[Wave 200pts] CHORE: Jest coverage thresholds are a minimal global-only gate, contradicting CONTRIBUTING.md's claim of enforced high-risk-module thresholds

[portableDD]

Summary

CONTRIBUTING.md states: "The repository enforces coverage thresholds in package.json for the highest-risk modules." The actual jest.coverageThreshold in package.json is a single global entry only — { branches: 8, functions: 45, lines: 55, statements: 55 } — with no per-path overrides for any specific "highest-risk" module (wallets, transactions, auth, fees, ledger, etc.). An 8% branch-coverage floor in particular is low enough that it provides almost no real protection against untested conditional logic anywhere in the codebase.

Why This Matters

Several of the concrete money-movement bugs surfaced elsewhere in this audit (missing awaits in fx.service.ts, the reconciliation formula, the fee-rate mismatch) live in files with zero or minimal test coverage — exactly the kind of regression a real per-module coverage gate on "highest-risk" areas is meant to catch, and exactly what CONTRIBUTING.md tells contributors already exists. As written, the actual enforced bar is weak enough that large swaths of business logic can ship with no tests at all and still pass npm run test:cov.

What Needs to Be Done

• Add path-scoped coverageThreshold overrides in package.json's jest config for the highest-risk directories (e.g. src/wallet/, src/transactions/, src/fx/, src/ledger/, src/auth/, src/fees/) with meaningfully higher thresholds than the current global 8%/45%/55%/55%.
• Raise the global branch-coverage floor to a more meaningful baseline now that the test-coverage gaps identified throughout this audit are being addressed.
• Update CONTRIBUTING.md if the per-module thresholds are scoped differently than "highest-risk modules" implies, so the documentation matches the actual enforcement.

Key Files

• package.json (jest.coverageThreshold)
• CONTRIBUTING.md (the claim about enforced per-module thresholds)

Acceptance Criteria

• jest.coverageThreshold includes path-scoped entries for at least the money-movement directories
• The global branch-coverage threshold is raised above the current 8% floor
• CONTRIBUTING.md's description matches the actual configured thresholds
• npm run test:cov fails if any of the newly-thresholded directories regress below their bar

---

Points: 200
Category: CHORE