Remove DNS mocking from tests; use live DNS everywhere

DNS is never mocked in this repository: tests exercise live DNS,
and robustness comes from handling real-world DNS behavior with
tolerant assertions and sensible timeouts, not from mocks.

watcher: drop mockResolver and wire the real iterative resolver
into the tests, querying stable public names (example.com,
www.example.com). Change detection is exercised by seeding the
state store with a synthetic previous observation that live DNS
cannot match (reserved .invalid nameserver names and RFC 5737
documentation addresses); DNS stays live in every run. The port
checker, TLS checker, and notifier remain test doubles since they
are not DNS, keeping notification and state assertions
deterministic against whatever addresses live DNS returns.

resolver: drop the timeoutClient fake DNSClient and the
NewFromLoggerWithClient mock constructor. The timeout test is
replaced by a live query against an RFC 5737 documentation
address where no nameserver can exist, asserting a classified
non-OK response with no records.

TESTING.md: extend the live-DNS policy to every package and
remove the carve-out that permitted DNS mocks in packages that
consume the resolver.

TODO.md: update stale references to hermetic mocked-DNS work to
reflect the no-mocking policy and the current state of
feature/resolver.

Intentionally dropped coverage: the exact StatusTimeout
classification (previously forced by the fake client) is no
longer asserted, because a genuinely unreachable server may fail
fast instead of timing out depending on the network path; the
live test tolerantly accepts any failure classification.

.golangci.yml

@@ -1,5 +1,9 @@
 version: "2"
 
+# Config schema uses the golangci-lint v2 layout (settings live under
+# linters.settings, not top-level linters-settings) so that the
+# thresholds below are actually applied by golangci-lint >= v2.
+
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -14,8 +18,7 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-
+  settings:
-linters-settings:
     lll:
       line-length: 88
     funlen:
@@ -27,6 +30,5 @@ linters-settings:
       threshold: 100
 
 issues:
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -4,8 +4,8 @@ FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4
 
 RUN apk add --no-cache git make gcc musl-dev binutils-gold
 
-# golangci-lint v2.10.1
+# golangci-lint v2.12.2, 2026-08-07
-RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5
 # goimports v0.42.0
 RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0
 

TESTING.md

@@ -2,8 +2,10 @@
 
 ## DNS Resolution Tests
 
-All resolver tests **MUST** use live queries against real DNS servers.
+All tests that involve DNS resolution — in every package, including
-No mocking of the DNS client layer is permitted.
+consumers of the resolver such as the watcher — **MUST** use live
+queries against real DNS servers. No mocking, faking, or stubbing of
+DNS at any layer is permitted.
 
 ### Rationale
 
@@ -12,6 +14,8 @@ the full delegation chain. Mocked responses cannot faithfully represent
 the variety of real-world DNS behavior (truncation, referrals, glue
 records, DNSSEC, varied response times, EDNS, etc.). Testing against
 real servers ensures the resolver works correctly in production.
+Robustness comes from handling real-world DNS behavior with tolerant
+assertions and sensible timeouts, not from mocks.
 
 ### Constraints
 
@@ -24,11 +28,14 @@ real servers ensures the resolver works correctly in production.
 - Flaky failures from transient network issues are acceptable and
   should be investigated as potential resolver bugs, not papered over
   with mocks or skip flags
+- Watcher change-detection tests seed a synthetic *previous state*
+  and compare it against fresh live lookups; the DNS side is never
+  faked
 
 ### What NOT to do
 
-- **Do not mock `DNSClient`** for resolver tests (the mock constructor
+- **Do not mock `DNSClient`**, the watcher's `DNSResolver` interface,
-  exists for unit-testing other packages that consume the resolver)
+  or any other DNS abstraction — in any package, for any reason
 - **Do not add `-short` flags** to skip slow tests
 - **Do not increase `-timeout`** to hide hanging queries
 - **Do not modify linter configuration** to suppress findings

TODO.md

@@ -14,7 +14,10 @@ pre-1.0. No git tags. Core resolver work in flight on feature/resolver
 (dirty: internal/resolver/resolver_test.go). Local checkout has diverged
 from origin: origin/main is 8 commits ahead (watcher orchestrator,
 unified TARGETS) and origin/feature/resolver already contains the full
-iterative resolver implementation with hermetic mocked tests.
+iterative resolver implementation. DNS mocking is banned in this repo
+(see `TESTING.md`): all tests use live DNS only. The hermetic mocked
+tests previously noted on `feature/resolver` are gone from its current
+tip, which carries a live-DNS suite against `*.dns.sneak.cloud`.
 
 # Next Step
 
@@ -25,10 +28,23 @@ confirm make check still passes.
 
