diff --git a/internal/cache/redis_test.go b/internal/cache/redis_test.go
index 1a3b9d0..396ef05 100644
--- a/internal/cache/redis_test.go
+++ b/internal/cache/redis_test.go
@@ -242,3 +242,100 @@ func TestInvalidate_DeletesKey(t *testing.T) {
 	// nil client → no panic.
 	cache.Invalidate(ctx, nil, "test:inv")
 }
+
+// unmarshalableMiss is a type whose json.Marshal always fails (channels are
+// not encodable), letting us exercise the cache.set_marshal_failed branch in
+// GetOrSet without poisoning the cache.
+type unmarshalable struct {
+	Ch chan int `json:"ch"`
+}
+
+// TestGetOrSet_SetMarshalFailureReturnsValue — when the freshly-computed
+// value cannot be JSON-encoded, GetOrSet logs and still returns the value so
+// the request succeeds (encoding failure is a programmer error, not a user
+// error). The cache entry must NOT be written.
+func TestGetOrSet_SetMarshalFailureReturnsValue(t *testing.T) {
+	rdb, cleanup := newMiniRedis(t)
+	defer cleanup()
+
+	want := unmarshalable{Ch: make(chan int)}
+	fn := func(_ context.Context) (unmarshalable, error) { return want, nil }
+
+	ctx := context.Background()
+	got, err := cache.GetOrSet(ctx, rdb, "test:marshalfail", time.Minute, fn)
+	require.NoError(t, err, "marshal failure must not surface to caller")
+	assert.Equal(t, want.Ch, got.Ch, "value is returned despite the encode failure")
+
+	// Nothing should have been written to the cache.
+	_, gerr := rdb.Get(ctx, "test:marshalfail").Bytes()
+	assert.ErrorIs(t, gerr, redis.Nil, "un-marshalable value must not be cached")
+}
+
+// TestGetOrSet_TypeMismatchAcrossCallersErrors — singleflight stores the
+// leader's value as interface{}. If a second caller reuses the same key with
+// a different T, the type assertion fails and GetOrSet returns an error rather
+// than returning a wrong-typed zero value. This pins the "caller bug" guard.
+func TestGetOrSet_TypeMismatchAcrossCallersErrors(t *testing.T) {
+	rdb, cleanup := newMiniRedis(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	const key = "test:typemismatch"
+
+	// Block the leader inside fn so the follower joins the same singleflight
+	// group, then both observe the leader's interface{} value.
+	release := make(chan struct{})
+	started := make(chan struct{})
+	var once sync.Once
+
+	leaderFn := func(_ context.Context) (usagePayload, error) {
+		once.Do(func() { close(started) })
+		<-release
+		return usagePayload{Postgres: 11}, nil
+	}
+	// Follower asks for a *different* T (int64) under the same key.
+	followerFn := func(_ context.Context) (int64, error) { return 99, nil }
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	var leaderErr, followerErr error
+	go func() {
+		defer wg.Done()
+		_, leaderErr = cache.GetOrSet(ctx, rdb, key, time.Minute, leaderFn)
+	}()
+	<-started // ensure the leader holds the singleflight slot first
+	go func() {
+		defer wg.Done()
+		_, followerErr = cache.GetOrSet(ctx, rdb, key, time.Minute, followerFn)
+	}()
+
+	// Give the follower a beat to join the in-flight group, then release.
+	time.Sleep(20 * time.Millisecond)
+	close(release)
+	wg.Wait()
+
+	// The leader succeeds; the follower (wrong T) must get the type-mismatch
+	// error. Singleflight makes this timing-dependent, so accept either the
+	// follower erroring OR the follower being the leader — but at least one of
+	// the calls must have produced the mismatch error if they shared a flight.
+	require.NoError(t, leaderErr)
+	if followerErr != nil {
+		assert.Contains(t, followerErr.Error(), "type mismatch")
+	}
+}
+
+// TestInvalidate_LogsButSwallowsDelError — Invalidate must never panic or
+// surface a Redis error to the caller. SetError forces Del to fail; the call
+// returns cleanly (fail-open).
+func TestInvalidate_LogsButSwallowsDelError(t *testing.T) {
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	defer mr.Close()
+	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	defer rdb.Close()
+
+	mr.SetError("forced del failure")
+	// Must not panic and returns nothing — the error is logged and swallowed.
+	cache.Invalidate(context.Background(), rdb, "test:invfail")
+}
diff --git a/internal/circuit/circuit_test.go b/internal/circuit/circuit_test.go
index 02ff9a1..8f557df 100644
--- a/internal/circuit/circuit_test.go
+++ b/internal/circuit/circuit_test.go
@@ -245,3 +245,94 @@ func TestBreaker_ErrOpenIsStableSentinel(t *testing.T) {
 		t.Fatal("errors.Is should detect ErrOpen through errors.Join")
 	}
 }
+
+// ---------------------------------------------------------------------------
+// NewBreaker input-clamping + accessors
+// ---------------------------------------------------------------------------
+
+// TestNewBreaker_ClampsInvalidThreshold verifies a threshold < 1 is clamped
+// to 1, so a single failure trips the breaker rather than never tripping.
+func TestNewBreaker_ClampsInvalidThreshold(t *testing.T) {
+	b := NewBreaker("clamp_threshold", 0, time.Second)
+	if got := b.threshold; got != 1 {
+		t.Fatalf("threshold 0 must clamp to 1, got %d", got)
+	}
+	b2 := NewBreaker("clamp_threshold_neg", -5, time.Second)
+	if got := b2.threshold; got != 1 {
+		t.Fatalf("threshold -5 must clamp to 1, got %d", got)
+	}
+}
+
+// TestNewBreaker_ClampsInvalidCooldown verifies a non-positive cooldown is
+// replaced by the 30s default so the breaker never reopens instantly.
+func TestNewBreaker_ClampsInvalidCooldown(t *testing.T) {
+	b := NewBreaker("clamp_cooldown", 3, 0)
+	if got := b.cooldown; got != 30*time.Second {
+		t.Fatalf("cooldown 0 must default to 30s, got %v", got)
+	}
+	b2 := NewBreaker("clamp_cooldown_neg", 3, -time.Minute)
+	if got := b2.cooldown; got != 30*time.Second {
+		t.Fatalf("negative cooldown must default to 30s, got %v", got)
+	}
+}
+
+// TestBreaker_NameReturnsLabel verifies Name() echoes the metric-label name.
+func TestBreaker_NameReturnsLabel(t *testing.T) {
+	b := NewBreaker("name_accessor", 3, time.Second)
+	if got := b.Name(); got != "name_accessor" {
+		t.Fatalf("Name() = %q, want name_accessor", got)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// State() — all three branches
+// ---------------------------------------------------------------------------
+
+// TestState_ClosedWhenFresh covers the openUntil==0 closed branch.
+func TestState_ClosedWhenFresh(t *testing.T) {
+	b := NewBreaker("state_fresh", 3, time.Second)
+	if got := b.State(); got != StateClosed {
+		t.Fatalf("fresh breaker State() = %v, want StateClosed", got)
+	}
+}
+
+// TestState_HalfOpenAfterCooldown covers the halfOpen==true branch: trip the
+// breaker, wait past cooldown, then Allow() grabs the trial slot moving it to
+// half-open, which State() must report.
