@@ -4,6 +4,67 @@ All notable changes to AgentFlow are documented in this file.
 
 ## [Unreleased]
 
+### Quality — the auth-manager mutation threshold ratchets to 0.90
+
+* **`serving/api/auth/manager.py` now gates at 0.90.** CI run 34542418689 on
+  77825f6 scored it 98.4% (553 killed of 562). The nine survivors are the
+  named residue in `tests/unit/test_auth_manager_mutation.py`. The old
+  comment above its `ModuleTarget` in `scripts/mutation_report.py` called
+  the structured-logging and Redis-URL survivors equivalents. T-48's
+  behaviour tests killed all of them except the upper-cased Redis URL
+  default, which is one of the nine. The comment now gives the measured
+  score and names the nine equivalent survivors, pointing to the test
+  file's docstring for their reasons. 0.90 is the bar the other serving
+  modules hold, and it sits 8.4 points under the measured 98.4%, so the
+  nine named equivalents cannot fail the gate while a real loss of killed
+  mutants still does.
+
+### Fixed — mutation_local no longer scores a missing pytest temp directory as a kill
+
+* **`scripts/mutation_local.py` recorded every mutant that reached a
+  `tmp_path` test as killed.** `measure_module()` handed pytest a `--basetemp`
+  under a scratch directory it never created, and pytest `mkdir`s that path
+  without parents, so the first `tmp_path` fixture failed at setup and pytest
+  exited 1. Under `-x` that false kill covered every mutant that survived the
+  tests before it. `run_mutant()` now creates the `--basetemp` parent before it
+  starts pytest, so a mutant that reaches a passing `tmp_path` test is scored
+  survived, and a real failure is still a kill.
+
+### Quality — the auth-manager mutation lane pins what its survivors changed
+
+* **`serving/api/auth/manager.py` sat two points above its 0.80 threshold.**
+  CI run 34464697021 on 6231b73 scored it 82.1% (430 killed of 524). Most of
+  the 94 survivors changed something a behaviour test can see, including the
+  logging and Redis-URL mutants that `scripts/mutation_report.py` calls
+  equivalents: a log event is the operator's interface, and the Redis URL
+  decides which server holds the rate-limit budget.
+  `tests/unit/test_auth_manager_mutation.py` now pins the key-store
+  writability probe, read-only file included; the construction wiring (the
+  injected store and audit publisher, usage rows flowing through the real
+  `UsageWriter`, the default store following `db_path`, the security config
+  path at construction and on `load()`, the grace-period fallback and its
+  warning, the Redis server the limiter targets); the `load()` log events
+  `api_keys_loaded`, `api_key_store_write_skipped_readonly` and
+  `hashed_key_count_exceeds_guidance` (strictly above the soft limit,
+  unindexed entries only); what `load()` writes back, and the key file it
+  leaves byte-for-byte alone; that a match's slot comes from the material that
+  matched, never from the stored entry; that `load()` carries rate-limit
+  windows over by bucket; scan order in `authenticate()`; when
+  `check_rate_limit()` trusts Redis; and `AGENTFLOW_API_KEYS` parsing.
+* **Two simplifications remove mutants no test could kill.** The writability
+  probe opens the key file in binary append mode: the text layer and its
+  `encoding="utf-8"` did nothing for an open-and-close probe, and three
+  mutants changed only them. `_legacy_env_keys()` stops passing
+  `allowed_entity_types` at `TenantKey`'s own default (`None`);
+  `rate_limit_rpm=DEFAULT_RATE_LIMIT_RPM` stays because `TenantKey`'s Field
+  default is evaluated at import, while a monkeypatch of the module global
+  is a load-time read.
+* **The residue is named, not suppressed.** Nine equivalent mutants stay
+  alive, each on a line that also carries killable mutants, so a line-level
+  `# pragma: no mutate` would silence those too; the test file's docstring
+  lists them with their reasons. The threshold is unchanged here: it is set
+  from the CI measurement of this tree.
+
 ### Fixed — a key configured without a key_id keeps the same id on every load
 
 A key whose configuration carries no `key_id` — every key from
 
@@ -338,13 +338,9 @@ asyncio_mode = "auto"
 # starting with `src.`, which (not duckdb) was the real blocker. (The gate runner
 # keeps mutmut workspaces free of relative pytest --basetemp overrides because
 # under py3.11 they break coverage->mutant mapping for file-I/O targets like
-# key_rotation; see scripts/mutation_report.py.) manager.py runs at an honest 0.80
-# threshold (not 0.90): it is a
-# large stateful auth class whose residual survivors are equivalent mutants
-# (structured-logging args, model_copy updates equal to their defaults, redis-url
-# strings masked by the `_redis = None` override, the env-only-dead write path) --
-# every behaviour-reachable mutant, including every auth-bypass and throttle
-# off-by-one, is killed. See scripts/mutation_report.py.
+# key_rotation; see scripts/mutation_report.py.) manager.py gates at 0.90 like
+# the other serving modules; scripts/mutation_report.py gives its measured
+# score and names its nine equivalent survivors.
 paths_to_mutate = [
     "src/agentflow_runtime/serving/api/auth/manager.py",
     "src/agentflow_runtime/serving/api/auth/key_rotation.py",
 