 # Completed Steps
 
+- 2026-08-07: DNS mocking removed from the entire test suite; watcher
+  tests now drive the real iterative resolver against live DNS and
+  `TESTING.md` bans DNS mocks in every package (`remove-dns-mocking`
+  branch)
+- 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
+  in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
+  org-standard v2-schema config used across the org's repos
+  (owner-authorized; same file is being landed as canonical via prompts
+  PR #24), with settings under `linters.settings` so the
+  lll/funlen/cyclop/dupl thresholds apply; fixed the resulting
+  `goconst`, `dupl`, and `lll` findings; the informational `gomodguard`
+  deprecation warning under this config is accepted
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-02-20: iterative DNS resolver implemented; tests made hermetic
-  with mocked DNS (origin/feature/resolver, unmerged)
+  with mocked DNS (origin/feature/resolver, unmerged; superseded — DNS
+  mocking is banned, see `TESTING.md`)
 - 2026-02-20: CI actions and go install refs pinned to commit SHAs;
   Gitea Actions workflow for make check (origin/ci/make-check, unmerged)
 - 2026-02-20: watcher monitoring orchestrator merged to main (#8)
@@ -55,8 +71,9 @@ Branch reconciliation:
 - Sync local checkout with origin: local main is 8 commits behind
   origin/main; local feature/resolver has diverged from
   origin/feature/resolver, which already implements the resolver
-- Merge in-flight branches to main once green: feature/resolver,
+- Merge in-flight branches to main once green: feature/resolver
-  ci/make-check, feature/portcheck-implementation,
+  (confirm its tests remain live-DNS — DNS mocking is banned, see
+  `TESTING.md`), ci/make-check, feature/portcheck-implementation,
   feature/tlscheck-implementation
 
 Resolver (plan from untracked TODO.md; largely implemented on
@@ -140,6 +157,7 @@ Infrastructure notes (from untracked TODO.md):
 - Module path sneak.berlin/go/dnswatcher differs from the git.eeqj.de
   remote intentionally; do not "fix" it
 - Dependencies: github.com/miekg/dns, golang.org/x/net/publicsuffix
-- Resolver tests originally used live DNS against *.dns.sneak.cloud
+- Resolver tests originally used live DNS against `*.dns.sneak.cloud`
-  (required records documented in the test file header); origin now has
+  (required records documented in the test file header); `main` now
-  mocked hermetic tests, keep them hermetic
+  tests against live public DNS. DNS mocking is banned (see
+  `TESTING.md`); never reintroduce hermetic mocked DNS tests

internal/config/classify_test.go

@@ -17,13 +17,33 @@ func TestClassifyDNSName(t *testing.T) {
 	}{
 		{name: "apex domain simple", input: "example.com", want: config.DNSNameTypeDomain},
 		{name: "hostname simple", input: "www.example.com", want: config.DNSNameTypeHostname},
-		{name: "apex domain multi-part TLD", input: "example.co.uk", want: config.DNSNameTypeDomain},
+		{
-		{name: "hostname multi-part TLD", input: "api.example.co.uk", want: config.DNSNameTypeHostname},
+			name:  "apex domain multi-part TLD",
+			input: "example.co.uk",
+			want:  config.DNSNameTypeDomain,
+		},
+		{
+			name:  "hostname multi-part TLD",
+			input: "api.example.co.uk",
+			want:  config.DNSNameTypeHostname,
+		},
 		{name: "public suffix itself", input: "co.uk", wantErr: true},
 		{name: "empty string", input: "", wantErr: true},
-		{name: "deeply nested hostname", input: "a.b.c.example.com", want: config.DNSNameTypeHostname},
+		{
-		{name: "trailing dot stripped", input: "example.com.", want: config.DNSNameTypeDomain},
+			name:  "deeply nested hostname",
-		{name: "uppercase normalized", input: "WWW.Example.COM", want: config.DNSNameTypeHostname},
+			input: "a.b.c.example.com",
+			want:  config.DNSNameTypeHostname,
+		},
+		{
+			name:  "trailing dot stripped",
+			input: "example.com.",
+			want:  config.DNSNameTypeDomain,
+		},
+		{
+			name:  "uppercase normalized",
+			input: "WWW.Example.COM",
+			want:  config.DNSNameTypeHostname,
+		},
 	}
 
 	for _, tt := range tests {

internal/notify/delivery_test.go

@@ -25,6 +25,20 @@ const (
 	colorDefault = "#6c757d"
 )
 
