ci: enforce the coverage floor again and raise it to 78%

.github/codex/coverage-improvement.md

@@ -17,15 +17,15 @@ go test -cover ./... 2>&1 | sort -t'%' -k2 -n
 
 2. **Pick the lowest-coverage package** from this priority list (skip packages already above 80%):
 
-| Priority | Package | Notes |
-|----------|---------|-------|
-| 1 | `scanner/` | Core scanning logic, high impact |
-| 2 | `watch/` | Daemon/event system |
-| 3 | `render/` | Output rendering |
-| 4 | `handoff/` | Handoff artifact building |
-| 5 | `cmd/` | CLI commands |
-| 6 | `config/` | Configuration loading |
-| 7 | `limits/` | Budget enforcement |
+| Priority | Target | Notes |
+|----------|--------|-------|
+| 1 | root package: `blast_radius.go`, `collide.go` | Largest untested block outside entry points |
+| 2 | `cmd/`: `hooks.go`, `doctor.go`, `drift.go` | CLI commands |
+| 3 | `topology/` | Build-system providers |
+| 4 | `watch/` | Daemon/event system |
+| 5 | `plugins/` | Plugin install |
+
+`scanner/`, `render/`, `handoff/`, `config/` and `limits/` were already above 80% on 2026-11-12.
 
 **Skip these packages** (hard to test in isolation):
 - `mcp/` — MCP server, requires full stdio lifecycle

.github/workflows/ci.yml

@@ -24,6 +24,13 @@ jobs:
           - os: windows-latest
             go-version: '1.26'
             experimental: true
+          # Exactly one job enforces the coverage floor, updates the badge and
+          # uploads. The steps key off this flag, not a Go version: when they
+          # named 1.23 and the matrix moved on, they silently stopped running.
+          # If this version leaves the matrix, the entry still adds its own job.
+          - os: ubuntu-latest
+            go-version: '1.26'
+            coverage: true
 
     steps:
       - uses: actions/checkout@v4
@@ -60,11 +67,11 @@ jobs:
         shell: bash
 
       - name: Enforce coverage floor
-        if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.23'
+        if: matrix.coverage
         run: |
           total=$(go tool cover -func=coverage.out | awk '/^total:/ {gsub("%","",$3); print $3}')
-          # Current enforced coverage floor. Codex PRs raise this incrementally toward 90%.
-          min=55.0
+          # Current enforced coverage floor (total was 80.8% on 2026-11-12). Raise it as coverage grows toward 90%.
+          min=78.0
           awk -v t="$total" -v m="$min" 'BEGIN {
             if (t+0 < m+0) {
               printf "Coverage %.1f%% is below floor %.1f%%\n", t, m
@@ -76,7 +83,7 @@ jobs:
           echo "COVERAGE=$(printf '%.0f' "$total")" >> "$GITHUB_ENV"
 
       - name: Update coverage badge
-        if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.23' && github.ref == 'refs/heads/main'
+        if: matrix.coverage && github.ref == 'refs/heads/main'
         # Cosmetic gist badge update; a bad/expired GIST_TOKEN must not red-fail
         # the whole main build. Rotate GIST_TOKEN (PAT with gist scope) to restore.
         continue-on-error: true
@@ -92,7 +99,7 @@ jobs:
           maxColorRange: 90
 
       - name: Upload coverage
-        if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.23'
+        if: matrix.coverage
         uses: codecov/codecov-action@v4
         with:
           files: coverage.out