.coverage-floors

# Per-package statement-coverage floors, enforced by scripts/coverage-gate.sh in CI.
#
# Each floor is that package's measured coverage rounded down to the nearest whole percent, so
# this file is green on the commit that introduces it. That is the point: a gate set above where
# the code is gets weakened until it passes, and a gate set at one number across a repo with a
# real spread has to sit at the floor of the worst package, at which point it gates nothing.
#
# Every line is a ratchet. Raising a floor is a deliberate act. Lowering one has to be defended
# in a diff, which is the only property that makes this file worth having — the alternative is a
# coverage number that drifts down a percent at a time and is never anyone's fault.
#
# A floor sitting exactly on a package's measured coverage will eventually flake, and that is worth
# tolerating rather than padding. One package here measured 51.0% or 50.6% depending on
# garbage-collector timing, so a commit touching only YAML went red — and chasing the flake found
# the larger defect: the varying statement was an alert branch whose test accepted either outcome
# with `t.Log("No alerts generated (may be normal...)")`, so deleting the branch entirely left it
# green. A gate with zero margin is what made that visible. Widen the test, not the margin.
#
# CLAUDE.md's target is 80%+ per package. Twenty-three of the thirty-five below are there — counted
# from the file rather than remembered, since this sentence said "sixteen of the thirty" for several
# releases after both numbers moved. Two of the four
# packages this file originally listed as furthest from it have since been rewritten, and both moved
# for a structural reason rather than by anyone writing tests harder — which is the useful thing to
# record, because it says where the remaining two are actually blocked:
#
#   internal/fuse       37.7% → 59.9%  the package became a translation shim over internal/vfs, so
#                                      its behavior is reachable by calling a node method instead of
#                                      by mounting
#   internal/adapter    45.7% → 46.9%  see its own note below; the floor stays at 40 on purpose
#   internal/health     48.5%          reachable now that pkg/health's probe path exists
#   pkg/errors          48.3%          mostly classification tables; needs table tests, not design
#                                      work
#
# Floors are deliberately absent for four packages, and the gate names all four in every run so the
# omission stays visible instead of looking like a decision. TestUnfloorablePackagesAreExplained in
# internal/config/coverage_floors_test.go asserts that the set the gate reports and the set this
# block explains are the same set, in both directions, so this list cannot drift out of agreement
# with the gate the way it had. It was six until #360 gave pkg/archive tests of its own and a floor
# and #361 made the coverage job's cgo posture explicit enough to floor sdks/c.
#
# All four report 0.0%, and in every case that number is an artifact rather than a
# measurement — which is the thing to understand before reading a floor into it. `go test
# -coverprofile` instruments only the package under test, so a package with no test files of its own
# gets a profile full of count-0 lines even when every statement in it executes under a sibling
# suite. Measured with -coverpkg pointed at each one from the packages that use it:
#
#   internal/cache/cachetest        0.0% reported, 81.9% under internal/cache + internal/cache/redis
#   internal/testhttp               0.0% reported, 75.6% under internal/adapter
#   pkg/compression                 0.0% reported, 88.9% under internal/compression
#   internal/awsrates/…/offertest   0.0% reported, 48.9% under internal/awsrates/...
