test: reach 100% unit test coverage by deleting dead code, and enforce it

[joshunrau]

Follow-up to #1632, which raised unit coverage to about 99.8% and was merged before this work landed. This PR takes every metric to 100% and makes 100% the gate locally and in CI.

Metric	Before	After
Lines	99.82% (8720/8736)	100% (8704/8704)
Statements	99.80% (9151/9169)	100% (9129/9129)
Functions	99.89% (2698/2701)	100% (2695/2695)
Branches	99.03% (4816/4863)	100% (4775/4775)

The denominators shrink because the gap was not untested code. It was code no input can reach, so it was deleted.

Dead code removed

Each location was proved dead from the types, every caller, or the library contract, then deleted or restructured so the impossible state cannot be written. Where a deletion relies on a type guarantee, tsc confirms it.

• Dialogs with no Dialog.Trigger. Radix only ever calls onOpenChange(false) for these (checked against @radix-ui/react-dialog), so if (!open) goes. Affected: the instrument preview, admin instruments, instrument repos, admin users and group manage.
• Fallbacks on values that cannot be null:
  • ?? [] on a useSuspenseQuery result;
  • ?? {} and ?? '' on schema-required fields;
  • if (records) on a required array.
• Guards repeating an earlier guard:
  • MapStep resolving behind a disabled button;
  • the login-page submit re-checking a colour it already rejected;
  • the ManageGroupForm reseed that its per-group key already performs (the key site now says so);
  • users.service's null check after a findById that throws.
• Branches the data cannot take:
  • the PERSONAL_INFO else if on a two-value enum (zod skips superRefine when the base parse fails);
  • an exhaustive switch default;
  • zod 4's int type name (z.int().def.type is 'number');
  • a .trim()med value compared to '\n';
  • split() results checked for falsiness.
• Exhaustive matches. SeriesInstrumentRenderer's .otherwise(() => null) arms after exhaustive status and step matches are now .exhaustive(), so the compiler holds the guarantee.
• Submit handlers. The scalar and series handlers are only ever passed to content rendered once the instrument is DONE, so they now take that instrument instead of re-checking the status.
• Small restructures:
  • EmailTemplateEditor is read-only when given no onChange, replacing a no-op handler;
  • mail settings read zod's flattened errors for the four fields that can fail;
  • the API's mail service decides password inheritance once (passwordSource), instead of guarding impossible null fallbacks at two call sites.
• API export worker: expandData never produces a failure entry, and the worker only ever acknowledges INIT with success. Both checks, the unused types and the test pinning an impossible failure are gone.
• Smaller packages: getTargetLanguage is narrowed to multilingual instruments, and the service worker no longer checks a module-level const Map for falsiness.

Bug fixed

#1651: the in-memory replica set is now stored and stopped in onApplicationShutdown, with a unit test. That is what apps/api/AGENTS.md already claimed happened.

Enforcement

• Threshold: the root vitest.config.ts sets coverage.thresholds: { 100: true }.
• CI: the unit step runs pnpm test:coverage.
• Rules: a new root AGENTS.md hard rule says code no test can reach is proved dead and deleted, never ignored or excluded. coverage.exclude stays reserved for non-code.
• Docs: "Before you are done", odc-done, odc-testing, testing-strategy.md (new §Coverage) and the playbooks now name pnpm test:coverage. They also note that a scoped coverage run needs --coverage.thresholds.100=false.

Verification

• pnpm lint: green (34/34 tasks).
• pnpm test:coverage: green at 100% on all four metrics, 4,392 tests passing plus 5 it.fails.
• pnpm test:e2e: 277/277 passed.

One deletion was wrong at first, and a unit test caught it before commit: the login-page colour check also feeds the live preview, where invalid colours do occur. It was restored, and only the post-guard submit copy was removed.

Exception: no new testing/ spec. The removals change no reachable behaviour, the #1651 fix has no browser-visible effect, and the existing suite passes unchanged.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com