diff --git a/tests/test_web_ui_handlers.py b/tests/test_web_ui_handlers.py
index 5dc48a2..3d8b37e 100644
--- a/tests/test_web_ui_handlers.py
+++ b/tests/test_web_ui_handlers.py
@@ -116,13 +116,27 @@ def test_authenticated_render_path(web_ui, monkeypatch):
 
 def test_hostile_fields_are_escaped_not_reflected_raw(web_ui, monkeypatch):
     """Regression lock: hostile field values must reach the HTML only as escaped
-    entities -- no raw <script>, and the payload's angle brackets must appear
-    escaped."""
+    entities -- no raw <script> in element context, and the payload's quotes
+    must be entity-escaped in attribute context (the onclick row-link sink), or
+    a " breaks out of the attribute value and injects an event handler."""
     monkeypatch.setattr(web_ui.mod, "is_authenticated", lambda event: True)
     monkeypatch.setattr(
         web_ui.mod, "dynamodb", _WebFakeDynamo({web_ui.table: [web_ui.hostile_item]})
     )
     body = web_ui.mod.handler({}, None)["body"]
 
+    # element context: angle brackets escaped
     assert "<script>alert(1)</script>" not in body  # never reflected raw
     assert "&lt;script&gt;alert(1)&lt;/script&gt;" in body  # escaped form present
+
+    # attribute context: the id flows through json.dumps into
+    # onclick="window.location={esc(..., quote=True)}", so the JSON string's
+    # opening quote must render as &quot; -- a raw " right after the = means
+    # quote-escaping regressed and the attribute is breakable
+    assert "window.location=&quot;" in body
+    assert 'window.location="' not in body
+
+    # the payload's own quote characters appear only entity-escaped
+    assert "&quot;" in body
+    assert "&#x27;" in body
+    assert _HOSTILE not in body