+// Priority strings used across multiple tests.
+const (
+	prioError   = "error"
+	prioWarning = "warning"
+	prioSuccess = "success"
+	prioInfo    = "info"
+	prioUnknown = "unknown"
+	prioDefault = "default"
+	prioUrgent  = "urgent"
+)
+
+// testHost is the hostname used in request construction tests.
+const testHost = "example.com"
+
 // errSimulated is a static error for transport failures.
 var errSimulated = errors.New("simulated transport failure")
 
@@ -101,13 +115,13 @@ func TestNtfyPriority(t *testing.T) {
 		input string
 		want  string
 	}{
-		{"error", "urgent"},
+		{prioError, prioUrgent},
-		{"warning", "high"},
+		{prioWarning, "high"},
-		{"success", "default"},
+		{prioSuccess, prioDefault},
-		{"info", "low"},
+		{prioInfo, "low"},
-		{"", "default"},
+		{"", prioDefault},
-		{"unknown", "default"},
+		{prioUnknown, prioDefault},
-		{"critical", "default"},
+		{"critical", prioDefault},
 	}
 
 	for _, tc := range cases {
@@ -134,12 +148,12 @@ func TestSlackColor(t *testing.T) {
 		input string
 		want  string
 	}{
-		{"error", colorError},
+		{prioError, colorError},
-		{"warning", colorWarning},
+		{prioWarning, colorWarning},
-		{"success", colorSuccess},
+		{prioSuccess, colorSuccess},
-		{"info", colorInfo},
+		{prioInfo, colorInfo},
 		{"", colorDefault},
-		{"unknown", colorDefault},
+		{prioUnknown, colorDefault},
 		{"critical", colorDefault},
 	}
 
@@ -165,7 +179,7 @@ func TestNewRequest(t *testing.T) {
 
 	target := &url.URL{
 		Scheme: "https",
-		Host:   "example.com",
+		Host:   testHost,
 		Path:   "/webhook",
 	}
 	body := bytes.NewBufferString("hello")
@@ -187,9 +201,9 @@ func TestNewRequest(t *testing.T) {
 		)
 	}
 
-	if req.Host != "example.com" {
+	if req.Host != testHost {
 		t.Errorf(
-			"Host = %q, want %q", req.Host, "example.com",
+			"Host = %q, want %q", req.Host, testHost,
 		)
 	}
 
@@ -217,7 +231,7 @@ func TestNewRequestPreservesContext(t *testing.T) {
 		ctxKey("k"),
 		"v",
 	)
-	target := &url.URL{Scheme: "https", Host: "example.com"}
+	target := &url.URL{Scheme: "https", Host: testHost}
 
 	req := notify.NewRequestForTest(
 		ctx, http.MethodGet, target, http.NoBody,
@@ -289,10 +303,10 @@ func TestSendNtfyHeaders(t *testing.T) {
 		)
 	}
 
-	if captured.priority != "urgent" {
+	if captured.priority != prioUrgent {
 		t.Errorf(
 			"Priority header = %q, want %q",
-			captured.priority, "urgent",
+			captured.priority, prioUrgent,
 		)
 	}
 
@@ -311,10 +325,10 @@ func TestSendNtfyAllPriorities(t *testing.T) {
 		input string
 		want  string
 	}{
-		{"error", "urgent"},
+		{prioError, prioUrgent},
-		{"warning", "high"},
+		{prioWarning, "high"},
-		{"success", "default"},
+		{prioSuccess, prioDefault},
-		{"info", "low"},
+		{prioInfo, "low"},
 	}
 
 	for _, tc := range priorities {
@@ -356,56 +370,69 @@ func TestSendNtfyAllPriorities(t *testing.T) {
 	}
 }
 
-func TestSendNtfyClientError(t *testing.T) {
+// assertSendStatusError verifies that send returns an error
-	t.Parallel()
+// wrapping wantErr when the server responds with status.
+func assertSendStatusError(
+	t *testing.T,
+	status int,
+	wantErr error,
+	send func(*notify.Service, *url.URL) error,
+) {
+	t.Helper()
 
 	srv := httptest.NewServer(
 		http.HandlerFunc(
 			func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(http.StatusForbidden)
+				w.WriteHeader(status)
 			}),
 	)
 	defer srv.Close()
 
 	svc := notify.NewTestService(srv.Client().Transport)
-	topicURL, _ := url.Parse(srv.URL)
+	target, _ := url.Parse(srv.URL)
 
-	err := svc.SendNtfy(
+	err := send(svc, target)
-		context.Background(), topicURL, "t", "m", "info",
-	)
 	if err == nil {
-		t.Fatal("expected error for 403 response")
+		t.Fatalf("expected error for %d response", status)
 	}
 
-	if !errors.Is(err, notify.ErrNtfyFailed) {
+	if !errors.Is(err, wantErr) {
-		t.Errorf("error = %v, want ErrNtfyFailed", err)
+		t.Errorf("error = %v, want %v", err, wantErr)
 	}
 }
 
