Epic: make the C# build, CI, and coverage gates report the truth

[drmoisan]

Epic: make the C# build, CI, and coverage gates report the truth

Fan-in of the build-ci-coverage-gate-fidelity epic: five child features across three dependency waves, merged into epic/build-ci-coverage-gate-fidelity-integration and now proposed to main.

Summary

• Coverage arithmetic no longer double-counts. Invoke-MSTestWithCoverage.Helpers.ps1 recomputed the Cobertura root attributes over the XPath descendant axis, counting every source line twice — once under <class>/<methods>/<method>/<lines> and once in the class-level <class>/<lines> rollup. A new pure helper reduces a class to a deduplicated per-line map and is called from both paths (Cobertura post-processing double-counts <line> nodes, inflating lines-valid and every coverage rate #441, Bug: merge-cobertura-classes-blends-union-with-primary-methods #478).
• The documented C# toolchain now actually executes. Two of the four mandatory commands did not do what they claimed: the format step used CSharpier v0 syntax against a 1.2.6 pin (exit 1, formatted nothing), and the type-check step returned exit 0 in under two seconds having skipped CoreCompile on all 18 projects. Every prior "nullable gate passed" claim overstated what was verified (Bug: nullable-gate-cannot-fail-incremental-build #512, Bug: nullable-gate-masked-by-incremental-build #492, Bug: csharpier-documented-command-incompatible-with-pinned-version #509, Bug: claudemd-nullable-gate-diverges-from-ci #522).
• [ExcludeFromCodeCoverage] now suppresses nested lambdas. The compiler hoists lambdas out of an attributed member into a closure type that does not inherit the attribute, so their lines stayed in the denominator permanently uncovered. A post-processing closure filter removes closure-type coverage whose declaring member is absent from the instrumented method set (Bug: excludefromcodecoverage-does-not-suppress-nested-lambdas #457).
• A coverage threshold is now mechanically enforced — but not yet a single one. Assert-CoberturaLineCoverageThreshold fails closed at 80% line coverage when the Cobertura artifact is missing or below the floor (Bug: conflicting-coverage-thresholds-across-policy-docs #494). The prose reconciliation that Bug: conflicting-coverage-thresholds-across-policy-docs #494 also set out to perform did not land; see Known gaps.
• CS2002 build warning removed. UtilitiesCS.Test.csproj listed PercentageFormatterTests.cs twice in the same <Compile> item group, warning on every local and CI build (Bug: utilitiescs-test-cs2002-duplicate-compile-entry #394).

Why

These five defects share one failure mode: a gate that reports success without having measured anything. A skipped CoreCompile returns exit 0. A doubled line count inflates every coverage rate. A closure type silently pads the denominator. A contradictory threshold makes the gate unresolvable, so it gets improvised or skipped.

The cost is compounding: every green result recorded while these were live is weaker evidence than it appears, which is why feature 512's user story is written as "a green result means my change is clean rather than that the command did nothing."

What Changed

Non-documentation changes (13 files)

File	Change
scripts/vscode/Invoke-MSTestWithCoverage.ClosureFilter.ps1	+389 / -0 — new closure-type coverage filter (#457)
scripts/vscode/Invoke-MSTestWithCoverage.Helpers.ps1	+151 / -17 — deduplicated line-map helper shared by both count paths, plus the threshold assertion (#441, #478, #494)
scripts/vscode/Invoke-VSBuild.ps1	+13 / -3 — build-invocation fidelity (#512)
scripts/vscode/Invoke-MSTestWithCoverage.ps1	+1 / -0 — filter wiring
UtilitiesCS.Test/UtilitiesCS.Test.csproj	-1 — duplicate <Compile Include> removed (#394)
tests/scripts/vscode/Invoke-MSTestWithCoverage.ClosureFilter.Tests.ps1	+443 / -0
tests/scripts/vscode/Invoke-MSTestWithCoverage.Helpers.Tests.ps1	+276 / -0
tests/scripts/vscode/Invoke-VSBuild.Tests.ps1	+23 / -2
tests/scripts/vscode/Invoke-MSTest.RunSettings.Tests.ps1	+9 / -1
CLAUDE.md	+19 / -13 — corrected C# toolchain commands (#512)
.claude/rules/csharp.md	+9 / -4 — same corrections, plus reusable-workflow references
.claude/skills/csharp-qa-gate/SKILL.md	+2 / -0
.vscode/tasks.json	+4 / -1 — task wiring for the corrected commands

No .cs source file changes in this PR.

Docs and evidence (391 files) — per-feature folders under docs/features/active/ (issue, spec, user story, plan, research, evidence, review artifacts), 55 agent-memory files, and the epic folder. Six committed Cobertura evidence documents account for roughly 1.1M added lines on their own.

