Close the value.c mutation survivors, and correct one that cannot be

Two new tests in value_arithmetic.c, each verified by hand-applying the mutant
rather than by assuming. The obvious maximum-length-string test does not work:
math_plus clones self into the scratch first, so joining a full string to an
empty one leaves the byte a short copy missed already correct. The operands
have to sum to the limit without either being the answer.

One of the five listed survivors is equivalent and cannot be killed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

TODO.md

@@ -1095,18 +1095,33 @@ What remains, in priority order:
    - **Item 17** is ours: a host cannot reliably create a script variable while a script is
      suspended. The fix is `akbasic_runtime_global()` and roughly fifteen lines. §6 describes
      it and names the one design question to settle first.
-6. **Mutation survivors in `src/value.c`.** The harness is in place (`scripts/mutation_test.py`,
-   the `mutation` CMake target, and a CI job on `src/symtab.c`), and a partial run over
-   `src/value.c` turned up test gaps worth closing. These are *not* equivalent mutants; each
-   is a real bug of that shape the suite would not notice:
+6. **Mutation survivors in `src/value.c`** — ~~closed~~, with one correction to what was
+   written here before. `tests/value_arithmetic.c` grew two functions,
+   `test_maximum_length_string()` and `test_pool_starts_empty()`, and each was verified by
+   hand-applying the mutant and watching the test fail rather than by assuming it would:
 
-   - `AKBASIC_MAX_STRING_LENGTH - 1` → `+ 1` and → `- 0` survive at `src/value.c:47-48`, in
-     `set_string`'s `strncpy` and its NUL terminator. Nothing in the suite writes a
-     *maximum-length* string, so the off-by-one that would truncate or overrun goes unseen.
-     One test that round-trips a 255-character string kills all five.
-   - `memset(obj, 0, ...)` → `memset(obj, 1, ...)` and its deletion survive in
-     `akbasic_valuepool_init`, as does `obj->next = 0` → `= 1`. Nothing asserts a freshly
-     initialised pool is actually empty and zeroed.
+   | Mutant | Result |
+   |---|---|
+   | `strncpy(dest->stringval, src, AKBASIC_MAX_STRING_LENGTH - 1)` → `- 2` | killed |
+   | `dest->stringval[AKBASIC_MAX_STRING_LENGTH - 1] = '\0'` → `- 2` | killed |
+   | `strncpy(..., AKBASIC_MAX_STRING_LENGTH - 1)` → `- 0` | **equivalent — cannot be killed** |
+   | `memset(obj, 0, sizeof(*obj))` deleted from `akbasic_valuepool_init` | killed |
+   | `obj->next = 0` → `= 1` | killed |
+
+   **The correction.** This entry used to say all five were real bugs and that "one test that
+   round-trips a 255-character string kills all five". Two things about that were wrong.
+
+   The `- 0` mutant is *equivalent*. `strncpy(dest, src, 256)` into a 256-byte buffer writes at
+   most 256 bytes, and `set_string()` has already refused anything longer than 255 two lines
+   above, so the extra byte is always the terminator `strncpy` would have written anyway. It
+   cannot be killed and should not be counted against the score.
+
+   And the obvious test does *not* kill the truncating mutant. Joining a full-length string to
+   an empty one passes with the mutant in place, because `akbasic_value_math_plus` clones
+   `self` into the scratch before writing and the byte a short copy fails to write is already
+   the right one. The operands have to sum to the limit **without either of them being the
+   answer** — the test uses 200 `X` plus 55 `Z`, and says so at the site, because this is
+   exactly the sort of thing that gets "simplified" back into a passing no-op.
 
    Two survivors there are genuinely equivalent and cannot be killed: `rval_as_int` and
    `rval_as_float` (`src/value.c:30,35`) tolerate `+` → `-` because the reference's habit of