+func sendNtfyInfo(
+	svc *notify.Service, target *url.URL,
+) error {
+	return svc.SendNtfy(
+		context.Background(), target, "t", "m", prioInfo,
+	)
+}
+
+func sendSlackInfo(
+	svc *notify.Service, target *url.URL,
+) error {
+	return svc.SendSlack(
+		context.Background(), target, "t", "m", prioInfo,
+	)
+}
+
+func TestSendNtfyClientError(t *testing.T) {
+	t.Parallel()
+
+	assertSendStatusError(
+		t, http.StatusForbidden,
+		notify.ErrNtfyFailed, sendNtfyInfo,
+	)
+}
+
 func TestSendNtfyServerError(t *testing.T) {
 	t.Parallel()
 
-	srv := httptest.NewServer(
+	assertSendStatusError(
-		http.HandlerFunc(
+		t, http.StatusInternalServerError,
-			func(w http.ResponseWriter, _ *http.Request) {
+		notify.ErrNtfyFailed, sendNtfyInfo,
-				w.WriteHeader(http.StatusInternalServerError)
-			}),
 	)
-	defer srv.Close()
-
-	svc := notify.NewTestService(srv.Client().Transport)
-	topicURL, _ := url.Parse(srv.URL)
-
-	err := svc.SendNtfy(
-		context.Background(), topicURL, "t", "m", "info",
-	)
-	if err == nil {
-		t.Fatal("expected error for 500 response")
-	}
-
-	if !errors.Is(err, notify.ErrNtfyFailed) {
-		t.Errorf("error = %v, want ErrNtfyFailed", err)
-	}
 }
 
 func TestSendNtfySuccess(t *testing.T) {
@@ -550,11 +577,11 @@ func TestSendSlackAllColors(t *testing.T) {
 		priority string
 		want     string
 	}{
-		{"error", colorError},
+		{prioError, colorError},
-		{"warning", colorWarning},
+		{prioWarning, colorWarning},
-		{"success", colorSuccess},
+		{prioSuccess, colorSuccess},
-		{"info", colorInfo},
+		{prioInfo, colorInfo},
-		{"unknown", colorDefault},
+		{prioUnknown, colorDefault},
 	}
 
 	for _, tc := range colors {
@@ -606,53 +633,19 @@ func TestSendSlackAllColors(t *testing.T) {
 func TestSendSlackClientError(t *testing.T) {
 	t.Parallel()
 
-	srv := httptest.NewServer(
+	assertSendStatusError(
-		http.HandlerFunc(
+		t, http.StatusBadRequest,
-			func(w http.ResponseWriter, _ *http.Request) {
+		notify.ErrSlackFailed, sendSlackInfo,
-				w.WriteHeader(http.StatusBadRequest)
-			}),
 	)
-	defer srv.Close()
-
-	svc := notify.NewTestService(srv.Client().Transport)
-	webhookURL, _ := url.Parse(srv.URL)
-
-	err := svc.SendSlack(
-		context.Background(), webhookURL, "t", "m", "info",
-	)
-	if err == nil {
-		t.Fatal("expected error for 400 response")
-	}
-
-	if !errors.Is(err, notify.ErrSlackFailed) {
-		t.Errorf("error = %v, want ErrSlackFailed", err)
-	}
 }
 
 func TestSendSlackServerError(t *testing.T) {
 	t.Parallel()
 
-	srv := httptest.NewServer(
+	assertSendStatusError(
-		http.HandlerFunc(
+		t, http.StatusBadGateway,
-			func(w http.ResponseWriter, _ *http.Request) {
+		notify.ErrSlackFailed, sendSlackInfo,
-				w.WriteHeader(http.StatusBadGateway)
-			}),
 	)
-	defer srv.Close()
-
-	svc := notify.NewTestService(srv.Client().Transport)
-	webhookURL, _ := url.Parse(srv.URL)
-
-	err := svc.SendSlack(
-		context.Background(), webhookURL, "t", "m", "error",
-	)
-	if err == nil {
-		t.Fatal("expected error for 502 response")
-	}
-
-	if !errors.Is(err, notify.ErrSlackFailed) {
-		t.Errorf("error = %v, want ErrSlackFailed", err)
-	}
 }
 
 func TestSendSlackNetworkError(t *testing.T) {
@@ -977,74 +970,62 @@ func TestSendNotificationMattermostOnly(t *testing.T) {
 	}
 }
 
