[rennf93]

Mechanism (mirrors the psr15-guard pilot, php 8.3 + pcov): the bespoke bin/test_agent.php suite stays in place and a runner (.github/coverage-runner.php, php-code-coverage ^11) executes it under coverage, gating on every reachable line in src/. The suite grew from 57 to 610 assertions.

Coverage went from 76.53% to 100.00% reachable lines (pcov, php 8.3). The extension adds: utils/model/config edges, static-only class contract checks, a scripted RESP fake server (tests/fake_redis_server.php) covering the StreamRedisClient wire paths (AUTH/SELECT, error replies, truncated bulks, protocol errors, abortive RST writes, command timeouts), scriptable raw 200 bodies in tests/mock_server.php, EventBuffer persistence edges, HttpTransport status-classification and 413/400/429 flows against the mock API, agent lifecycle failure containment, the ext-redis adapter driven over the real phpredis extension against the redis service, and the PredisRedisClient adapter over a scripted client.

Provably-unreachable defensive lines: 57, enumerated in UNREACHABLE_LINES inside the runner with per-file reasoning; the gate fails on any uncovered line NOT in that list, so regressions cannot slip through. Summary of the audited sites:

• Catches around internally-total helpers: RedisHandler catches every client Throwable, so EventBuffer/GuardAgent catch arms over keys/delete/close/persist are dead (EventBuffer 176, 196-197, 204, 233, 271-272, 289-290, 377-378, 425-426, 595-596; GuardAgent 252-253).
• Null-handler guards on private methods whose only caller assigns the handler first (EventBuffer 176, 204, 233).
• json_encode/openssl/curl impossibilities: JSON_THROW_ON_ERROR never returns false (Json 37); a finite float cannot fail encoding (CanonicalJson 64-65); openssl_encrypt cannot fail for a verified 32-byte key, so the rethrow arm and verifyKey catch stay dead (PayloadEncryptor 80, 85, 138-139); curl_init failure (HttpTransport 357).
• initEncryption impossible states: create() is non-null for every key passing the guard and verifyKey() holds whenever openssl works (HttpTransport 413, 417-419, 456).
• toWire() casts metadata/tags to objects, so the transport-boundary is_array redaction branches never fire (HttpTransport 512-515, 522-525).
• Type-system impossibilities: optionalStringInput/stringListInput null-alt-key guards never hit (AgentConfigResolver 232, 300); sanitize of an array always returns an array (GuardAgent 778, 789); DateTimeImmutable('@'.int) cannot throw on 64-bit (WireFormat 44-45); HeadersRedactor's sanitizeValue catch and re-encode catch are unreachable for its value domain (46-47, 112-113).
• Environment-gated branches: DefaultAgentLogger's web-SAPI and missing-STDOUT fallbacks (61-62, 68); InstallId catch arms over @-suppressed filesystem calls that return false instead of throwing (76-77, 79, 95-96); phpredis 6 close() is silent on a closed socket, so the adapter's catch arm exists only for older versions (ExtRedisClient 72).

The coverage and test jobs run php with the sockets extension (the RST tests use socket_import_stream); the coverage job runs as the non-root runner user, which the install-id permission-failure test requires. Suite pass/fail remains gated by the existing test job.