---
id: w4/m6/t009
title: "Test coverage — meaningful tests for the behavior this milestone shipped"
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m6/t007]
---

## Objective

Round out test coverage for m6's behavior: Core secrets methods against the fake store and an httptest OpenBao stub (login failure, KV errors, unavailable), adapter shape tests (Render-compat request/response, 503, 403), CRD env-merge edge cases (PORT shadowing attempt, empty env, secret-ref to a missing Secret), and the materialize-on-write path in envtest. Tests must assert real behavior and failure modes — never trivial, tautological, or snapshot-everything tests.

## Context

- Standing closing task; unit + envtest via `make test` (remember GOTOOLCHAIN pin — memory: go-toolchain-quirk).

## Steps

1. Gap-scan the milestone's DoD and each task's acceptance criteria against existing tests.
2. Add the missing cases, favoring failure modes.
3. `make test` green.

## Files

- `operator/internal/api/*_test.go`, `operator/internal/controller/*_test.go`

## Acceptance criteria

- [ ] Every DoD clause and failure mode above has an asserting test; `make test` green.

## Out of scope

- E2E rework (t006 owns the mock-cluster flow).
