golangci: re-vendor the org config with gomodguard_v2 (closes #123)

The org .golangci.yml now uses gomodguard_v2 in place of the
deprecated gomodguard, which made every lint run print a deprecation
warning. The file is copied unchanged from sneak/prompts. It also turns
on depguard with the org test-support rule, which rejects
net/http/httptest except in test files and in files under a directory
whose name ends in test. This repo's previous copy had no deny entries
of its own, so there were none to carry forward.

Model: opus-5-5

.golangci.yml

@@ -10,14 +10,20 @@ run:
 
 linters:
   default: all
+  enable:
+    # Successor to the deprecated gomodguard. Named explicitly, rather than
+    # left to `default: all`, because it carries the module policy below.
+    - gomodguard_v2
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
-    - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
-    - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
+    # Deprecated: the warning is attached to the old name, so it is
+    # silenced by disabling that name, not by enabling the successor.
+    - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
   settings:
     lll:
       line-length: 88
@@ -28,6 +34,64 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
+    depguard:
+      # Test-support code must not be compiled into the shipped binary. A
+      # test-support package exists to hand a test privileges the program
+      # itself must never have, so a file that is not a test must not import
+      # one. Test files, and the files inside a package whose directory name
+      # ends in `test`, are where that code belongs, and are exempt.
+      #
+      # The deny list below is the one part of this file a repository is
+      # expected to extend, and the only part it may. depguard matches an
+      # import path against a list of prefixes, so it cannot be told "any path
+      # whose last segment ends in test"; a repository's own test-support
+      # packages have to be named here one at a time, by full import path,
+      # under a module path that differs from repository to repository. Add
+      # them; change nothing else.
+      rules:
+        test-support:
+          list-mode: lax
+          files:
+            - "$all"
+            - "!$test"
+            - "!**/*test/**"
+          deny:
+            - pkg: net/http/httptest
+              desc: >-
+                Test-support code belongs in test files and in packages whose
+                directory name ends in test, not in the shipped binary.
+    # Only decisions already recorded in the Go package defaults are
+    # listed here. Every entry matches the module path exactly.
+    gomodguard_v2:
+      blocked:
+        - module: github.com/rs/zerolog
+          recommendations:
+            - log/slog
+          reason: "Structured logging is stdlib log/slog."
+        # One entry per pre-fork module path, because the later releases
+        # are separate paths. A prefix match would be shorter but would
+        # also reach github.com/go-redis/redismock, the test double for
+        # the successor these entries recommend.
+        - module: github.com/go-redis/redis
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v7
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v8
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/sergi/go-diff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "No unified diff output; use go-udiff."
+        - module: github.com/hexops/gotextdiff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "Unmaintained fork; use go-udiff."
 
