test: resolve the test harness repo root with fileURLToPath and cover the fixture-sandbox contract

[hivecommons-hive]

Test Improvement

Claims exactly three files: tests/helpers.mjs (the module-level repoRoot
constant only), tests/validators-smoke.test.mjs, and a new
tests/helpers.test.mjs. Cluster: the fixture-sandbox harness contract.

The break

Both tests/helpers.mjs:6 and tests/validators-smoke.test.mjs:6 derived the
repository root from URL.prototype.pathname, which stays percent-encoded.
On a checkout whose path contains a space the root resolved to
/tmp/space%20dir/repo/ — a directory that does not exist — so every sandbox
run died in cpSync with ENOENT before the script under test was ever
spawned:

$ cp -r endusers "/tmp/space dir/repo" && cd "/tmp/space dir/repo" && node --test
ℹ tests 55
ℹ pass 0
ℹ fail 55

~/My Documents/, /Users/jane doe/ and C:\Users\...\My Repos\ are all
ordinary developer layouts. This resolves the root with fileURLToPath
instead, and exports the resolution so it can be asserted directly rather than
only observed through a downstream ENOENT.

The missing coverage

runScriptWithFixtures is the single point every fixture-based validator test
runs through, and nothing exercised it. A regression in the harness degrades
those suites rather than failing them — a sandbox that quietly read the real
repository would make every "rejects X" assertion pass for the wrong reason,
and no assertion anywhere would notice.

tests/helpers.test.mjs pins the contract in both directions: percent-decoded
root resolution, scripts/lib mirroring (so an ERR_MODULE_NOT_FOUND can
never masquerade as a rejected fixture), nested fixture placement, isolation
from the real repository, isolation between successive runs, temp-directory
cleanup, and distinct reporting of status/stdout/stderr.

Verification

Revision 00b44df, node v26.8.2, 2026-09-20.

checkout path	before	after
space-free	55 tests, 55 pass	63 tests, 63 pass
/tmp/space dir/	55 tests, 0 pass	63 tests, 62 pass

The one test still failing under a spaced path is
validate-architectures.mjs passes against current repo data, which is the
production half of the same defect — six scripts/*.mjs files carry the
identical .pathname line. That half is not in this PR: it is production
code under scripts/, which the quality lane cannot push. It is filed with
exact replacement text as #353 and needs a human or an agent whose lane can
touch scripts/ to land it.

Falsification check: reverting resolveRepoRoot to .pathname fails exactly
the new percent-decoding assertion (8 tests, 7 pass, 1 fail), so the new test
cannot pass vacuously. prettier --check clean on all three files.

Disjointness from open PRs

• [quality] test: cover validate-architecture-assets.mjs --fix write mode (tests/helpers.mjs args/readBack + tests/validate-architecture-assets.test.mjs) #231 is the only other open PR touching tests/helpers.mjs. It extends
  runScriptWithFixtures with options.args and options.readBack and leaves
  line 6 untouched. This PR changes the module-level repoRoot constant and
  adds a new import from node:url; it does not alter the function's signature
  or body. Different invariant, no competing implementation. If [quality] test: cover validate-architecture-assets.mjs --fix write mode (tests/helpers.mjs args/readBack + tests/validate-architecture-assets.test.mjs) #231 lands
  first, the only interaction is a trivial import-block rebase.
• [quality] test: report coverage of fixture-sandbox runs (tests/tools/coverage-report.mjs) #225 adds tests/tools/coverage-report.mjs for coverage attribution of
  sandbox runs ([quality] node --test coverage discards every fixture-sandbox run (reports 73.51%, true value 97.53%) #224); it does not test harness behaviour.
• [quality] test: cover scripts/collect-metrics.mjs with an offline script sandbox (tests/helpers-script-sandbox.mjs + tests/collect-metrics.test.mjs) #197, [quality] test: cover scripts/fetch-community-people.mjs with an offline fetch stub (tests/fetch-community-people.test.mjs + tests/helpers-fetch-mock.mjs) #214, [quality] test: cover scripts/import-architectures.mjs offline (tests/helpers-import-sandbox.mjs + tests/import-architectures.test.mjs) #216 and [quality] test: cover src/components/ArchitectureFilters filterArchitectures and add a JSX import path (tests/tools/jsx-hooks.mjs + tests/helpers-jsx.mjs + tests/architecture-filters.test.mjs) #229 add their own tests/helpers-*.mjs sandboxes and
  do not touch tests/helpers.mjs.

Related Issue

Closes #352 — merging this leaves nothing for #352 to track: it scopes only the
tests/ half, and both of its boxes land here. The scripts/ half is tracked
separately as #353 and is deliberately out of scope for this lane.

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.

[hivecommons-hive]

CI triage: the Validate repository failure on this PR was PR-local, not a shared incident — hive-baseline-check.sh cncf/endusers 'Validate repository' exited 2 (could not read open PR checks), and manual diagnosis showed sibling quality PRs #360, #350, #347 and #343 green on the same check.

Root cause was in this PR's own new assertion, not in the harness under test. the sandbox directory is removed once the run returns counted endusers-test-* entries in the shared temp directory before and after a run. node --test runs test files in parallel processes, so a sandbox created and removed by another test file changes that count mid-assertion — hence 1 !== 2 against a harness that cleans up correctly.

Fixed in c96210b by pinning the assertion to this run's own sandbox: the fixture-less run dies with an ENOENT naming its sandbox path, and the test asserts that exact directory no longer exists. That is independent of concurrent runs.

Verified at node v26.8.2: npm run test:unit 63/63 pass, node --test tests/helpers.test.mjs 8/8 pass across repeated runs, prettier --check clean.

hold label stays on; human review still required.

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: c96210b

— hive: agent=quality backend=copilot model=claude-opus-5