ci: watch the coverage floor on the newest Elixir

The floor was enforced in only one place that ran it - mix precommit, on
whatever Elixir the contributor happened to have - and nothing in CI checked
it at all. The test matrix ran a plain mix test and the precommit job is
pinned to the one version that agreed with the number, so CI stayed green
while a clean tree failed the gate on Elixir 1.20. A drift nothing watches is
a drift the next contributor finds.

The newest cell of the test matrix now exports coverage and checks the floor.
It is the lowest reporter, so it trips first on attribution drift. Every other
cell stays on a plain mix test: seven readings that disagree by version would
be noise rather than signal. The include entry augments the existing 1.20/29
cell rather than adding a job.

Two steps rather than one mix test --cover, so the step that goes red names
what broke without opening the log - exporting cannot fail on the threshold,
and mix test.coverage cannot fail on a test. The job name carries the same
information.

Verified on 1.20.3/OTP 29: export exits 0, the check reports 88.40% and exits
0, and with the floor raised to 89 the check exits 3 - so it is a gate and not
decoration.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: ausimian

.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
       run: mix precommit
 
   test:
-    name: Test (Elixir ${{ matrix.elixir }} / OTP ${{ matrix.otp }})
+    name: Test (Elixir ${{ matrix.elixir }} / OTP ${{ matrix.otp }})${{ matrix.cover && ' + coverage floor' || '' }}
     # Only Linux for now. Castle is pure Elixir talking to :release_handler,
     # with no shell scripts of its own and no suite that boots a release, so
     # there is nothing platform-sensitive to run. Add macos-15 alongside the
@@ -60,6 +60,27 @@ jobs:
           # Elixir 1.19 supports Erlang/OTP 26-28
           - elixir: '1.19'
             otp: '29'
+        include:
+          # **The one cell that checks the coverage floor, and the only place in
+          # CI that checks it at all.** `mix precommit` enforces the threshold in
+          # `mix.exs`, but the `precommit` job below is pinned to a single
+          # Elixir, so on its own it says nothing about the rest of the
+          # `~> 1.18` range that `mix.exs` declares - and cover's line
+          # attribution is not constant across that range. Elixir 1.20 counts
+          # one more relevant line in `Castle.Peer` than 1.19 does, which is how
+          # a floor set from the pinned toolchain came to fail a clean tree for
+          # contributors on a current Elixir.
+          #
+          # This is the newest Elixir in the matrix, so it reports the lowest
+          # figure and trips first: a canary for exactly that drift. Every other
+          # cell stays on a plain `mix test` deliberately - seven readings that
+          # disagree by version would be noise, not signal.
+          #
+          # Keep this on whichever cell is newest when the matrix moves on. The
+          # threshold note in `mix.exs` explains what to do if it goes red.
+          - elixir: '1.20'
+            otp: '29'
+            cover: true
 
     steps:
     - name: Checkout code
@@ -91,4 +112,23 @@ jobs:
       run: mix compile --warnings-as-errors
 
     - name: Run tests
+      if: ${{ !matrix.cover }}
       run: mix test
+
+    # Split in two rather than one `mix test --cover`, so that the step which
+    # goes red names the thing that broke without anyone opening the log:
+    # exporting cannot fail on coverage, and checking cannot fail on a test.
+    - name: Run tests (exporting coverage)
+      if: ${{ matrix.cover }}
+      run: mix test --cover --export-coverage ci
+
+    - name: Check the coverage floor
+      # Red here means the total fell under the threshold in `mix.exs` while the
+      # tests passed. Either coverage genuinely dropped, or this Elixir
+      # attributes relevant lines differently from the pinned toolchain - read
+      # the threshold note in `mix.exs` before changing the number, because it
+      # is a floor across the whole supported range and not a reading from one.
+      if: ${{ matrix.cover }}
+      env:
+        MIX_ENV: test
+      run: mix test.coverage

AGENTS.md

@@ -1538,13 +1538,32 @@ list is module names rather than a pattern: a regex over `Stub` would swallow a
 production module spelled that way, which is the one thing an exclusion must not
 do.
 
-**It is part of `mix precommit`**, which is what makes the threshold a gate
-rather than a number in a comment. Nothing else runs it: CI's `test` matrix runs
-a plain `mix test`, and CI's `precommit` job is pinned to Elixir 1.19 / OTP 28.
-So the *only* place this number is checked against the rest of the `~> 1.18`
-range is a contributor's own machine, in the gate this project makes mandatory —
-which is exactly where a false failure does the most damage, because the lesson
-it teaches is to stop running the gate.
+**Three things check the floor, and they are not checking the same thing.**
+
+* **`mix precommit`** runs `test --cover`, which is what makes the threshold a
+  gate rather than a number in a comment. It runs on whatever Elixir the
+  contributor happens to have, so this is where the floor meets the `~> 1.18`
+  range in practice — and where a false failure does the most damage, because
+  the lesson it teaches is to stop running the gate.
+* **CI's `precommit` job** runs the same alias pinned to Elixir 1.19 / OTP 28.
+  That is the reading the rest of this section quotes.
+* **One cell of CI's `test` matrix** — the newest Elixir, currently 1.20 /
+  OTP 29 — exports coverage and then runs `mix test.coverage`. It is the lowest
+  reporter, so it trips first: a canary for attribution drift rather than a
+  second opinion on the figure. Every other cell stays on a plain `mix test`
+  deliberately, because seven readings that disagree by version are noise.
+
+That cell is **two steps rather than one `mix test --cover`**, so the step that
+goes red names what broke without anyone opening the log: exporting coverage
+cannot fail on the threshold, and `mix test.coverage` cannot fail on a test. Its
+job name carries `+ coverage floor` for the same reason. Move the `cover: true`
+flag when the matrix's newest cell moves on.
+
+None of that existed until the floor had already failed a clean tree on 1.20 and
+CI had stayed green through it, because the matrix ran a plain `mix test` and the
+one job that checked the threshold was pinned to the version that agreed with
+it. A gate checked only on the maintainer's toolchain is a gate that discovers
+its own bugs through other people.
 
 **The figure is not the same on every supported toolchain, and the threshold has
 to be a floor across them rather than a reading from one.** Measured, one cell