#
# So a floor for any of those four would not be a weak gate, it would be a broken one: it would have
# to be 0 to pass, and 0 is not a gate. The real check for each is that its consumers' suites fail when it changes,
# which is what their own floors above already enforce.
#
# Two more packages used to appear in the gate's unfloored list and no longer do: `flatted`, an npm
# dependency of docs-platform and sdks/javascript, ships a Go port inside its package directory, so
# `go list ./...` reports it twice once anything has run `npm install`. The gate now skips any profile
# path under node_modules. They are gitignored and the coverage job never installs npm packages, so
# they were visible only on a developer machine — noise in the one place a gate's output is read most
# often, and not actionable by either a floor or a test, because the code is not this repository's.
#
# no-floor: internal/cache/cachetest
#     no tests, deliberately: it is the shared conformance suite five cache implementations are
#     enrolled in, so every statement in it runs under internal/cache and internal/cache/redis, both
#     floored above. A test of its own would assert that the suite it just ran agrees with itself
# no-floor: internal/testhttp
#     no tests, deliberately: it is test support, and every statement in it runs under the suites
#     that use it. A test for FreeAddr would assert that an address is free by binding it, which is
#     what the function does — a tautology. Its real check is that deleting adapter.Start's metrics
#     call fails the tests built on it, which it does, with the message it exists to print
# no-floor: pkg/compression
#     no tests in this package; its constants and SupportedAlgorithms list are exercised from
#     internal/compression, which is at 88.6%. SupportedAlgorithms is load-bearing there since #230
#     — the decoder table is derived from it, so adding an algorithm to that list makes it readable
#     with no second edit
# no-floor: internal/awsrates/offerfile/offertest
#     no tests, deliberately, and for the same reason as internal/testhttp: it builds the offer-file
#     fixtures three suites run against, so every statement in it executes on every run. A test of
#     its own would assert that a fixture it just built contains what it put in — the
#     self-consistency failure the Glacier PUT defect had. Its real check is that the suites using
#     it fail when a rule changes
#
# `pkg/types` was in this block as `no-statements` and is now floored above. #282 gave it its first
# function bodies — Precondition.Validate and IsZero — and TestNoStatementPackagesStillHaveNone caught
# the transition on the commit that made it, which is what that test exists for.
#
# Two packages are absent from the gate's report entirely, and that is correct rather than a gap.
# They contain no statements at all, so they produce no profile lines for the gate to match, and
# `go test` reports them as `coverage: [no statements]` rather than 0.0%:
#
# no-statements: tests
#     five _test.go files and no non-test Go files, so there is nothing in the package for a profile
#     to be about. Three of the five are behind build tags (aws_s3, distributed, e2e)
# no-statements: test/benchmarks
#     behind //go:build benchmark, so `go list ./...` does not report it either
#
# A floor for either of these fails the gate rather than weakening it — verified, not assumed:
# adding `pkg/types 50` produces "FAIL pkg/types — a floor of 50% is set but the coverage profile has
# no data for it" and exits 1, via the stale-floor arm in coverage-gate.sh. That arm is correct and
# should stay; the consequence is just that a zero-statement package cannot be floored, which is why
# these three are documented here rather than in the list above.
#
# `pkg/optimization` was in this file's backlog (#199) as an unexplained absence. It no longer exists:
# 4d10da0 deleted pkg/optimization/interfaces.go.

