add min coverage check for server core

.github/workflows/qa-server-core.yml

@@ -59,5 +59,5 @@ jobs:
         working-directory: server/core
 
       - name: Run unit tests
-        run: go test -race ./...
+        run: make check-coverage
         working-directory: server/core

server/core/CLAUDE.md

@@ -39,10 +39,11 @@ of the convention.
 ## Commands & QA gates
 
 ```sh
-make build       # goreleaser snapshot build -> bin/ + ghcr.io/oxynote/core:dev image
-make test        # go test -race ./...
-make lint        # golangci-lint run --fix (applies automatic fixes)
-make check-lint  # golangci-lint run (verification only)
+make build          # goreleaser snapshot build -> bin/ + ghcr.io/oxynote/core:dev image
+make test           # go test -race ./...
+make check-coverage # go test -race with coverage; fails below COVERAGE_MIN
+make lint           # golangci-lint run --fix (applies automatic fixes)
+make check-lint     # golangci-lint run (verification only)
 ```
 
 ## Repository layout

server/core/Makefile

@@ -1,3 +1,7 @@
+# Minimum total statement coverage. Set from the measured baseline and
+# ratcheted up as suites grow — never lowered.
+COVERAGE_MIN = 93.1
+
 # Build the Docker image
 # dockers_v2 snapshot builds load into the local daemon with an arch suffix;
 # retag so the dev compose stack can reference a stable :dev tag.
@@ -11,6 +15,13 @@ build:
 test:
 	@go test -race ./...
 
+# Run all tests with coverage and fail below the minimum.
+.PHONY: check-coverage
+check-coverage:
+	@go test -race -coverprofile=coverage.out ./...
+	@go tool cover -func=coverage.out | tail -n 1 | awk -v min=$(COVERAGE_MIN) \
+		'{ print; if ($$3 + 0 < min) { printf "total coverage is below the %s%% minimum\n", min; exit 1 } }'
+
 # Run the linters and apply automatic fixes.
 .PHONY: lint
 lint: