[DFL-AUDIT-121 follow-up] Set coverage gate and source-mutation baseline

[Anionix]

Risk

Coverage regressions can remain ungated, and descriptive artifact-mutation counts do not measure source-code mutation adequacy.

Owner

Repository maintainers.

Exit contract

The accepted risk recorded by #303 expires after the third successful manual coverage run on distinct merged main commits, or on 2026-08-07, whichever comes first.

• Record each exact main SHA, workflow run URL, branch-coverage artifact name, total coverage, and job duration.
• After three successful runs, set a numeric coverage floor no higher than the minimum observed total so the existing baseline passes while later regressions fail.
• Run one serial source-mutation pilot against src/format_bench/report.py and src/format_bench/robustness/summary.py; record tool/version, exact SHA, killed/survived/error/timeout counts, and duration.
• If the pilot completes within the 20-minute workflow budget, add a reproducible manual mutation workflow and publish its baseline. If it exceeds the budget, retain the evidence and move this issue to ready-for-human for an explicit budget decision.

Acceptance

Close only after the coverage gate and reproducible source-mutation baseline are merged, or after a maintainer records a new time-bounded accepted-risk decision with measured evidence.

Refs #303.

[Anionix]

Baseline 1/3 recorded.

• Exact merged main SHA: 315cc61487c29d0e51a4189d6a4f743d71c86c43
• Workflow run: https://github.com/Anionix/data-format-lab/actions/runs/30080954866
• Result: 599 passed, 3 skipped; 6m29s
• Coverage: 5847 statements, 779 missing, 1832 branches, 338 partial, total 83%
• Artifact: branch-coverage-315cc61487c29d0e51a4189d6a4f743d71c86c43 (ID 8591918992, 489409 bytes, non-expired)

Two more successful runs on distinct merged main commits remain before the coverage-floor decision. The source-mutation pilot also remains open under this issue.