Architecture / How It Fits Together

The coverage pipeline is a chain of pure XML-to-XML transforms over a document the pipeline already parses:

dotnet-coverage  ->  raw Cobertura
                     |
                     +-- Merge-CoberturaClassesByFilename       (unions same-filename classes)
                     +-- Remove-CoberturaExemptClosureCoverage  (#457 closure filter)
                     +-- Get-CoberturaClassLineSummary          (#441 dedup line map, shared)
                     |
                     v
                  post-processed Cobertura  ->  Assert-CoberturaLineCoverageThreshold (#494)

Get-CoberturaClassLineSummary is the single deduplication point: both the merge path and the root-attribute recomputation call it, which is what removes the double count rather than patching each site.

Verification

Completed

• Composed-diff review. Two independent feature-review passes against base main at merge-base 0569ac0b, head 22b5de02, each executing the full review-workflow contract. Both returned zero Blocking findings. Artifacts: docs/features/epics/build-ci-coverage-gate-fidelity/{policy-audit,code-review,feature-audit}.2026-08-15T05-11.md and ...2026-08-15T05-25.md.
• Merge-conflict resolutions audited. The main merge at fb8eff9b hand-resolved three Markdown conflicts. Both review passes diffed all three files against both merge parents and confirmed no incoming hunk from main was dropped.
• Acceptance criteria. All five children resolve to work-mode full-bug, so spec.md is the sole AC source. All 67 acceptance criteria across the five specs are checked off and evaluate PASS (two Bug: conflicting-coverage-thresholds-across-policy-docs #494 criteria PASS-with-qualification). An independent epic-review pass found no AC whose check-off state is unsupported by evidence.
• Pester suite on this exact head: 70 of 70 passed, 0 failed, across all five containers. Evidence: docs/features/epics/build-ci-coverage-gate-fidelity/evidence/qa-gates/pester-integrated-tree.2026-08-15T05-10.md.
• Per-feature evidence is committed under each feature folder's evidence/ tree — fail-before/pass-after regression captures, Pester runs, PoshQC format and analyze, and per-feature coverage deltas.

Not previously covered — the last green integrated-tree run (workflow_dispatch 31493339489 at c7d398c2) predates both feature 494 (85ff0c34) and the main merge (fb8eff9b). This PR's own CI is the first full-suite signal covering the current tree, and it is eligible because its base is main — child PRs based on the integration branch were not, since ci.yml triggers pull_request only on [main, development].

Recommended

# PowerShell suite — all core logic in this PR is PowerShell, and no CI job runs it (see #562)
pwsh -NoProfile -Command "Invoke-Pester tests/scripts/vscode -Output Detailed"

# C# toolchain, using the commands this epic corrected
dotnet tool restore
dotnet tool run csharpier check .
msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true
msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:TreatWarningsAsErrors=true

Known gaps merging with this PR

These were found by the fan-in review, are filed as issues, and are not resolved here. They are recorded rather than absorbed, because remediating them inside a fan-in would widen its scope.

Gap	Issue
The coverage-threshold contradiction was not removed. CLAUDE.md and .claude/rules/csharp.md state 80%; .claude/rules/general-unit-test.md and .claude/rules/quality-tiers.md state 85% line / 75% branch. #494's scope correction deferred the prose edits upstream. The new Assert-CoberturaLineCoverageThreshold enforces 80% while .claude/hooks/validate-feature-review-coverage.ps1 fails below 85 — a figure in [80, 85) passes one live gate and fails the other.	#563
CLAUDE.md cites .github/workflows/ci.yml for three toolchain commands that the #553 split relocated into _format-check.yml, _build-analyzers.yml, and _build-nullable.yml. The same fix was applied to .claude/rules/csharp.md but not to CLAUDE.md.	#564
Invoke-MSTestWithCoverage.ps1 asserts the threshold before Set-Content, so a failing gate discards the post-processed document and leaves the raw un-post-processed Cobertura on disk.	#565
CI collects coverage but enforces no threshold: _mstest-coverage.yml never converts to Cobertura or compares a floor, so a coverage regression cannot fail CI.	#561
No Pester job exists in CI, so the four PowerShell scripts that constitute this epic's core logic have zero CI coverage.	#562

Repository-wide PowerShell line coverage measures roughly 69-72% against the 85% floor. The reviewer dispositioned this non-blocking: the entire shortfall sits in five never-tested scripts absent from this diff, changed-line coverage is 100%, and the branch raises the figure from roughly 67.2%.

Backward Compatibility / Migration Notes

• Coverage numbers move. Removing the double count and the exempt-closure lines changes reported percentages for every project. Post-change figures are not comparable to any pre-change baseline; re-baseline rather than treating the shift as a regression.
• Documented toolchain commands changed. dotnet tool run csharpier . becomes dotnet tool run csharpier format . / check ., and the msbuild gates move from /t:Build to /t:Rebuild /m. /p:Nullable=enable is removed — no project carries a <Nullable> element, so it conscripted every un-annotated file and made the gate unpassable. Local runs are slower because they now genuinely recompile.
• No public API changes. No renamed or removed source paths outside the feature-doc tree.