@@ -495,8 +495,12 @@ def run_mutant(
 
     Each mutant gets its own `--basetemp`: pytest wipes and recreates that
     directory at startup, so concurrent runs sharing one abort each other and
-    exit 2.
+    exit 2. pytest creates `--basetemp` itself with a non-recursive mkdir, so
+    the parent has to exist before pytest starts -- otherwise the first
+    `tmp_path` fixture errors at setup, pytest exits 1, and the mutant is
+    scored killed.
     """
+    basetemp.parent.mkdir(parents=True, exist_ok=True)
     command = [
         python,
         "-m",
 
@@ -76,23 +76,22 @@ class ModuleTarget:
         threshold=0.90,
         tests=("tests/unit/test_nl_queries_mutation.py",),
     ),
-    # manager.py runs at 0.80, not the 0.90 the pure-function guards (sql_guard,
-    # sql_builder, ...) hold. It is a ~400-line stateful auth class whose
-    # surviving mutants are dominated by EQUIVALENTS that no behaviour-level test
-    # can kill: structured-logging arguments (the auth logger event names / kwargs),
-    # `model_copy(update=...)` dicts whose mutated field equals its default
-    # ("matched_slot" already defaults to "current"; "key"==api_key on a plaintext
-    # match), the redis-url strings masked by the `_redis = None` override under the
-    # duckdb-free harness, and the config-file write path that is dead under the
-    # env-only test. Every BEHAVIOUR-reachable mutant is killed -- crucially every
-    # auth bypass (the verify_api_key argument-swap mutants on the indexed / legacy
-    # / previous-key paths and in _matches_key_material) and every rate-limit /
-    # failed-auth throttle off-by-one. Local mutmut (py3.10) scores 405/483 = 83.9%;
-    # 0.80 leaves headroom for equivalent-mutant noise while still enforcing a real
-    # floor (the do-nothing baseline was 76.5%). key_rotation is the next target and
-    # stays declared-only until it gets its own duckdb-free test.
+    # manager.py scored 553/562 killed (98.4%) on CI run 34542418689 against
+    # commit 77825f6. The nine survivors are the named residue in the module
+    # docstring of tests/unit/test_auth_manager_mutation.py, grouped:
+    # __init__ 55 and 93 -- _key_store_readonly_skip_logged flag and the
+    # upper-cased Redis URL default;
+    # _load_config 3 and 5 -- encoding="utf-8" case / None;
+    # _sweep_expired_windows 10 and 20 -- pop(key, None) race guard;
+    # authenticate 10 and 11 -- model_copy of a just-proven-equal key;
+    # load 1 -- skipped_readonly_write truthiness. The docstring has the
+    # one-line reason for each. Every behaviour-reachable mutant is killed.
+    # The threshold is 0.90 because that is the bar the other serving modules
+    # hold; it sits 8.4 points under the measured 98.4%, so the nine named
+    # equivalents cannot fail the gate while a real loss of killed mutants
+    # still does.
     Path("serving/api/auth/manager.py"): ModuleTarget(
-        threshold=0.80,
+        threshold=0.90,
         tests=("tests/unit/test_auth_manager_mutation.py",),
     ),
     # key_rotation runs at 0.90. Its residual survivors (local mutmut: 21 of 365)
 
@@ -133,7 +133,8 @@ def probe_key_store_writable(path: Path | str | None) -> bool:
 
 def _file_is_writable(path: Path) -> bool:
     try:
-        with path.open("a", encoding="utf-8"):
+        # Binary: an open-and-close probe has no text to encode.
+        with path.open("ab"):
             return True
     except OSError as exc:
         if is_permission_denied(exc):
@@ -708,7 +709,6 @@ def _legacy_env_keys(self) -> list[TenantKey]:
                     name=name.strip(),
                     tenant="default",
                     rate_limit_rpm=DEFAULT_RATE_LIMIT_RPM,
-                    allowed_entity_types=None,
                     created_at=datetime.now(UTC).date(),
                 )
             )
 
@@ -60,12 +60,12 @@ def test_load_sweeps_expired_rate_windows(self, manager: AuthManager) -> None:
         manager._rate_windows["fresh-key"] = [now - 5]
         manager.load()  # triggers _sweep_expired_windows under config lock
         assert "stale-key" not in manager._rate_windows
-        # 'fresh-key' is also removed because load() rebuilds _rate_windows
-        # from keys_by_value (none configured in this fixture) — that
-        # rebuild is documented behaviour from session 17 and is independent
-        # of the H-C4 sweep, but the assertion below pins it so a future
-        # refactor that reuses the old `defaultdict` cannot reintroduce
-        # the unbounded-growth path silently.
+        # 'fresh-key' is also removed: load() keeps only the windows whose
+        # bucket belongs to a still-configured key, and no configured key
+        # names 'fresh-key' (the fixture configures none). That carry-over is
+        # independent of the H-C4 sweep, but the assertion below pins it so a
+        # future refactor that keeps every window cannot reintroduce the
+        # unbounded-growth path silently.
         assert "fresh-key" not in manager._rate_windows