internal/analytics       96
internal/archive         90
internal/awsname         100

# internal/awsrates went 76.2 → 100 when #161 made the region reachable. The 24 points were not new
# tests over old code: Regions, HasRegion, and both regional accessors existed with no non-integration
# test at all, because the drift test that covered this package needed AWS credentials and skipped
# without them. Seven mutations against the fallback logic are all caught, including the one that
# matters — ForRegion ignoring its region argument, which is the shape of the defect #161 closes.
internal/awsrates        100

# internal/awsrates/offerfile enters at 89, from `[no test files]`. The 10 points missing are
# genrates' error paths and two HTTP failure arms; the extraction rules themselves are at 100.
#
# Measured under a full-repo `go test ./...` run, not an isolated one. That distinction has bitten this
# file three times: a package measured alone can score higher, because tests in sibling packages are
# not competing for the same -race budget and timing-dependent branches land differently. A floor set
# from the luckier measurement goes red on a commit that touches nothing.
internal/awsrates/offerfile 89

# cmd/genrates enters at 74, from `[no test files]`. run() itself is at 90.6; the gap is main(), which
# calls os.Exit and so cannot be covered by a test in the same binary.
#
# It became testable by taking its fetcher as a parameter instead of calling offerfile.NewFetcher()
# inline — one line, and the reason it had no tests. Worth recording as the pattern rather than the
# incident: this command writes the file every price ObjectFS quotes comes from, and its failure modes
# all produce a *plausible file* rather than an error. A wrong skip rule drops a region silently; an
# empty table compiles and prices every tier at $0, over the top of the file that was correct. Four
# mutations covering exactly those are caught.
internal/awsrates/offerfile/cmd/genrates 74

# cmd/objectfs enters this file at 77, from no entry at all — the note above it used to say "no
# tests, currently untestable because main() calls log.Fatalf directly", which was true and was the
# whole defect. log.Fatalf calls os.Exit, so it takes the test binary with it; no test could reach a
# single argument-handling decision, in the one package whose entire job is to read an operator's
# command line. main() is now three lines around `run(args, stdout, stderr) int`, and the subcommand
# dispatch, the flag parsing, the config-file-versus-command-line precedence, and the dry-run path are
# all callable.
#
# 77 rather than higher because what remains uncovered is the mount lifecycle itself: mountAndWait
# builds an adapter, starts a FUSE server, and blocks on a signal. That needs a mount, which is what
# the fuse_mount build tag and `make test-fuse-mount` are for. Everything reachable without one is
# covered, including the three cases that were regressions waiting to happen — a flag after the
# positional arguments being silently ignored, --dry-run approving a URI nothing in this build can
# mount, and --mount-point disagreeing with the positional argument.
cmd/objectfs             77
# internal/cache/redis goes 87 → 88 with the shared conformance suite (#178). The gain is small and
# what it bought is not: the suite is the test that found Get answering a ten-byte request with two
# bytes, which ten implementation-specific tests had missed because none of them asked for a range
# longer than the value stored.
internal/cache/redis     88
internal/circuit         96
# internal/compression goes from 87 to 88 with the decoder-table tests #230 added: a matrix over
# every writable algorithm read back by every algorithm and by a disabled compressor.
#
# 88 → 87 with #159's parser consolidation, and this is the deletion-of-tested-code shape rather than a
# weakened gate — the same one internal/fuse's note below records. Counted rather than asserted: the
# package went from 280 statements with 248 covered to 264 with 232, so all 16 statements that left were
# covered ones and the uncovered count is unchanged at 32. `parseSize` and the `TestParseSize` that
# exercised it both went; the floor a percentage produces moves even when nothing became less tested.
#
# What replaced them is not a smaller test. TestMinSizeIsParsedByTheSharedParser asserts `c.minSize` —
# the floor that actually reaches the Compressor — over twelve cases including the three the deleted
# parser got wrong, where TestParseSize asserted a private function's return value and passed while
# disagreeing with the parser the mount used. The 32 statements still uncovered are the codec-table
# construction failures in buildDecoders and NewCompressor, unreachable without breaking
# SupportedAlgorithms itself.
#
# 87 → 90 with #184's skip. Ratcheted because the new statements arrived covered rather than because a
# suite was widened over old ones: AlreadyCompressed is three statements and the table test drives all
# of them, so the floor follows the code up. The 32 uncovered statements above are still the same 32.
internal/compression     90
