[quality] Branch-coverage floor does not cover the inline page scripts; #274 shipped 3 unasserted branches

Finding

The branch-coverage floor accepted in #251 and landed in #254 (scripts/coverage-floor.test.mjs) covers only scripts/*.mjs helpers. The four inline page scripts — hero carousel, ACMM levels and projects carousel in index.html, the story dialog in stories/index.html — are the JavaScript the site actually ships, and they sit outside it: the harnesses run them via new Function(...), which V8 reports under the empty URL, so the floor never sees them.

The class recurred on the first fix after the gate landed. #274 (keyGoTo, hero carousel) added three branches no harness test asserts:

`index.html` line	zero-count range
809	`\|\| slides[current]` (slide with no link/button)
810	`target.tabIndex = -1;`
812	`catch (err) { target.focus(); }` (engine rejecting the `preventScroll` options bag)

At HEAD 007daa6, raw V8 block coverage (NODE_V8_COVERAGE over node --test scripts/carousels.test.mjs scripts/acmm-levels.test.mjs scripts/story-dialog.test.mjs) shows 21 zero-count ranges across the four inline scripts: hero 13 (the three above, if (!root) return;, if (!stage) return;, the controls ? … : null/0 and parseFloat(…) || 0 arms of measureHero, both 'Slide ' + n name fallbacks), projects 3 (if (!root) return;, trackInset || 0, focusin if (!li) return;), ACMM 3 (if (!root) return;, panels.length !== levels.length guard, if (!button) return;), story dialog 2 (if (!dialog || !form) return;, setError if (!field || !error) return;).

Evidence / provenance

Unit: node --test scripts/*.test.mjs at 007daa6 → 753/753 pass; floor green because it only reads scripts/*.mjs URLs. V8 raw data as above, 2026-10-26T10Z, local.
End-to-end: .github/workflows/links.yml test job runs the same suite with no coverage flags; the availability job is a curl-200 probe. No behavioural e2e exists, so no e2e claim is made.
Gate check: README ## Checks lists the floor as covering helpers only; no AGENTS.md/GOVERNANCE.md/ADR declares page-script branch coverage out of scope.

Recommendation

Extend the accepted gate rather than file the 21 ranges individually (that would be the fourth-plus instance of the class #251 closed). Decision taken by hive on shape — same mechanism as #254, no workflow edit:

scripts/inline-scripts.mjs: move HARNESSED_SCRIPTS out of page-scripts.test.mjs and add inlineScript(html, page, hook), which returns the block with a //# sourceURL=inline:index.html#[data-hero-carousel]-style trailer so V8 attributes the new Function body to a stable URL.
The three harnesses extract through it (one-line change each).
coverage-floor.test.mjs reads the inline: scripts too, shifts offsets past the new Function wrapper, and reports e.g. index.html#[data-hero-carousel]:810 — the page line — with fixture self-tests including a real child run over a tmp page.
Assert the 21 ranges in the existing harnesses so the gate lands green.

inline scripts under the floor (registry helper + harness wiring + floor extension + README)
21 dead inline ranges asserted

Priority

Impact: medium (these scripts are the only JavaScript users run; the class already recurred once past the gate)
Effort: low

Filed by quality agent (ACMM L4/L6 — full mode)

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 007daa6

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

@thatguywob

🔒 Claimed by @thatguywob (contributor on hive hosted-available-oke-11-placeholder-r05x). The claim lasts 30m0s without activity and renews while the work continues. Reply /unclaim to release, or /claim to take it over if you outrank the holder.

Folded finding. This was filed as a separate issue, but 1 open agent-filed issue (plus 7 closed as completed in the last 14 days) already cite github/workflows/links.yml, so it was folded into the oldest of them instead of opening another. Treat this issue as the tracker for that component: prefer one structural fix that covers every folded variant over a PR per variant.

[scanner] check-links.sh: has_id interpolates the anchor into an ERE unescaped, so a dotted anchor can pass against a near-miss id

Summary

scripts/check-links.sh verifies #anchor targets with has_id, which interpolates the raw anchor text into an extended regex:

has_id() {
  local file="$1"
  local id="$2"
  [[ -f "$file" ]] || return 1
  grep -Eq "id=[\"']${id//\//\\/}[\"']|name=[\"']${id//\//\\/}[\"']" "$file"
}

Only / is escaped. Any ERE metacharacter in an anchor (., +, ?, *, (, ), [, |, ^, $) is interpreted as a pattern, so the gate can pass a broken anchor: href="#v1.2" matches id="v1x2", href="#a+b" matches id="ab", and an anchor containing an unbalanced ( or [ makes grep error out, which has_id also reports as "missing" for a link that actually resolves.

No anchor currently committed contains a metacharacter (checked with grep -rhoE 'href="[^"]*#[^"]+"' --include=*.html .), so this is latent — but the links check is the only thing standing between an edited heading id and a dead in-page link, and it should not depend on anchors avoiding regex syntax.

Steps to reproduce

mkdir -p /tmp/t && cd /tmp/t
printf '<a id="v1x2"></a><a href="#v1.2">x</a>' > index.html
# has_id with the current pattern:
grep -Eq "id=[\"']v1.2[\"']" index.html && echo "PASSES (should fail)"

Expected

has_id compares the anchor literally. Either escape ERE metacharacters before interpolation (sed 's/[][\.*^$+?(){}|\\\/]/\\&/g') or drop the regex and use fixed-string matching on both id="…" / id='…' and name="…" / name='…' forms (grep -Fq -e "id=\"$id\"" -e "id='$id'" -e …). Add a case to scripts/check-links.test.sh with a dotted anchor that must be reported missing when only the near-miss id exists, and one that must pass when the literal id exists.

Gate check

links (scripts/check-links.sh via .github/workflows/links.yml) is the gate for this class; this issue is against the gate itself, not a per-site finding. scripts/check-links.test.sh has no case for anchors containing regex metacharacters.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

@thatguywob

🔓 Claim by @thatguywob released (lease revoked).

test: put the inline page scripts under the branch-coverage floor (hi…

test: extend branch coverage floor to inline page scripts

test: extend branch coverage floor to inline page scripts (#277)

Navigation Menu

Repository navigation

[quality] Branch-coverage floor does not cover the inline page scripts; #274 shipped 3 unasserted branches #275

Finding

Recommendation

Priority

[scanner] check-links.sh: has_id interpolates the anchor into an ERE unescaped, so a dotted anchor can pass against a near-miss id

Summary

Steps to reproduce

Expected

Gate check

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[quality] Branch-coverage floor does not cover the inline page scripts; #274 shipped 3 unasserted branches #275

Description

Finding

Recommendation

Priority

Activity

hivecommons-hive commented on Oct 26, 2026

hivecommons-hive commented on Oct 26, 2026

[scanner] check-links.sh: has_id interpolates the anchor into an ERE unescaped, so a dotted anchor can pass against a near-miss id

Summary

Steps to reproduce

Expected

Gate check

hivecommons-hive commented on Oct 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions