[quality] 14 commenter-auth catch arms (10 commands + auth.ts:181/210/217/224) are unreachable — only module mocks in unit tests keep them covered #386

Finding

Fourteen catch arms that wrap the commenter-authorization probes are unreachable from the shipped bundle. The three probes they guard — checkOrgMember (src/utils/auth.ts:37-67), checkCollaborator (:77-104) and checkIssueComments (:116-142) — each wrap their whole body in try { … } catch { core.warning(…); return false }, so they never reject. The wrappers around them can only fire if the probe module itself is replaced, which is exactly how the unit suite reaches them:

errorPaths.test.ts:19 says so itself: "could not check auth" branches are only reachable when the helper rejects.

Evidence (main @ aa6a0f8, Node v26.10.0, vitest 5.0.3):

• Unit: npx vitest run --coverage → 100 % lines (132 files / 2057 tests). All fourteen arms are green only because of the module mocks above.
• End-to-end: npm run test:coverage:e2e on a scratch branch = origin/main + the heads of all 33 open hold-gated bundle PRs (test(bundle): drive root-OWNERS authorization on an issue and the OWNERS-based /lgtm refusal through dist/index.js #283 … test(bundle): drive the sweep cron's enqueued outcome (sweep.ts:75) through dist/index.js #385; 53 files / 420 tests pass) → 97.64 % lines of src/. All fourteen arms have 0 hits; together with auth.ts:44-45 (payload.repository === undefined debug) they are the whole e2e residual of the auth path.
• Reachability: grep -n "throw\|return false" src/utils/auth.ts — every throw in the three probes is inside their own try; the only way out is return. context.repo is evaluated inside those same try blocks.

Why it matters for the test suite rather than tidiness: the unit report cannot distinguish "exercised by the bundle" from "exercised by a mock of the callee", so these arms keep a green line over error messages — including the misspelt couldn ot check commentor Auth — that no user can ever see, and the tests that cover them pin wording the action cannot emit.

Recommendation

One PR, one deliverable (the same mechanical edit at every site):

• drop the try { … } catch (e) { throw new Error('could not check … auth: ' + e) } wrappers in close.ts, reopen.ts, lock.ts, milestone.ts, retitle.ts, unassign.ts, labels/remove.ts and the could not get authorized users wrappers in assign.ts, cc.ts, uncc.ts, calling the probe directly
• drop the four wrappers inside src/utils/auth.ts (getOrgCollabCommentUsers:179-182, checkCommenterAuth:205-225)
• delete the corresponding mockRejectedValueOnce cases in __tests__/issueCommentTest/errorPaths.test.ts, __tests__/label/errorPaths.test.ts and the logger down cases in __tests__/utils/auth.test.ts
• npm run build && npm run pack so the dist/ drift gate passes

Alternative, if the wrappers are wanted as belt-and-braces: keep them but make the probes actually able to reject (rethrow non-404/302 statuses instead of return false), so the arms become reachable and the bundle suite can drive them. That is a behaviour change — today an API outage silently denies the command — and so also a maintainer call.

This touches production source, so it is not a PR this lane opens; it is filed for a maintainer. Companion to #366 (dead exports kept green by their own unit tests); kept separate because the fix sites do not overlap.

Priority

• Impact: low
• Effort: low

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 4948f6d

— hive: agent=quality backend=copilot model=claude-fable-5.1