# internal/config goes from 83 to 86 with the validation the config plumbing added. The two points
# that raise is worth are in what the new tests assert rather than in the number: each case checks
# that the rejection message names the YAML path, because the failure being prevented is not "a bad
# value was accepted" but "a bad value was accepted, replaced with something plausible, and never
# mentioned again" — an unrecognized storage class became STANDARD, and any unparseable size became
# 1 GiB. An error that says "invalid configuration" leaves the operator exactly as stuck.
#
# 86 → 88 with #157's move of the compression block to storage.s3. The two points are in the
# rejection cases rather than the move: `write_buffer.compression` and
# `performance.compression_enabled` are removed rather than kept as ignored fields, and the tests that
# hold that decision assert the loader *refuses* a file still setting either, naming the key. A key
# kept in the schema and read by nothing is what produced the defect — a shipped
# `compression_enabled: true` over a feature that was off — so a test that only checked the new path
# worked would leave the old one free to come back as a silent no-op.
internal/config          88
# internal/coord enters at 88, and the number is the less interesting half of what it took to get
# there. 87.4% was reached with Guard.PutIf and Guard.Delete at 66.7% each, covered only on the path
# where they *refuse* — so either could have had its write deleted entirely and every test would
# still have passed, because the package's other tests assert that a stale holder's writes do not
# land. Verified by mutation, not predicted: replacing Delete's body with `return nil` failed nothing
# until TestGuardedWritesReachTheStoreWhileTheLeaseIsHeld existed.
#
# 88 → 89 with the transient-store branch of Renew, the one arm that must *not* drop the claim. It was
# left uncovered on the theory that reaching it needed a capability the harness lacked; testaws.Fault
# already had it, so the note recording that gap was wrong rather than the gap being real — worth
# remembering as a reason to check the harness before believing a branch is unreachable. It goes
# through the injector rather than a backend double on purpose: a double returning a canned error
# exercises the errors.Is arms without proving anything about which errors S3 produces, and the whole
# question here is how a real 500 classifies after the SDK, the breaker, and the translator have had it.
#
# The uncovered remainder is the crypto/rand and json.Marshal error arms, which need a failing
# encoder rather than a failing endpoint.
internal/coord           89
# internal/cost sat here at 98 until #226 deleted it: a per-tenant cost calculator with no importer,
# no configuration path to the tenants or budgets it was built around, and — being under internal/ —
# no way for another module to become its caller either. 98% covered and not part of the product,
# which is the same lesson pkg/api's floor carried: coverage cannot tell the difference.
internal/difftest        75
internal/distributed     67
# 100, and it can hold there: the package is one type with five methods and two free functions, no
# I/O, no clock, and no error paths — so there is no code in it that is expensive to reach. A floor
# below 100 here would only be permission to add an untested branch.
internal/distributed/hashring 100
internal/filesystem      88
# 45 → 48: the previous floor was not a stable measurement. Eight tests started a Monitor whose
# default Config enables the health endpoint on the fixed port 8081, so each Start raced its siblings
# for one port; the losers hit startHTTPServer's bind-error arm, and how many did was a matter of
# goroutine scheduling. The package measured 45.0% on an idle machine and 44.7% under CI's load, and
# the floor had been set from the luckier run — so CI failed a gate that passed locally, over two
# statements nothing had deliberately tested. Tests that are not about the endpoint no longer open
# one, the two that are bind port 0, and the result is 48.5% at every -cpu value from 1 to 8.
internal/health          48
# 79 → 85: the wiring tests scrape the endpoint over a socket rather than inspecting the collector's
# fields, which is what reaches Start, the HTTP handlers, and the label validation. None of that was
# callable from a test that only constructed a collector — and a collector with no listener gathers
# identically to one with a listener, so the six points were exactly where the defects were.
internal/metrics         85

