tests: rename internal/livedns to livednstest and deny it outside tests (closes #164)

The live-DNS retry and concurrency limit is only for tests, but nothing
stopped program code from importing it and compiling it into the
binary. Its directory name now ends in test, and its import path is on
the test-support deny list in .golangci.yml, so make lint fails when
program code imports it. Every import and mention is updated to the new
name.

Model: opus-5-5

.golangci.yml

@@ -10,14 +10,20 @@ run:
 
 linters:
   default: all
+  enable:
+    # Successor to the deprecated gomodguard. Named explicitly, rather than
+    # left to `default: all`, because it carries the module policy below.
+    - gomodguard_v2
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
-    - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
-    - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
+    # Deprecated: the warning is attached to the old name, so it is
+    # silenced by disabling that name, not by enabling the successor.
+    - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
   settings:
     lll:
       line-length: 88
@@ -28,6 +34,68 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
+    depguard:
+      # Test-support code must not be compiled into the shipped binary. A
+      # test-support package exists to hand a test privileges the program
+      # itself must never have, so a file that is not a test must not import
+      # one. Test files, and the files inside a package whose directory name
+      # ends in `test`, are where that code belongs, and are exempt.
+      #
+      # The deny list below is the one part of this file a repository is
+      # expected to extend, and the only part it may. depguard matches an
+      # import path against a list of prefixes, so it cannot be told "any path
+      # whose last segment ends in test"; a repository's own test-support
+      # packages have to be named here one at a time, by full import path,
+      # under a module path that differs from repository to repository. Add
+      # them; change nothing else.
+      rules:
+        test-support:
+          list-mode: lax
+          files:
+            - "$all"
+            - "!$test"
+            - "!**/*test/**"
+          deny:
+            - pkg: net/http/httptest
+              desc: >-
+                Test-support code belongs in test files and in packages whose
+                directory name ends in test, not in the shipped binary.
+            - pkg: sneak.berlin/go/dnswatcher/internal/livednstest
+              desc: >-
+                Live-DNS test support belongs in test files and in packages
+                whose directory name ends in test, not in the shipped binary.
+    # Only decisions already recorded in the Go package defaults are
+    # listed here. Every entry matches the module path exactly.
+    gomodguard_v2:
+      blocked:
+        - module: github.com/rs/zerolog
+          recommendations:
+            - log/slog
+          reason: "Structured logging is stdlib log/slog."
+        # One entry per pre-fork module path, because the later releases
+        # are separate paths. A prefix match would be shorter but would
+        # also reach github.com/go-redis/redismock, the test double for
+        # the successor these entries recommend.
+        - module: github.com/go-redis/redis
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v7
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v8
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/sergi/go-diff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "No unified diff output; use go-udiff."
+        - module: github.com/hexops/gotextdiff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "Unmaintained fork; use go-udiff."
 
 issues:
   max-issues-per-linter: 0

README.md

@@ -278,6 +278,8 @@ internal/
   tlscheck/tlscheck.go        TLS certificate inspector
   notify/notify.go             Notification service (Slack, Mattermost, ntfy)
   watcher/watcher.go           Main monitoring orchestrator and scheduler
+  livednstest/livednstest.go   Retry and concurrency limit for tests
+                               against live DNS (imported only by tests)
 ```
 
 ### Design Principles

TESTING.md

@@ -25,7 +25,7 @@ real servers ensures the resolver works correctly in production.
 - Query timeout is calibrated to 3× maximum antipodal RTT (~300ms)
   plus processing margin
 - Root server fan-out is limited to reduce parallel query load
-- Live lookups that expect an answer go through `internal/livedns`,
+- Live lookups that expect an answer go through `internal/livednstest`,
   which limits how many run at once in a test binary and retries a
   lookup that got none
 - Flaky failures from transient network issues are acceptable and

TODO.md

@@ -10,11 +10,7 @@
 
 # Status
 
-pre-1.0. No git tags. Core resolver work in flight on feature/resolver
+pre-1.0. No git tags.
