diff --git a/test/manifest.bats b/test/manifest.bats
index 822c1ca..c4d7314 100644
--- a/test/manifest.bats
+++ b/test/manifest.bats
@@ -507,3 +507,118 @@ m_nojq_path() {
   [[ "$output" == *"--dry-run"* ]] || false
   [[ "$output" == *".secrets.json"* ]] || false
 }
+
+# ─── Coverage backfill (ship Step 7 gap paths) ─────────────────────────
+
+@test "json external entry with unknown type warns and is skipped" {
+  init_with_remote
+  local dir="$WORK_DIR/unktype"; mkdir -p "$dir"
+  echo "K=v" > "$dir/.env"
+  printf '{"version":2,"external":[{"type":"wat","path":"~/x.properties","keys":["k"]}]}\n' > "$dir/.secrets.json"
+  cd "$dir"
+  run "$SECRETS_BIN" push unktype
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"unknown external type"* ]] || false
+}
+
+@test "json external entry with unsafe path warns and is skipped" {
+  init_with_remote
+  local dir="$WORK_DIR/unsafext"; mkdir -p "$dir"
+  echo "K=v" > "$dir/.env"
+  printf '{"version":2,"external":[{"type":"properties","path":"~/../etc/x.properties","keys":["k"]}]}\n' > "$dir/.secrets.json"
+  cd "$dir"
+  run "$SECRETS_BIN" push unsafext
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"unsafe characters in external path"* ]] || false
+}
+
+@test "json external entry with unsafe keys warns and is skipped" {
+  init_with_remote
+  local dir="$WORK_DIR/unsafekeys"; mkdir -p "$dir"
+  echo "K=v" > "$dir/.env"
+  printf '{"version":2,"external":[{"type":"properties","path":"~/.gradle/gradle.properties","keys":["k;rm"]}]}\n' > "$dir/.secrets.json"
+  cd "$dir"
+  run "$SECRETS_BIN" push unsafekeys
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"unsafe characters in key list"* ]] || false
+}
+
+@test "json properties entry without keys warns and is skipped" {
+  init_with_remote
+  local dir="$WORK_DIR/nokeys"; mkdir -p "$dir"
+  echo "K=v" > "$dir/.env"
+  printf '{"version":2,"external":[{"type":"properties","path":"~/.gradle/gradle.properties"}]}\n' > "$dir/.secrets.json"
+  cd "$dir"
+  run "$SECRETS_BIN" push nokeys
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"has no keys"* ]] || false
+}
+
+@test "symlinked .secrets-files is ignored with a warning on push" {
+  init_with_remote
+  m_gradle_src $'beaconClerkPkTest=x\n'
+  local dir="$WORK_DIR/symlegacy"; mkdir -p "$dir"
+  echo "K=v" > "$dir/.env"
+  printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > "$TEST_TMPDIR/real-sf"
+  ln -s "$TEST_TMPDIR/real-sf" "$dir/.secrets-files"
+  cd "$dir"
+  run "$SECRETS_BIN" push symlegacy
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"symlink"* ]] || false
+  run bash -c "ls $SECRETS_DIR/symlegacy/external/*.age 2>/dev/null"
+  [ "$status" -ne 0 ]
+}
+
+@test "pull with declared entries dies with directed error when project absent from store" {
+  init_with_remote
+  mkdir -p "$WORK_DIR/ghostproj"
+  cd "$WORK_DIR/ghostproj"
+  printf '{"version":2,"dotenv":[".env"]}\n' > .secrets.json
+  run "$SECRETS_BIN" pull ghostproj
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"not found"* ]] || false
+  [[ "$output" == *"secrets list"* ]] || false
+}
+
+@test "add without an argument dies with usage" {
+  create_project_dir noargadd
+  run "$SECRETS_BIN" add
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"Usage: secrets add"* ]] || false
+}
+
+@test "push rejects an unknown flag with usage" {
+  init_with_remote
+  create_project_dir badflag
+  run "$SECRETS_BIN" push --nope
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"Unknown push flag"* ]] || false
+}
+
+@test "add normalizes a leading ./ prefix" {
+  create_project_dir dotslash
+  run "$SECRETS_BIN" add ./.env
+  [ "$status" -eq 0 ]
+  run jq -r '.dotenv[0]' .secrets.json
+  [ "$output" = ".env" ]
+}
+
+@test "push --dry-run reports nothing-new when manifest covers all discovered files" {
+  init_with_remote
+  create_project_dir alldecl
+  "$SECRETS_BIN" add .env >/dev/null
+  "$SECRETS_BIN" add .env.staging >/dev/null
+  run "$SECRETS_BIN" push --dry-run
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Nothing new to add"* ]] || false
+}
+
+@test "which displays external entries from the manifest" {
+  create_project_dir whichext
+  printf '{"version":2,"dotenv":[".env"],"external":[{"type":"properties","path":"~/.gradle/gradle.properties","keys":["k1"]}]}\n' > .secrets.json
+  run "$SECRETS_BIN" which
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"properties"* ]] || false
+  [[ "$output" == *"gradle.properties"* ]] || false
+  [[ "$output" == *"k1"* ]] || false
+}