指向包外兄弟技能的失效相对链接。

Answer one question: which caller-visible production behaviors could change
without an existing test failing? Mutation reasoning is a probe, not the goal.
Inventory public outcomes first, then verify only credible gaps.

Decision flow

1. Set scope

Discover production and test files from manifests and file types. After a narrow
search misses, inspect the current directory broadly before asking for paths.

When the request names a risk, turn it into a one-line public-outcome allowlist
before reading code. An outcome is not in scope merely because the same method writes it.
For money math, allow computed or returned amounts, rates, tier/boundary
choice, percentage base/order, floors/caps, and rounding; exclude non-monetary
state predicates (including derived booleans), identity, and formatting. Private
code is in scope only to trace an allowed outcome.

Do not expand a focused request into a repository audit, plan artifact, or
dashboard. Use source and tests directly for familiar frameworks. Invoke
test-analysis-extensions only when discovery or assertion semantics are
unclear.

2. Establish one baseline

Run the narrowest existing test command once. Choose it from the project
manifest; Microsoft.Testing.Platform executables may require dotnet run.
Confirm tests executed: exit 0 with build-only output is not green. If that one
attempt cannot run the suite, do not troubleshoot the runner or try alternate
commands for an advisory review; continue statically and label all candidates
unverified. Do not infer a project-configuration cause from missing output;
name a cause only when the command reports it.

Missing runner output limits only claims of empirical mutation survival. It does
not make source-proven facts tentative: a public outcome with no reaching test
is still No coverage, and an exact expected value derived from the
unmodified implementation is still actionable. State the baseline limitation
once, then give the static source/assertion conclusion directly instead of
hedging every row.

For an advisory review such as "would tests catch this?", stop execution after
that baseline. Source-to-assertion mapping is sufficient evidence for No
coverage and Candidate survivor (unverified). Trace or run the unmodified
code once only when an original value is unclear. Apply mutations only for
explicit verification, an exhaustive audit, or closing gaps with tests.

Any focused mutation budget limits execution, not discovery. Keep every
distinct unasserted public outcome in the inventory.

3. Inventory public outcomes

For each public entry point, map:

• input partitions: classifier arms, compound conditions, invalid and
  nearest-valid guard boundaries, and default cases;
• each independent observation: returned field/variant, exception type,
  invalid-input acceptance, public state transition, or external side effect;
• private-helper composition, constants/rates, rounding, retries, cancellation,
  and error propagation as observed through the public caller.

Use public input/sequence -> expected outcome -> existing assertion -> gap.
One asserted return field does not cover another. One allowed result does not
cover its denial.

Money math: inventory the no-op path, every rate/tier and exact boundary,
operation order, percentage base or composition, floor/cap, and rounding. Trace
private helpers through the public result. A test asserting only a broad range
does not pin any exact amount. For each actionable money row, derive one witness
input and its exact original result through the complete call chain; do not
recommend a generic "assert the exact amount" without supplying that amount.

Ordered guards and retries: inventory invalid below minimum | first valid | last allowed or retryable | first blocked | later blocked. For an upper guard
such as value >= limit, use limit - 1, limit, and limit + 1; the last
witness exposes narrowing to value == limit. Inventory every accepted and
rejected error class. When type matching is polymorphic, include a representative
derived accepted type that would expose exact-runtime-type narrowing. A test at
the first blocked value does not protect the last allowed or later blocked value.

Authorization: enumerate each relevant identity/role, resource class, and
action from the caller's view. Untested false, forbidden, and unchanged-role
outcomes are first-class security gaps. Do not analyze variants of an allowed
path while a denial outcome remains uninventoried. Check each public surface:

• permission-returning APIs: every distinct role/resource class and every
  returned capability independently;
• action-dispatch APIs: each read/write/delete-style action branch, especially
  paths that must return denial;
• role/state transitions: accepted, rejected, invalid, null, and empty inputs,
  including outcomes that must leave state unchanged.