-(dirty: internal/resolver/resolver_test.go). Local checkout has diverged
-from origin: origin/main is 8 commits ahead (watcher orchestrator,
-unified TARGETS) and origin/feature/resolver already contains the full
-iterative resolver implementation with hermetic mocked tests.
 
 # Next Step
 
@@ -23,13 +19,22 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 # Completed Steps
 
-- 2026-09-29: nothing stands in for DNS any more. The watcher tests use the
+- 2026-09-29: the live-DNS test package is renamed `internal/livednstest` and
-  real resolver against live DNS and test changes by preparing the saved
+  added to the `test-support` `deny` list in `.golangci.yml`, so `make lint`
-  state a check starts from; the resolver timeout test queries an address
+  fails when program code imports it (closes #164).
-  that never answers, and `NewFromLoggerWithClient`, used only by its
+- 2026-09-29: `.golangci.yml` re-fetched unchanged from `sneak/prompts`. It
-  stand-in client, is gone. The live-DNS retry and concurrency limit moved
+  replaces the deprecated `gomodguard` with `gomodguard_v2`, so `make lint` no
-  to `internal/livedns`, which both test packages use. `TESTING.md` states
+  longer warns about it, and turns on `depguard` with the org `test-support`
-  the README's rule (closes #159).
+  rule, which rejects `net/http/httptest` except in test files and in files
+  under a directory whose name ends in `test`. This repo had no `deny` entries
+  of its own to carry forward (closes #123).
+- 2026-09-29: nothing stands in for DNS any more. Watcher tests that look
+  something up in DNS use the real resolver against live DNS servers and test
+  record and nameserver changes by preparing the saved state a check starts
+  from; the resolver timeout test queries an address that never answers, and
+  `NewFromLoggerWithClient`, used only by its stand-in client, is gone. The
+  live-DNS retry and concurrency limit moved to `internal/livednstest`, which
+  both test packages use. `TESTING.md` states the README's rule (closes #159).
 - 2026-09-28: the inconsistency alert is sent once, on the check where two
   nameservers start to disagree or where a nameserver that disagrees first
   appears, instead of on every check while they disagree, and not again after
@@ -268,4 +273,5 @@ Infrastructure notes (from untracked TODO.md):
 - Module path sneak.berlin/go/dnswatcher differs from the git.eeqj.de
   remote intentionally; do not "fix" it
 - Dependencies: github.com/miekg/dns, golang.org/x/net/publicsuffix
-- Tests use live DNS and never mock it (README, "No DNS mocking. Ever.")
+- DNS is never mocked; tests that look something up in DNS query live DNS
+  servers (README, "No DNS mocking. Ever.")

internal/livednstest/livednstest.go

@@ -1,5 +1,5 @@
-// Package livedns runs the live DNS operations of tests. Every test in
+// Package livednstest runs the live DNS operations of tests. Tests that
-// this project that needs DNS resolves against the real, live DNS —
+// look something up in DNS query live DNS servers, never a stand-in —
 // see TESTING.md. Nothing here mocks, fakes, stubs, records or replays
 // DNS, and nothing here skips a test: it only changes *how* the live
 // queries are issued, so that a single dropped UDP packet or one slow
@@ -16,11 +16,13 @@
 //     operations are in flight at once in one test binary.
 //
 //  2. Retry with exponential backoff. Each live operation gets several
-//     attempts with its own timeout. The retry condition is strictly
+//     attempts with its own timeout. An attempt is retried when it
-//     transport-level — "did a nameserver answer at all" — never the
+//     obtained nothing to check, never because of what the test
-//     assertion the test is making. Code that answers incorrectly
+//     asserts about the result, so a wrong result still fails on the
-//     still fails on the first attempt.
+//     first attempt. A fault in the code under test that leaves
-package livedns
+//     nothing to check looks the same as live DNS not answering, and
+//     fails only after the last attempt.