-func TestSendNotificationNtfyError(t *testing.T) {
+// assertSendNotificationTolerates verifies SendNotification
-	t.Parallel()
+// neither panics nor blocks when the endpoint configured by
+// setURL responds with status.
+func assertSendNotificationTolerates(
+	t *testing.T,
+	status int,
+	priority string,
+	setURL func(*notify.Service, *url.URL),
+) {
+	t.Helper()
 
 	srv := httptest.NewServer(
 		http.HandlerFunc(
 			func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(http.StatusInternalServerError)
+				w.WriteHeader(status)
 			}),
 	)
 	defer srv.Close()
 
-	ntfyURL, _ := url.Parse(srv.URL)
+	target, _ := url.Parse(srv.URL)
 
 	svc := notify.NewTestService(http.DefaultTransport)
-	svc.SetNtfyURL(ntfyURL)
+	setURL(svc, target)
 
-	// Should not panic or block.
 	svc.SendNotification(
-		context.Background(), "t", "m", "error",
+		context.Background(), "t", "m", priority,
 	)
 
 	time.Sleep(100 * time.Millisecond)
 }
 
+func TestSendNotificationNtfyError(t *testing.T) {
+	t.Parallel()
+
+	assertSendNotificationTolerates(
+		t, http.StatusInternalServerError, prioError,
+		(*notify.Service).SetNtfyURL,
+	)
+}
+
 func TestSendNotificationSlackError(t *testing.T) {
 	t.Parallel()
 
-	srv := httptest.NewServer(
+	assertSendNotificationTolerates(
-		http.HandlerFunc(
+		t, http.StatusForbidden, prioError,
-			func(w http.ResponseWriter, _ *http.Request) {
+		(*notify.Service).SetSlackWebhookURL,
-				w.WriteHeader(http.StatusForbidden)
-			}),
 	)
-	defer srv.Close()
-
-	slackURL, _ := url.Parse(srv.URL)
-
-	svc := notify.NewTestService(http.DefaultTransport)
-	svc.SetSlackWebhookURL(slackURL)
-
-	svc.SendNotification(
-		context.Background(), "t", "m", "error",
-	)
-
-	time.Sleep(100 * time.Millisecond)
 }
 
 func TestSendNotificationMattermostError(t *testing.T) {
 	t.Parallel()
 
-	srv := httptest.NewServer(
+	assertSendNotificationTolerates(
-		http.HandlerFunc(
+		t, http.StatusBadGateway, prioWarning,
-			func(w http.ResponseWriter, _ *http.Request) {
+		(*notify.Service).SetMattermostWebhookURL,
-				w.WriteHeader(http.StatusBadGateway)
-			}),
 	)
-	defer srv.Close()
-
-	mmURL, _ := url.Parse(srv.URL)
-
-	svc := notify.NewTestService(http.DefaultTransport)
-	svc.SetMattermostWebhookURL(mmURL)
-
-	svc.SendNotification(
-		context.Background(), "t", "m", "warning",
-	)
-
-	time.Sleep(100 * time.Millisecond)
 }
 
 // ── SlackPayload JSON marshaling ──────────────────────────

internal/notify/history_test.go

@@ -29,14 +29,14 @@ func TestAlertHistoryAddAndRecent(t *testing.T) {
 		Timestamp: now.Add(-2 * time.Minute),
 		Title:     "first",
 		Message:   "msg1",
-		Priority:  "info",
+		Priority:  prioInfo,
 	})
 
 	h.Add(notify.AlertEntry{
 		Timestamp: now.Add(-1 * time.Minute),
 		Title:     "second",
 		Message:   "msg2",
-		Priority:  "warning",
+		Priority:  prioWarning,
 	})
 
 	entries := h.Recent()

internal/notify/retry.go

@@ -69,7 +69,7 @@ func (rc RetryConfig) backoff(attempt int) time.Duration {
 	lo := raw * (1 - jitterFraction)
 	hi := raw * (1 + jitterFraction)
 
-	jittered := lo + rand.Float64()*(hi-lo) //nolint:gosec // jitter does not need crypto/rand
+	jittered := lo + rand.Float64()*(hi-lo) //nolint:gosec // jitter needs no crypto/rand
 
 	return time.Duration(jittered)
 }

internal/resolver/dns_client.go

@@ -7,8 +7,8 @@ import (
 	"github.com/miekg/dns"
 )
 
-// DNSClient abstracts DNS wire-protocol exchanges so the resolver
+// DNSClient abstracts DNS wire-protocol exchanges over a single
-// can be tested without hitting real nameservers.
+// transport, letting the resolver switch between UDP and TCP.
 type DNSClient interface {
 	ExchangeContext(
 		ctx context.Context,

internal/resolver/resolver.go

@@ -67,17 +67,4 @@ func NewFromLogger(log *slog.Logger) *Resolver {
 	}
 }
 
-// NewFromLoggerWithClient creates a Resolver with a custom DNS
-// client, useful for testing with mock DNS responses.
-func NewFromLoggerWithClient(
-	log *slog.Logger,
-	client DNSClient,
-) *Resolver {
-	return &Resolver{
-		log:    log,
-		client: client,
-		tcp:    client,
-	}
-}
-
 // Method implementations are in iterative.go.

