Test coverage push #3: 78% → 79%

- Add nameserver SetTTL/Reap + reapExpired test
- Add standalone tasksubmit.Server tests (accept + reject)
- Add CalculateTimeStaged/CalculateTimeCpu edge case tests
- Remove dead code: sendKeyExchangeAuto, sendAuthKeyExchange,
  sendKeyExchange, SetPeerPubKey, closeFull, unregisterAcceptCh

Author: teovl

pkg/daemon/tunnel.go

@@ -199,13 +199,6 @@ func (tm *TunnelManager) SetPeerVerifyFunc(fn func(uint32) (ed25519.PublicKey, e
 	tm.mu.Unlock()
 }
 
-// SetPeerPubKey caches a peer's Ed25519 public key for authentication.
-func (tm *TunnelManager) SetPeerPubKey(nodeID uint32, pubKey ed25519.PublicKey) {
-	tm.mu.Lock()
-	tm.peerPubKeys[nodeID] = pubKey
-	tm.mu.Unlock()
-}
-
 // SetBeaconAddr configures the beacon address for NAT hole-punching and relay.
 func (tm *TunnelManager) SetBeaconAddr(addr string) error {
 	a, err := net.ResolveUDPAddr("udp", addr)
@@ -769,42 +762,6 @@ func (tm *TunnelManager) buildKeyExchangeFrame() []byte {
 	return frame
 }
 
-// sendKeyExchangeAuto sends an authenticated key exchange if identity is available,
-// otherwise falls back to unauthenticated. Uses addr-based direct send (for backward compat).
-func (tm *TunnelManager) sendKeyExchangeAuto(addr *net.UDPAddr) {
-	tm.mu.RLock()
-	hasIdentity := tm.identity != nil
-	tm.mu.RUnlock()
-	if hasIdentity {
-		tm.sendAuthKeyExchange(addr)
-	} else {
-		tm.sendKeyExchange(addr)
-	}
-}
-
-// sendAuthKeyExchange sends our X25519 public key + Ed25519 signature to a peer (direct).
-func (tm *TunnelManager) sendAuthKeyExchange(addr *net.UDPAddr) {
-	frame := tm.buildAuthKeyExchangeFrame()
-	if frame == nil {
-		tm.sendKeyExchange(addr)
-		return
-	}
-	if _, err := tm.conn.WriteToUDP(frame, addr); err != nil {
-		slog.Error("send auth key exchange failed", "addr", addr, "error", err)
-	}
-}
-
-// sendKeyExchange sends our public key to a peer (unauthenticated, direct).
-func (tm *TunnelManager) sendKeyExchange(addr *net.UDPAddr) {
-	frame := tm.buildKeyExchangeFrame()
-	if frame == nil {
-		return
-	}
-	if _, err := tm.conn.WriteToUDP(frame, addr); err != nil {
-		slog.Error("send key exchange failed", "addr", addr, "error", err)
-	}
-}
-
 // flushPending sends any queued packets for a peer now that encryption is ready.
 func (tm *TunnelManager) flushPending(nodeID uint32) {
 	tm.pendMu.Lock()

pkg/driver/ipc.go

@@ -275,15 +275,6 @@ func (c *ipcClient) registerAcceptCh(port uint16) chan []byte {
 	return ch
 }
 
-func (c *ipcClient) unregisterAcceptCh(port uint16) {
-	c.acceptMu.Lock()
-	defer c.acceptMu.Unlock()
-	if ch, ok := c.acceptChs[port]; ok {
-		close(ch)
-		delete(c.acceptChs, port)
-	}
-}
-
 func (c *ipcClient) registerRecvCh(connID uint32) chan []byte {
 	ch := make(chan []byte, 256)
 	c.recvMu.Lock()

pkg/driver/listener.go

@@ -72,12 +72,6 @@ func (l *Listener) Close() error {
 	return nil
 }
 
-// closeFull closes the listener and unregisters the accept channel.
-func (l *Listener) closeFull() {
-	l.Close()
-	l.ipc.unregisterAcceptCh(l.port)
-}
-
 func (l *Listener) Addr() net.Addr {
 	return pilotAddr(protocol.SocketAddr{Port: l.port})
 }

