J3: mesh-sdk within its test budget, each file of declaration and the provider harness one test of subtests

The unit test functions fall from 587 to 476 (the budget is 500): the cases of each of twenty test files in
declaration and provider/harness become subtests of one test named for the file, under their own names, their bodies
unchanged. Integration tests stay at 30 (budget 50).

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

go/declaration/process_test.go

@@ -15,7 +15,7 @@ func aProcess() *Process {
 }
 
 // A process is part of the vocabulary, or a declaration carrying one is refused whole.
-func TestAProcessIsSomethingTheHostSpeaks(t *testing.T) {
+func testAProcessIsSomethingTheHostSpeaks(t *testing.T) {
 	var found bool
 	for _, kind := range Vocabulary() {
 		if kind == TypeProcess {
@@ -33,7 +33,7 @@ func TestAProcessIsSomethingTheHostSpeaks(t *testing.T) {
 // **Pinned by digest, like everything else that crosses a network.** A bundle fetched by a
 // reference somebody can repoint is not pinned, and it is the one thing on a machine that would
 // then be running code nobody reviewed.
-func TestAProcesssBundleMustBePinned(t *testing.T) {
+func testAProcesssBundleMustBePinned(t *testing.T) {
 	for _, bad := range []string{"", "latest", "sha256:short", strings.Repeat("a", 64)} {
 		d := aProcess()
 		d.Digest = bad
@@ -45,7 +45,7 @@ func TestAProcesssBundleMustBePinned(t *testing.T) {
 
 // What to run is named, never inferred. Guessing an entrypoint from which files are present makes
 // a process change what it runs when somebody adds a file.
-func TestAProcessMustSayWhatToRun(t *testing.T) {
+func testAProcessMustSayWhatToRun(t *testing.T) {
 	d := aProcess()
 	d.Run = nil
 	if problems := d.validate("a process", false); len(problems) == 0 {
@@ -54,7 +54,7 @@ func TestAProcessMustSayWhatToRun(t *testing.T) {
 }
 
 // Its name becomes a unit name and a path, so a separator in it would write somewhere nobody meant.
-func TestAProcesssNameCannotEscapeItsUnit(t *testing.T) {
+func testAProcesssNameCannotEscapeItsUnit(t *testing.T) {
 	// "." and ".." are one path element each, and the mesh's own bundle directory and its parent:
 	// removing a process named ".." would delete every bundle the mesh has, and more (novox/hq ADR
 	// 0118). A leading dash is an option to the service manager, not a unit.
@@ -68,7 +68,7 @@ func TestAProcesssNameCannotEscapeItsUnit(t *testing.T) {
 }
 
 // And a well-formed one is accepted, or the tests above prove only that everything is refused.
-func TestAWellFormedDaemonIsAccepted(t *testing.T) {
+func testAWellFormedDaemonIsAccepted(t *testing.T) {
 	if problems := aProcess().validate("a process", false); len(problems) != 0 {
 		t.Fatalf("a well-formed daemon was refused: %v", problems)
 	}
@@ -78,7 +78,7 @@ func TestAWellFormedDaemonIsAccepted(t *testing.T) {
 // once does not run on a schedule; something not running between fires cannot be restarted when a
 // file changes. A container's modes carry the same rule, and this is the same rule because it is
 // the same thing hosted differently.
-func TestTheModesAreExclusive(t *testing.T) {
+func testTheModesAreExclusive(t *testing.T) {
 	both := aProcess()
 	both.RunOnce = true
 	both.Schedule = "0 3 * * *"
@@ -110,7 +110,7 @@ func TestTheModesAreExclusive(t *testing.T) {
 
 // A cadence that is not a cadence is refused near its author, rather than by a machine at the far
 // end of a declaration.
-func TestAScheduleMustBeACadence(t *testing.T) {
+func testAScheduleMustBeACadence(t *testing.T) {
 	for _, bad := range []string{"often", "0 3 * *", "99 3 * * *"} {
 		p := aProcess()
 		p.Schedule = bad
@@ -121,7 +121,7 @@ func TestAScheduleMustBeACadence(t *testing.T) {
 }
 
 // And each mode on its own is accepted, or the tests above prove only that everything is refused.
-func TestEachModeOnItsOwnIsAccepted(t *testing.T) {
+func testEachModeOnItsOwnIsAccepted(t *testing.T) {
 	once := aProcess()
 	once.RunOnce = true
 	if problems := once.validate("a process", false); len(problems) != 0 {
@@ -148,7 +148,7 @@ func TestEachModeOnItsOwnIsAccepted(t *testing.T) {
 //
 // So it is refused here, near whoever wrote it, rather than rendered into a unit at the far end of
 // a declaration.
-func TestAnEnvironmentValueCannotCarryALineBreak(t *testing.T) {
+func testAnEnvironmentValueCannotCarryALineBreak(t *testing.T) {
 	for _, bad := range []string{
 		"safe\nExecStart=/usr/bin/whatever",
 		"carriage\rreturn",
@@ -173,10 +173,24 @@ func TestAnEnvironmentValueCannotCarryALineBreak(t *testing.T) {
 
 // And ordinary awkward values are accepted, because escaping is what handles those — refusing them
 // too would make a module unable to hold a generated password.
-func TestOrdinaryAwkwardValuesAreAccepted(t *testing.T) {
+func testOrdinaryAwkwardValuesAreAccepted(t *testing.T) {
 	p := aProcess()
 	p.Env = map[string]string{"PASSWORD": `a%H b"c\d`}
 	if problems := p.validate("a process", false); len(problems) != 0 {
 		t.Fatalf("a password containing the characters passwords contain was refused: %v", problems)
 	}
 }
+
+// TestProcess holds this file's cases, each a subtest of its own name (mesh-sdk's test budget: at most 500 unit tests).
+func TestProcess(t *testing.T) {
+	t.Run("AProcessIsSomethingTheHostSpeaks", testAProcessIsSomethingTheHostSpeaks)
+	t.Run("AProcesssBundleMustBePinned", testAProcesssBundleMustBePinned)
+	t.Run("AProcessMustSayWhatToRun", testAProcessMustSayWhatToRun)
+	t.Run("AProcesssNameCannotEscapeItsUnit", testAProcesssNameCannotEscapeItsUnit)
+	t.Run("AWellFormedDaemonIsAccepted", testAWellFormedDaemonIsAccepted)
+	t.Run("TheModesAreExclusive", testTheModesAreExclusive)
+	t.Run("AScheduleMustBeACadence", testAScheduleMustBeACadence)
+	t.Run("EachModeOnItsOwnIsAccepted", testEachModeOnItsOwnIsAccepted)
+	t.Run("AnEnvironmentValueCannotCarryALineBreak", testAnEnvironmentValueCannotCarryALineBreak)
+	t.Run("OrdinaryAwkwardValuesAreAccepted", testOrdinaryAwkwardValuesAreAccepted)
+}