+func TestState_HalfOpenAfterCooldown(t *testing.T) {
+	b := NewBreaker("state_halfopen", 1, 20*time.Millisecond)
+	b.Record(errors.New("boom")) // trip → open
+	if got := b.State(); got != StateOpen {
+		t.Fatalf("after trip State() = %v, want StateOpen", got)
+	}
+	time.Sleep(40 * time.Millisecond) // wait out cooldown
+	if !b.Allow() {
+		t.Fatal("Allow() should grant the half-open trial slot after cooldown")
+	}
+	if got := b.State(); got != StateHalfOpen {
+		t.Fatalf("after trial slot State() = %v, want StateHalfOpen", got)
+	}
+}
+
+// TestState_OpenWhileCoolingDown covers the openUntil>now open branch.
+func TestState_OpenWhileCoolingDown(t *testing.T) {
+	b := NewBreaker("state_open", 1, time.Hour)
+	b.Record(errors.New("boom"))
+	if got := b.State(); got != StateOpen {
+		t.Fatalf("during cooldown State() = %v, want StateOpen", got)
+	}
+}
+
+// TestState_OpenAfterCooldownButNoProbeYet covers the final State() branch:
+// cooldown has elapsed but no Allow() has grabbed the trial slot, so the
+// dashboard still treats the breaker as open until something probes it.
+func TestState_OpenAfterCooldownButNoProbeYet(t *testing.T) {
+	b := NewBreaker("state_open_unprobed", 1, 15*time.Millisecond)
+	b.Record(errors.New("boom")) // open, openUntil ≈ now+15ms
+	time.Sleep(35 * time.Millisecond)
+	// Deliberately do NOT call Allow() — halfOpen stays false, openUntil
+	// is non-zero but now > openUntil, hitting the trailing return StateOpen.
+	if got := b.State(); got != StateOpen {
+		t.Fatalf("State() after elapsed cooldown w/o probe = %v, want StateOpen", got)
+	}
+}
diff --git a/internal/cliconfig/cliconfig_test.go b/internal/cliconfig/cliconfig_test.go
index 1c2d861..d47637e 100644
--- a/internal/cliconfig/cliconfig_test.go
+++ b/internal/cliconfig/cliconfig_test.go
@@ -212,3 +212,120 @@ func TestRoundTrip_EffectiveTierAfterLoad(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "hobby", loaded.EffectiveTier())
 }
+
+// ---------------------------------------------------------------------------
+// configPath error branches (UserHomeDir failure)
+// ---------------------------------------------------------------------------
+
+// unsetHome removes HOME for the duration of the test so os.UserHomeDir()
+// fails. t.Setenv with an empty value still leaves HOME defined, so we must
+// Unsetenv and restore manually.
+func unsetHome(t *testing.T) {
+	t.Helper()
+	orig, had := os.LookupEnv("HOME")
+	require.NoError(t, os.Unsetenv("HOME"))
+	t.Cleanup(func() {
+		if had {
+			_ = os.Setenv("HOME", orig)
+		} else {
+			_ = os.Unsetenv("HOME")
+		}
+	})
+}
+
+func TestLoad_ReturnsEmptyConfigWhenHomeUnresolvable(t *testing.T) {
+	unsetHome(t)
+	cfg, err := Load()
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+	assert.Empty(t, cfg.path, "path stays empty when configPath() errors")
+	assert.Empty(t, cfg.APIKey)
+}
+
+func TestSave_ErrorsWhenHomeUnresolvable(t *testing.T) {
+	unsetHome(t)
+	// Empty path forces Save to call configPath(), which fails with no HOME.
+	cfg := &Config{APIKey: "inst_live_x"}
+	err := cfg.Save()
+	require.Error(t, err, "Save must surface the configPath() error")
+}
+
+func TestClear_ErrorsWhenHomeUnresolvable(t *testing.T) {
+	unsetHome(t)
+	err := Clear()
+	require.Error(t, err, "Clear must surface the configPath() error")
+}
+
+// ---------------------------------------------------------------------------
+// Load error branches: malformed JSON + unreadable file
+// ---------------------------------------------------------------------------
+
+func TestLoad_ReturnsErrorOnMalformedJSON(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	path := filepath.Join(dir, ".instant-config")
+	require.NoError(t, os.WriteFile(path, []byte("{not valid json"), 0600))
+
+	cfg, err := Load()
+	require.Error(t, err, "malformed JSON must produce a parse error")
+	assert.Nil(t, cfg)
+}
+
+func TestLoad_ReturnsErrorWhenPathIsADirectory(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	// Create a *directory* at the config path so os.ReadFile returns a
+	// non-NotExist error (EISDIR), exercising the generic read-error branch.
+	require.NoError(t, os.Mkdir(filepath.Join(dir, ".instant-config"), 0700))
+
+	cfg, err := Load()
+	require.Error(t, err, "reading a directory must produce a read error")
+	assert.Nil(t, cfg)
+}
+
+// ---------------------------------------------------------------------------
+// Save error branch: rename target unwritable (temp write fails)
+// ---------------------------------------------------------------------------
+
+func TestSave_ErrorsWhenTempWriteFails(t *testing.T) {
+	// Point path at a file inside a non-existent directory so the temp-file
+	// WriteFile (path + ".tmp") fails with ENOENT.
+	cfg := &Config{path: filepath.Join(t.TempDir(), "no-such-dir", "cfg")}
+	err := cfg.Save()
+	require.Error(t, err, "Save must surface the temp-file write error")
+	assert.Contains(t, err.Error(), "writing")
+}
+
+// ---------------------------------------------------------------------------
+// Save with empty path resolves via configPath() (path == "" branch)
+// ---------------------------------------------------------------------------
+
+func TestSave_ResolvesPathViaConfigPathWhenEmpty(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+
+	cfg := &Config{APIKey: "inst_live_resolve"} // path intentionally empty
+	require.NoError(t, cfg.Save())
+
+	// Save must have resolved and persisted the path.
+	assert.Equal(t, filepath.Join(dir, ".instant-config"), cfg.path)
+	_, err := os.Stat(cfg.path)
+	require.NoError(t, err)
+}
+
+// ---------------------------------------------------------------------------
+// Clear error branch: Remove fails for a non-NotExist reason
+// ---------------------------------------------------------------------------
+
+func TestClear_ErrorsWhenTargetIsNonEmptyDirectory(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	// A non-empty directory at the config path makes os.Remove fail with
+	// ENOTEMPTY — a non-NotExist error that Clear must surface.
+	cfgDir := filepath.Join(dir, ".instant-config")
+	require.NoError(t, os.Mkdir(cfgDir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(cfgDir, "child"), []byte("x"), 0600))
+
+	err := Clear()
+	require.Error(t, err, "Clear must surface a non-NotExist Remove error")
+}
diff --git a/internal/db/postgres_migrations_test.go b/internal/db/postgres_migrations_test.go
new file mode 100644
index 0000000..5a2b1ac
--- /dev/null
+++ b/internal/db/postgres_migrations_test.go
@@ -0,0 +1,499 @@
+// Package db: coverage tests for the migration runner + connect helpers.
+//
+// Rule-22 coverage block — symptom: api/internal/db migration runner +
+// connect entry points are the platform-DB boot gate. Enumeration: every
+// exported symbol in postgres.go + redis.go.
+//   RunMigrations, embeddedMigrationFilenames, MigrationFiles,
+//   ErrDBConnect.{Error,Unwrap}, ConnectPostgres,
+//   ErrRedisConnect.{Error,Unwrap}, ConnectRedis.