pkg/nameserver/records.go

@@ -143,6 +143,18 @@ func (rs *RecordStore) reapExpired() {
 	}
 }
 
+// SetTTL overrides the default record TTL.
+func (rs *RecordStore) SetTTL(d time.Duration) {
+	rs.mu.Lock()
+	rs.ttl = d
+	rs.mu.Unlock()
+}
+
+// Reap forces an immediate removal of expired records.
+func (rs *RecordStore) Reap() {
+	rs.reapExpired()
+}
+
 // SetStorePath enables persistence to the given file path and loads existing data.
 func (rs *RecordStore) SetStorePath(path string) {
 	rs.mu.Lock()

tests/nameserver_test.go

@@ -309,6 +309,52 @@ func TestNameserverMultipleClients(t *testing.T) {
 	t.Logf("both clients resolved correctly: B=%s, C=%s", addrB, addrC)
 }
 
+// TestNameserverReapExpired verifies that expired records are reaped.
+func TestNameserverReapExpired(t *testing.T) {
+	t.Parallel()
+
+	store := nameserver.NewRecordStore()
+	defer store.Close()
+
+	// Set TTL to zero so all records are immediately expired
+	store.SetTTL(0)
+
+	// Register A, N, and S records
+	store.RegisterA("reap-a", protocol.AddrZero)
+	store.RegisterN("reap-n", 42)
+	store.RegisterS("reap-s", protocol.AddrZero, 1, 7)
+
+	// Verify records exist before reap
+	_, err := store.LookupA("reap-a")
+	if err != nil {
+		t.Fatalf("LookupA before reap: %v", err)
+	}
+
+	// Force reap — all records should be removed (TTL=0)
+	time.Sleep(time.Millisecond) // ensure time.Now() > CreatedAt
+	store.Reap()
+
+	// Verify A record is gone
+	_, err = store.LookupA("reap-a")
+	if err == nil {
+		t.Error("expected A record to be reaped")
+	}
+
+	// Verify N record is gone
+	_, err = store.LookupN("reap-n")
+	if err == nil {
+		t.Error("expected N record to be reaped")
+	}
+
+	// Verify S record is gone
+	entries := store.LookupS(1, 7)
+	if len(entries) > 0 {
+		t.Error("expected S record to be reaped")
+	}
+
+	t.Log("all expired records reaped successfully")
+}
+
 var _ = protocol.AddrZero // keep protocol import
 var _ = os.Remove         // keep os import
 var _ = filepath.Join     // keep filepath import