+package livednstest
 
 import (
 	"context"
@@ -113,7 +115,7 @@ func Retry(
 	}
 
 	t.Fatalf(
-		"%s: no answer after %d live attempts: %v",
+		"%s: all %d live attempts failed: %v",
 		what, attempts, last,
 	)
 }

internal/livednstest/livednstest_test.go

@@ -1,4 +1,4 @@
-package livedns_test
+package livednstest_test
 
 import (
 	"context"
@@ -8,7 +8,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"sneak.berlin/go/dnswatcher/internal/livedns"
+	"sneak.berlin/go/dnswatcher/internal/livednstest"
 )
 
 // Tests for the retry and the concurrency limit themselves. They
@@ -21,11 +21,11 @@ func TestRetryRecoversFromTransientFailure(t *testing.T) {
 
 	attempts := 0
 
-	livedns.Retry(t, "transient", func(_ context.Context) error {
+	livednstest.Retry(t, "transient", func(_ context.Context) error {
 		attempts++
 
 		if attempts < wantAttempts {
-			return livedns.ErrNoAnswer
+			return livednstest.ErrNoAnswer
 		}
 
 		return nil
@@ -37,19 +37,19 @@ func TestRetryRecoversFromTransientFailure(t *testing.T) {
 func TestRetryGivesEachAttemptADeadline(t *testing.T) {
 	t.Parallel()
 
-	livedns.Retry(t, "deadline", func(ctx context.Context) error {
+	livednstest.Retry(t, "deadline", func(ctx context.Context) error {
 		deadline, ok := ctx.Deadline()
 		assert.True(t, ok, "attempt should carry a deadline")
 
 		remaining := time.Until(deadline)
 
-		assert.LessOrEqual(t, remaining, livedns.AttemptTimeout)
+		assert.LessOrEqual(t, remaining, livednstest.AttemptTimeout)
 
 		// Lower bound too: without one this passes for a
 		// deadline far shorter than intended, which would
 		// silently turn every live attempt into an instant
 		// timeout.
-		assert.Greater(t, remaining, livedns.AttemptTimeout/2)
+		assert.Greater(t, remaining, livednstest.AttemptTimeout/2)
 
 		return nil
 	})
@@ -73,7 +73,7 @@ func TestRunBoundsConcurrency(t *testing.T) {
 		go func() {
 			defer wg.Done()
 
-			_ = livedns.Run(func(_ context.Context) error {
+			_ = livednstest.Run(func(_ context.Context) error {
 				mu.Lock()
 				inFlight++
 
@@ -97,7 +97,7 @@ func TestRunBoundsConcurrency(t *testing.T) {
 
 	assert.Positive(t, maxSeen)
 	assert.LessOrEqual(
-		t, maxSeen, livedns.Concurrency,
+		t, maxSeen, livednstest.Concurrency,
 		"live queries must stay under the package-wide gate",
 	)
 }

internal/resolver/livedns_test.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"sneak.berlin/go/dnswatcher/internal/livedns"
+	"sneak.berlin/go/dnswatcher/internal/livednstest"
 	"sneak.berlin/go/dnswatcher/internal/resolver"
 )
 
@@ -17,11 +17,12 @@ import (
 // Live DNS test support
 // ----------------------------------------------------------------
 //
-// Every test in this package resolves against the real, live DNS —
+// Tests that look something up in DNS query live DNS servers, never a
-// see TESTING.md. Each live operation below goes through
+// stand-in; logic that works on record data may be tested on that
-// livedns.Retry, which bounds how many resolutions are in flight at
+// data with no lookup (see TESTING.md). Each live operation below goes
-// once and retries an operation that got no answer (see package
+// through livednstest.Retry, which bounds how many resolutions are in
-// livedns).
+// flight at once and retries an operation that got no answer (see
+// package livednstest).