+// Sites touched: all of the above. Coverage test: this file.
+package db
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	_ "github.com/lib/pq"
+)
+
+// testDSN returns the test postgres DSN. Mirrors testhelpers.defaultTestDBURL
+// without importing testhelpers (which would create a dependency cycle:
+// testhelpers imports internal/handlers which imports back into common
+// stacks). Override via TEST_DATABASE_URL.
+func testDSN() string {
+	if v := os.Getenv("TEST_DATABASE_URL"); v != "" {
+		return v
+	}
+	return "postgres://postgres:postgres@localhost:5432/instant_dev_test?sslmode=disable"
+}
+
+// freshTestDB creates an isolated per-test Postgres database to avoid
+// colliding with the shared `instant_dev_test` schema. The migration runner
+// is destructive on schema_migrations rows and side-effecting on every
+// table, so a unit test that exercises RunMigrations end-to-end MUST run
+// against its own DB. Each test DB is dropped on cleanup.
+func freshTestDB(t *testing.T) (string, func()) {
+	t.Helper()
+
+	adminDSN := testDSN()
+	admin, err := sql.Open("postgres", adminDSN)
+	if err != nil {
+		t.Skipf("postgres unreachable: %v", err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if err := admin.PingContext(ctx); err != nil {
+		admin.Close()
+		t.Skipf("postgres ping failed: %v", err)
+	}
+
+	dbName := fmt.Sprintf("db_runner_test_%d", time.Now().UnixNano())
+	if _, err := admin.Exec("CREATE DATABASE " + dbName); err != nil {
+		admin.Close()
+		t.Fatalf("CREATE DATABASE %s: %v", dbName, err)
+	}
+	admin.Close()
+
+	// build the new DSN by swapping the dbname in the URL
+	newDSN := swapDBName(adminDSN, dbName)
+	cleanup := func() {
+		a, err := sql.Open("postgres", adminDSN)
+		if err != nil {
+			return
+		}
+		defer a.Close()
+		// terminate stragglers, then drop
+		_, _ = a.Exec(`SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname=$1 AND pid<>pg_backend_pid()`, dbName)
+		_, _ = a.Exec("DROP DATABASE IF EXISTS " + dbName)
+	}
+	return newDSN, cleanup
+}
+
+// swapDBName replaces the trailing /<dbname>?... segment in a postgres URL.
+func swapDBName(dsn, newName string) string {
+	// find the last '/' before any '?'
+	qIdx := strings.Index(dsn, "?")
+	pathPart := dsn
+	query := ""
+	if qIdx >= 0 {
+		pathPart = dsn[:qIdx]
+		query = dsn[qIdx:]
+	}
+	slash := strings.LastIndex(pathPart, "/")
+	if slash < 0 {
+		return dsn // unparseable — leave alone, test will fail downstream
+	}
+	return pathPart[:slash+1] + newName + query
+}
+
+// TestMigrationFiles_NonEmptyAndSorted asserts the embedded filename
+// list is populated and lex-sorted. The runner relies on sort order
+// for deterministic application; a future change that breaks ordering
+// (e.g. switching to map iteration) would re-introduce the historical
+// "024 ran before 023" bug.
+func TestMigrationFiles_NonEmptyAndSorted(t *testing.T) {
+	files := MigrationFiles()
+	if len(files) == 0 {
+		t.Fatal("MigrationFiles: returned empty slice — embed.FS pattern broken")
+	}
+	for i := 1; i < len(files); i++ {
+		if files[i-1] >= files[i] {
+			t.Errorf("MigrationFiles: not sorted at index %d: %q >= %q", i, files[i-1], files[i])
+		}
+	}
+	// sanity: every entry ends in .sql
+	for _, f := range files {
+		if !strings.HasSuffix(f, ".sql") {
+			t.Errorf("MigrationFiles: non-.sql entry: %q", f)
+		}
+	}
+}
+
+// TestEmbeddedMigrationFilenames_DirectCall covers the unexported helper
+// in case a future refactor changes MigrationFiles() to not call it.
+func TestEmbeddedMigrationFilenames_DirectCall(t *testing.T) {
+	files, err := embeddedMigrationFilenames()
+	if err != nil {
+		t.Fatalf("embeddedMigrationFilenames: %v", err)
+	}
+	if len(files) < 10 {
+		t.Errorf("expected ≥10 migrations, got %d", len(files))
+	}
+}
+
+// TestRunMigrations_AppliesAllAndRecordsRows runs the migration runner
+// against a fresh DB, then verifies:
+//  1. it returns nil (apply branch).
+//  2. every embedded filename ends up in schema_migrations (record branch).
+//  3. the highest filename matches the lex-max of the embed.FS — what
+//     /healthz reports as migration_version.
+func TestRunMigrations_AppliesAllAndRecordsRows(t *testing.T) {
+	dsn, cleanup := freshTestDB(t)
+	defer cleanup()
+
+	db, err := sql.Open("postgres", dsn)
+	if err != nil {
+		t.Fatalf("sql.Open: %v", err)
+	}
+	defer db.Close()
+
+	if err := RunMigrations(db); err != nil {
+		t.Fatalf("RunMigrations (first apply): %v", err)
+	}
+
+	files := MigrationFiles()
+	var count int
+	if err := db.QueryRow("SELECT COUNT(*) FROM schema_migrations").Scan(&count); err != nil {
+		t.Fatalf("count schema_migrations: %v", err)
+	}
+	if count != len(files) {
+		t.Errorf("schema_migrations row count: want %d, got %d", len(files), count)
+	}
+
+	var maxFile string
+	if err := db.QueryRow("SELECT filename FROM schema_migrations ORDER BY filename DESC LIMIT 1").Scan(&maxFile); err != nil {
+		t.Fatalf("max filename: %v", err)
+	}
+	if maxFile != files[len(files)-1] {
+		t.Errorf("max filename: want %q, got %q", files[len(files)-1], maxFile)
+	}
+}
+
+// TestRunMigrations_Idempotent re-runs the runner on an already-migrated
+// DB. The CREATE TABLE IF NOT EXISTS / ADD COLUMN IF NOT EXISTS / ON CONFLICT
+// DO NOTHING guards must all hold; a second invocation should leave the
+// schema_migrations row count exactly equal to the first run.
+func TestRunMigrations_Idempotent(t *testing.T) {
+	dsn, cleanup := freshTestDB(t)
+	defer cleanup()
+
+	db, err := sql.Open("postgres", dsn)
+	if err != nil {
+		t.Fatalf("sql.Open: %v", err)
+	}
+	defer db.Close()
+
+	if err := RunMigrations(db); err != nil {
+		t.Fatalf("RunMigrations (first): %v", err)
+	}
+	var first int
+	if err := db.QueryRow("SELECT COUNT(*) FROM schema_migrations").Scan(&first); err != nil {
+		t.Fatalf("first count: %v", err)
+	}
+
+	if err := RunMigrations(db); err != nil {
+		t.Fatalf("RunMigrations (second): %v", err)
+	}
+	var second int
+	if err := db.QueryRow("SELECT COUNT(*) FROM schema_migrations").Scan(&second); err != nil {
+		t.Fatalf("second count: %v", err)
+	}
+	if first != second {
+		t.Errorf("idempotency broken: first=%d second=%d", first, second)
+	}
+}
+
+// TestRunMigrations_PreservesAppliedAt — re-running the runner must not
+// move applied_at. The ON CONFLICT DO NOTHING clause guards this; a
+// regression to ON CONFLICT DO UPDATE would mask history.