internal/resolver/resolver_test.go

@@ -10,7 +10,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -624,57 +623,40 @@ func TestQueryAllNameservers_ContextCanceled(t *testing.T) {
 }
 
 // ----------------------------------------------------------------
-// Timeout tests
+// Unreachable nameserver tests
 // ----------------------------------------------------------------
 
-func TestQueryNameserverIP_Timeout(t *testing.T) {
+func TestQueryNameserverIP_UnreachableServer(t *testing.T) {
 	t.Parallel()
 
-	log := slog.New(slog.NewTextHandler(
+	r := newTestResolver(t)
-		os.Stderr,
-		&slog.HandlerOptions{Level: slog.LevelDebug},
-	))
-
-	r := resolver.NewFromLoggerWithClient(
-		log, &timeoutClient{},
-	)
 
 	ctx, cancel := context.WithTimeout(
 		context.Background(), 10*time.Second,
 	)
 	t.Cleanup(cancel)
 
-	// Query any IP — the client always returns a timeout error.
+	// 192.0.2.1 is an RFC 5737 documentation address: no
+	// nameserver can exist there. Depending on the network
+	// path the queries either time out (silent drop) or fail
+	// fast (ICMP unreachable), so accept any non-OK status;
+	// the resolver must return a classified response with no
+	// records rather than an error or a hang.
 	resp, err := r.QueryNameserverIP(
 		ctx, "unreachable.test.", "192.0.2.1",
 		"example.com",
 	)
 	require.NoError(t, err)
 
-	assert.Equal(t, resolver.StatusTimeout, resp.Status)
+	assert.NotEqual(t, resolver.StatusOK, resp.Status)
-	assert.NotEmpty(t, resp.Error)
+
+	totalRecords := 0
+	for _, values := range resp.Records {
+		totalRecords += len(values)
 	}
 
-// timeoutClient simulates DNS timeout errors for testing.
+	assert.Zero(t, totalRecords)
-type timeoutClient struct{}
-
-func (c *timeoutClient) ExchangeContext(
-	_ context.Context,
-	_ *dns.Msg,
-	_ string,
-) (*dns.Msg, time.Duration, error) {
-	return nil, 0, &net.OpError{
-		Op:  "read",
-		Net: "udp",
-		Err: &timeoutError{},
 }
-}
-
-type timeoutError struct{}
-
-func (e *timeoutError) Error() string   { return "i/o timeout" }
-func (e *timeoutError) Timeout() bool   { return true }
-func (e *timeoutError) Temporary() bool { return true }
 
 func TestResolveIPAddresses_ContextCanceled(t *testing.T) {
 	t.Parallel()

internal/state/state_test.go

@@ -13,6 +13,16 @@ import (
 
 const testHostname = "www.example.com"
 
+// Shared fixture values used across tests.
+const (
+	testNS1     = "ns1.example.com."
+	testNS2     = "ns2.example.com."
+	testAltNS1  = "ns1.test.com."
+	testIPv4    = "93.184.216.34"
+	testIP      = "1.2.3.4"
+	statusError = "error"
+)
+
 // populateState fills a State with representative test data across all categories.
 func populateState(t *testing.T, s *state.State) {
 	t.Helper()
@@ -20,7 +30,7 @@ func populateState(t *testing.T, s *state.State) {
 	now := time.Now().UTC().Truncate(time.Second)
 
 	s.SetDomainState("example.com", &state.DomainState{
-		Nameservers: []string{"ns1.example.com.", "ns2.example.com."},
+		Nameservers: []string{testNS1, testNS2},
 		LastChecked: now,
 	})
 
@@ -31,17 +41,17 @@ func populateState(t *testing.T, s *state.State) {
 
 	s.SetHostnameState(testHostname, &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			"ns1.example.com.": {
+			testNS1: {
 				Records: map[string][]string{
-					"A":    {"93.184.216.34"},
+					"A":    {testIPv4},
 					"AAAA": {"2606:2800:220:1:248:1893:25c8:1946"},
 				},
 				Status:      "ok",
 				LastChecked: now,
 			},
-			"ns2.example.com.": {
+			testNS2: {
 				Records: map[string][]string{
-					"A": {"93.184.216.34"},
+					"A": {testIPv4},
 				},
 				Status:      "ok",
 				LastChecked: now,
@@ -152,13 +162,13 @@ func TestSaveLoadRoundTrip_Hostnames(t *testing.T) {
 func verifyNS1Records(t *testing.T, hn *state.HostnameState) {
 	t.Helper()
 