# 100 → 98, and the drop is the file set changing rather than coverage falling. This floor was
# measured on macOS, where congestion_stub.go supplies 24 lines; on Linux congestion_linux.go
# supplies 66 in their place, and three of its functions had no test at all — setTCPCongestion at 0%,
# newPlatformDialer at 20% with its Control closure never invoked, and both procfs readers missing
# their absent-file arms. The package measured a clean 100% locally and 86.9% in CI, below a floor
# nobody could see was wrong from the machine it was set on.
#
# congestion_linux_test.go covers those, taking Linux to 98.8%. The floor sits at 98 rather than 100
# because one arm genuinely resists: rawConn.Control's own error, which needs a socket whose fd is
# already invalid. The lesson worth keeping is the first one — a per-package floor set on one
# platform is a claim about a file set that platform does not compile, so CI is the authority for
# any package with a //go:build split. internal/fuse is the other one.
internal/network         98

# internal/testaws 61 → 64 with SeedConditionalConflict/ClearConditionalConflicts, which drive
# substrate's conditional-conflict control endpoint so a test can make the emulator answer 409
# ConditionalRequestConflict. The seed's own regression test is what earns the points, and what it
# pins is the property that makes a seed worth having over a Fault: the conflict is consumed *after*
# the preconditions are evaluated, so an unconditional write is unaffected and a genuine 412 still
# reports as itself. A Fault short-circuits in front of the emulator and would answer 409 to a write
# whose precondition never held — a state S3 does not produce, and a test built on it would assert
# against a fiction.
internal/testaws         64
internal/vfs             98

# internal/storage/s3 goes from 71 to 73 with the two operations the node contract added to the
# backend: an attribute-only write and a listing that follows continuation tokens. Both are seam
# operations in the strict sense — what matters is what crosses the wire, so both are tested by
# asserting on the endpoint rather than on a return value.
#
# The two points that raise is worth: writing the missing assertion for "SetObjectMetadata restates
# the storage class" found that the configured storage_tier never reached S3 at all on the shipped
# default path. Every layer in between agreed on the tier — ValidateWrite enforced its minimum size,
# the logs named it, ConvertTierToStorageClass had a passing unit test — while objects were stored as
# INTELLIGENT_TIERING. Coverage of a seam is not the same quantity as coverage of a function.
#
# The config-plumbing work takes it from 73 to 79, and most of that is the same lesson twice. The
# backend's config had six fields nothing on the mount path ever set, so the tests that now cover
# them are seam tests too: they assert what the endpoint recorded for a configured storage tier, and
# they drive the cost optimizer's access-pattern map through GetObject rather than calling it, because
# the map was written from the read path and a test that called the optimizer directly would prove
# the lock works without proving the path that needs it has it.
#
# 79 to 81 with the multipart-abort and batch-partial-failure work. Both raises are error paths, which
# is where this package's coverage was thinnest and where its defects were: the paths that run when
# something has already gone wrong are the ones a test has to arrange a failure to reach, so they were
# reachable only by whichever error a happy-path test happened to provoke. Both are now driven by
# faults injected at the endpoint — a 403 on the Complete of a multipart upload, a 503 that outlasts
# the retry budget on one key of a batch — which is the only way to reach them at all.
internal/storage/s3      81

# internal/adapter is the one package whose floor is set below the current measurement on purpose.
# Its coverage moves with which S3-backed tests the harness can run, and the write-path rebuild
# will churn it substantially; 40 is the level below which it has genuinely regressed.
internal/adapter         40