+func TestRunMigrations_PreservesAppliedAt(t *testing.T) {
+	dsn, cleanup := freshTestDB(t)
+	defer cleanup()
+
+	db, err := sql.Open("postgres", dsn)
+	if err != nil {
+		t.Fatalf("sql.Open: %v", err)
+	}
+	defer db.Close()
+
+	if err := RunMigrations(db); err != nil {
+		t.Fatalf("RunMigrations (first): %v", err)
+	}
+
+	var firstStamp time.Time
+	const probe = "022_schema_migrations.sql"
+	if err := db.QueryRow("SELECT applied_at FROM schema_migrations WHERE filename=$1", probe).Scan(&firstStamp); err != nil {
+		t.Fatalf("read first applied_at: %v", err)
+	}
+
+	// Sleep just long enough that a re-update would produce a different stamp
+	time.Sleep(50 * time.Millisecond)
+
+	if err := RunMigrations(db); err != nil {
+		t.Fatalf("RunMigrations (second): %v", err)
+	}
+
+	var secondStamp time.Time
+	if err := db.QueryRow("SELECT applied_at FROM schema_migrations WHERE filename=$1", probe).Scan(&secondStamp); err != nil {
+		t.Fatalf("read second applied_at: %v", err)
+	}
+	if !firstStamp.Equal(secondStamp) {
+		t.Errorf("applied_at moved: first=%v second=%v — ON CONFLICT branch broken", firstStamp, secondStamp)
+	}
+}
+
+// TestRunMigrations_RecordWarnBranch — when the per-filename INSERT into
+// schema_migrations fails after the migrations themselves applied, the
+// runner must NOT return an error (the migrations succeeded; the
+// tracking-row write is best-effort per the doc comment). We force the
+// INSERT to fail by pre-creating schema_migrations as a non-updatable
+// view masking the real table — every embedded migration still applies
+// (CREATE TABLE IF NOT EXISTS sees the view, treats name as taken, no-op)
+// but the per-filename INSERT fires against the view and errors with
+// "cannot insert into view".
+//
+// This is the only practical way to exercise the L57-62 warn branch
+// without DI; the embedded migrations include 022_schema_migrations
+// which would otherwise resurrect the table.
+func TestRunMigrations_RecordWarnBranch(t *testing.T) {
+	dsn, cleanup := freshTestDB(t)
+	defer cleanup()
+
+	db, err := sql.Open("postgres", dsn)
+	if err != nil {
+		t.Fatalf("sql.Open: %v", err)
+	}
+	defer db.Close()
+
+	// pre-stage: create the table the runner needs (matching the schema
+	// from 022_schema_migrations.sql) then swap it out for a view of a
+	// different relation that does NOT have a `filename` column. INSERTs
+	// against the view fail with "cannot insert into view".
+	if _, err := db.Exec(`CREATE TABLE _backing (id INT PRIMARY KEY)`); err != nil {
+		t.Fatalf("create _backing: %v", err)
+	}
+	if _, err := db.Exec(`CREATE VIEW schema_migrations AS SELECT id::text AS filename, now() AS applied_at FROM _backing`); err != nil {
+		t.Fatalf("create view: %v", err)
+	}
+
+	// Now run the migration set. The "CREATE TABLE IF NOT EXISTS
+	// schema_migrations" inside 022 will see a relation with that
+	// name and skip. Every other migration applies cleanly. The
+	// per-filename INSERT loop then tries to write into the view
+	// and emits the warn branch.
+	if err := RunMigrations(db); err != nil {
+		t.Fatalf("RunMigrations: want nil (warn-only branch), got %v", err)
+	}
+}
+
+// TestRunMigrations_ExecErrorPropagates injects a closed DB to force the
+// Exec branch of RunMigrations to fail. Covers the error-wrapping path
+// `db.RunMigrations: exec %s: %w`.
+func TestRunMigrations_ExecErrorPropagates(t *testing.T) {
+	dsn, cleanup := freshTestDB(t)
+	defer cleanup()
+
+	db, err := sql.Open("postgres", dsn)
+	if err != nil {
+		t.Fatalf("sql.Open: %v", err)
+	}
+	// close it before passing to RunMigrations — every Exec will error
+	db.Close()
+
+	err = RunMigrations(db)
+	if err == nil {
+		t.Fatal("RunMigrations on closed db: want error, got nil")
+	}
+	if !strings.Contains(err.Error(), "db.RunMigrations") {
+		t.Errorf("error wrapping lost: %v", err)
+	}
+}
+
+// TestErrDBConnect_ErrorAndUnwrap covers both methods on the sentinel.
+func TestErrDBConnect_ErrorAndUnwrap(t *testing.T) {
+	inner := errors.New("dial tcp 127.0.0.1:1: connection refused")
+	e := &ErrDBConnect{Cause: inner}
+
+	if !strings.Contains(e.Error(), "failed to connect to postgres") {
+		t.Errorf("Error() prefix: got %q", e.Error())
+	}
+	if !strings.Contains(e.Error(), "connection refused") {
+		t.Errorf("Error() missing cause: %q", e.Error())
+	}
+	if got := e.Unwrap(); !errors.Is(got, inner) {
+		t.Errorf("Unwrap: want inner err, got %v", got)
+	}
+	// errors.Is should walk through Unwrap correctly
+	wrapped := fmt.Errorf("higher: %w", e)
+	var target *ErrDBConnect
+	if !errors.As(wrapped, &target) {
+		t.Error("errors.As did not unwrap ErrDBConnect")
+	}
+}
+
+// TestErrRedisConnect_ErrorAndUnwrap mirrors the ErrDBConnect test.
+func TestErrRedisConnect_ErrorAndUnwrap(t *testing.T) {
+	inner := errors.New("EOF")
+	e := &ErrRedisConnect{Cause: inner}
+
+	if !strings.Contains(e.Error(), "failed to connect to redis") {
+		t.Errorf("Error() prefix: got %q", e.Error())
+	}
+	if !strings.Contains(e.Error(), "EOF") {
+		t.Errorf("Error() missing cause: %q", e.Error())
+	}
+	if got := e.Unwrap(); !errors.Is(got, inner) {
+		t.Errorf("Unwrap: want inner err, got %v", got)
+	}
+	var target *ErrRedisConnect
+	if !errors.As(fmt.Errorf("h: %w", e), &target) {
+		t.Error("errors.As did not unwrap ErrRedisConnect")
+	}
+}
+
+// TestConnectPostgres_Success covers the happy path: real DSN → real
+// connection → Stats validates the env-tunable pool knobs were applied.
+func TestConnectPostgres_Success(t *testing.T) {
+	dsn := testDSN()
+	probe, err := sql.Open("postgres", dsn)
+	if err != nil {
+		t.Skipf("postgres open: %v", err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	if err := probe.PingContext(ctx); err != nil {
+		probe.Close()
+		t.Skipf("postgres ping: %v", err)
+	}
+	probe.Close()
+
+	// override the pool knobs so we can prove the env path is wired
+	t.Setenv("API_PG_MAX_OPEN_CONNS", "7")
+	t.Setenv("API_PG_MAX_IDLE_CONNS", "3")
+	t.Setenv("API_PG_CONN_MAX_LIFETIME", "2m")
+	t.Setenv("API_PG_CONN_MAX_IDLE_TIME", "45s")
+
+	db := ConnectPostgres(dsn)
+	defer db.Close()
+
+	if got := db.Stats().MaxOpenConnections; got != 7 {
+		t.Errorf("MaxOpenConnections: want 7, got %d", got)
+	}
+}
+
+// TestConnectPostgres_PanicsOnBadDSN exercises the panic path the way
+// startup would: an invalid DSN should panic with *ErrDBConnect.
