[quality] e2e coverage per-file region floor has no margin: PeopleFreshness is 2/3 regions while ci.yml pins only Node major 22

Start in .github/workflows/ci.yml at the e2e-coverage job's actions/setup-node step, and read the comment block in tests/e2e-coverage-gate.test.mjs that explains MEASURED_ON_NODE_MAJOR. Pinning the Node patch and adding a matching constant is only done once a maintainer chooses between that pin and lowering --check-source-file-regions, and the workflow change needs write access that a newcomer may not have.

Finding

The "End-to-end coverage" job gates on --check-source-file-regions 66
(.github/workflows/ci.yml, the "Render e2e coverage report" step), and one
source file sits exactly on that floor.

From the job's own artifact — actions/runs/38418930699, artifact
e2e-coverage, report.json runId 38418930699-1, head
1e37cdcd499390193e5915d26807f85cf4a484e8, runStatus passed:

{
  "file": "src/components/PeopleFreshness/index.js",
  "executableLines": 19,
  "coveredLines": 19,
  "linePercent": 100,
  "regions": 3,
  "coveredRegions": 2,
  "regionPercent": 66.67,
  "uncoveredRegions": [13]
}

66.67 >= 66 passes by two-thirds of a percentage point, and the denominator
is 3.

Why that is load-bearing

The uncovered region is not a coverage gap, and this issue does not ask for a
test. src/components/PeopleFreshness/index.js:13 is unit-covered by
tests/people-freshness.test.mjs and is demonstrably executed in the browser by
tests/e2e/fixtures/data-variant/community-people.json; the union does not
credit it for the #1066/#1256 reason tests/e2e-coverage-gate.test.mjs
already records in its ceiling note. It is a documented reporting residual.

The risk is that the denominator is a V8 artifact. tests/e2e-coverage-gate.test.mjs
says so directly, and its own two-column table shows the counts moving between
runtimes:

The covered counts barely move; the denominator does, because V8 splits the
same expression into a different number of ranges.

On a 3-region file, one extra split is the whole margin: 2/4 is 50.00%, and the
job fails --check-source-file-regions 66 on a tree where nothing changed.

What is not pinned

Every actions/setup-node in the repository requests a floating major:

So the job resolves whatever 22.x is current on the day of the run.
tests/e2e-coverage-gate.test.mjs guards the major via
MEASURED_ON_NODE_MAJOR, and states in the same comment that this is the one
input it cannot see:

ci.yml pins node-version: 22, so the job resolves the newest 22.x on the day
of the run. MEASURED_ON_NODE_MAJOR cannot detect that, so a same-major
difference from this table is runtime drift, not a code change.

MEASURED_AT_SPEC_COUNT and MEASURED_AT_SOURCE_MODULE_COUNT close the other
two inputs that move the table. The Node patch is the remaining one, and it is
the only one that can move the lane with no commit at all.

Recommendation

Pin the patch in the job whose thresholds were measured against it, so the
denominator is reproducible and a runtime bump arrives as a reviewable diff
rather than as a red required check on an unrelated PR.

In .github/workflows/ci.yml, in the e2e-coverage job, replace:

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
          cache: npm

with:

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          # Pinned to the patch, not the major. The e2e region floors this job
          # gates on (--check-source-regions, --check-source-file-regions) are
          # ratios whose denominators V8 chooses, and
          # tests/e2e-coverage-gate.test.mjs records that they move with the
          # runtime while the covered counts do not.
          # src/components/PeopleFreshness/index.js is 2/3 regions, exactly on
          # --check-source-file-regions 66, so one extra split fails the job on
          # an unchanged tree. Bump this deliberately, re-measure with the
          # CONTRIBUTING.md recipe, and update the table and
          # MEASURED_ON_NODE_MAJOR in tests/e2e-coverage-gate.test.mjs in the
          # same change.
          node-version: 22.21.1
          cache: npm

Substitute whichever 22.x the floors are actually re-measured on; 22.21.1 is
the version tests/e2e-coverage-gate.test.mjs's node-22 column names, not a
version this report verified is current.

Two follow-ons belong in the same change, and both are mechanical once the
value above is chosen:

• Pin the patch in the e2e-coverage job (.github/workflows/ci.yml).
• Extend tests/e2e-coverage-gate.test.mjs with a MEASURED_ON_NODE_VERSION
  constant asserted against that job's node-version, the same way
  MEASURED_ON_NODE_MAJOR is asserted today, so a future bump cannot land
  without re-measuring.

The decision this needs

Pinning the patch trades an unannounced red check for a version that must be
bumped on purpose. The alternatives are to lower
--check-source-file-regions below 66 to buy margin — which weakens the gate
the lowest file is there to hold — or to accept the wobble and re-measure when
it fires. Which of those the project wants is a maintainer call, so this is
filed rather than implemented.

Why there is no pull request

The entire fix is inside .github/workflows/. The GitHub App token this lane
is minted with does not carry the Workflows permission, so any push whose diff
touches that directory is rejected by GitHub server-side — nothing this lane can
push would contain the change. This needs a human or a lane with workflow
write access to land. The replacement text above is given in full so applying
it is mechanical rather than a re-derivation.

The second checkbox (tests/e2e-coverage-gate.test.mjs) is pushable on its own,
but it asserts against the pinned value, so it cannot land before the workflow
does and is not split out.

Priority

• Impact: medium — a required check can go red on an unchanged tree, and the
  failure names a coverage threshold rather than a runtime bump, so the first
  PR it lands on absorbs the diagnosis.
• Effort: low — one pinned version plus one constant.

Evidence and provenance

• E2E: actions/runs/38418930699, artifact e2e-coverage, report.json
runId 38418930699-1, head 1e37cdcd, runStatus passed. Aggregate
  src files 656/674 regions (97.33%), 2177/2177 lines (100.00%).
  This is the most recent e2e-coverage artifact available on main; it is two
  commits behind bf18311 (#1527, #1531). The PeopleFreshness denominator
  of 3 is not affected by either — neither touches that file — but the aggregate
  figures above are as-of 1e37cdc.
• Unit: npm run test:unit:coverage at bf18311 — src files 100.00%
  lines (9638/9638) and 100.00% regions (2794/2794); npm run test:unit 2705
  pass / 0 fail. Run locally on Node v26.10.0, which is not the major CI
  pins; the unit lane's line-based floors are not runtime-sensitive the way the
  e2e region floors are, and no unit figure is relied on above.
• The two coverage sources are reported separately rather than merged: they are
  different toolchains (node --test V8 coverage vs browser V8 coverage mapped
  through v8-to-istanbul) and were produced at different revisions, so their
  raw data is not combinable here.
• E2E coverage could not be reproduced locally: Chromium fails to launch in this
  environment (libglib-2.0.so.0: cannot open shared object file) and
  installing its system dependencies needs root. The artifact above is therefore
  the sole e2e source, which is why its provenance is stated in full.

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: bf18311

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88