test: drop the export aliases that re-cover their callers

[retr0h]

Implements the last open task in specify-go-code-standards — "confirm no test uses an exported alias to re-cover behavior the caller's own test already reaches."

2,508 lines deleted. Coverage unchanged at 100% against a 99.9% gate.

Measured, not read

The rule turns on whether the caller's test already reaches the code, which no search can decide. So for each package: run the tests twice — once fully, once with the alias-using suites excluded — and compare per-function coverage.

• coverage unchanged → the caller already covered it → redundant
• coverage drops → the alias is doing real work → keep

Result

	count
Redundant — removed	36
Load-bearing — kept	68
Constructors / seams, not aliases	8

gohai needed nothing: 0 aliases, 53 boundary seams across its 32 export_test.go files. Every one replaces a dependency with a setter, which is the pattern the requirement endorses.

What went

33 in pkg/sdk/client — the deref* helpers and the *FromGen converters, every one already reached by its service method's httptest-driven test. Plus checkSudoAccess (internal/agent), stringPtrOrNil (api/node/docker), validateFileName (api/file).

31 test methods and 7 now-empty test files went with them.

What stayed, and why

Removing these would lose real coverage:

Function	Without its alias test
parsePortMappings	100% → 18.2%
envSliceToMap	100% → 25.0%
agentFromGen	100% → 29.6%
parseRegistryKey	100% → 0.0%
wrapInSignedEnvelope	100% → 0.0%

Several drop to zero — the caller's test never reaches them, so they cannot be re-covering anything. These are the pure helpers with their own contract that the requirement explicitly permits.

Correcting my earlier estimate

I reported this as "132 aliases needing cleanup." That counted every alias rather than every violation. The real number is 36, and the difference is not bookkeeping — most of the 132 are doing work no other test does.

Two packages could not be isolated by measurement (internal/controller, internal/agent/identity): every suite in them uses an alias. Reviewed by hand — internal/agent/identity exposes default function values, which are seams; internal/controller wraps three heartbeat steps and is left alone pending a closer look.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##             main     #457   +/-   ##
=======================================
  Coverage   99.94%   99.94%           
=======================================
  Files         484      484           
  Lines       24935    24935           
=======================================
  Hits        24921    24921           
  Misses         14       14           

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 63dd1cf...f1b87e8. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.