+func TestConnectPostgres_PanicsOnBadDSN(t *testing.T) {
+	defer func() {
+		r := recover()
+		if r == nil {
+			t.Fatal("ConnectPostgres on bad DSN: expected panic")
+		}
+		e, ok := r.(*ErrDBConnect)
+		if !ok {
+			t.Errorf("panic value: want *ErrDBConnect, got %T (%v)", r, r)
+			return
+		}
+		if e.Cause == nil {
+			t.Error("ErrDBConnect.Cause should be set")
+		}
+	}()
+	// lib/pq sql.Open with an unparseable URL returns an error → panic
+	ConnectPostgres("postgres://[::invalid")
+}
+
+// TestConnectPostgres_PanicsOnUnreachable — open succeeds (lazy) but
+// PingContext fails. Covers the second panic site in ConnectPostgres.
+func TestConnectPostgres_PanicsOnUnreachable(t *testing.T) {
+	defer func() {
+		r := recover()
+		if r == nil {
+			t.Fatal("ConnectPostgres on unreachable host: expected panic")
+		}
+		if _, ok := r.(*ErrDBConnect); !ok {
+			t.Errorf("panic value: want *ErrDBConnect, got %T (%v)", r, r)
+		}
+	}()
+	// port 1 on localhost is reserved tcpmux; nothing listens, so ping
+	// fails within the 10s timeout in ConnectPostgres.
+	ConnectPostgres("postgres://nobody@127.0.0.1:1/postgres?sslmode=disable&connect_timeout=2")
+}
+
+// TestConnectRedis_Success — happy path against the local test redis.
+func TestConnectRedis_Success(t *testing.T) {
+	url := os.Getenv("TEST_REDIS_URL")
+	if url == "" {
+		url = "redis://localhost:6379/15"
+	}
+	// best-effort skip on unreachable redis (e.g. CI without the service)
+	defer func() {
+		if r := recover(); r != nil {
+			t.Skipf("redis unreachable, skipping: %v", r)
+		}
+	}()
+	rdb := ConnectRedis(url)
+	defer rdb.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	if err := rdb.Ping(ctx).Err(); err != nil {
+		t.Errorf("post-connect ping: %v", err)
+	}
+}
+
+// TestConnectRedis_PanicsOnBadURL covers the ParseURL-failure path.
+func TestConnectRedis_PanicsOnBadURL(t *testing.T) {
+	defer func() {
+		r := recover()
+		if r == nil {
+			t.Fatal("ConnectRedis on bad URL: expected panic")
+		}
+		if _, ok := r.(*ErrRedisConnect); !ok {
+			t.Errorf("panic value: want *ErrRedisConnect, got %T", r)
+		}
+	}()
+	ConnectRedis("not-a-redis-url")
+}
+
+// TestStartPoolStatsExporter_TickFires covers the ticker.C branch of the
+// exporter loop (the eager-emit before the first tick covers the rest).
+// The default ticker interval is 5 seconds — we run for 6 to guarantee
+// at least one tick fires before context cancellation. Skipped in
+// `-short` mode so the default unit-test run stays fast.
+func TestStartPoolStatsExporter_TickFires(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping 6s ticker test in -short mode")
+	}
+	db, err := sql.Open("postgres", "postgres://nobody@127.0.0.1:1/postgres?sslmode=disable")
+	if err != nil {
+		t.Fatalf("sql.Open: %v", err)
+	}
+	defer db.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 6*time.Second)
+	defer cancel()
+	done := make(chan struct{})
+	go func() {
+		StartPoolStatsExporter(ctx, db, "tick_test_pool")
+		close(done)
+	}()
+	select {
+	case <-done:
+		// good — exited cleanly after at least one tick
+	case <-time.After(8 * time.Second):
+		t.Fatal("StartPoolStatsExporter did not return")
+	}
+}
+
+// TestConnectRedis_PanicsOnUnreachable covers the Ping-failure path
+// (URL is valid, but no server listens).
+func TestConnectRedis_PanicsOnUnreachable(t *testing.T) {
+	defer func() {
+		r := recover()
+		if r == nil {
+			t.Fatal("ConnectRedis on unreachable host: expected panic")
+		}
+		if _, ok := r.(*ErrRedisConnect); !ok {
+			t.Errorf("panic value: want *ErrRedisConnect, got %T", r)
+		}
+	}()
+	// 127.0.0.1:1 has nothing listening; the client retries within 10s
+	// then returns the ping error → ConnectRedis panics with *ErrRedisConnect.
+	ConnectRedis("redis://127.0.0.1:1/0")
+}
diff --git a/internal/email/breaker_test.go b/internal/email/breaker_test.go
index ef7932d..94adf5f 100644
--- a/internal/email/breaker_test.go
+++ b/internal/email/breaker_test.go
@@ -368,3 +368,102 @@ func TestBrevoProvider_SetsIdempotencyHeaders(t *testing.T) {
 func jsonMarshal(v interface{}) ([]byte, error) {
 	return []byte(fmt.Sprintf(`%v`, v)), nil
 }
+
+// noopClient builds a *Client whose underlying provider succeeds silently
+// (ProviderNoop). Used to drive the closed-state success paths of the
+// keyless wrappers so record(nil) and the inner happy path are covered.
+func noopClient() *Client {
+	return New(Config{Provider: string(ProviderNoop)})
+}
+
+// TestNewBreakingClient_ProductionDefaults exercises the production
+// constructor (the test ctor is used everywhere else) and pins the
+// package-default threshold + cooldown + metric label name.
+func TestNewBreakingClient_ProductionDefaults(t *testing.T) {
+	b := NewBreakingClient(noopClient())
+	if b.threshold != transactionalCircuitThreshold {
+		t.Errorf("threshold = %d, want %d", b.threshold, transactionalCircuitThreshold)
+	}
+	if b.cooldown != transactionalCircuitCooldown {
+		t.Errorf("cooldown = %v, want %v", b.cooldown, transactionalCircuitCooldown)
+	}
+	if b.name != "email_transactional" {
+		t.Errorf("name = %q, want email_transactional", b.name)
+	}
+	// A fresh production breaker must admit (closed state).
+	if err := b.SendPaymentFailed(context.Background(), "u@example.com", 1, nil); err != nil {
+		t.Errorf("fresh production breaker rejected a send: %v", err)
+	}
+}
+
+// TestBreakingClient_ProviderName covers the forwarding accessor plus its two
+// defensive nil branches (nil receiver and nil inner → ProviderNoop).
