[aledbf]

Comment cleanup across all of cmd/ and internal/ (385 Go files, 368 changed). Comment lines go from 6,869 to about 520.

Deleted: doc comments that repeat a name, step narration and banners, "X is TS Y" notes the parity and oracle tests already pin, history of fixed bugs ("Go used to…", "0.88: …"), bare issue tags, and divergence notes already recorded in docs/DIVERGENCES.md or docs/go-only-features.md.

Kept: comments about behaviour we can't change (Docker, BuildKit, Compose, git, POSIX shell, Go's stdlib, JavaScript/V8 semantics the reference forces), the recipe that regenerates the ts-features-build goldens, and divergences recorded nowhere else (listed below).

Only comments change

• Each of the 368 files parses to the same AST once comments are stripped; //go: and //nolint are compared too.
• Protected markers keep their counts: mutate-lane 22, mutate-exempt 37, //go: 9, //nolint 1. Every mutate-lane still sits directly above its func.
• The remaining insertions are gofmt realigning fields once trailing comments were removed, plus one comment that had lost its first sentence (above featureRequestHeaders), now rewritten.

Validation (local)

• go tool task lint: pass (golangci-lint 0 issues, mutate -stale-exempts OK, deadcode, testquality).
• go tool task test:race with TMPDIR outside /tmp: pass. With the default TMPDIR, TestOpen* and TestComputeWorkspaceConfigOutsideARepository fail identically on main because the dev machine has a /tmp/.git.
• go tool task parity:contract: 104 pass. The 2 read-configuration.features-configuration-local-feature-* cases also fail locally without this change and pass in CI.

Follow-ups found during the cleanup (not changed here)

Bugs

• internal/docker/client.go FindDockerDriverBuilder: ctxRes, _ := c.Run(...) then reads ctxRes.Stdout; Run returns nil, err when docker can't be executed, so this panics.
• internal/cli/feature_install.go isGitHubTarballURI: HasPrefix(u, "https://github.com") also matches https://github.com.attacker.example, which then gets GITHUB_TOKEN. The TS reference does the same (containerFeaturesConfiguration.ts:406, v0.89.0), so fixing it is a deliberate, security-motivated divergence.

Silent fallbacks (AGENTS.md error handling)

• internal/cli/secrets.go secretValuesFromFile / buildSecretsFromFile: nil on any read or parse error.
• internal/cli/stop.go resolveWorkspaceContainer: drops the resolveContainerID error.
• internal/lifecycle/probe.go ProbedRemoteEnv: a probe error becomes an empty env.
• internal/docker/dockerfile.go finalStageName: ignores the instructions.Parse error.
• internal/log/log.go jsonHandler: drops a failed stringify.JSON.
• internal/oci/push.go PushArtifact: a failed tag push is only a warning.
• internal/features/lockfile.go jsonTruthy: returns true on a decode error.

Divergences recorded only in a code comment (should move to docs/DIVERGENCES.md)

• gpu.go detectGPU (nvidia-container-cli probe, #319)
• build [path] positional (chore(deps): bump the actions group across 1 directory with 2 updates #8)
• .dockerignore copy (#969)
• stage LABEL devcontainer.metadata (#1225)
• compose build --label (#930)
• collection single-item folders (#876)
• host vars in Feature containerEnv (#308)
• Feature shorthand auto-mapping with a tag and for unknown ids
• Mermaid hashes
• ENV key order in generateContainerEnvs
• no Run: events for Engine SDK calls
• secretservice vs secret credential helper
• credential-helper timeout warning
• unparsable auth realm only refused under hardening

Dead code

• internal/cli/exec.go var _ = json.Marshal
• internal/cli/e2e_test.go unused cmd := exec.Command(...); _ = cmd

🤖 Generated with Claude Code