 //
 // Where an assertion spans several independent nameservers, a quorum
 // is enough: a strict majority answering as expected. A server that
@@ -161,7 +162,7 @@ func liveFindAuthoritative(
 
 	var out []string
 
-	livedns.Retry(
+	livednstest.Retry(
 		t,
 		"FindAuthoritativeNameservers("+domain+")",
 		func(ctx context.Context) error {
@@ -173,7 +174,7 @@ func liveFindAuthoritative(
 			if len(ns) == 0 {
 				return fmt.Errorf(
 					"%w: %s has no nameservers",
-					livedns.ErrNoAnswer, domain,
+					livednstest.ErrNoAnswer, domain,
 				)
 			}
 
@@ -197,7 +198,7 @@ func liveLookupNS(
 
 	var out []string
 
-	livedns.Retry(
+	livednstest.Retry(
 		t,
 		"LookupNS("+domain+")",
 		func(ctx context.Context) error {
@@ -209,7 +210,7 @@ func liveLookupNS(
 			if len(ns) == 0 {
 				return fmt.Errorf(
 					"%w: %s has no nameservers",
-					livedns.ErrNoAnswer, domain,
+					livednstest.ErrNoAnswer, domain,
 				)
 			}
 
@@ -239,7 +240,7 @@ func liveQueryNameserver(
 
 	var out *resolver.NameserverResponse
 
-	livedns.Retry(
+	livednstest.Retry(
 		t,
 		what,
 		func(ctx context.Context) error {
@@ -254,7 +255,7 @@ func liveQueryNameserver(
 				resp.Status == resolver.StatusError {
 				return fmt.Errorf(
 					"%w: %s returned %s: %s",
-					livedns.ErrNoAnswer, nameserver,
+					livednstest.ErrNoAnswer, nameserver,
 					resp.Status, resp.Error,
 				)
 			}
@@ -281,7 +282,7 @@ func liveQueryAllNameservers(
 
 	var out map[string]*resolver.NameserverResponse
 
-	livedns.Retry(
+	livednstest.Retry(
 		t,
 		"QueryAllNameservers("+hostname+")",
 		func(ctx context.Context) error {
@@ -293,7 +294,7 @@ func liveQueryAllNameservers(
 			if len(results) == 0 {
 				return fmt.Errorf(
 					"%w: no nameservers queried for %s",
-					livedns.ErrNoAnswer, hostname,
+					livednstest.ErrNoAnswer, hostname,
 				)
 			}
 
@@ -326,7 +327,7 @@ func liveResolveIPs(
 
 	var out []string
 
-	livedns.Retry(
+	livednstest.Retry(
 		t,
 		"ResolveIPAddresses("+hostname+")",
 		func(ctx context.Context) error {
@@ -338,7 +339,7 @@ func liveResolveIPs(
 			if len(ips) == 0 {
 				return fmt.Errorf(
 					"%w: no addresses for %s",
-					livedns.ErrNoAnswer, hostname,
+					livednstest.ErrNoAnswer, hostname,
 				)
 			}
 
@@ -365,7 +366,7 @@ func liveResolveIPsAllowingEmpty(
 
 	var out []string
 
-	livedns.Retry(
+	livednstest.Retry(
 		t,
 		"ResolveIPAddresses("+hostname+")",
 		func(ctx context.Context) error {

internal/resolver/resolver_test.go

@@ -32,8 +32,8 @@ func newTestResolver(t *testing.T) *resolver.Resolver {
 }
 
 // findOneNSForDomain picks one authoritative nameserver to aim a
-// test at. Live-DNS retry, concurrency and quorum handling live in
+// test at. Quorum handling lives in livedns_test.go, and the live-DNS
-// livedns_test.go.
+// retry and concurrency limit in package livednstest.
 func findOneNSForDomain(
 	t *testing.T,
 	r *resolver.Resolver,
@@ -528,10 +528,10 @@ func TestQueryNameserverIP_Timeout(t *testing.T) {
 	r := newTestResolver(t)
 
 	// Nothing answers at 192.0.2.1, a documentation address. The
-	// resolver tries each query twice; if the deadline has passed
+	// resolver tries each query twice, and the first try gives up
-	// before the second try starts, the query is reported as nodata,
+	// after two seconds. A deadline that ends during the first try
-	// not timeout. So the deadline must outlast the first try's
+	// makes the status vary from run to run between nodata and
-	// two-second timeout.