 issues:
   max-issues-per-linter: 0

README.md

@@ -278,6 +278,8 @@ internal/
   tlscheck/tlscheck.go        TLS certificate inspector
   notify/notify.go             Notification service (Slack, Mattermost, ntfy)
   watcher/watcher.go           Main monitoring orchestrator and scheduler
+  livedns/livedns.go           Retry and concurrency limit for tests
+                               against live DNS (imported only by tests)
 ```
 
 ### Design Principles

TESTING.md

@@ -4,9 +4,10 @@
 
 DNS is never mocked in this project, not in tests and not anywhere
 else; see the README section "No DNS mocking. Ever." Every test that
-involves DNS **MUST** use live queries against real DNS servers: the
-resolver's tests, and the tests of code that uses the resolver, such
-as the watcher.
+looks something up in DNS **MUST** query live DNS servers, never a
+stand-in. Logic that works on record data, such as comparing or
+formatting records, may be tested on that data directly with no
+lookup.
 
 ### Rationale
 

TODO.md

@@ -10,11 +10,7 @@
 
 # Status
 
-pre-1.0. No git tags. Core resolver work in flight on feature/resolver
-(dirty: internal/resolver/resolver_test.go). Local checkout has diverged
-from origin: origin/main is 8 commits ahead (watcher orchestrator,
-unified TARGETS) and origin/feature/resolver already contains the full
-iterative resolver implementation with hermetic mocked tests.
+pre-1.0. No git tags.
 
 # Next Step
 
@@ -23,13 +19,19 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 # Completed Steps
 
-- 2026-09-29: nothing stands in for DNS any more. The watcher tests use the
-  real resolver against live DNS and test changes by preparing the saved
-  state a check starts from; the resolver timeout test queries an address
-  that never answers, and `NewFromLoggerWithClient`, used only by its
-  stand-in client, is gone. The live-DNS retry and concurrency limit moved
-  to `internal/livedns`, which both test packages use. `TESTING.md` states
-  the README's rule (closes #159).
+- 2026-09-29: `.golangci.yml` re-fetched unchanged from `sneak/prompts`. It
+  replaces the deprecated `gomodguard` with `gomodguard_v2`, so `make lint` no
+  longer warns about it, and turns on `depguard` with the org `test-support`
+  rule, which rejects `net/http/httptest` except in test files and in files
+  under a directory whose name ends in `test`. This repo had no `deny` entries
+  of its own to carry forward (closes #123).
+- 2026-09-29: nothing stands in for DNS any more. Watcher tests that look
+  something up in DNS use the real resolver against live DNS servers and test
+  record and nameserver changes by preparing the saved state a check starts
+  from; the resolver timeout test queries an address that never answers, and
+  `NewFromLoggerWithClient`, used only by its stand-in client, is gone. The
+  live-DNS retry and concurrency limit moved to `internal/livedns`, which both
+  test packages use. `TESTING.md` states the README's rule (closes #159).
 - 2026-09-28: the inconsistency alert is sent once, on the check where two
   nameservers start to disagree or where a nameserver that disagrees first
   appears, instead of on every check while they disagree, and not again after
@@ -268,4 +270,5 @@ Infrastructure notes (from untracked TODO.md):
 - Module path sneak.berlin/go/dnswatcher differs from the git.eeqj.de
   remote intentionally; do not "fix" it
 - Dependencies: github.com/miekg/dns, golang.org/x/net/publicsuffix
-- Tests use live DNS and never mock it (README, "No DNS mocking. Ever.")
+- DNS is never mocked; tests that look something up in DNS query live DNS
+  servers (README, "No DNS mocking. Ever.")

internal/livedns/livedns.go

@@ -1,5 +1,5 @@
-// Package livedns runs the live DNS operations of tests. Every test in
-// this project that needs DNS resolves against the real, live DNS —
+// Package livedns runs the live DNS operations of tests. Tests that
+// look something up in DNS query live DNS servers, never a stand-in —
 // see TESTING.md. Nothing here mocks, fakes, stubs, records or replays
 // DNS, and nothing here skips a test: it only changes *how* the live
 // queries are issued, so that a single dropped UDP packet or one slow
@@ -16,10 +16,12 @@
 //     operations are in flight at once in one test binary.
 //
 //  2. Retry with exponential backoff. Each live operation gets several
-//     attempts with its own timeout. The retry condition is strictly
-//     transport-level — "did a nameserver answer at all" — never the
-//     assertion the test is making. Code that answers incorrectly
-//     still fails on the first attempt.
+//     attempts with its own timeout. An attempt is retried when it
+//     obtained nothing to check, never because of what the test
+//     asserts about the result, so a wrong result still fails on the
+//     first attempt. A fault in the code under test that leaves
+//     nothing to check looks the same as live DNS not answering, and
+//     fails only after the last attempt.
 package livedns
 
 import (
@@ -113,7 +115,7 @@ func Retry(
 	}
 
 	t.Fatalf(
-		"%s: no answer after %d live attempts: %v",
+		"%s: all %d live attempts failed: %v",
 		what, attempts, last,
 	)
 }

internal/resolver/livedns_test.go

@@ -17,11 +17,12 @@ import (
