[hivecommons-hive]

Test Improvement

websiteUrl() in src/lib/profile-links.mjs turns the free-text blog field
of a third-party GitHub profile into an href. Three of its arms are covered
by tests/profile-links.test.mjs but never run in a browser, because no record
in the checked-in data/community-people.json has the shape that reaches them:
the typeof guard (line 51), the no-scheme arm of the https ternary (line 55)
and the URL-parser catch (line 62). Every real blog value is either "" or
an absolute http(s):// URL.

This adds three records to the existing E2E_COVERAGE=1 overlay
(tests/e2e/fixtures/data/community-people.json) — one with no blog, one
with a bare host, one that opens with a scheme but does not parse — and asserts
each rendered outcome in tests/e2e/data-fixtures.spec.js. The bare-host case
asserts the href is https://fixture.example/, which is the behaviour that
stops trusted.example@attacker.example from producing a link whose visible
prefix and real authority disagree; the other two assert no anchor is rendered
rather than a dead one.

npm run build:production is untouched: the overlay is applied only by the
loader the coverage build installs, and tests/e2e/data-fixtures.spec.js skips
itself outside E2E_COVERAGE=1.

Evidence

Measured at 900592b by building and running the whole suite locally, twice,
with and without this diff — same specs, same build command, same machine
(node v26.10.0, Chromium 153.0.8010.12):

	specs	covered regions	src files
before	298 passed	379 / 469	80.81%
after	301 passed	385 / 480	80.21%

The baseline reproduces job End-to-end coverage of run
37164361552
attempt 1 to within one region (CI: 379 / 468, 80.98%), and
src/lib/profile-links.mjs is identical in both at 57.14%.

Six more regions are covered. The denominator also grows by eleven, which
is why the ratio falls even though strictly more code is reached: the added
records put the component into chunk shapes that contribute further zero-count
spans over lines that demonstrably ran — the phantom-region effect #1035
reports and #1051 folds out. Rendering these same artifacts with #1051's
reporter gives src files 385 / 439 = 87.70% and
src/lib/profile-links.mjs 82.35%.

The gate stays green, with less headroom

Run exactly as .github/workflows/ci.yml runs it:

node tests/tools/e2e-coverage-report.mjs --input "$RUN_DIR" --build build \
  --check-source 100 --check-source-regions 80 --require-source-files
# exit 0

80.21% against a floor of 80 passes, but the margin drops from 0.81 to 0.21
points, so this is worth a reviewer's attention rather than being buried: on
today's reporter the floor has little room left for the next branch anyone
covers this way. Merging #1051 first removes the effect entirely (87.70%), and
#1035 already asks for the floor to be re-derived once it lands. Nothing in
this PR touches the reporter or the floor.

npm run test:unit:coverage:check → exit 0. npm run check:format → clean.

Scope

Touches exactly two files, tests/e2e/fixtures/data/community-people.json and
tests/e2e/data-fixtures.spec.js. Neither appears in the diff of any open
hold-gated PR: #1034 is tests/e2e/data-variants.spec.js,
tests/e2e-data-fixtures.test.mjs and the data-variants/ fixture directory
(the variant build, PeopleFreshness); #1040 and #1051 are the reporter and
its tests; #1042 and #1044 are svg-active-content; #1039 is
mdx-active-content; #1048 is tests/coverage-report-cli.test.mjs; #1050 is
SECURITY.md and the lockfile. The component cluster is disjoint too —
src/lib/profile-links.mjs via CommunityPeople's PersonDialog, not
PeopleFreshness and not useFocusTrap.

Related Issue

Closes #1053

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.