-	ns1, ok := hn.RecordsByNameserver["ns1.example.com."]
+	ns1, ok := hn.RecordsByNameserver[testNS1]
 	if !ok {
 		t.Fatal("missing nameserver ns1.example.com.")
 	}
 
 	aRecords := ns1.Records["A"]
-	if len(aRecords) != 1 || aRecords[0] != "93.184.216.34" {
+	if len(aRecords) != 1 || aRecords[0] != testIPv4 {
 		t.Errorf("ns1 A records: got %v", aRecords)
 	}
 
@@ -213,7 +223,8 @@ func TestSaveLoadRoundTrip_Ports(t *testing.T) {
 	}
 }
 
-// TestSaveLoadRoundTrip_Certificates verifies certificate data survives a save/load cycle.
+// TestSaveLoadRoundTrip_Certificates verifies certificate data
+// survives a save/load cycle.
 func TestSaveLoadRoundTrip_Certificates(t *testing.T) {
 	t.Parallel()
 
@@ -653,7 +664,7 @@ func TestDomainState_GetSet(t *testing.T) {
 
 	now := time.Now().UTC().Truncate(time.Second)
 	ds := &state.DomainState{
-		Nameservers: []string{"ns1.test.com."},
+		Nameservers: []string{testAltNS1},
 		LastChecked: now,
 	}
 
@@ -664,7 +675,7 @@ func TestDomainState_GetSet(t *testing.T) {
 		t.Fatal("expected true for existing domain")
 	}
 
-	if len(got.Nameservers) != 1 || got.Nameservers[0] != "ns1.test.com." {
+	if len(got.Nameservers) != 1 || got.Nameservers[0] != testAltNS1 {
 		t.Errorf("nameservers: got %v", got.Nameservers)
 	}
 
@@ -674,7 +685,7 @@ func TestDomainState_GetSet(t *testing.T) {
 
 	// Overwrite.
 	ds2 := &state.DomainState{
-		Nameservers: []string{"ns1.test.com.", "ns2.test.com."},
+		Nameservers: []string{testAltNS1, "ns2.test.com."},
 		LastChecked: now.Add(time.Hour),
 	}
 
@@ -704,8 +715,8 @@ func TestHostnameState_GetSet(t *testing.T) {
 	now := time.Now().UTC().Truncate(time.Second)
 	hs := &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			"ns1.example.com.": {
+			testNS1: {
-				Records:     map[string][]string{"A": {"1.2.3.4"}},
+				Records:     map[string][]string{"A": {testIP}},
 				Status:      "ok",
 				LastChecked: now,
 			},
@@ -720,7 +731,7 @@ func TestHostnameState_GetSet(t *testing.T) {
 		t.Fatal("expected true for existing hostname")
 	}
 
-	nsState, ok := got.RecordsByNameserver["ns1.example.com."]
+	nsState, ok := got.RecordsByNameserver[testNS1]
 	if !ok {
 		t.Fatal("missing nameserver entry")
 	}
@@ -730,7 +741,7 @@ func TestHostnameState_GetSet(t *testing.T) {
 	}
 
 	aRecords := nsState.Records["A"]
-	if len(aRecords) != 1 || aRecords[0] != "1.2.3.4" {
+	if len(aRecords) != 1 || aRecords[0] != testIP {
 		t.Errorf("A records: got %v", aRecords)
 	}
 }
@@ -869,7 +880,7 @@ func TestCertificateState_ErrorField(t *testing.T) {
 
 	now := time.Now().UTC().Truncate(time.Second)
 	cs := &state.CertificateState{
-		Status:      "error",
+		Status:      statusError,
 		Error:       "connection refused",
 		LastChecked: now,
 	}
@@ -893,8 +904,8 @@ func TestCertificateState_ErrorField(t *testing.T) {
 		t.Fatal("missing certificate after load")
 	}
 
-	if got.Status != "error" {
+	if got.Status != statusError {
-		t.Errorf("status: got %q, want %q", got.Status, "error")
+		t.Errorf("status: got %q, want %q", got.Status, statusError)
 	}
 
 	if got.Error != "connection refused" {
@@ -912,9 +923,9 @@ func TestHostnameState_ErrorField(t *testing.T) {
 	now := time.Now().UTC().Truncate(time.Second)
 	hs := &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			"ns1.example.com.": {
+			testNS1: {
 				Records:     nil,
-				Status:      "error",
+				Status:      statusError,
 				Error:       "SERVFAIL",
 				LastChecked: now,
 			},
@@ -941,9 +952,9 @@ func TestHostnameState_ErrorField(t *testing.T) {
 		t.Fatal("missing hostname after load")
 	}
 
