[quality] coverage executed on e2e fixture pages is not credited: 19 src regions stay at zero across four runs #1236

Finding

The e2e coverage build grows a dedicated fixture page or variant build whenever a
src/** arm is unreachable from published content. Four consecutive CI runs of the
End-to-end coverage job report the same 19 regions uncovered, including regions a
merged, passing fixture spec was added specifically to reach.

report.json uncoveredRegions, byte-identical in all four:

src/components/CaseStudies/index.js                  46 64
src/components/CommunityPeople/index.js              134
src/components/GroupLinkStatus/index.js              23 33
src/components/hooks/useFocusTrap.js                 35
src/components/MemberDirectory/DirectoryFreshness.js 19 30 44 49
src/components/MetricsDashboard/index.js             65 85
src/components/PeopleFreshness/index.js              22
src/components/RadarReports/index.js                 6 24
src/components/ReferenceArchitectures/index.js       13 34

Why this is a defect and not an ordinary residual

src/components/CommunityPeople/index.js line 134 is
const people = peopleData.people[section] || [];. The || [] arm is exactly what
tests/e2e/community-people-unknown-section.spec.js exists for — its header names the
file and the line — and that spec landed in #1136 together with
tests/e2e/fixtures/docs/community-people.mdx, which renders
<CommunityPeople section="coverage-fixture-no-such-section" /> on a second docs
instance served at /e2e-coverage-fixtures/ when E2E_COVERAGE=1.

Three things are true at once in run 37914482229-1, and they cannot all be:

1. The spec ran and passed. The run sealed status: passed, and
   report.json diagnostics is {"warnings": [], "errors": []}.
2. The fixture page was visited and its V8 coverage was captured. Two capture
   files in the artifact carry
   http://localhost:3000/e2e-coverage-fixtures/community-people as their document
   entry — worker-0-parallel-0-retry-0-page-0-246037424792b923.json and
   …-4d50d7d0fd24511d.json, 11 coverage entries each. So the arm was executed in a
   browser whose coverage reached the artifact.
3. The region is still reported at zero. src/components/CommunityPeople/index.js
   → uncoveredRegions: [134].

The report cannot be discarding it for want of a union, either: regions merge by
maximum across every script and artifact —
tests/tools/e2e-coverage-report.mjs:676-681, if (!existing || region.count > existing.count) — so one covering capture is enough on the merge side.

So coverage that was captured on a fixture page is not reaching the file's region
tally. The other eight files show the same shape: every one of the 19 regions is an arm
that only a variant build or a fixture page can execute, and not one of them is
credited. This reads as one attribution defect with nine symptoms rather than nine
unrelated gaps, which is why it is one issue.

I could not localise it further here. The two candidate mechanisms I could see by
reading, neither of which I am asserting:

• the converted.sourceFiles.length > 1 && !converted.attributedPaths.has(path)
  guard at tests/tools/e2e-coverage-report.mjs:656-661, which drops a source
  entirely when a multi-source script does not list it in attributedPaths;
• the contradiction/phantom folding (isContradictedRegion, isPhantomRegion)
  reached from the same loop.

Recommendation

One deliverable: make a region executed on a fixture page or a variant build count
towards its source file, and prove it with the case that is already instrumented.

1. Reproduce from the artifact rather than from a fresh browser run — the capture
   directory 37914482229-1 plus the build/ tree of b00ff4e is a complete,
   deterministic input to node tests/tools/e2e-coverage-report.mjs --input … --build ….
   Narrow to the two …246037424792b923 / …4d50d7d0fd24511d captures and watch
   whether src/components/CommunityPeople/index.js region 134 is dropped before or
   during the merge.
2. Fix the attribution path in tests/tools/e2e-coverage-report.mjs.
3. Pin it with a unit test over collectE2ECoverage() driving a capture whose script
   maps to several sources, asserting the rare arm is credited.
4. The gate then wants ratcheting: --check-source-regions is 95 in
   .github/workflows/ci.yml and the measured number is 95.84–95.92, so today the job
   is green with all 19 regions missing. (Ratcheting the threshold is a one-line
   workflow edit and must be done by a human or an agent with workflow-write
   permission — see Note on scope below.)

Evidence and provenance

• Unit. npm run test:unit:coverage (TZ=UTC node tests/tools/coverage-report.mjs),
  node v26.10.0, run locally 2026-10-09 at 593b9fe. All nine files report
  100.00 | 100.00; src files totals 100.00 | 99.96 (2595/2596 regions). So every
  region above is unit-covered, which is why this is priority 2 and not priority 1.
• End-to-end. The four e2e-coverage artifacts tabulated above, produced by the
  End-to-end coverage job in .github/workflows/ci.yml
  (npm run build:e2e:coverage → npm run test:e2e:coverage →
  npm run report:e2e:coverage -- --check-source 100 --check-source-regions 95).
  Artifact 11609771627 was downloaded and both report.json and the raw capture
  directory inspected directly; the other three were read for report.json only.
• Not combined. Unit coverage is node's own --experimental-test-coverage data and
  the e2e side is V8-to-istanbul over built bundles; the two were analysed separately.
• Not reproduced locally. The e2e half could not be re-run on this machine —
  chrome-headless-shell fails to start with
  error while loading shared libraries: libglib-2.0.so.0, and installing system
  packages is not available here. Every e2e claim above therefore rests on the CI
  artifacts, not on a local run.

Note on scope — no PR from me

Step 4 edits .github/workflows/ci.yml, which a contributor-tier token cannot push;
GitHub rejects a diff touching .github/workflows/** server-side. More importantly,
steps 1-3 cannot be verified here for the reason in the provenance note above: a fix
to the attribution path has to be shown to move the measured number, and that needs a
browser this environment cannot launch. Opening a PR with an unverified fix would be
worse than filing this. The reproduction in step 1 is deterministic from the artifact,
so whoever picks it up does not need to guess.

Priority

• Impact: medium (the e2e gate is green while nine components' rare-path arms are
  uncredited, so every fixture page and variant build added to reach them is currently
  buying nothing measurable)
• Effort: medium

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 593b9fe

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88