diff --git a/scripts/availability-probes.test.mjs b/scripts/availability-probes.test.mjs
index 3e53c59..62ab544 100644
--- a/scripts/availability-probes.test.mjs
+++ b/scripts/availability-probes.test.mjs
@@ -106,6 +106,18 @@ test("fixture: a missing availability job or loop yields null", () => {
   assert.equal(probedUrls(GOOD_YAML.replace("for url in", "for u in")), null);
 });
 
+test("fixture: siteUrlToFile resolves /, directories and bare files, and rejects the bare origin, foreign hosts and traversal", () => {
+  assert.equal(siteUrlToFile(SITE_ORIGIN + "/"), join(ROOT, "index.html"));
+  assert.equal(siteUrlToFile(SITE_ORIGIN + "/stories/"), join(ROOT, "stories", "index.html"));
+  assert.equal(siteUrlToFile(SITE_ORIGIN + "/og.png?v=2#x"), join(ROOT, "og.png"));
+  // Unlike page-meta's resolver, the bare origin is not the home page here: a
+  // probe URL must carry its trailing slash or curl sees a 301, not the page.
+  assert.equal(siteUrlToFile(SITE_ORIGIN), null);
+  assert.equal(siteUrlToFile("https://docs.hivecommons.dev/"), null);
+  assert.equal(siteUrlToFile(SITE_ORIGIN + "/../scripts/availability-probes.test.mjs"), null);
+  assert.equal(siteUrlToFile(SITE_ORIGIN + "/definitely-not-a-page/"), null);
+});
+
 test("fixture: sitemap <loc> values are extracted", () => {
   assert.deepEqual(sitemapLocs(`<urlset><url><loc> ${SITE_ORIGIN}/ </loc></url><url><loc>${SITE_ORIGIN}/a/</loc></url></urlset>`), [
     `${SITE_ORIGIN}/`, `${SITE_ORIGIN}/a/`,
diff --git a/scripts/coverage-floor.test.mjs b/scripts/coverage-floor.test.mjs
index 43529af..2bdbb6a 100644
--- a/scripts/coverage-floor.test.mjs
+++ b/scripts/coverage-floor.test.mjs
@@ -34,7 +34,6 @@ const CHILD_ENV = "COVERAGE_FLOOR_CHILD";
 export const TEST_HELPER_BASELINE = {
   "scripts/acmm-levels.test.mjs": 3,
   "scripts/automation-docs.test.mjs": 4,
-  "scripts/availability-probes.test.mjs": 2,
   "scripts/carousels.test.mjs": 6,
   "scripts/ci-wiring.test.mjs": 6,
   "scripts/dependabot-config.test.mjs": 9,
@@ -44,7 +43,6 @@ export const TEST_HELPER_BASELINE = {
   "scripts/no-js-controls.test.mjs": 5,
   "scripts/page-404.test.mjs": 5,
   "scripts/page-images.test.mjs": 19,
-  "scripts/page-markup.test.mjs": 2,
   "scripts/page-meta.test.mjs": 20,
   "scripts/page-structure.test.mjs": 7,
   "scripts/pages-build.test.mjs": 4,
diff --git a/scripts/page-markup.test.mjs b/scripts/page-markup.test.mjs
index de038ee..1f39aa2 100644
--- a/scripts/page-markup.test.mjs
+++ b/scripts/page-markup.test.mjs
@@ -29,7 +29,8 @@ function markupOnly(html) {
 function attrValue(tag, name) {
   const m = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s"'>]+))`, "i").exec(tag);
   if (!m) return null;
-  return m[1] ?? m[2] ?? m[3] ?? "";
+  // Exactly one alternative matched; the quoted ones capture "" for an empty value.
+  return m[1] ?? m[2] ?? m[3];
 }
 
 function hasAttr(tag, name) {
@@ -172,6 +173,13 @@ test("fixture: ids declared only inside <script> text do not satisfy idrefs", ()
   assert.equal(danglingIdrefs(html).length, 1);
 });
 
+test("fixture: unquoted and single-quoted attribute values are read like double-quoted ones", () => {
+  const html = `<html lang=en><body>\n<input id=name>\n<label for=name></label>\n<label for='name'></label>\n<label for=gone></label>\n<p id=name></p></body></html>`;
+  assert.deepEqual(danglingIdrefs(html), ['line 5: for="gone" does not match any id on the page']);
+  assert.deepEqual(duplicateIds(html), ['line 6: duplicate id "name" (first at line 2)']);
+  assert.deepEqual(missingHtmlLang(html), []);
+});
+
 test("fixture: <img> without alt is reported; alt=\"\" and unquoted alt are fine", () => {
   const html = `<html lang="en"><body>\n<img src="a.png">\n<img src="b.png" alt="">\n<img alt=x src="c.png">\n<img src="d.png"\n  width="1"></body></html>`;
   assert.deepEqual(imagesWithoutAlt(html), [