address feedback: refactor declarative validation migration checks

- Extract HV error filtering into filterHandwrittenErrors for readability.
- Simplify errOutputMatcherByStability initialization in testing helpers.

pkg/api/testing/validation.go

@@ -400,7 +400,7 @@ func verifyValidationEquivalence(t *testing.T, expectedErrs field.ErrorList, run
 		allDeclarativeErrs := runValidations(testCtx)
 
 		// The matcher here is more specific to ensure that errors from Alpha rules are included and matched correctly.
-		errOutputMatcherByStability := field.ErrorMatcher{}.ByType().ByOrigin().ByFieldNormalized(opt.NormalizationRules).ByValidationStabilityLevel()
+		errOutputMatcherByStability := errOutputMatcher.ByValidationStabilityLevel()
 		if len(expectedErrs) > 0 {
 			errOutputMatcherByStability.Test(t, expectedErrs, allDeclarativeErrs)
 		} else if len(allDeclarativeErrs) != 0 {

staging/src/k8s.io/apiserver/pkg/registry/rest/validate.go

@@ -442,26 +442,7 @@ func ValidateDeclarativelyWithMigrationChecks(ctx context.Context, scheme *runti
 	}
 
 	// Filter HV errors
-	// We remove HV errors that are covered by declarative validation AND are enforced.
-	errs = errs.Filter(func(e error) bool {
-		var fe *field.Error
-		if !errors.As(e, &fe) || !fe.CoveredByDeclarative {
-			return false
-		}
-
-		if allDeclarativeEnforced {
-			return true
-		}
-
-		// Explicit Strategy
-		if fe.IsBeta() {
-			// Beta validations are enforced only if the Beta feature gate is enabled.
-			return betaEnabled
-		}
-		// For Standard validations, we keep the handwritten error for now to avoid losing coverage
-		// before it is deleted from source. Alpha validations are always shadowed (kept).
-		return false
-	})
+	errs = filterHandwrittenErrors(errs, allDeclarativeEnforced, betaEnabled)
 
 	// Append Enforced DV errors
 	for _, dvErr := range declarativeErrs {
@@ -484,6 +465,29 @@ func ValidateDeclarativelyWithMigrationChecks(ctx context.Context, scheme *runti
 	return errs
 }
 
+func filterHandwrittenErrors(errs field.ErrorList, allDeclarativeEnforced, betaEnabled bool) field.ErrorList {
+	// We remove HV errors that are covered by declarative validation AND are enforced.
+	return errs.Filter(func(e error) bool {
+		var fe *field.Error
+		if !errors.As(e, &fe) || !fe.CoveredByDeclarative {
+			return false
+		}
+
+		if allDeclarativeEnforced {
+			return true
+		}
+
+		// Explicit Strategy
+		if fe.IsBeta() {
+			// Beta validations are enforced only if the Beta feature gate is enabled.
+			return betaEnabled
+		}
+		// For Standard validations, we keep the handwritten error for now to avoid losing coverage
+		// before it is deleted from source. Alpha validations are always shadowed (kept).
+		return false
+	})
+}
+
 // RecordDuplicateValidationErrors increments a metric and log the error when duplicate validation errors are found.
 func RecordDuplicateValidationErrors(ctx context.Context, qualifiedKind schema.GroupKind, errs field.ErrorList) {
 	logger := klog.FromContext(ctx)