 // Live DNS test support
 // ----------------------------------------------------------------
 //
-// Every test in this package resolves against the real, live DNS —
-// see TESTING.md. Each live operation below goes through
-// livedns.Retry, which bounds how many resolutions are in flight at
-// once and retries an operation that got no answer (see package
-// livedns).
+// Tests that look something up in DNS query live DNS servers, never a
+// stand-in; logic that works on record data may be tested on that
+// data with no lookup (see TESTING.md). Each live operation below goes
+// through livedns.Retry, which bounds how many resolutions are in
+// flight at once and retries an operation that got no answer (see
+// package livedns).
 //
 // Where an assertion spans several independent nameservers, a quorum
 // is enough: a strict majority answering as expected. A server that

internal/resolver/resolver_test.go

@@ -32,8 +32,8 @@ func newTestResolver(t *testing.T) *resolver.Resolver {
 }
 
 // findOneNSForDomain picks one authoritative nameserver to aim a
-// test at. Live-DNS retry, concurrency and quorum handling live in
-// livedns_test.go.
+// test at. Quorum handling lives in livedns_test.go, and the live-DNS
+// retry and concurrency limit in package livedns.
 func findOneNSForDomain(
 	t *testing.T,
 	r *resolver.Resolver,
@@ -528,8 +528,10 @@ func TestQueryNameserverIP_Timeout(t *testing.T) {
 	r := newTestResolver(t)
 
 	// Nothing answers at 192.0.2.1, a documentation address. The
-	// deadline must outlast one query timeout (two seconds): a query
-	// cut short by the deadline itself is not reported as a timeout.
+	// resolver tries each query twice, and the first try gives up
+	// after two seconds. A deadline that ends during the first try
+	// makes the status vary from run to run between nodata and
+	// timeout, so the deadline must outlast the first try.
 	ctx, cancel := context.WithTimeout(
 		context.Background(), 3*time.Second,
 	)

internal/watcher/watcher_test.go

@@ -19,9 +19,10 @@ import (
 )
 
 // The watcher looks these names up in live DNS with the real resolver,
-// so tests assert on notifications and saved state, never on the
-// records these zones publish. testHost's addresses stay the same from
-// one check to the next, which the tests that check it twice rely on.
+// so tests assert on what the watcher does with the answers, never on
+// the records these zones publish. testHost's nameservers and addresses
+// stay the same from one check to the next, which the tests that check
+// it twice rely on.
 const (
 	testDomain = "google.com"
 	testHost   = "cloudflare.com"
@@ -38,7 +39,8 @@ const (
 
 // --- Stand-ins for the port checker, TLS checker and notifier ---
 //
-// DNS has none: the watcher uses the real resolver (see TESTING.md).
+// DNS has none: the watchers built here use the real resolver (see
+// TESTING.md).
 
 // mockPortChecker reports every port open until closed is set.
 type mockPortChecker struct {
@@ -171,11 +173,10 @@ func defaultTestConfig(t *testing.T) *config.Config {
 	}
 }
 
-// checkOnce runs the watcher's checks once and returns
-// livedns.ErrNoAnswer when live DNS did not answer for a configured
-// name. The watcher saves a name's hostname state only when all of the
-// name's lookups succeed, so live DNS answered for a name when this
-// check saved its hostname state and that state holds an address.
+// checkOnce runs the watcher's checks once and returns an error when a
+// configured name has no hostname state saved by this check, or that
+// state holds no address. Either live DNS gave no answer for the name,
+// or the watcher saved no fresh result for it.
 func checkOnce(
 	ctx context.Context,
 	w *watcher.Watcher,
@@ -191,53 +192,53 @@ func checkOnce(
 		hs, ok := deps.state.GetHostnameState(name)
 		if !ok || hs.LastChecked.Before(started) ||
 			len(addresses(hs)) == 0 {
-			return fmt.Errorf("%w: %s", livedns.ErrNoAnswer, name)
+			return fmt.Errorf(
+				"%s: %w, or the watcher saved no fresh "+
+					"result for it",
+				name, livedns.ErrNoAnswer,
+			)
 		}
 	}
 
 	return nil
 }
 
-// runFirstCheck builds a watcher, lets prepare set up the saved state
-// and stand-ins it starts from, and runs its checks once against live
-// DNS. When live DNS does not answer, the watcher is thrown away and
-// built again, so a failed attempt leaves nothing behind in the state
-// or the notifications.
-func runFirstCheck(
+// runChecks builds a watcher, lets prepare set up the saved state and
+// stand-ins it starts from, and runs its checks once against live DNS.
+// If change is not nil, change then alters the saved state or stand-ins
+// and the checks run a second time. When either check finds no fresh
+// address for a name (see checkOnce), the watcher is thrown away and
+// all of this runs again on a new one, so a failed attempt leaves
+// nothing behind in the saved state, the stand-ins or the notifications.
+func runChecks(
 	t *testing.T,
 	cfg *config.Config,
-	prepare func(deps *testDeps),
-) (*watcher.Watcher, *testDeps) {
+	prepare, change func(deps *testDeps),
+) *testDeps {
 	t.Helper()
 
-	var (
-		w    *watcher.Watcher
-		deps *testDeps
-	)
+	var deps *testDeps
+
+	livedns.Retry(t, "watcher checks", func(ctx context.Context) error {
