build: set the coverage floor from the measurement and enforce it

The 85 threshold sat below the 87.95% it was meant to floor, so it
ratcheted nothing and licensed a thirteen-line regression. It is now
88.58 - the measured figure, 419 of 473 relevant lines. One uncovered
line added to lib gives 88.40% and fails; that was checked rather than
assumed.

And precommit runs test --cover, so the floor is a gate. Nothing else
ran it, and a floor nothing enforces is decoration. CI test matrix
stays on a plain mix test: cover line attribution can differ between
Elixir versions, so the figure is enforced on the one pinned toolchain
the precommit job uses.

90% would need 426 covered, seven more. Five of the seven can only come
from the compiler generated clauses for defaulted arities nothing
calls - measured, not assumed: calling the intermediate arities covers
all five and reaches 89.64%. Each is a delegation whose defaults are a
subset of an arity already called, so those cases would asserted
nothing. That is the move this project does not make.

The mechanism claim was also wrong. cover does not need distribution:
:cover.start/0 works in a VM with no node name. What happens is that
Mix instruments the modules loaded on this node and the peer loads the
target own beams, which nothing instrumented - and cover only route to
another VM is a distributed node, which the peer deliberately is not.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: ausimian

mix.exs

@@ -42,36 +42,52 @@ defmodule Castle.MixProject do
   # `mix test --cover` measures the shipped code, which is `lib` - the modules
   # under `test/support` are fixtures, and a fixture is covered by being run at
   # all. Left in, they moved the total without ever being the thing measured, and
-  # two of them moved it *down* for a reason that is not about tests: `mix test`
-  # compiles everything into one `cover` run on this node, while
+  # two of them moved it *down* for a reason that is not about tests:
   # `Castle.PeerProviderStub` and most of `Castle.IoSink` execute inside the peer
-  # VM, which is a separate node with no `cover` on it. Their code genuinely runs
-  # and genuinely cannot be observed from here, so the figure they contributed was
-  # an artefact of where they run rather than a gap in the suite - and raising it
-  # would have meant calling them directly on the test node, which tests nothing.
+  # VM, which nothing instruments - see the threshold below. Their code genuinely
+  # runs and genuinely cannot be observed from here, so the figure they
+  # contributed was an artefact of where they run rather than a gap in the suite,
+  # and raising it would have meant calling them directly on the test node, which
+  # tests nothing.
   #
   # Named module by module rather than matched by a pattern. A regex over `Stub`
   # or over `Castle.*Release` would quietly swallow a production module that
   # happened to be spelled that way, which is the one thing an exclusion list
   # must not do. Renaming a fixture makes the total drop, which is visible.
   #
-  # The threshold is explicit because the default, 90, is unreachable here by
-  # construction rather than for want of tests. The second half of
-  # `Castle.Peer` - `resolve/1` and everything below the `## In the peer` comment -
-  # runs in the peer VM, which has no node name and `is_alive() == false`, so
-  # `cover` cannot be started on it. Around 7% of the shipped lines therefore
-  # execute on every run of `Castle.PeerTest` and are counted as missed, which
-  # puts the observable ceiling near 93%. Left at the default, `mix test --cover`
-  # reports a failure that no test can fix and that says nothing about the suite.
+  # **The threshold is the measured figure and nothing rounder.** 419 of 473
+  # relevant lines, which is 88.58%; a single uncovered line added to `lib` takes
+  # it to 88.37% and fails. It is set from a measurement rather than chosen, so a
+  # refactor that legitimately removes covered lines will fail it too - and the
+  # right answer then is to re-measure and edit this number deliberately, which
+  # is the same rule every other claim in this project is held to. It replaced an
+  # 85 that sat *below* the figure it was meant to floor and so licensed a
+  # thirteen-line regression.
   #
-  # It is deliberately not part of `mix precommit`. A percentage is the wrong
-  # shape of gate for this project: every test here is justified by what it fails
-  # against, and a merge-blocking number cannot tell a test that discriminates
-  # from one written to raise it. See AGENTS.md for what is left uncovered and
-  # why.
+  # 90% would need 426 covered, seven more than there are. What is left is 33
+  # lines in the peer's VM (below) plus 21 that are observable in principle: five
+  # are the compiler's own default-argument clauses for arities nothing calls,
+  # and the other sixteen need a file mode, a device node, or a config provider
+  # sabotaging Castle's working directory. So the seven would have to include all
+  # five of the default-argument clauses, whose only effect is on this number.
+  # That is the move this project does not make. See AGENTS.md for the line-by-
+  # line account.
+  #
+  # **What cannot be measured is the peer's VM, and the reason is where
+  # instrumentation is applied rather than anything cover cannot do.**
+  # `:cover.start/0` works perfectly well in a VM with no node name -
+  # `is_alive() == false` is no obstacle to it. What happens here is that Mix
+  # starts cover on *this* node and instruments the modules loaded here; the peer
+  # is a separate VM that loads `Castle.Peer` from the target release's own beam
+  # files on disk, which nothing has instrumented. Cover's only mechanism for
+  # another VM is `:cover.start/1` over a *distributed* node, and this peer
+  # deliberately has no distribution at all. So `resolve/1` and everything below
+  # the `## In the peer` comment - 33 lines, about 7% of the shipped total - run
+  # on every `Castle.PeerTest` and are counted as missed, which puts the
+  # observable ceiling near 93%.
   defp test_coverage do
     [
-      summary: [threshold: 85],
+      summary: [threshold: 88.58],
       ignore_modules: [
         Castle.DeploymentStub,
         Castle.InitStub,
@@ -105,7 +121,13 @@ defmodule Castle.MixProject do
         "deps.unlock --unused",
         "format",
         "credo --strict",
-        "test"
+        # With `--cover`, so the threshold in `test_coverage/0` is a gate rather
+        # than decoration: nothing else runs it, and a floor nothing enforces is
+        # a number in a comment. This is the only place it is enforced - the CI
+        # `test` matrix stays on a plain `mix test`, deliberately, because line
+        # attribution can differ between Elixir versions and the figure is
+        # measured on one toolchain.
+        "test --cover"
       ]
     ]
   end