# internal/fuse was lowered from 24 to 17 by the write-path rebuild — the one shape of lowering that
# is not a weakened gate, because the drop was the deletion of tests for deleted code. The
# WriteCoalescer and its thirteen tests went with it (the type corrupted data on a routine overwrite
# while every one of those tests passed), so numerator and denominator both fell and the statements
# that remained were covered exactly as well as before.
#
# The read-path work raises it to 37: nine tests driving FileHandle.Read and the metadata cache
# against a real byte-range cache, a real write path, and a substrate-backed S3 endpoint. Those are
# the paths where the cache-keying and prefetch defects lived, and they were previously reachable in
# tests only through a map-backed stub that answered every request regardless of length.
#
# The node-contract work raises it to 56, and the mechanism is the one the previous note predicted:
# the package became a translation shim over internal/vfs, so its behaviour is now reachable by
# calling a node method and asserting on S3 rather than by mounting. Getattr, Setattr, Fsync, Statfs,
# Lookup, Readdir, Mkdir, and Create are covered against a substrate-backed endpoint.
#
# A table test over toErrno takes it to 59. That function is the whole of the package's error contract
# and was at 16.2% — reachable only incidentally, through whichever error an operation test happened to
# provoke. It is also the one function here whose defects are invisible to every other test, because a
# wrong errno does not fail an operation, it fails it differently: v0.10.0 collapsed every HeadObject
# error to ENOENT, and Create read that as "absent" and wrote an empty object over a throttled file.
#
# 59 → 67, and the seven points that are not the FUSE-options work are a correction rather than a
# raise. The package measured 66.2% on the commit before it while the floor said 59: several releases
# raised coverage without moving the number, so the gate had drifted into slack that no longer gated
# anything. A floor eight points under the code is a floor that permits a real regression silently,
# which is the one failure mode this file exists to prevent, so it is set to the measurement again.
#
# The remaining 1.3 points are #180's four seam tests. They reach one of the two things the note below
# said a unit test could not: the go-fuse option construction is now covered, because `fs.NewNodeFS`
# returns a RawFileSystem whose Lookup/Open/Create can be called directly, and rawBridge.Open copies a
# node's returned fuseFlags into the OpenOut the kernel receives. What is left is genuinely
# mount-only — the mount and unmount lifecycle and the signal handling around it — plus the kernel's
# own half of direct I/O and page-cache retention, which is what the fuse_mount build tag and
# `make test-fuse-mount` are for.
#
# 67 held, but not on the measurement it was set from, and the discrepancy is worth recording because it
# is the third instance of the same mistake in this file. The package measures 67.5% run alone and 66.4%
# under `go test ./...`, so the floor set from an isolated run failed the very next full-repo gate. Six
# statements were load-dependent: the trim loop in inflightFetches.unclaimedStart and the arm in
# performPrefetch that drops a prefetch whose whole range is already in flight. Both are only reached
# when a read is outstanding at the instant a prefetch is scheduled, which an idle machine arranges by
# accident and a loaded one does not — the same shape as internal/health's port race above and
# internal/network's platform split below. A floor is a claim about a *measurement*, so the measurement
# has to be the one CI takes.
#
# They are now owned by tests rather than by luck: unclaimedStart is driven directly over seven cases
# including the chained advance a real reader cannot be made to produce on demand, and the drop arm is
# driven by a fetch registered and never finished. The second one is bounded with an explicit timeout
# because removing the arm makes the prefetch *block* on the read it was trimmed against rather than
# fetch too much — a parked prefetch worker, which no byte-count assertion can see.
#
# 67 → 72 with #167's extended attributes: xattr.go's five operations, the base64 name encoding, the
# budget check and the removal tombstone are all reached by unit tests, a differential oracle against the
# local OS filesystem, and a per-platform errno hook. Two of those tests exist because a mutation showed
# the code they cover was unowned — deleting the clamp in xattrSize left the whole package green.
#
# This entry is the first one in this file set from CI's own log rather than a local run, which is the
# lesson the three paragraphs above kept re-learning. It matters more here than the load-dependence they
# describe: CI is ubuntu-latest and compiles unmount_path_linux.go (52 lines) where a darwin run compiles
# unmount_path_darwin.go (44), so the two platforms do not even have the same denominator. Darwin
# measured 72.2% and linux 72.5% for the same tree. There is no Docker on the development machine, so the
# linux figure is not obtainable except from a PR — which means the ratchet is a second commit, after the
# feature is green, and not part of the commit that earned the points.
internal/fuse            72

# internal/cache went 74 → 76 with the re-keying work — the byte-range keying, splitting, coalescing,
# and coverage checks are now covered by 27 tests and a fuzz target where before they were two copies
# of the same untested sprintf — and then 76 → 82 with the predictive-cache shutdown fixes. That
# second jump has a cause worth recording: every pre-existing test in the package set
# `EnablePrefetch: false`, so the prefetcher's queue, workers, rate limiter, and shutdown path had no
# coverage at all, and three defects lived there — a panic on close racing a read, a token bucket that
# never refilled, and a Close nothing called. Switching prefetch on in tests is what found them.
#
# 82 → 85 with #178: the four in-process implementations are now enrolled in the shared conformance
# suite in internal/cache/cachetest, and NewFromConfig has a caller and therefore tests that assert
# which implementation a configuration selects rather than only that one was returned.
internal/cache           85