+		var w *watcher.Watcher
 
-	livedns.Retry(t, "first check", func(ctx context.Context) error {
 		w, deps = newTestWatcher(t, cfg)
 
 		if prepare != nil {
 			prepare(deps)
 		}
 
-		return checkOnce(ctx, w, deps)
-	})
-
-	return w, deps
+		err := checkOnce(ctx, w, deps)
+		if err != nil || change == nil {
+			return err
 		}
 
-// runCheck runs the watcher's checks once more against live DNS,
-// repeating them while live DNS does not answer. A failed lookup keeps
-// the name's saved records, so a repeat compares against the same
-// saved state.
-func runCheck(t *testing.T, w *watcher.Watcher, deps *testDeps) {
-	t.Helper()
+		change(deps)
 
-	livedns.Retry(t, "check", func(ctx context.Context) error {
 		return checkOnce(ctx, w, deps)
 	})
+
+	return deps
 }
 
 // addresses returns the A and AAAA values saved for a hostname.
@@ -295,7 +296,7 @@ func TestFirstRunBaseline(t *testing.T) {
 	cfg.Domains = []string{testDomain}
 	cfg.Hostnames = []string{testHost}
 
-	_, deps := runFirstCheck(t, cfg, nil)
+	deps := runChecks(t, cfg, nil, nil)
 
 	assertNoNotifications(t, deps)
 	assertStatePopulated(t, deps)
@@ -347,7 +348,7 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
 
-	_, deps := runFirstCheck(t, cfg, nil)
+	deps := runChecks(t, cfg, nil, nil)
 
 	snap := deps.state.GetSnapshot()
 
@@ -387,11 +388,11 @@ func TestNSChangeDetection(t *testing.T) {
 	cfg.Domains = []string{testDomain}
 
 	// The saved state lists nameservers that live DNS does not.
-	_, deps := runFirstCheck(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetDomainState(testDomain, &state.DomainState{
 			Nameservers: []string{oldNS1, oldNS2},
 		})
-	})
+	}, nil)
 
 	assertNotified(t, deps, "NS Change: "+testDomain, "warning")
 
@@ -407,17 +408,16 @@ func TestRecordChangeDetection(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	w, deps := runFirstCheck(t, cfg, nil)
-
-	// Save, for every nameserver, an address live DNS never returns.
+	// Between the checks, save for every nameserver an address live DNS
+	// never returns.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
 		hs, _ := deps.state.GetHostnameState(testHost)
 		for _, nsState := range hs.RecordsByNameserver {
 			nsState.Records = map[string][]string{"A": {oldIP}}
 		}
 
 		deps.state.SetHostnameState(testHost, hs)
-
-	runCheck(t, w, deps)
+	})
 
 	assertNotified(t, deps, "Record Change: "+testHost, "warning")
 }
@@ -428,13 +428,12 @@ func TestPortStateChange(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	w, deps := runFirstCheck(t, cfg, nil)
-
+	// Between the checks, every port closes.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
 		deps.portChecker.mu.Lock()
 		deps.portChecker.closed = true
 		deps.portChecker.mu.Unlock()
-
-	runCheck(t, w, deps)
+	})
 
 	hs, _ := deps.state.GetHostnameState(testHost)
 	assertNotified(
@@ -454,7 +453,7 @@ func TestTLSExpiryWarning(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	_, deps := runFirstCheck(t, cfg, expiresInThreeDays)
+	deps := runChecks(t, cfg, expiresInThreeDays, nil)
 
 	assertNotified(t, deps, "TLS Expiry Warning: "+testHost, "warning")
 }
@@ -466,18 +465,19 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
 	cfg.Hostnames = []string{testHost}
 	cfg.TLSInterval = 24 * time.Hour
 
-	w, deps := runFirstCheck(t, cfg, expiresInThreeDays)
-
 	title := "TLS Expiry Warning: " + testHost
 
-	warnings := countNotifications(deps, title)
-	if warnings == 0 {
-		t.Fatal("expected expiry warnings from the first check")
-	}
-
 	// The second check comes within the TLS interval of the first,
 	// so it must not warn again.
-	runCheck(t, w, deps)
+	var warnings int
+
+	deps := runChecks(t, cfg, expiresInThreeDays, func(deps *testDeps) {
+		warnings = countNotifications(deps, title)
+	})
+
+	if warnings == 0 {
+		t.Fatal("expected expiry warnings from the first check")
+	}
 
 	got := countNotifications(deps, title)
 	if got != warnings {
@@ -525,7 +525,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	cfg.Hostnames = []string{testHost}
 
 	// The saved state says the last check found testHost at oldIP.
-	_, deps := runFirstCheck(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetHostnameState(testHost, &state.HostnameState{
 			RecordsByNameserver: map[string]*state.NameserverRecordState{
 				oldNS1: {
@@ -534,7 +534,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 				},
 			},
 		})
-	})
+	}, nil)
 
 	snap := deps.state.GetSnapshot()
 
@@ -665,10 +665,9 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	w, deps := runFirstCheck(t, cfg, nil)
-
-	// Save every nameserver the first check found as failed, and add
-	// one that live DNS does not list as having answered.
+	// Between the checks, save every nameserver the first check found
+	// as failed, and add, as answering, one that live DNS does not list.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
 		hs, _ := deps.state.GetHostnameState(testHost)
 		for _, nsState := range hs.RecordsByNameserver {
 			nsState.Status = "error"
@@ -680,8 +679,7 @@ func TestNSFailureAndRecovery(t *testing.T) {
 		}
 
 		deps.state.SetHostnameState(testHost, hs)
-
-	runCheck(t, w, deps)
+	})
 
 	assertNotified(t, deps, "NS Failure: "+testHost, "error")
 	assertNotified(t, deps, "NS Recovery: "+testHost, "success")