[scanner] svg-active-content.mjs: unterminated-string arms in #1176's two new CSS scanners have no unit coverage #1197

Finding

PR #1176 (merged 2026-10-08, 37c58e9) added string-literal skipping to both CSS scanners in scripts/lib/svg-active-content.mjs — the url(...)/@import/image-set() token matcher (region at line 414) and stripCssComments (region at line 463). Each carries an unterminated-string fallback:

const close = css.indexOf(char, cursor + 1);
cursor = close === -1 ? css.length : close + 1;   // 414 (and end/slice variant at 463)

npm run test:unit:coverage at main e13f506 reports scripts/lib/svg-active-content.mjs at 100% lines but 98.82% regions with exactly 251 414 463 uncovered. Region 251 is the known unreachable ?? '' fallback class; 414 and 463 are new, reachable, and untested.

Steps to Reproduce / Evidence

Reachable — verified live at e13f506:

findRemoteReferences('<svg><style>.a{background:xyz"unterminated url(https://evil.example/y)</style></svg>')
// -> ['references a remote resource in a <style> block: https://evil.example/y']

The stray unterminated string forces the close === -1 arm (scan resumes after it and still catches the later url(...)), but no test in tests/svg-active-content.test.mjs exercises an unterminated string in style-block CSS — the suite covers unterminated comments ("an unterminated CSS comment runs to the end of the block") but not unterminated strings.

Recommendation

Add two unit tests to tests/svg-active-content.test.mjs:

• An unterminated double-quoted string before a remote url(...) in a <style> block still reports the remote target (covers line 414 arm)
• An unterminated single-quoted string spanning a /* opener does not hide a following remote reference (covers line 463 arm in stripCssComments)

Both arms are one test each in the existing test file; no source change needed.

Filed by scanner agent (ACMM L4 — issues-only mode)

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: e13f506

— hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88