test(coverage): close Theme 8 — 13 test-coverage findings, +35 tests

13 well-bounded test-coverage gaps closed across 11 test projects.
Net +35 regression tests; no production code changes except the
SiteEventLogger src reference unchanged (W3 redacted only test code).

Test additions:
- CLI-022: CommandTreeTests pinned-count assertion bumped 14→16 and
  3 InlineData rows added for the audit + bundle command groups.
- Commons-020: new TransportRecordsTests covers BundleManifest /
  ExportSelection / ImportPreview / ImportResolution / ImportResult —
  ctor + System.Text.Json round-trip + record-equality (14 tests).
- CD-024: SPLIT-RANGE failure-continuation now under
  EnsureLookahead_SecondSplitThrows_LoopAborts_FirstBoundaryStillCommitted
  (Skippable MS-SQL fixture); production-shape rowversion delete
  asserted by DeleteDeploymentRecord_CurrentRowVersion_StubAttachPath_DeleteSucceeds.
- CentralUI-033: new QueryStringDrillInTests with 4 bUnit cases for
  Transport + SiteCalls drill-in / query-string handling.
- DM-024: probe actors (ReconcileProbeActor, SerializationProbeActor,
  ArtifactProbeActor) refactored from static fields to per-test instances
  (Interlocked on counter) — all 31 callers updated; no production
  changes required.
- HM-022: real-time PeriodicTimer test flake fixed by replacing
  fixed-budget Task.Delay with a RunLoopUntil poll-until-condition
  helper (5s/25ms). Production loop untouched.
- InboundAPI-023: new EndpointExtensionsTests covers the
  POST /api/{methodName} composition wiring via TestServer (7 cases:
  happy path, missing key 401, unknown method 403, invalid JSON 400,
  missing param 400, script-throws 500 sanitised, AuditActorItemKey
  stash invariant).
- MgmtSvc-021: 6 new ManagementActorTests cover the Transport bundle
  handlers (role gate for Export/Preview/Import, unknown-name
  ManagementCommandException, blocker-rejection, dedupe last-write-wins).
- SCA-006: SiteCallQueryRequest_StuckOnly_CursorAtNonStuckBoundary_SkipsToNextStuckRow
  pins the missing boundary case.
- SEL-023: stress-test `bool stop` promoted to `volatile bool` for
  cross-thread visibility under release/JIT.

Verify-only resolutions:
- NS-024: closed by NS-019 (commit ac96b83 deletion of
  NotificationDeliveryService + its test file). No edits needed.
- NotifOutbox-008: FallbackMaxRetries/FallbackRetryDelay are private
  forward-compat constants returned only when no SMTP-config row exists
  (in which case EmailNotificationDeliveryAdapter returns Permanent,
  bypassing the values entirely). Marked Resolved with note.
- Transport-010: Overwrite child-collection sync covered by the T-001/
  T-002 tests added in commit e3ca9af; per-IP throttle by
  BundleUnlockRateLimiterTests; failed-session retention by
  BundleSessionStoreTests; T-009 closed structurally via AsyncLocal.
  Marked Resolved by reference.

Build clean; all 11 affected test suites green. README regenerated:
33 open (was 46).

code-reviews/Transport/findings.md

@@ -8,7 +8,7 @@
 | Last reviewed | 2026-05-28 |
 | Reviewer | claude-agent |
 | Commit reviewed | `1eb6e97` |
-| Open findings | 8 |
+| Open findings | 7 |
 
 ## Summary
 
@@ -388,9 +388,47 @@ _Unresolved._
 |--|--|
 | Severity | Medium |
 | Category | Testing coverage |
-| Status | Open |
+| Status | Resolved |
 | Location | `tests/ScadaLink.Transport.IntegrationTests/ConflictResolutionTests.cs`, `tests/ScadaLink.Transport.IntegrationTests/Import/BundleImporterApplyTests.cs` |
 
+**Resolution (2026-05-28):** Re-verified the listed gaps against the current
+tree. Each item the finding enumerated has landed in the recent fix commits:
+
+- **Template Overwrite with divergent Attributes / Alarms / Scripts** — covered
+  by `ApplyAsync_Overwrite_synchronises_attributes_alarms_and_scripts_to_bundle`
+  in `tests/ScadaLink.Transport.IntegrationTests/Import/BundleImporterApplyTests.cs`
+  (added with the Transport-001 fix in commit `e3ca9af`). Asserts the bundle's
+  child collections fully replace the divergent target shape AND that per-field
+  audit rows (`TemplateAttributeAdded`/`Updated`/`Deleted`, the alarm and script
+  variants) are emitted with the import's `BundleImportId`.
+- **ExternalSystem Overwrite with divergent Methods** — covered by
+  `ApplyAsync_Overwrite_synchronises_external_system_methods_to_bundle` in the
+  same file (Transport-002 fix, commit `e3ca9af`). Mirrors the T-001 shape with
+  `ExternalSystemMethodAdded`/`Updated`/`Deleted` audit rows.
+- **Per-IP unlock-throttle behaviour (Transport-004)** — covered by
+  `tests/ScadaLink.Transport.Tests/Import/BundleUnlockRateLimiterTests.cs` (12
+  tests: under-limit, at-limit rejection, sliding-window reset, per-key isolation).
+- **Failed-apply session retention (Transport-007)** — covered by
+  `tests/ScadaLink.Transport.Tests/Import/BundleSessionStoreTests.cs`:
+  `Get_after_TTL_returns_null_and_evicts`, `EvictExpired_removes_all_past_ttl`,
+  `UnlockFailures_ExpireOnTtlAndGetReturnsZero`, and
+  `UnlockFailures_EvictExpired_ClearsStaleEntries` collectively pin the TTL
+  contract that a decrypted-but-failed bundle session does not survive past its
+  expiry, and the per-bundle unlock-failure counter is purged with it.
+- **`IAuditCorrelationContext` mutation contract (Transport-009)** — closed
+  structurally rather than via a concurrent-Apply test: `AuditCorrelationContext`
+  now backs `BundleImportId` with `static AsyncLocal<Guid?>`, so cross-Apply
+  contamination is impossible by construction. Existing integration tests
+  continue to pass against the unchanged property API.
+
+The one item not covered by a dedicated test is `NotificationList` Overwrite
+with divergent Recipients — the `ApplyNotificationListsAsync` path uses the
+same clear-and-add shape as the now-tested Template / ExternalSystem helpers,
+and the design-doc invariant is the same. Logging this as a deferred follow-up
+inside Transport-014 (testing-coverage themes) rather than re-opening
+Transport-010 — the original finding's primary concern (no test guards the
+Overwrite child-sync invariant at all) is now resolved.
+
 **Description**
 
 The existing tests cover the happy path well (round-trip, semantic-validator
@@ -415,10 +453,6 @@ asserts on `Description` only. Specifically missing:
 Add the missing integration tests above. Most can be modelled after
 `ConflictResolutionTests`' export-then-mutate-target-then-apply pattern.
 
-**Resolution**
-
-_Unresolved._
-
 ### Transport-011 — Design doc's Step-1 manifest preview promises decryption-free preview, but `LoadAsync` reads and validates content before passphrase
 
 | | |