+func TestBreakingClient_ProviderName(t *testing.T) {
+	b := NewBreakingClient(noopClient())
+	if got := b.ProviderName(); got != ProviderNoop {
+		t.Errorf("ProviderName() = %v, want ProviderNoop", got)
+	}
+
+	var nilB *BreakingClient
+	if got := nilB.ProviderName(); got != ProviderNoop {
+		t.Errorf("nil receiver ProviderName() = %v, want ProviderNoop", got)
+	}
+
+	nilInner := &BreakingClient{inner: nil}
+	if got := nilInner.ProviderName(); got != ProviderNoop {
+		t.Errorf("nil inner ProviderName() = %v, want ProviderNoop", got)
+	}
+}
+
+// TestBreakingClient_KeylessWrappersSucceedClosed drives every keyless Send*
+// wrapper through the closed-state success path (inner returns nil), covering
+// the 40%-covered methods' happy branch + record(nil) reset.
+func TestBreakingClient_KeylessWrappersSucceedClosed(t *testing.T) {
+	b := NewBreakingClient(noopClient())
+	ctx := context.Background()
+
+	if err := b.SendPaymentSucceeded(ctx, "u@example.com", PaymentReceipt{Plan: "pro", AmountKnown: true, AmountDisplay: "$49"}); err != nil {
+		t.Errorf("SendPaymentSucceeded: %v", err)
+	}
+	if err := b.SendTeamInvite(ctx, "u@example.com", "Acme", "https://instanode.dev/accept"); err != nil {
+		t.Errorf("SendTeamInvite: %v", err)
+	}
+	if err := b.SendDeletionConfirmation(ctx, "u@example.com", "db-abc", "https://instanode.dev/confirm", 30); err != nil {
+		t.Errorf("SendDeletionConfirmation: %v", err)
+	}
+	if err := b.SendMagicLink(ctx, "u@example.com", "https://instanode.dev/magic"); err != nil {
+		t.Errorf("SendMagicLink: %v", err)
+	}
+
+	// consecutive must be 0 after a run of successes (record(nil) resets).
+	if got := b.consecutive.Load(); got != 0 {
+		t.Errorf("consecutive after successes = %d, want 0", got)
+	}
+}
+
+// TestBreakingClient_KeylessWrappersRejectWhenOpen drives the four keyless
+// wrappers' fast-fail branch: once the breaker is open, each returns
+// ErrCircuitOpen without touching the inner provider.
+func TestBreakingClient_KeylessWrappersRejectWhenOpen(t *testing.T) {
+	inner := failingClient()
+	b := newBreakingClientWithConfig(inner, 1, 5*time.Second)
+	ctx := context.Background()
+
+	// One failure trips the breaker (threshold=1).
+	_ = b.SendPaymentSucceeded(ctx, "u@example.com", PaymentReceipt{})
+
+	sends := []struct {
+		name string
+		fn   func() error
+	}{
+		{"SendPaymentSucceeded", func() error { return b.SendPaymentSucceeded(ctx, "u@example.com", PaymentReceipt{}) }},
+		{"SendTeamInvite", func() error { return b.SendTeamInvite(ctx, "u@example.com", "Acme", "x") }},
+		{"SendDeletionConfirmation", func() error { return b.SendDeletionConfirmation(ctx, "u@example.com", "db", "x", 30) }},
+		{"SendMagicLink", func() error { return b.SendMagicLink(ctx, "u@example.com", "x") }},
+	}
+	for _, s := range sends {
+		if err := s.fn(); !errors.Is(err, ErrCircuitOpen) {
+			t.Errorf("%s when open: want ErrCircuitOpen, got %v", s.name, err)
+		}
+	}
+}
diff --git a/internal/email/email_coverage_test.go b/internal/email/email_coverage_test.go
new file mode 100644
index 0000000..71a7fec
--- /dev/null
+++ b/internal/email/email_coverage_test.go
@@ -0,0 +1,327 @@
+package email
+
+// email_coverage_test.go — straggler coverage for the low-level dispatch,
+// provider, and helper paths that the behavioural tests don't reach:
+//   - resolveProvider precedence (explicit strings + key-based inference)
+//   - ProviderName nil-provider branch
+//   - sendWithKey: nil provider, suppression fail-open + suppressed,
+//     ledger probe fail-open + dedup, MarkSent fail-open
+//   - brevoProvider.Send: empty recipient, non-2xx status, keyed headers
+//   - resendProvider.Send: keyless + keyed happy paths and the error path
+//   - maskEmail edge cases (no "@", leading "@", one-char local part)
+//
+// White-box (package email) so we can construct providers directly and
+// reach unexported fields.
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	resend "github.com/resend/resend-go/v2"
+)
+
+// ---------------------------------------------------------------------------
+// resolveProvider
+// ---------------------------------------------------------------------------
+
+func TestResolveProvider_Precedence(t *testing.T) {
+	cases := []struct {
+		name string
+		cfg  Config
+		want ProviderName
+	}{
+		{"explicit brevo", Config{Provider: "brevo"}, ProviderBrevo},
+		{"explicit resend", Config{Provider: "Resend"}, ProviderResend},
+		{"explicit noop", Config{Provider: "noop"}, ProviderNoop},
+		{"brevo key infers brevo", Config{BrevoAPIKey: "xkeysib-x"}, ProviderBrevo},
+		{"resend key infers resend", Config{ResendAPIKey: "re_live_x"}, ProviderResend},
+		{"resend sentinel ignored", Config{ResendAPIKey: resendSentinelUnset}, ProviderNoop},
+		{"empty config defaults noop", Config{}, ProviderNoop},
+		{"brevo key wins over resend key", Config{BrevoAPIKey: "x", ResendAPIKey: "re_y"}, ProviderBrevo},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := resolveProvider(tc.cfg); got != tc.want {
+				t.Errorf("resolveProvider = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// ---------------------------------------------------------------------------
+// ProviderName nil-provider branch
+// ---------------------------------------------------------------------------
+
+func TestClient_ProviderName_NilProviderReturnsNoop(t *testing.T) {
+	c := &Client{} // zero value, provider is nil
+	if got := c.ProviderName(); got != ProviderNoop {
+		t.Errorf("ProviderName on nil-provider client = %v, want ProviderNoop", got)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// sendWithKey paths
+// ---------------------------------------------------------------------------
+
+func TestSendWithKey_NilProviderIsNoop(t *testing.T) {
+	c := &Client{} // provider nil → defensive noop, returns nil
+	if err := c.sendWithKey(context.Background(), "u@example.com", "s", "t", "h", "", ""); err != nil {
+		t.Errorf("nil-provider sendWithKey: want nil, got %v", err)
+	}
+}
+
+// covSuppression returns a fixed (suppressed, err) for IsSuppressed. Named to
+// avoid colliding with the existing fakeSuppression in email_test.go.
+type covSuppression struct {
+	suppressed bool
+	err        error
+}
+
+func (f covSuppression) IsSuppressed(_ context.Context, _ string) (bool, error) {
+	return f.suppressed, f.err
+}
+
+func TestSendWithKey_SuppressionErrorFailsOpen(t *testing.T) {
+	c := NewNoop().WithSuppressionChecker(covSuppression{err: errors.New("db down")})
+	// Fail-open: a suppression-lookup error must still deliver (noop → nil).
+	if err := c.sendWithKey(context.Background(), "u@example.com", "s", "t", "h", "", ""); err != nil {
+		t.Errorf("suppression fail-open: want nil, got %v", err)
+	}
+}
+
+func TestSendWithKey_SuppressedRecipientSkipped(t *testing.T) {
+	c := NewNoop().WithSuppressionChecker(covSuppression{suppressed: true})
+	if err := c.sendWithKey(context.Background(), "u@example.com", "s", "t", "h", "", ""); err != nil {
+		t.Errorf("suppressed recipient: want nil (skipped), got %v", err)
+	}
+}
+
+// covLedger drives the SendLedger probe + mark branches. Named to avoid
+// colliding with the existing fakeLedger in breaker_test.go.
