[quality] --require-source-files cannot see the repo-root config modules that --check-source already scores #1370

Finding

tests/tools/coverage-report.mjs classifies the repository-root config modules
two different ways, and the disagreement leaves them ungated.

isSourceFile() is !file.startsWith('tests/'), so docusaurus.config.js,
sidebars.js and playwright.config.js are source files: the moment a
coverage record exists for one, it becomes a row in the report and is folded
into the src files ratios that --check-source 100 and
--check-source-regions 100 gate on.

enumerateSourceFiles() disagrees. It walks SOURCE_ROOTS
(scripts, src, tests/tools) plus the tests/helpers*.mjs modules, and
nothing else. The root configs are files at the repository root, not a tree, so
no walk reaches them.

--require-source-files is built on missingSourceFiles(), which is
enumerateSourceFiles().filter(not measured). A file the enumeration never
lists cannot be reported missing. Verified at f5586b0:

enumerateSourceFiles() total: 92
  docusaurus.config.js -> in required set? false
  sidebars.js          -> in required set? false
  playwright.config.js -> in required set? false
isSourceFile('docusaurus.config.js')                 -> true
missingSourceFiles([]) flags docusaurus.config.js    -> false

So these three modules are gated only for as long as some test happens to
import them. If tests/site-config.test.mjs or
tests/playwright-config.test.mjs stopped importing one, it would contribute
neither numerator nor denominator; src files would stay at 100.00 / 100.00,
every threshold would pass, and the whole-set guard that exists precisely to
catch "a file nothing ran at all" would say nothing. That is the same silence
--require-source-files was added to close for src/, left open at the root.

This is a gate blind spot, not a present coverage gap. All three modules are at
100.00 | 100.00 today, so no threshold is currently being evaded:

• Unit evidence: npm run test:unit:coverage:check at f5586b0
  (node --test, TZ=UTC, Node 22.x per engines) reports
  docusaurus.config.js, playwright.config.js and sidebars.js each at
  100.00 | 100.00, and src files | 100.00 | 100.00 | 9405/9405 lines | 2802/2802 regions.
• End-to-end evidence: not applicable to these files.
  tests/tools/e2e-coverage-report.mjs restricts its own required set with
  .filter((file) => file.startsWith('src/')) and measures browser coverage
  only, so the root configs are outside the e2e lane by construction. No claim
  is made here about their end-to-end coverage.

What makes it worth closing rather than noting: docusaurus.config.js holds
the CSP IMAGE_HOST_SOURCES allowlist and the two E2E_COVERAGE=1 plugins
(endusersE2ESourceMaps, endusersE2EDataFixtures) that give the e2e coverage
run its source maps and data overlays. Losing measurement of that file silently
would cost the e2e gate its source attribution, not merely a row in a report.

Recommendation

Make the enumerated set agree with the scored set by enumerating the root
config modules, listed one level deep:

• Add a enumerateRootModules(root) to tests/tools/coverage-report.mjs
  that reads the repository root non-recursively and keeps non-symlink
  files matching SOURCE_FILE, mirroring enumerateHarnessModules().
  One level deep is the point: walking . would descend into
  node_modules/ and build/.
• Push its results into enumerateSourceFiles().
• Update the three --require-source-files diagnostics, which name only
  the SOURCE_ROOTS trees and would otherwise send a reader whose
  unmeasured file is sidebars.js looking under directories it was never
  going to be in.
• Extend tests/coverage-report-source-files.test.mjs, whose fixture
  currently asserts docusaurus.config.js is excluded.

enumerateSourceFiles() then returns 95 entries and missingSourceFiles([])
flags all three. npm run test:unit:coverage:check still exits 0 — the three
modules are already fully covered, so this adds a guard without moving a
threshold. The e2e lane is untouched: its startsWith('src/') filter means the
root modules never enter it.

Priority

• Impact: medium
• Effort: low

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: f5586b0

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88