Reserve execution for wholly untested public branches before another variant
of a partially covered helper. If more than five high-risk behaviors are
unasserted, execute the top 3-5 and keep the rest visible as No coverage or
Candidate survivor (unverified).

Execution never replaces the ledger. Before mutating or answering, classify
every required outcome, including each invalid input, guard boundary,
classifier arm, action, and denial.

Completeness checkpoint: before selecting findings, explicitly account for
every independent mode/flag, both zero and negative for a <= 0 guard, every
accepted exception class, and a representative derived accepted exception when
matching is polymorphic. For a removed guard, trace the fallthrough: if it still
produces the same public exception type, it is equivalent unless finer exception
metadata is an established contract.

4. Admit only observable candidates

First replay each exact mutation against every existing asserted input or
sequence with all arguments fixed. Any changed return, exception, state, or side
effect is Likely killed; a dedicated single-purpose test is unnecessary.
Never compare the mutant on one input with the original on another.

For survivors, choose a witness before execution or reporting and state
witness -> original observation -> mutant observation. Reuse it in the
smallest test. Admit it only when the last two differ publicly after tracing the
full call chain; otherwise choose a distinguishing witness or drop it.

Exclude:

• edits that require inserting or reordering statements rather than changing or
  removing an existing expression, condition, constant, return, or side effect;
• edits that do not compile, including removal of a declaration whose value is
  still referenced;
• overflow behavior, exception message/ParamName metadata, or other semantics
  not established by the current contract, source intent, or tests;
• a removed guard or short-circuit that falls through to the same result,
  exception, state, and side effects;
• private representation changes that every public input sequence observes
  identically, even if the suite stays green;
• a mutation whose proposed test passes against both original and mutant;
• boundary edits that return the same value on the distinguishing input; for
  example, changing result < floor ? floor : result to <= is equivalent at
  equality because both branches return floor;
• a standalone auto-property or trivial one-line wrapper/predicate with no
  meaningful branch, calculation, or side effect, unless the user names it;
• hypothetical future impact, generated code, logging/formatting-only changes,
  impossible values, and duplicate syntax variants.

Missing direct assertions do not prove No coverage: first trace existing
assertions through public callers and shared branches. Missing assertions make
an observable candidate a survivor; they do not make an inert mutation
meaningful.

5. Rank and classify

Rank: (1) security denials, financial outcomes, errors, and state changes;
(2) wholly unasserted public outcomes; (3) boundaries or exact values reached by
weak assertions; (4) alternate variants of already-asserted behavior.

Finish the inventory before selecting mutations or a verdict. One killed
attempt, exception type, or switch arm does not clear its siblings.

Choose the verdict from the completed inventory:

• Strong when core branches and primary boundaries are protected and only a
  few validation or default-case variants remain;
• Mixed when meaningful coverage exists but at least one important outcome
  partition is unprotected;
• Weak when important outcomes are broadly unprotected.

A handful of validation gaps does not make an otherwise broad suite Mixed
unless validation is the named risk or the gaps threaten security, data, or
other contract-critical behavior.

When the inventory meets the Strong criteria above, lead with Strong and
name the protected boundaries and dual assertions before listing minor gaps. Do
not open with Mixed, "only core paths", or a risk-heavy dashboard.

Stop when existing assertions kill the remaining candidates or no credible
public survivor remains. Do not mutate every operator merely to fill a report or
calculate a score.

Outside explicit verification, an exhaustive audit, or a requested test
addition, execute no mutations. Do not mutate to confirm obvious no coverage.
For explicit verification, execute one representative candidate per distinct
high-risk outcome in scope; do not stop after the first one or two while another
guard, action branch, error class, or denial remains unclassified. Omit
equivalent syntax variants.

6. Verify without creating false positives

Enter this phase only for explicit verification, an exhaustive audit, or a
requested test addition.

1. Apply one candidate and confirm the diff changes exactly one intended
   expression.
2. Run the narrowest covering test: green means Survived, red means
   Killed, for that edit only.
3. Revert immediately and confirm the clean source/test baseline.
4. After a green run, re-check the public counterfactual. Execution proves the
   suite missed the edit, not that the edit changes behavior; drop inert or
   unobservable mutants.

