[T-Crypt]

Coverage is reported, and the prompt-injection boundary now has a test that can fail.

What changed

• npm run coverage runs node --test --experimental-test-coverage with a floor of 60 line coverage on the run total.
• test/fence.test.ts asserts defang, quoted, and attribute against literal expected strings, and pins every category of invisible character that INVISIBLE_CLASS names.
• test/entry-format.test.ts pins the entry kind names and the [from: …] marker. The names are stored data that the web app reads, so that file is a contract, not a behavior check.

Proof

The new test in test/fence.test.ts puts 81 of one representative character between < and /, so the 80-character alternative in CLOSER cannot defang the tag and only INVISIBLE_CLASS can. There are ten representatives, one per category the class names: a control character, a format character, a lone surrogate, a private-use character, an unassigned code point, a variation selector supplement, the braille blank, the two Hangul fillers, and the combining grapheme joiner. Each is a \u escape, so the file stays ASCII.

Narrowing INVISIBLE_CLASS to \p{Cc}\p{Cf} in a scratch copy, which is the mistake the class guards against:

$ node --test test/fence.test.ts
ℹ tests 7
ℹ pass 6
ℹ fail 1

✖ a closing tag loses its < behind every category of invisible character the class names
  AssertionError [ERR_ASSERTION]: a lone surrogate

Eight of the ten representatives stop being defanged, everything except the control and the format character, which the narrowed class still names. With the class restored the same run is 7 pass, exit 0, and src/server/fence.ts is unchanged.

Coverage measured on this branch: run total 64.34 lines with the browser tests running, 66.62 with them skipped, against a floor of 60. The new tests add no coverage, because both files were already at 100 through test/hooks.test.ts. Their value is the direct assertion. The floor is on the run total, not per file.

npm test 638 pass, exit 0. npm run check, npm run lint, npm run format:check exit 0.

Open

• The coverage exit code is still decided by test/visible-models-ui.test.ts, whose model menu races the picker's Routers group: it failed one run here and passed on reruns. 01: CI runs the repo's checks on push and PR #11 makes that test deterministic.
• --test-coverage-lines on Node 22.19 is unchecked here, because this machine runs Node 26. Node's CLI documentation lists the flag as added in v22.8.0, so the engines minimum is covered. node --help | grep test-coverage-lines on a 22 leg is the proof to collect there.

Ticket 03. This run's report: ~/handoffs/oh-my-pocket/2026-10-13-pr11-13-rerun/implement-03-coverage-tests.md.