+	// timeout, so the deadline must outlast the first try.
 	ctx, cancel := context.WithTimeout(
 		context.Background(), 3*time.Second,
 	)

internal/watcher/watcher_test.go

@@ -10,7 +10,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/livedns"
+	"sneak.berlin/go/dnswatcher/internal/livednstest"
 	"sneak.berlin/go/dnswatcher/internal/portcheck"
 	"sneak.berlin/go/dnswatcher/internal/resolver"
 	"sneak.berlin/go/dnswatcher/internal/state"
@@ -19,9 +19,10 @@ import (
 )
 
 // The watcher looks these names up in live DNS with the real resolver,
-// so tests assert on notifications and saved state, never on the
+// so tests assert on what the watcher does with the answers, never on
-// records these zones publish. testHost's addresses stay the same from
+// the records these zones publish. testHost's nameservers and addresses
-// one check to the next, which the tests that check it twice rely on.
+// stay the same from one check to the next, which the tests that check
+// it twice rely on.
 const (
 	testDomain = "google.com"
 	testHost   = "cloudflare.com"
@@ -38,7 +39,8 @@ const (
 
 // --- Stand-ins for the port checker, TLS checker and notifier ---
 //
-// DNS has none: the watcher uses the real resolver (see TESTING.md).
+// DNS has none: the watchers built here use the real resolver (see
+// TESTING.md).
 
 // mockPortChecker reports every port open until closed is set.
 type mockPortChecker struct {
@@ -171,11 +173,10 @@ func defaultTestConfig(t *testing.T) *config.Config {
 	}
 }
 
-// checkOnce runs the watcher's checks once and returns
+// checkOnce runs the watcher's checks once and returns an error when a
-// livedns.ErrNoAnswer when live DNS did not answer for a configured
+// configured name has no hostname state saved by this check, or that
-// name. The watcher saves a name's hostname state only when all of the
+// state holds no address. Either live DNS gave no answer for the name,
-// name's lookups succeed, so live DNS answered for a name when this
+// or the watcher saved no fresh result for it.
-// check saved its hostname state and that state holds an address.
 func checkOnce(
 	ctx context.Context,
 	w *watcher.Watcher,
@@ -191,53 +192,53 @@ func checkOnce(
 		hs, ok := deps.state.GetHostnameState(name)
 		if !ok || hs.LastChecked.Before(started) ||
 			len(addresses(hs)) == 0 {
-			return fmt.Errorf("%w: %s", livedns.ErrNoAnswer, name)
+			return fmt.Errorf(
+				"%s: %w, or the watcher saved no fresh "+
+					"result for it",
+				name, livednstest.ErrNoAnswer,
+			)
 		}
 	}
 
 	return nil
 }
 
-// runFirstCheck builds a watcher, lets prepare set up the saved state
+// runChecks builds a watcher, lets prepare set up the saved state and
-// and stand-ins it starts from, and runs its checks once against live
+// stand-ins it starts from, and runs its checks once against live DNS.
-// DNS. When live DNS does not answer, the watcher is thrown away and
+// If change is not nil, change then alters the saved state or stand-ins
-// built again, so a failed attempt leaves nothing behind in the state
+// and the checks run a second time. When either check finds no fresh
-// or the notifications.
+// address for a name (see checkOnce), the watcher is thrown away and
-func runFirstCheck(
+// all of this runs again on a new one, so a failed attempt leaves
+// nothing behind in the saved state, the stand-ins or the notifications.
+func runChecks(
 	t *testing.T,
 	cfg *config.Config,
-	prepare func(deps *testDeps),
+	prepare, change func(deps *testDeps),
-) (*watcher.Watcher, *testDeps) {
+) *testDeps {
 	t.Helper()
 
-	var (
+	var deps *testDeps
-		w    *watcher.Watcher
+
-		deps *testDeps
+	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
-	)
+		var w *watcher.Watcher
 
-	livedns.Retry(t, "first check", func(ctx context.Context) error {
 		w, deps = newTestWatcher(t, cfg)
 
 		if prepare != nil {
 			prepare(deps)
 		}
 
-		return checkOnce(ctx, w, deps)
+		err := checkOnce(ctx, w, deps)
-	})
+		if err != nil || change == nil {
-
+			return err
-	return w, deps
 		}
 
-// runCheck runs the watcher's checks once more against live DNS,
+		change(deps)
-// repeating them while live DNS does not answer. A failed lookup keeps
-// the name's saved records, so a repeat compares against the same
-// saved state.