Never leave mutations in the workspace. Before reporting, reconcile every
unasserted high-risk outcome as Survived, Candidate survivor
(unverified), No coverage, or omitted Equivalent. Stop when no credible
public gap remains; do not fill a report with internal details or calculate a
score unless the user requested an exhaustive audit.

7. Close gaps only when requested

1. Add focused tests only for executed Survived mutations or demonstrated
   No coverage behavior.
2. Cover every distinct gap in the requested scope before adding tests
   for alternate variants of an already-covered behavior.
3. Before editing, create a survivor-to-test checklist. Before stopping, map
   every verified survivor to an added test and every added test back to a
   verified survivor; a passing final suite alone does not prove completeness.
4. Preserve production code and existing tests when requested.
5. Prefer one behavior-focused test that kills related mutations over one test
   per syntax change.
6. Re-apply the original mutation and prove the new test kills it, then restore
   the source and run the narrow suite cleanly.
7. If the fixture or repository supplies a canonical mutation verifier, run
   that exact command after the tests are added and cite its successful result.
   Hand-created substitute mutations, a broad green suite, or a test-count
   increase do not replace the supplied oracle. Once every requested survivor
   maps to a focused test and the canonical verifier passes, stop; extra tests
   are not an advantage.
8. When the request requires existing source or test files to remain unchanged,
   compare each protected file byte-for-byte with its pre-edit snapshot and
   report that evidence. Before adding a test, prove its witness differs from
   every existing case on the relevant branch, boundary, or rounded result so a
   nominally new test does not duplicate existing coverage.

Output contract

Scale the response to the request.

For focused or small analysis, return:

1. A one-line verdict: Strong, Mixed, or Weak, with the reason.
2. For a Strong suite, one short strengths sentence naming the concrete
   protected boundaries, guards, or paired observations that justify the verdict.
3. One compact row per actionable Survived, Candidate survivor
   (unverified), or No coverage outcome. Before adding a row, apply the
   outcome allowlist when the request names a risk, then apply the
   observable-candidate rules; omit any candidate that fails either filter.
   Include every high-risk outcome, use one row per distinct public outcome, and
   consolidate only related low-risk variants:

Every gap needs a distinguishing witness and a concrete smallest test. An
error-path gap must name an invalid input and the expected error/result.

4. For a Mixed or Weak suite, one short strengths sentence naming
   important killed behavior.
5. When the request names exclusions, one short scope sentence naming the
   generated, trivial, or unrelated code intentionally skipped.

Do not repeat the table in prose or report discarded mutants, tool chronology,
or in-flight reasoning.

For an exhaustive audit, add counts for Killed / Survived / No coverage /
Equivalent and group findings by risk. Count only executed or definitively
classified candidates.

For test additions, name the tests added, the verified mutations they kill, and
the successful final command.

Reliability rules

• A passing test that does not assert the changed outcome does not kill a
  mutation.
• Coverage is per behavior partition. One switch/ternary arm or compound input
  does not prove siblings: allow does not prove deny; read does not prove write;
  null does not prove empty or whitespace when those inputs have different
  caller-visible outcomes. A kill clears only the edit and path that ran.
• Private helpers reached through a public method remain in scope.
• Error semantics are language-specific: in Rust, ? propagation versus panic
  is observable behavior; in C#, exception type and whether an input guard
  accepts or rejects a value are observable behavior.
• Cross-check every exact amount or boundary result against the unmodified
  implementation or an existing exact assertion. If it cannot be checked,
  state the behavioral relation without inventing a number.
• Do not label a finding high-risk merely because a mutation survived.
• Never recommend a redundant test for behavior the existing suite already
  protects.

