Coverage gate is fail-open: an unlisted package is silently ungated

open   by a73x

Labels: backlog

[claude 2026-08-18] Carried in notes as "coverage-gate inversion". scripts/coverage.sh
lines 124-125 skip any package with no FLOOR entry, so a newly added package is
ungated until someone remembers to floor it. The renamed/removed guard (line 138)
catches a gated package disappearing; nothing catches one appearing.
Invert it: every package gated by default, with an explicit commented exemption list
for the ones that legitimately cannot carry a floor (generated code, packages
measured only through their callers).