+type covLedger struct {
+	sent        bool
+	sentErr     error
+	markErr     error
+	markedKeys  []string
+	markedKinds []string
+}
+
+func (f *covLedger) Sent(_ context.Context, _ string) (bool, error) {
+	return f.sent, f.sentErr
+}
+
+func (f *covLedger) MarkSent(_ context.Context, key, kind string) error {
+	f.markedKeys = append(f.markedKeys, key)
+	f.markedKinds = append(f.markedKinds, kind)
+	return f.markErr
+}
+
+func TestSendWithKey_LedgerProbeErrorFailsOpen(t *testing.T) {
+	led := &covLedger{sentErr: errors.New("probe boom")}
+	c := NewNoop().WithSendLedger(led)
+	// Probe error → fail open → send proceeds → MarkSent attempted.
+	if err := c.sendWithKey(context.Background(), "u@example.com", "s", "t", "h", "key-1", "magic_link"); err != nil {
+		t.Errorf("ledger probe fail-open: want nil, got %v", err)
+	}
+	if len(led.markedKeys) != 1 || led.markedKeys[0] != "key-1" {
+		t.Errorf("expected MarkSent(key-1), got %v", led.markedKeys)
+	}
+}
+
+func TestSendWithKey_LedgerDedupSkips(t *testing.T) {
+	led := &covLedger{sent: true}
+	c := NewNoop().WithSendLedger(led)
+	if err := c.sendWithKey(context.Background(), "u@example.com", "s", "t", "h", "key-dup", "magic_link"); err != nil {
+		t.Errorf("ledger dedup: want nil, got %v", err)
+	}
+	if len(led.markedKeys) != 0 {
+		t.Errorf("deduped send must not MarkSent, got %v", led.markedKeys)
+	}
+}
+
+func TestSendWithKey_MarkSentErrorIsSwallowed(t *testing.T) {
+	led := &covLedger{markErr: errors.New("mark boom")}
+	c := NewNoop().WithSendLedger(led)
+	// MarkSent error is best-effort — must not surface to the caller.
+	if err := c.sendWithKey(context.Background(), "u@example.com", "s", "t", "h", "key-2", "team_invite"); err != nil {
+		t.Errorf("MarkSent error must be swallowed, got %v", err)
+	}
+}
+
+// covRewriter is a RoundTripper that rewrites scheme+host to the test server.
+// (email_test.go's urlRewriter lives in the external email_test package and is
+// not visible here in package email.)
+type covRewriter struct{ base string }
+
+func (u *covRewriter) RoundTrip(req *http.Request) (*http.Response, error) {
+	if idx := strings.Index(u.base, "://"); idx > 0 {
+		req.URL.Scheme = u.base[:idx]
+		req.URL.Host = u.base[idx+3:]
+	}
+	return http.DefaultTransport.RoundTrip(req)
+}
+
+// ---------------------------------------------------------------------------
+// brevoProvider.Send error + keyed-header paths
+// ---------------------------------------------------------------------------
+
+func TestBrevoProvider_Send_EmptyRecipientErrors(t *testing.T) {
+	p := &brevoProvider{apiKey: "k", http: http.DefaultClient, fromName: "I", fromAddr: "n@i.dev"}
+	err := p.Send(context.Background(), "   ", "s", "t", "h", "")
+	if err == nil || !strings.Contains(err.Error(), "empty recipient") {
+		t.Fatalf("empty recipient: want error, got %v", err)
+	}
+}
+
+func TestBrevoProvider_Send_Non2xxStatusErrors(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+		_, _ = w.Write([]byte(`{"message":"sender not verified"}`))
+	}))
+	defer srv.Close()
+
+	p := &brevoProvider{
+		apiKey:   "k",
+		http:     &http.Client{Transport: &covRewriter{base: srv.URL}},
+		fromName: "I", fromAddr: "n@i.dev",
+	}
+	err := p.Send(context.Background(), "u@example.com", "s", "t", "h", "")
+	if err == nil || !strings.Contains(err.Error(), "unexpected status 400") {
+		t.Fatalf("non-2xx: want status error, got %v", err)
+	}
+	if !strings.Contains(err.Error(), "sender not verified") {
+		t.Errorf("error must surface body, got %v", err)
+	}
+}
+
+func TestBrevoProvider_Send_KeyedSetsIdempotencyHeaders(t *testing.T) {
+	var customHdr, idemHdr string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		customHdr = r.Header.Get("X-Mailin-Custom")
+		idemHdr = r.Header.Get("Idempotency-Key")
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	p := &brevoProvider{
+		apiKey:   "k",
+		http:     &http.Client{Transport: &covRewriter{base: srv.URL}},
+		fromName: "I", fromAddr: "n@i.dev",
+	}
+	if err := p.Send(context.Background(), "u@example.com", "s", "t", "h", "idem-99"); err != nil {
+		t.Fatalf("keyed send: %v", err)
+	}
+	if customHdr != "idem-99" {
+		t.Errorf("X-Mailin-Custom = %q, want idem-99", customHdr)
+	}
+	if idemHdr != "idem-99" {
+		t.Errorf("Idempotency-Key = %q, want idem-99", idemHdr)
+	}
+}
+
+func TestBrevoProvider_Send_Accepted202IsSuccess(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusAccepted)
+	}))
+	defer srv.Close()
+	p := &brevoProvider{
+		apiKey:   "k",
+		http:     &http.Client{Transport: &covRewriter{base: srv.URL}},
+		fromName: "I", fromAddr: "n@i.dev",
+	}
+	if err := p.Send(context.Background(), "u@example.com", "s", "t", "h", ""); err != nil {
+		t.Errorf("202 Accepted should be success, got %v", err)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// resendProvider.Send keyless + keyed happy paths + error path
+// ---------------------------------------------------------------------------
+
+// newResendProviderTo builds a resendProvider whose SDK client targets srv.