Validation

• [ ] Scope stayed proportional to the request
• [ ] The original suite passed, or static-only limits are explicit
• [ ] Every high-risk public outcome in scope was inventoried
• [ ] Original and mutant have different caller-visible observations
• [ ] Every outcome labeled Survived was executed; unexecuted candidates use
  Candidate survivor (unverified)
• [ ] Every temporary mutation was reverted
• [ ] Findings exclude trivial, generated, and equivalent changes
• [ ] Recommendations target only demonstrated gaps
• [ ] Every public entry-point branch and each accepted exception type in scope
  is explicitly accounted for
• [ ] A supplied canonical mutation verifier was run and reported, not replaced
  with an ad-hoc proxy

购买前先看 / Read before purchase

一次调用交付 / One-call delivery

• 中文：适用于补齐测试前的缺口盘点；输入代码与现有测试，输出按优先级排序的缺口清单与验证方式，不把覆盖率数字当结论 / Use for gap inventory before filling in tests; accept code and existing tests and return a prioritised gap list with verification steps, without treating coverage numbers as the conclusion.
• English: Test Gap Analysis for Behaviour Blind Spots
• 输入与输出 / Input and output：按本技能定义提供结构化输入；输出为可执行的结构化结果、清单与验收提示。 / Provide the structured input defined by this skill; the output is an executable structured result, checklist, and acceptance cues.
• 适合 / Best for：需要明确产出、可复核边界、且不想为多个小步骤重复付款的任务。 / Tasks that need a clear, reviewable deliverable without paying separately for every small step.
• 不适合 / Not for：缺失必要字段、要求读取服务器本地路径、要求执行任意脚本或要求绕过平台的请求。 / Requests missing required fields, asking to access server paths, asking to execute arbitrary scripts, or asking to bypass the platform.
• 交付标准 / Acceptance：成功响应返回结构化结果、处理摘要与复核提示；输入不完整时先返回缺失项，不虚构结果。 / A successful response returns structured results, a summary, and review cues; incomplete input returns missing fields instead of invented output.

示例 / Example

POST /v1/pay/skills/test-gap-analysis-free/invoke

{"modules": [{"name": "支付回调", "coverage": 0.2, "criticality": "high", "changedRecently": true}, {"name": "导出报表", "coverage": 0.7, "criticality": "low", "changedRecently": false}]}

使用契约 / Usage contract

售后与满意度 / Satisfaction & recovery

• 只有服务端实现同一订单的 retry_credit、幂等和补偿记录时，才能提供一次不重复计费的修正重试。
• 如果尚未实现补偿，只提供问题反馈和人工处理路径，不承诺免费再次调用或自动退款。
• 免费预览、基础能力和付费完整结果必须区分资源或端点；成功交付后可提供自愿打赏，但打赏不影响访问、验收或售后。

A free correction retry is allowed only when the server implements retry_credit, idempotency, and compensation records for the same order. Otherwise, provide support feedback without promising a free call or automatic refund.

线上收费 API 范围 / Hosted paid API scope

线上范围：按结构化请求产出本技能定义的结果、清单或报告；线上不读取服务器本地路径、不处理买家二进制文件、不执行买家脚本。

The hosted scope returns the result, checklist, or report defined by this skill from a structured request. It does not read server-local paths, process buyer binaries, or execute buyer scripts.

本次更新 / Version 1.0.6 update

中文：新增可选买方编排示例 买方宿主的支付宝官方组件（probe/pay/complete/retry/status；只输出支付宝官方 CLI 参数，不实现支付、不安装组件、不含密钥），并新增「买方支付操作示例」一节；同步修正「不含任何脚本」的自相矛盾表述。服务地址、Service ID、¥0.10 计费契约与 402 流程保持不变。

English: Added the optional buyer-side orchestration example 买方宿主的支付宝官方组件 (probe/pay/complete/retry/status; it only emits arguments for Alipay's official CLI — no payment implementation, no installs, no keys) and a buyer payment walkthrough section; fixed the self-contradictory "contains no scripts" wording. Service URL, service ID, ¥0.10 billing contract, and the 402 flow are unchanged.

已核对的输入示例 / Registered input example

{
  "features": [
    "登录",
    "支付",
    "退款"
  ],
  "tests": [
    "登录成功用例",
    "支付成功用例"
  ]
}