Risks and Mitigations

Risk	Mitigation
The closure filter over-matches and drops legitimate coverage	The rule keys on the declaring member being absent from the instrumented method set, not on a blanket <>c exclusion; both retention and removal cases are covered by the 443-line Pester suite. Three known residual gaps are tracked, not absorbed — see Follow-ups.
Corrected /t:Rebuild gates surface pre-existing debt as new failures	Reproduced and dispositioned during feature 512; the gates were previously incapable of failing, so anything they now report is pre-existing rather than introduced here.
Large diff obscures a substantive change	13 of 404 files are non-documentation. See the Review Guide.
Two enforcement points disagree on the coverage floor	Tracked as #563. Both gates fail closed, so the disagreement produces a spurious failure rather than a spurious pass.

Rollback: revert the merge commit. The coverage post-processing is a pure transform with no persisted state, so reverting restores prior behavior and prior numbers together.

Review Guide

Suggested order — the first four files carry essentially all the behavior:

1. scripts/vscode/Invoke-MSTestWithCoverage.Helpers.ps1 — the deduplicated line map (Cobertura post-processing double-counts <line> nodes, inflating lines-valid and every coverage rate #441) and the threshold assertion (Bug: conflicting-coverage-thresholds-across-policy-docs #494)
2. scripts/vscode/Invoke-MSTestWithCoverage.ClosureFilter.ps1 — the closure filter and its name-derivation regexes (Bug: excludefromcodecoverage-does-not-suppress-nested-lambdas #457)
3. scripts/vscode/Invoke-VSBuild.ps1 and Invoke-MSTestWithCoverage.ps1 — invocation fidelity and wiring
4. UtilitiesCS.Test/UtilitiesCS.Test.csproj — one-line deletion (Bug: utilitiescs-test-cs2002-duplicate-compile-entry #394)
5. CLAUDE.md and .claude/rules/csharp.md — the corrected toolchain commands
6. Tests under tests/scripts/vscode/

Low-signal, high-volume: docs/features/active/**/evidence/**. The six *.cobertura.xml captures under feature 494 are ~187,786 lines each and are committed as evidence, not as reviewable source.

Follow-ups

• Gaps merging with this PR, all filed: CI collects coverage but enforces no threshold: _mstest-coverage.yml never converts to Cobertura or compares a floor #561, No Pester job in CI: production PowerShell under scripts/vscode has zero CI coverage #562, Coverage threshold contradiction remains: CLAUDE.md/csharp.md say 80%, general-unit-test.md/quality-tiers.md say 85%/75%, and two live gates disagree #563, CLAUDE.md cites ci.yml for three toolchain commands the #553 split moved into reusable workflows #564, Invoke-MSTestWithCoverage.ps1 asserts coverage threshold before Set-Content, leaving the raw un-post-processed Cobertura on disk when the gate fails #565. See Known gaps.
• Three documented residuals of the Bug: excludefromcodecoverage-does-not-suppress-nested-lambdas #457 closure filter, promoted to issues at epic close: Bug: exempt-async-member-lambdas-remain-counted #558 (lambdas in exempt async/iterator members), Bug: local-functions-in-exempt-members-remain-counted #559 (local functions in exempt members), Bug: overload-name-collision-under-exclusion #560 (overload name collision under exclusion).
• Two further potential entries from the Bug: excludefromcodecoverage-does-not-suppress-nested-lambdas #457 review remain unpromoted: closure-filter-rebuild-drifts-from-merge-line-map and closure-filter-whatifpreference-silently-skips.
• tests/scripts/vscode/Invoke-VSBuild.Tests.ps1 dot-sources the script's whole top-level body in BeforeAll, so a test run executes vswhere.exe and Sync-PackageReferences.ps1, which writes .csproj files. This makes measured PowerShell coverage non-deterministic and needs an injectable seam before Pester can run on a clean runner (noted in No Pester job in CI: production PowerShell under scripts/vscode has zero CI coverage #562).
• TimeoutAfter_GenericTask_ShouldPropagateFaultedSourceException_WhenSourceFaultsLater is a confirmed intermittent test inherited from main, not introduced here — it races a 100 ms wall-clock timeout against fault propagation, violating the determinism rules in .claude/rules/general-unit-test.md. Three sibling tests share the pattern. If CI trips it, re-run; do not adjust a threshold or gate.
• Issue Bug: collect-pr-context-misclassifies-csharp-as-documentation #513 is out of scope and must be fixed upstream in the drm-copilot repository. The PR-context collector also silently drops all 55 .claude/agent-memory/** files from its classification (344 of 404 files accounted for), which is a further data point for that issue.

GitHub Auto-close

• Closes Cobertura post-processing double-counts <line> nodes, inflating lines-valid and every coverage rate #441
• Closes Bug: merge-cobertura-classes-blends-union-with-primary-methods #478
• Closes Bug: nullable-gate-masked-by-incremental-build #492
• Closes Bug: csharpier-documented-command-incompatible-with-pinned-version #509
• Closes Bug: nullable-gate-cannot-fail-incremental-build #512
• Closes Bug: claudemd-nullable-gate-diverges-from-ci #522
• Closes Bug: utilitiescs-test-cs2002-duplicate-compile-entry #394
• Closes Bug: excludefromcodecoverage-does-not-suppress-nested-lambdas #457
• Closes Bug: conflicting-coverage-thresholds-across-policy-docs #494