-	nsState := got.RecordsByNameserver["ns1.example.com."]
+	nsState := got.RecordsByNameserver[testNS1]
-	if nsState.Status != "error" {
+	if nsState.Status != statusError {
-		t.Errorf("status: got %q, want %q", nsState.Status, "error")
+		t.Errorf("status: got %q, want %q", nsState.Status, statusError)
 	}
 
 	if nsState.Error != "SERVFAIL" {
@@ -1062,7 +1073,8 @@ func TestConcurrentGetSet(t *testing.T) {
 	wg.Wait()
 }
 
-// runConcurrentOps performs a series of get/set/delete operations for concurrency testing.
+// runConcurrentOps performs a series of get/set/delete
+// operations for concurrency testing.
 func runConcurrentOps(s *state.State, key string, now time.Time) {
 	const iterations = 50
 
@@ -1085,7 +1097,7 @@ func runConcurrentOps(s *state.State, key string, now time.Time) {
 		s.SetHostnameState(key+".example.com", &state.HostnameState{
 			RecordsByNameserver: map[string]*state.NameserverRecordState{
 				"ns1.test.": {
-					Records:     map[string][]string{"A": {"1.2.3.4"}},
+					Records:     map[string][]string{"A": {testIP}},
 					Status:      "ok",
 					LastChecked: now,
 				},

internal/watcher/watcher.go

@@ -26,6 +26,12 @@ const tlsPort = 443
 // hoursPerDay converts days to hours for duration calculations.
 const hoursPerDay = 24
 
+// Status values recorded for nameserver and certificate checks.
+const (
+	statusOK    = "ok"
+	statusError = "error"
+)
+
 // Params contains dependencies for Watcher.
 type Params struct {
 	fx.In
@@ -344,7 +350,7 @@ func buildHostnameState(
 	for ns, recs := range records {
 		hs.RecordsByNameserver[ns] = &state.NameserverRecordState{
 			Records:     recs,
-			Status:      "ok",
+			Status:      statusOK,
 			LastChecked: now,
 		}
 	}
@@ -402,7 +408,7 @@ func (w *Watcher) detectNSDisappearances(
 	current map[string]map[string][]string,
 ) {
 	for ns, prevNS := range prev.RecordsByNameserver {
-		if _, ok := current[ns]; ok || prevNS.Status != "ok" {
+		if _, ok := current[ns]; ok || prevNS.Status != statusOK {
 			continue
 		}
 
@@ -421,7 +427,7 @@ func (w *Watcher) detectNSDisappearances(
 
 	for ns := range current {
 		prevNS, ok := prev.RecordsByNameserver[ns]
-		if !ok || prevNS.Status != "error" {
+		if !ok || prevNS.Status != statusError {
 			continue
 		}
 
@@ -705,7 +711,7 @@ func (w *Watcher) handleTLSError(
 	now time.Time,
 	err error,
 ) {
-	if hasPrev && !w.firstRun && prev.Status == "ok" {
+	if hasPrev && !w.firstRun && prev.Status == statusOK {
 		msg := fmt.Sprintf(
 			"Host: %s\nIP: %s\nError: %s",
 			hostname, ip, err,
@@ -721,7 +727,7 @@ func (w *Watcher) handleTLSError(
 
 	w.state.SetCertificateState(
 		certKey, &state.CertificateState{
-			Status:      "error",
+			Status:      statusError,
 			Error:       err.Error(),
 			LastChecked: now,
 		},
@@ -748,7 +754,7 @@ func (w *Watcher) handleTLSSuccess(
 			Issuer:                  cert.Issuer,
 			NotAfter:                cert.NotAfter,
 			SubjectAlternativeNames: cert.SubjectAlternativeNames,
-			Status:                  "ok",
+			Status:                  statusOK,
 			LastChecked:             now,
 		},
 	)
@@ -760,7 +766,7 @@ func (w *Watcher) detectTLSChanges(
 	prev *state.CertificateState,
 	cert *tlscheck.CertificateInfo,
 ) {
-	if prev.Status == "error" {
+	if prev.Status == statusError {
 		msg := fmt.Sprintf(
 			"Host: %s\nIP: %s\nTLS recovered",
 			hostname, ip,

script/bootstrap

@@ -9,9 +9,9 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-07-07 (same pins as the Dockerfile)
+# Pinned versions, 2026-08-07 (same pins as the Dockerfile)
-# golangci-lint v2.10.1
+# golangci-lint v2.12.2
-GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee"
+GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5"
 # goimports v0.42.0
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"