+func newResendProviderTo(t *testing.T, srvURL string) *resendProvider {
+	t.Helper()
+	cli := resend.NewCustomClient(http.DefaultClient, "re_test_key")
+	u, err := url.Parse(srvURL + "/")
+	if err != nil {
+		t.Fatalf("parse url: %v", err)
+	}
+	cli.BaseURL = u
+	return &resendProvider{client: cli, from: "InstaNode <noreply@instanode.dev>"}
+}
+
+func TestResendProvider_Send_KeylessSuccess(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"id":"re-123"}`))
+	}))
+	defer srv.Close()
+
+	p := newResendProviderTo(t, srv.URL)
+	if err := p.Send(context.Background(), "u@example.com", "s", "t", "<p>h</p>", ""); err != nil {
+		t.Errorf("keyless resend send: %v", err)
+	}
+}
+
+func TestResendProvider_Send_KeyedSuccess(t *testing.T) {
+	var sawIdem string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		sawIdem = r.Header.Get("Idempotency-Key")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"id":"re-456"}`))
+	}))
+	defer srv.Close()
+
+	p := newResendProviderTo(t, srv.URL)
+	if err := p.Send(context.Background(), "u@example.com", "s", "t", "<p>h</p>", "idem-key-7"); err != nil {
+		t.Errorf("keyed resend send: %v", err)
+	}
+	if sawIdem != "idem-key-7" {
+		t.Errorf("resend Idempotency-Key header = %q, want idem-key-7", sawIdem)
+	}
+}
+
+func TestResendProvider_Send_ErrorPath(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusUnprocessableEntity)
+		_, _ = w.Write([]byte(`{"message":"invalid from","name":"validation_error"}`))
+	}))
+	defer srv.Close()
+
+	p := newResendProviderTo(t, srv.URL)
+	err := p.Send(context.Background(), "u@example.com", "s", "t", "h", "")
+	if err == nil || !strings.Contains(err.Error(), "email.send") {
+		t.Fatalf("resend error path: want wrapped error, got %v", err)
+	}
+}
+
+func TestResendProvider_Name(t *testing.T) {
+	p := &resendProvider{}
+	if p.Name() != ProviderResend {
+		t.Errorf("resendProvider.Name() = %v, want ProviderResend", p.Name())
+	}
+}
+
+// ---------------------------------------------------------------------------
+// maskEmail edge cases
+// ---------------------------------------------------------------------------
+
+func TestMaskEmail_EdgeCases(t *testing.T) {
+	cases := []struct{ in, want string }{
+		{"alice@example.com", "a***@example.com"},
+		{"a@example.com", "a@example.com"}, // one-char local part kept as-is
+		{"no-at-sign", "no-at-sign"},       // no "@" → unchanged
+		{"@example.com", "@example.com"},   // leading "@" (at == 0) → unchanged
+		{"", ""},                           // empty → unchanged
+	}
+	for _, tc := range cases {
+		if got := maskEmail(tc.in); got != tc.want {
+			t.Errorf("maskEmail(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}
diff --git a/internal/experiments/experiments_test.go b/internal/experiments/experiments_test.go
index 6f9aa47..580908f 100644
--- a/internal/experiments/experiments_test.go
+++ b/internal/experiments/experiments_test.go
@@ -151,3 +151,60 @@ func TestSaltIsolation_DifferentSaltsDiffer(t *testing.T) {
 			disagree, N, N*40/100)
 	}
 }
+
+// ---------------------------------------------------------------------------
+// register panic branches + pickFromVariants empty guard
+// ---------------------------------------------------------------------------
+
+// TestRegister_PanicsOnDuplicate verifies a second registration of the same
+// name fails loudly — duplicate registration is always a programmer error.
+func TestRegister_PanicsOnDuplicate(t *testing.T) {
+	const name = "test_dup_experiment"
+	register(Experiment{Name: name, Variants: []string{"a", "b"}, Salt: "s"})
+	t.Cleanup(func() { delete(registry, name) })
+
+	defer func() {
+		r := recover()
+		if r == nil {
+			t.Fatal("expected panic on duplicate registration")
+		}
+		msg, _ := r.(string)
+		if msg != "experiments: duplicate registration: "+name {
+			t.Fatalf("unexpected panic message: %v", r)
+		}
+	}()
+	register(Experiment{Name: name, Variants: []string{"x"}, Salt: "s2"})
+}
+
+// TestRegister_PanicsOnEmptyVariants verifies an experiment with no variants
+// fails loudly at startup rather than silently producing "" buckets.
+func TestRegister_PanicsOnEmptyVariants(t *testing.T) {
+	const name = "test_empty_variants_experiment"
+	defer func() {
+		r := recover()
+		if r == nil {
+			t.Fatal("expected panic on empty variants")
+		}
+		msg, _ := r.(string)
+		if msg != "experiments: variants empty: "+name {
+			t.Fatalf("unexpected panic message: %v", r)
+		}
+		// Ensure the failed registration did not leak into the registry.
+		if _, ok := registry[name]; ok {
+			delete(registry, name)
+			t.Fatal("empty-variant experiment must not be registered")
+		}
+	}()
+	register(Experiment{Name: name, Variants: nil, Salt: "s"})
+}
+
+// TestPickFromVariants_EmptyReturnsEmpty exercises the defensive empty-slice
+// guard that Pick relies on for unknown experiments.
+func TestPickFromVariants_EmptyReturnsEmpty(t *testing.T) {
+	if got := pickFromVariants(nil, "salt", "id"); got != "" {
+		t.Fatalf("empty variants must return \"\", got %q", got)
+	}
+	if got := pickFromVariants([]string{}, "salt", "id"); got != "" {
+		t.Fatalf("empty variants must return \"\", got %q", got)
+	}
+}
diff --git a/internal/telemetry/tracer_test.go b/internal/telemetry/tracer_test.go
index f714dd4..8591a06 100644
--- a/internal/telemetry/tracer_test.go
+++ b/internal/telemetry/tracer_test.go
@@ -77,3 +77,58 @@ func TestStripScheme(t *testing.T) {
 		}
 	}
 }
+
+// TestInitTracer_ServiceNameOverride — OTEL_SERVICE_NAME, when set, overrides
+// the passed serviceName. We can't read the resource back out, but exercising
+// the branch + booting cleanly is what coverage needs; the shutdown must be
+// callable.
+func TestInitTracer_ServiceNameOverride(t *testing.T) {
+	t.Setenv("OTEL_SERVICE_NAME", "override-svc")
+	t.Setenv("NEW_RELIC_LICENSE_KEY", "")
+	shutdown := InitTracer("instant-api", "https://otlp.nr-data.net:4317")
+	if shutdown == nil {
+		t.Fatal("nil shutdown")
+	}
+	if err := shutdown(context.Background()); err != nil {
+		t.Errorf("shutdown: %v", err)
+	}
+}
+
+// TestInitTracer_InsecureEndpoint — a plaintext (http://) endpoint takes the
+// WithInsecure() branch instead of WithTLSCredentials.
+func TestInitTracer_InsecureEndpoint(t *testing.T) {
+	t.Setenv("NEW_RELIC_LICENSE_KEY", "")
+	shutdown := InitTracer("instant-api", "http://localhost:4317")
+	if shutdown == nil {
+		t.Fatal("nil shutdown")
+	}
+	if err := shutdown(context.Background()); err != nil {
+		t.Errorf("shutdown: %v", err)
+	}
+}
+
+// TestInitTracer_WithLicenseKey — a real (non-sentinel) license key takes the
+// WithHeaders(api-key) branch.
+func TestInitTracer_WithLicenseKey(t *testing.T) {
+	t.Setenv("NEW_RELIC_LICENSE_KEY", "real-license-key-1234567890")
+	shutdown := InitTracer("instant-api", "https://otlp.nr-data.net:4317")
+	if shutdown == nil {
+		t.Fatal("nil shutdown")
+	}
+	if err := shutdown(context.Background()); err != nil {
+		t.Errorf("shutdown: %v", err)
+	}
+}
+
+// TestInitTracer_SentinelLicenseKeyTreatedAsMissing — the CHANGE_ME sentinel
+// must take the license-missing warning branch (no api-key header).
+func TestInitTracer_SentinelLicenseKeyTreatedAsMissing(t *testing.T) {
+	t.Setenv("NEW_RELIC_LICENSE_KEY", "CHANGE_ME")
+	shutdown := InitTracer("instant-api", "otlp.nr-data.net:4317")
+	if shutdown == nil {
+		t.Fatal("nil shutdown")
+	}
+	if err := shutdown(context.Background()); err != nil {
+		t.Errorf("shutdown: %v", err)
+	}
+}