[quality] mirrorArtworkUrls' non-regular-file destination arm is the one untested region in architecture-content.mjs #1164

Finding

mirrorArtworkUrls() in scripts/lib/architecture-content.mjs guards its
destination before writing fetched third-party bytes:

152    const existing = lstatSync(destination, { throwIfNoEntry: false });
153    if (existing?.isSymbolicLink() || (existing && !existing.isFile())) {
154      console.warn(
155        `Could not mirror CNCF project asset: ${path}: destination is not a regular file`,
156      );
157      continue;
158    }

The guard has two arms. The symlink arm is pinned by
tests/architecture-content-mirror.test.mjs:59 ("refuses to write … through a
symlinked destination", parameterised over a PNG and an SVG), and the
pass-through case is pinned by tests/architecture-content-mirror.test.mjs:87
("still writes a regular-file destination").

The second arm — existing && !existing.isFile(), an entry that exists and is
not a symlink and not a regular file — has no test at all. It is the one
uncovered region in the file.

That arm needs no adversary to reach. A directory sitting on a mirror path is
what an interrupted run leaves behind, or what an upstream asset renamed from
<name> to <name>/<name> produces, and
.github/workflows/import-architectures.yml reruns npm run import:architectures daily over whatever the previous run left on disk.
Without the guard, writeFileSync() raises EISDIR and aborts the whole
import rather than skipping the single asset it cannot mirror — so the arm is
the difference between one missing logo and a failed daily job. Nothing
currently asserts that it skips, that it warns, or that it leaves the occupied
destination untouched.

Evidence and provenance

• Unit — not covered. npm run test:unit:coverage
  (TZ=UTC node tests/tools/coverage-report.mjs, node v26.10.0, npm 11.19.1),
  run locally on 2026-10-07 against main at 03cfcfe:

  scripts/lib/architecture-content.mjs | 100.00 | 97.78 |  | 155
  scripts/lib/svg-active-content.mjs   | 100.00 | 99.52 |  | 251
  

  Those two are the only sub-100%-region files in src/ + scripts/; line
  155 is the warning inside the guard, reached only by the untested arm.

• End-to-end — not applicable, and deliberately not claimed. The e2e
  coverage mechanism is Playwright V8 coverage over the browser bundle
  (artifact e2e-coverage, id 11492367935, run
  37641752914,
  workflow Validate repository, job End-to-end coverage, main at
  03cfcfe). scripts/lib/architecture-content.mjs is a Node build-time
  module that never enters a bundle: it does not appear in that report's
  sources, and no mechanism in this repository could put it there. This is a
  stated limitation of the available evidence, not a measurement that the
  path lacks end-to-end coverage, and the two coverage sources are analysed
  separately because they cannot be combined for a file only one of them can
  observe.

• Under the coverage-evidence rules this is priority 2: unit evidence
  exists and shows the arm uncovered, and no end-to-end evidence is obtainable
  for it.

Recommendation

Add two tests to tests/architecture-content-mirror.test.mjs, beside the
symlink pair so both arms of the one guard are read together:

• a directory on the mirror destination makes mirrorArtworkUrls() skip
  the asset and emit exactly one destination is not a regular file
  warning — a silent continue would leave the asset missing with nothing
  in the import log saying why
• the occupied destination is left byte-for-byte alone: still a directory,
  still holding only its original entry, whose contents are unchanged

scripts/lib/architecture-content.mjs reaches 100% regions once they land;
scripts/lib/svg-active-content.mjs:251 is a separate, already-tracked gap and
is not part of this issue.

Coordination

The change touches exactly one file,
tests/architecture-content-mirror.test.mjs, and adds to it rather than
editing any existing test. It does not touch
tests/tools/e2e-coverage-report.mjs or tests/e2e-coverage-report.test.mjs
(occupied by #1163), scripts/lib/architecture-content.mjs itself (no
production change is proposed — the guard is already correct, only untested),
or any workflow file.

Priority

• Impact: medium (the arm that keeps a scheduled daily import from aborting on
  a leftover directory, in a function that writes fetched third-party bytes)
• Effort: low

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 03cfcfe

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88