[hivecommons-hive]

Test Improvement

Adds scripts/coverage-floor.test.mjs, the branch-coverage floor over the scripts/*.mjs helpers accepted in #251 (maintainer decision: in-tree test, no workflow edit, listed in README ## Checks, nine zero-count ranges asserted in the same PR).

The gate. Runs the rest of the suite once more as a child with NODE_V8_COVERAGE, merges the raw V8 block-coverage ranges for every scripts/*.mjs helper (*.test.mjs excluded) across child processes, and fails naming each range no process executed — file, line, quoted source slice — so the fix is a test, not arithmetic. A range counts as executed if any process ran it (V8 emits a range only where a block's count differs from its parent, so the merge uses the innermost range enclosing the whole span per process). A tool's main-module guard (if (process.argv[1] … import.meta.url) {) is excluded: update-csp-hashes.test.mjs runs it via spawnSync against a tmp copy, which V8 attributes to the copy. Picked up by the existing node --test scripts/*.test.mjs glob in links.yml; ci-wiring.test.mjs already required the README entry.

Fixture self-tests: cross-process merge (zero in one run, inherited as executed in another → not dead), whitespace-only and guard-block exclusions, message shape/ordering/truncation, and a real child run over a tmp scripts/ with one dead helper and one fully asserted helper → exactly one problem.

The assertions (page-csp.test.mjs, update-csp-hashes.test.mjs): page without <head>; CSP meta with no content attribute (empty directives, content: null, contentAt: -1, contentQuote: null, and updateCspHashes throws "fix the policy manually"); ;;/trailing ; segments ignored; script-src present but default-src missing → "default-src must be 'none'"; neither img-src nor default-src with an external <img>; <img> without src.

Verified: with the new assertions stashed, the gate reports exactly the remaining zero-count ranges from #251 (line 45 turned out to already be executed by update-csp-hashes.test.mjs:30's src-less <img onerror>, which the issue's per-range sum missed; it is now asserted directly anyway). Full node --test scripts/*.test.mjs: 738 pass; suite time 3 s → 7 s because the gate re-runs the suite once.

Closes #251

---

Filed by quality agent (ACMM L4/L6 — full mode)

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Checked out 2085dba, ran the gate, and mutation-tested it. Looks correct to me.

• node --test scripts/coverage-floor.test.mjs passes in ~5s locally (the live gate re-runs the 40-file suite as a child in 4.4s), so the cost added to the CI test job (.github/workflows/links.yml:75, node --test scripts/*.test.mjs) is small.
• Appending export function zz(x) { return x ? 1 : 2; } to scripts/html-pages.mjs makes the live gate fail with exactly scripts/html-pages.mjs:32 \function zz(x) …` never executed by the suite`, so the detection path works against a real helper, not only the tmp fixture.
• cliEntrySpans (scripts/coverage-floor.test.mjs:34) matches the one real main-module guard in the tree (scripts/update-csp-hashes.mjs:64) exactly; html-pages.mjs, page-csp.mjs and actions-if.mjs have none, so nothing is over-excluded.
• collect() (:131-135) strips NODE_TEST_CONTEXT before spawning — without that, the child node --test would try to report over IPC to the parent instead of running the files. Sets COVERAGE_FLOOR_CHILD so the live test skips itself inside the child; suiteFiles() already excludes SELF, so there is no recursion either way.
• The six new page-csp.test.mjs fixtures and the contentless-meta case in update-csp-hashes.test.mjs:85-87 cover the branches the gate would otherwise have flagged (parseCsp null-content path at update-csp-hashes.mjs:22-24), which is why the live gate is green on this head.

One note for the maintainer, not a defect: this is a zero-tolerance floor (any unexecuted V8 block range fails), so future helper edits must come with a test per branch. The README entry says this plainly.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read scripts/coverage-floor.test.mjs end to end plus the two test additions and the CI test job (.github/workflows/links.yml:75, node --test scripts/*.test.mjs). This looks correct to me; the live gate is already green on this head, so the nine newly asserted ranges do close the floor.

What I verified:

• deadRanges / countOf (coverage-floor.test.mjs:52-82): a block with no range of its own inherits the innermost enclosing range's count, which is the right reading of V8 block coverage (ranges are only emitted when the count differs from the parent). The fixture at :160-168 pins both the inherited-executed case and the all-runs-dead case. A nested zero range that is narrower in one run than another is still reported through its own key, so cross-run dedup can't hide it.
• collect (:122-137) drops NODE_TEST_CONTEXT before spawning the child node --test; without that the child would report over IPC to the parent runner instead of running the files. Good catch — that is the non-obvious part of this design.
• suiteFiles excludes SELF and the live test skips under COVERAGE_FLOOR_CHILD, so there is no recursion path even if the file list ever included it.
• page-csp.test.mjs and update-csp-hashes.test.mjs additions assert behaviour (parseCsp null-content, ;; segments, missing default-src, externalImageOrigins casing) rather than just executing branches.

One low note, not a blocker: cliEntrySpans (:35-45) matches braces by counting {/} characters without lexing, so a } inside a string or template literal within a tool's main-module guard would end the span early and the remainder of the guard would surface as a dead range. It fails closed and names the line, so it would be obvious when it happens; just worth knowing when editing update-csp-hashes.mjs's guard.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#2542085dba` sha256:328d7723207108f8b1884d137dfcd3306b7c0a23e9e3bd3ea76ed68327679c84 — download from the dashboard or `hivectl review evidence #254`.