[quality] bundle e2e suite never drives /assign with argument users or /milestone set-by-name through dist/index.js #249

Finding

__tests__/bundle/bundle.test.ts is the only suite that runs the committed dist/index.js. For two issue_comment handlers it exercises exactly one arm each:

• /assign (src/issueComment/assign.ts): only the bare self-assign by an org member (bundle.test.ts:462). The argument-user path — getOrgCollabCommentUsers filtering @user arguments by org membership / collaborator / prior comment, the no authorized users found failure, the could not add assignees rethrow, the silent no-op for an unauthorized self-assign and the could not self assign rethrow — never runs through the bundle.
• /milestone (src/issueComment/milestone.ts): only /milestone clear (bundle.test.ts:825). Setting a milestone by name (GET …/milestones → PATCH …/issues/1 {milestone: <number>}), the milestone "x" not found. Available milestones: … / none failures, the bare-command please provide a milestone to add failure and the non-collaborator refusal never run through the bundle.

Evidence, main @ c48bd6d:

• unit: npx vitest run --coverage → All files 99.83 | 98.35 | 100 | 99.82; assign.ts and milestone.ts at 100% lines — the arms are unit-covered (__tests__/issueCommentTest/{assign,milestone}.test.ts).
• e2e: grep -n "/assign\|/milestone" __tests__/bundle/*.ts → the two cases above only. The bundle suite's coverage is not captured in the report ([quality] the bundle e2e suite's coverage of src/ is never captured — runBundle.ts drops NODE_V8_COVERAGE and dist/ has no source map #235), so this is read from the test list, not from a merged profile.

Unit-covered, not e2e-covered → medium priority under the coverage-gap rules.

Recommendation

Add __tests__/bundle/assignAndMilestone.test.ts (new file, reusing fakeGithub.ts and runBundle.ts) driving both handlers through dist/index.js:

• /assign @octocat @stranger → six unordered authorization reads, one POST issues/1/assignees {assignees:['octocat']}
• /assign @stranger authorized by a prior comment; @octocat octocat de-duplicated; no authorized user → exit 1; refused POST (argument and self paths) → exit 1; unauthorized bare /assign → no write
• /milestone v1.0 → GET milestones, PATCH issues/1 {milestone: 3}; name with spaces; CLEAR case-insensitive; unknown name (with and without milestones) → exit 1, no write; bare /milestone → exit 1; non-collaborator → exit 1 after one read

Priority

• Impact: medium — the shipped bundle's two assignment/milestone flows are only verified by mocked unit tests
• Effort: low

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: c48bd6d

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88