tests/tasksubmit_test.go

@@ -3,6 +3,7 @@ package tests
 import (
 	"encoding/json"
 	"fmt"
+	"net"
 	"os"
 	"testing"
 	"time"
@@ -1533,3 +1534,124 @@ func TestTaskResultsEndToEnd(t *testing.T) {
 		t.Errorf("expected result text, got %q", string(data))
 	}
 }
+
+// TestTaskSubmitServerStandalone tests the standalone tasksubmit.Server.
+func TestTaskSubmitServerStandalone(t *testing.T) {
+	t.Parallel()
+	env := NewTestEnv(t)
+
+	// Daemon A with built-in task submit DISABLED — we'll use the standalone server
+	a := env.AddDaemon(func(c *daemon.Config) { c.DisableTaskSubmit = true })
+	b := env.AddDaemon()
+
+	// Start standalone tasksubmit.Server on daemon A
+	accepted := make(chan *tasksubmit.SubmitRequest, 1)
+	srv := tasksubmit.NewServer(a.Driver, func(conn net.Conn, req *tasksubmit.SubmitRequest) bool {
+		accepted <- req
+		return true
+	})
+	go srv.ListenAndServe()
+	time.Sleep(100 * time.Millisecond) // wait for listen
+
+	// B submits a task to A via the tasksubmit client
+	client, err := tasksubmit.Dial(b.Driver, a.Daemon.Addr())
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer client.Close()
+
+	resp, err := client.SubmitTask("standalone test task", a.Daemon.Addr().String())
+	if err != nil {
+		t.Fatalf("submit: %v", err)
+	}
+	if resp.Status != tasksubmit.StatusAccepted {
+		t.Errorf("expected accepted, got status %d", resp.Status)
+	}
+	t.Logf("response: status=%d message=%q", resp.Status, resp.Message)
+
+	// Verify handler received the request
+	select {
+	case req := <-accepted:
+		if req.TaskDescription != "standalone test task" {
+			t.Errorf("expected description, got %q", req.TaskDescription)
+		}
+		t.Logf("handler received: %q", req.TaskDescription)
+	case <-time.After(3 * time.Second):
+		t.Fatal("handler did not receive request")
+	}
+}
+
+// TestCalculateTimeStagedEdgeCases tests empty/invalid inputs for CalculateTimeStaged.
+func TestCalculateTimeStagedEdgeCases(t *testing.T) {
+	t.Parallel()
+
+	// Empty StagedAt — should be a no-op
+	tf := &tasksubmit.TaskFile{TaskID: "calc-staged-empty"}
+	tf.CalculateTimeStaged()
+	if tf.ExecuteStartedAt != "" {
+		t.Errorf("expected empty ExecuteStartedAt for empty StagedAt, got %q", tf.ExecuteStartedAt)
+	}
+	if tf.TimeStagedMs != 0 {
+		t.Errorf("expected zero TimeStagedMs for empty StagedAt, got %d", tf.TimeStagedMs)
+	}
+
+	// Invalid StagedAt — should be a no-op
+	tf2 := &tasksubmit.TaskFile{TaskID: "calc-staged-invalid", StagedAt: "not-a-date"}
+	tf2.CalculateTimeStaged()
+	if tf2.ExecuteStartedAt != "" {
+		t.Error("expected empty ExecuteStartedAt for invalid StagedAt")
+	}
+}
+
+// TestCalculateTimeCpuEdgeCases tests empty/invalid inputs for CalculateTimeCpu.
+func TestCalculateTimeCpuEdgeCases(t *testing.T) {
+	t.Parallel()
+
+	// Empty ExecuteStartedAt — should be a no-op
+	tf := &tasksubmit.TaskFile{TaskID: "calc-cpu-empty"}
+	tf.CalculateTimeCpu()
+	if tf.CompletedAt != "" {
+		t.Errorf("expected empty CompletedAt for empty ExecuteStartedAt, got %q", tf.CompletedAt)
+	}
+	if tf.TimeCpuMs != 0 {
+		t.Errorf("expected zero TimeCpuMs for empty ExecuteStartedAt, got %d", tf.TimeCpuMs)
+	}
+
+	// Invalid ExecuteStartedAt — should be a no-op
+	tf2 := &tasksubmit.TaskFile{TaskID: "calc-cpu-invalid", ExecuteStartedAt: "garbage"}
+	tf2.CalculateTimeCpu()
+	if tf2.CompletedAt != "" {
+		t.Error("expected empty CompletedAt for invalid ExecuteStartedAt")
+	}
+}
+
+// TestTaskSubmitServerReject tests the standalone server rejection path.
+func TestTaskSubmitServerReject(t *testing.T) {
+	t.Parallel()
+	env := NewTestEnv(t)
+
+	a := env.AddDaemon(func(c *daemon.Config) { c.DisableTaskSubmit = true })
+	b := env.AddDaemon()
+
+	// Server that always rejects
+	srv := tasksubmit.NewServer(a.Driver, func(conn net.Conn, req *tasksubmit.SubmitRequest) bool {
+		return false
+	})
+	go srv.ListenAndServe()
+	time.Sleep(100 * time.Millisecond)
+
+	client, err := tasksubmit.Dial(b.Driver, a.Daemon.Addr())
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer client.Close()
+
+	resp, err := client.SubmitTask("reject me", a.Daemon.Addr().String())
+	if err != nil {
+		t.Fatalf("submit: %v", err)
+	}
+	if resp.Status != tasksubmit.StatusRejected {
+		t.Errorf("expected rejected (status %d), got %d", tasksubmit.StatusRejected, resp.Status)
+	}
+	t.Logf("rejection response: status=%d message=%q", resp.Status, resp.Message)
+}