Summary

Caps the cross-repo 95% coverage push for common. After PRs #25-#30 landed
for crypto/nats/plans/readiness/r2/logctx, two storage backends remained
below the floor:

• storageprovider/dospaces 63.6% -> 100.0%
• storageprovider/s3 72.2% -> 97.2%

Total: 94.5% -> 98.0%. Every package is now >=95%.

What's covered

dospaces: accessor methods (MasterAccessKey, MasterSecretKey, Endpoint,
PublicURL, Bucket, Region, UseTLS) plus the scheme-prefix and
already-schemed endpoint branches inside customerEndpointURL().

s3: accessor methods, IssueTenantCredentials default-fallback
branches (empty Prefix/Bucket/TTL), safeSessionName branch coverage
(digits/dashes/underscores retained, truncation at 56),
customerEndpointURL passthrough for already-schemed endpoints,
RevokeTenantCredentials no-op confirmation, and AssumeRole error
propagation.

Approach

No production code changes. The two storage providers don't talk to AWS
SDK directly — dospaces returns the master key verbatim; s3 already
exposes SetAssumeRoleFunc for test injection. Coverage gains come from
exercising existing branches via the public API.

Test plan

• go test ./... -short -coverprofile=cov.out -covermode=atomic
• go vet ./...
• Consumer builds: cd ../api && go build ./... (no break)
• Consumer builds: cd ../worker && go build ./... (no break)
• Consumer builds: cd ../provisioner && go build ./... (no break)
• No exported API change (only _test.go files added)

Coverage block (rule 17)

Symptom:        common total 94.5% < 95% target; dospaces 63.6%, s3 72.2%
Enumeration:    go tool cover -func | sort | grep "<100"
Sites found:    2 (storageprovider/dospaces, storageprovider/s3)
Sites touched:  both
Coverage test:  TestRegistry_AllProvidersSatisfyContract walks the
                registered backends; new files add branch assertions.
Live verified:  go test ./... -short -coverprofile cov.out -> 98.0%

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

🤖 Generated with Claude Code