MOTIR-2449 · Four coverage thresholds are INERT — a `app/(authed)/…` literal path matches no file, so the route-group components have never been gated

MOTIR-2449Done

Four coverage thresholds are INERT — a `app/(authed)/…` literal path matches no file, so the route-group components have never been gated

Found mid-run by MOTIR-2264 while adding this story's components to the coverage gate. Out of scope for that card (notes.html #27 — surface it, never absorb it), and it is a live hole in a gate the repo relies on.

The defect

vitest.config.ts names four Next.js route-group components in BOTH coverage.include and coverage.thresholds:

app/(authed)/settings/account/_components/ConnectCliPanel.tsx
app/(authed)/settings/project/code-access/_components/CodeAccessSettings.tsx
app/(authed)/settings/project/repositories/_components/TakeoverRow.tsx · TakeoverModal.tsx · RepositoriesRoom.tsx

None of them has ever appeared in a coverage report. A route group's parentheses are extglob syntax to the matcher v8 coverage globs with, so the literal path app/(authed)/… is parsed as an alternation group and matches nothing on disk.

Rung-2 evidence, measured on `parent/MOTIR-2282-roles-permissions-screens`

A --coverage.reporter=json-summary run over tests/permissions tests/settings produced 36 app/** entries and ZERO containing authed — every route-group file is absent from the report, including the five above.
Adding this story's four components as the literal app/(authed)/settings/project/roles/_components/RoleList.tsx (etc.) produced no rows. Changing the single line to app/**/settings/project/roles/_components/*.tsx produced all four, with real numbers.
The threshold half fails the same way and fails SILENTLY: an unmatched threshold key is not an error, so the five components read as gated at ≥90% while being measured at nothing. A file that is genuinely at 0% errors loudly (lib/mcp/payloads/registry.ts does, in the same run) — these do not, because they are not in the report at all.

Why it matters more than the number

The gate's whole value is that a new component cannot ship untested. These five are the ones a card deliberately chose to gate — somebody wrote the threshold entry on purpose — and the protection has been absent since. Worse, the failure mode is invisible in exactly the direction that matters: a green CI run is evidence of nothing for these files.

Acceptance criteria

Every route-group path in vitest.config.ts's coverage.include and coverage.thresholds is rewritten to a form the matcher actually resolves (app/**/…, or whatever the shipped matcher accepts — verify by reading the file back out of a json-summary report, not by reasoning about the glob).
The five components above appear in a json-summary coverage report, with their real numbers quoted in the PR body.
Where a file's measured number is below the ≥90% floor, the missing tests are written rather than the threshold lowered — that is the whole point of discovering this.
A guard fails the build when a thresholds key matches no file in the report. An unmatched key must never be a silent pass again; that property is the actual fix, since the same mistake in any future entry is otherwise undetectable.
MOTIR-2264's own entries (added on this branch with the working glob and a comment pointing here) are left as they are or folded into whatever uniform form this card settles on.

Context refs

vitest.config.ts — coverage.include and coverage.thresholds.
app/(authed)/settings/project/roles/_components/*.tsx — this story's four components, measured at 100/100/100 under the working glob; the worked example of the fix.
tests/settings/rolesPermissionsScreens.test.tsx — the suite whose numbers the measurement came from.