# 100, and the only floor in this file set at 100 on purpose rather than because a package happens to
# be small. pkg/archive is 189 lines of declarations plus IsArchive and four index methods; there is
# no error path, no I/O, and no concurrency in it, so every statement is reachable from a table entry
# and a floor below 100 would permit a regression with nothing to justify it.
#
# It had no floor until #360. The note that used to stand here said its statements ran under
# internal/archive, reaching 48.6% — true, and the weaker of the two available positions, because the
# uncovered 51.4% was ListDirectory and its two helpers, which no consumer calls at all. Testing the
# package directly rather than reaching it from internal/archive was the deliberate choice #360 asked
# for: ArchiveIndex is exported, so its contract should not depend on which consumer happens to exist.
#
# Reaching 100 turned up the thing worth knowing. ListDirectory's second disjunct requires an entry
# whose Path ends in '/', and internal/archive.BuildIndexFromBytes runs every tar name through
# path.Clean, which strips exactly that — so that branch, and containsSlashExceptLast which only it
# calls, are unreachable from the only producer in the repository. They are covered rather than
# deleted because a caller outside this repository may build an index using tar's own convention,
# where a directory name keeps its slash. The test says which convention each half serves, so
# removing the branch stays a decision about the exported surface.
pkg/archive              100

pkg/errors               48
pkg/health               93
pkg/recovery             86
pkg/retry                87
pkg/status               93

# pkg/types enters at 100, from `no-statements`. That is not an achievement — the package is four
# files of interface and struct declarations plus, since #282, exactly two function bodies:
# Precondition.Validate and IsZero. Both are fully covered, so the floor is the measurement.
#
# 100 is the right ratchet here rather than a hostage: anything added to this package is either
# another declaration, which does not move the number, or logic, which should arrive with its tests.
# The one live risk is a floor at 100 flaking, and it cannot — there is no timing-dependent statement
# to vary, which is the failure mode this file's header warns about.
pkg/types                100

pkg/utils                82

# sdks/c measures 12.1%, and the floor is 12 rather than 11 for a reason worth recording: 11.0% was
# what this file claimed while it argued the package was unfloorable, and that number was already
# stale when it was written. #355 added the tests that took it from 11.0% to 12.1%; the note was
# authored on a branch cut before #355 merged, so it recorded a measurement its own commit had
# invalidated. Verified rather than reasoned — `sdks/c` has no commits touching it since, and the
# package measures 11.0% at f6f2ae5^ and 12.1% at HEAD.
#
# The number depends on CGO_ENABLED, which is why this floor waited on #361. main.go is a CgoFile, so
# `CGO_ENABLED=0 go test ./sdks/c/` does not fall back to a build-tag-excluded variant — it fails to
# compile, because main_test.go references codeFromErr, fillCStr, maxPutLength and more, and none of
# those declarations are built. Part of CI sets CGO_ENABLED=0 deliberately (the cross-build matrix
# and the release build, where the point is a static binary), so a floor read off an inherited value
# would have been a claim about a file set some jobs do not compile. The coverage job now states
# CGO_ENABLED=1, so this floor is about a configuration a workflow declares.
#
# 12.1% is low and stays low by design: the covered part is the pure-Go logic reachable without a
# live C caller (codeFromErr, fillCStr, bytesToCacheString, the length and limit error builders), and
# the rest is //export cgo entry points whose parameters are C pointers. Exercising those needs the
# C test suite in sdks/c/tests, which links the shared library and is not a `go test` target. The
# floor is a ratchet on the Go-testable half, not a coverage target for the SDK.
sdks/c                   12

# sdks/go/objectfs measures 54.1% with AWS credentials present and 43.5% without, because several
# of its tests call requireAWS and skip. CI has no credentials, so the floor is set for the
# skipping case — the higher number is not something CI can hold it to.
sdks/go/objectfs         43