Summary

Closes three code-coverage gaps in the worker repo, driving each target area to 100% (well above the 95% floor), using test seams not waivers.

Coverage block (before → after)

Measured by full-suite go test ./... -short. Full suite passes; all other packages unchanged.

What changed

internal/logsafe (88.9 → 100): added a direct unit test for the unexported itoa helper covering the n==0 and defensive n<0 branches that Token() can't reach via a real len() argument.

internal/migrations (93.9 → 100): added tests for NewReader's ttl<=0 default-clamp branch (behavioural — verifies the cache TTL is positive) and queryState's COUNT-query error path (sqlmock). No DB required — the package already uses go-sqlmock.

root main.go (0 → 100): the binary's main() was one large untestable function. Refactored using the standard Go main-coverage seam:

• Extracted pure/wiring helpers: setupLogger, resolvePlansPath, loadPlanRegistry, newHealthzHandler, buildMux, serveLiveness/startLivenessServer/shutdownLivenessServer, awaitShutdown, setupTelemetry/telemetryCleanup, connectProvisioner, deployK8sInitOK, newSignalContext.
• Introduced a run(ctx, deps) int seam where infra constructors are injectable (deps struct) plus package-var indirection (osExit, signalCtxFn, realMainFn, newDeployK8sClients).
• main() is now a thin osExit(realMainFn(...)) wrapper, itself covered by swapping its indirected collaborators.
• Tests drive the full boot/clean-shutdown and River-failed-to-start paths with sqlmock + miniredis + a fake workerSet + a cancelled context — no real Postgres / Redis / gRPC / River. A generic forceErr3 wrapper exercises the fail-open k8s-init branch without naming the unexported provider types.

cmd/smoke-buildinfo (bonus): extracted a render(io.Writer) seam (100% covered); the remaining main() is the irreducible one-line wrapper.

Verification

• go build ./... clean
• go vet ./... clean
• target packages pass under -race
• full-suite go test ./... -short green

🤖 Generated with Claude Code