[quality] the coverage-artifact seal's two containment guards have never been executed by a test #1127

Finding

tests/tools/e2e-coverage-scripts.mjs seals a coverage run by copying every
build script the run referenced into the run directory, so the published
artifact renders without the build that produced it (#1040). No test file
imports it. grep -rl 'captureRunScripts\|e2e-coverage-scripts' tests/ scripts/
at 7ab301e returns only the module itself and its two callers
(tests/tools/e2e-coverage-run.mjs, tests/tools/e2e-coverage-report.mjs), so
the coverage it does have is whatever the e2e-coverage-run tests happened to
execute on the way past.

Four regions are never reached at all, and two of them are containment guards:

119   const source = await readFile(script.path, 'utf8');
120   const reference = sourceMapReference(source);
...
124     if (!isInside(script.root, mapPath)) return null;           // uncovered
...
131     if (!isInside(script.root, resolvedMapPath)) return null;   // uncovered
...
169     if (payload?.kind !== artifactKind) continue;               // uncovered
170     for (const scriptCoverage of payload.result ?? []) {        // uncovered

captureScript reads the sourceMappingURL comment out of a build script and
copies the map it names. That comment is content, not a path the harness
chose. Lines 124 and 131 are what stop a reference that climbs out of the build
root, or one that names a symlink pointing out of it, from writing an arbitrary
file into the published artifact; both must return null so the script lands in
missing and the reporter falls back to build/. Neither guard has ever been
executed by a test, so neither would fail one if it were dropped.

Lines 169 and 170 are the payload filters in captureRunScripts: a JSON file in
the run directory that is not a coverage payload must be skipped by kind
rather than mined for script URLs, and a payload carrying no result must fall
back to an empty list instead of throwing and failing the seal.

Evidence and provenance

• Unit — partially covered, these four regions not at all.
  npm run test:unit:coverage (TZ=UTC node tests/tools/coverage-report.mjs,
  node v26.10.0) run locally on 2026-10-06 at main = 7ab301e:
  tests/tools/e2e-coverage-scripts.mjs | 100.00 | 94.67 | | 124 131 169-170.
• End-to-end — no surface exists, so no e2e claim is made here. The e2e
  coverage reporter instruments only the browser-served src/** bundle: CI
  artifact e2e-coverage, id 11428330480, from run
  37496141453,
  job End-to-end coverage, lists src/** rows and nothing else. This module
  is Node-only test tooling that no browser loads, so the unit/e2e priority
  table does not apply to it and no missing-e2e claim is made. That
  limitation is recorded here rather than inferred from the unit profile.
• Priority 2 on the non-coverage scale: the guards are small, but they are
  the ones standing between a sourceMappingURL comment and a write into the
  artifact that backs the merge gate.

Recommendation

• Add tests/e2e-coverage-scripts.test.mjs driving the exported
  captureRunScripts — not the private helpers — so each guard is asserted
  where it sits in the seal:
  - a reference that leaves the build root and is only steered back inside
  by a symlink (proves line 124 specifically: realpath resolves it to a
  contained path, so line 131 waves it through)
  - a reference contained until realpath() follows it out (line 131)
  - a well-formed non-coverage payload naming a script that really is in
  build/, so only the kind filter keeps it out (line 169)
  - a coverage payload with no result key (line 170)
  - a script and its map copied together, as the success baseline
• tests/tools/e2e-coverage-scripts.mjs reaches 100% regions in
  npm run test:unit:coverage

Each case must be written so that removing the single guard it targets fails
it; a test that merely executes the line is worth nothing on a guard.

Coordination

Both the new test file and the module under test are untouched by every open
hold-gated PR: #1110 edits tests/tools/e2e-data-fixtures.cjs, #1114 edits
tests/e2e-coverage-report.test.mjs, and the rest are component specs and
variant fixtures. No workflow file is involved — the existing gate
npm run test:unit:coverage:check already covers this module's rows.

Priority

• Impact: medium (two never-executed containment guards on the path that writes
  the published coverage artifact)
• Effort: low

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 7ab301e

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88