-func runCheck(t *testing.T, w *watcher.Watcher, deps *testDeps) {
-	t.Helper()
 
-	livedns.Retry(t, "check", func(ctx context.Context) error {
 		return checkOnce(ctx, w, deps)
 	})
+
+	return deps
 }
 
 // addresses returns the A and AAAA values saved for a hostname.
@@ -295,7 +296,7 @@ func TestFirstRunBaseline(t *testing.T) {
 	cfg.Domains = []string{testDomain}
 	cfg.Hostnames = []string{testHost}
 
-	_, deps := runFirstCheck(t, cfg, nil)
+	deps := runChecks(t, cfg, nil, nil)
 
 	assertNoNotifications(t, deps)
 	assertStatePopulated(t, deps)
@@ -347,7 +348,7 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
 
-	_, deps := runFirstCheck(t, cfg, nil)
+	deps := runChecks(t, cfg, nil, nil)
 
 	snap := deps.state.GetSnapshot()
 
@@ -387,11 +388,11 @@ func TestNSChangeDetection(t *testing.T) {
 	cfg.Domains = []string{testDomain}
 
 	// The saved state lists nameservers that live DNS does not.
-	_, deps := runFirstCheck(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetDomainState(testDomain, &state.DomainState{
 			Nameservers: []string{oldNS1, oldNS2},
 		})
-	})
+	}, nil)
 
 	assertNotified(t, deps, "NS Change: "+testDomain, "warning")
 
@@ -407,17 +408,16 @@ func TestRecordChangeDetection(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	w, deps := runFirstCheck(t, cfg, nil)
+	// Between the checks, save for every nameserver an address live DNS
-
+	// never returns.
-	// Save, for every nameserver, an address live DNS never returns.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
 		hs, _ := deps.state.GetHostnameState(testHost)
 		for _, nsState := range hs.RecordsByNameserver {
 			nsState.Records = map[string][]string{"A": {oldIP}}
 		}
 
 		deps.state.SetHostnameState(testHost, hs)
-
+	})
-	runCheck(t, w, deps)
 
 	assertNotified(t, deps, "Record Change: "+testHost, "warning")
 }
@@ -428,13 +428,12 @@ func TestPortStateChange(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	w, deps := runFirstCheck(t, cfg, nil)
+	// Between the checks, every port closes.
-
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
 		deps.portChecker.mu.Lock()
 		deps.portChecker.closed = true
 		deps.portChecker.mu.Unlock()
-
+	})
-	runCheck(t, w, deps)
 
 	hs, _ := deps.state.GetHostnameState(testHost)
 	assertNotified(
@@ -454,7 +453,7 @@ func TestTLSExpiryWarning(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	_, deps := runFirstCheck(t, cfg, expiresInThreeDays)
+	deps := runChecks(t, cfg, expiresInThreeDays, nil)
 
 	assertNotified(t, deps, "TLS Expiry Warning: "+testHost, "warning")
 }
@@ -466,18 +465,19 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
 	cfg.Hostnames = []string{testHost}
 	cfg.TLSInterval = 24 * time.Hour
 
-	w, deps := runFirstCheck(t, cfg, expiresInThreeDays)
-
 	title := "TLS Expiry Warning: " + testHost
 
-	warnings := countNotifications(deps, title)
-	if warnings == 0 {
-		t.Fatal("expected expiry warnings from the first check")
-	}
-
 	// The second check comes within the TLS interval of the first,
 	// so it must not warn again.
-	runCheck(t, w, deps)
+	var warnings int
+
+	deps := runChecks(t, cfg, expiresInThreeDays, func(deps *testDeps) {
+		warnings = countNotifications(deps, title)
+	})
+
+	if warnings == 0 {
+		t.Fatal("expected expiry warnings from the first check")
+	}
 
 	got := countNotifications(deps, title)
 	if got != warnings {
@@ -525,7 +525,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	cfg.Hostnames = []string{testHost}
 
 	// The saved state says the last check found testHost at oldIP.
-	_, deps := runFirstCheck(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetHostnameState(testHost, &state.HostnameState{
 			RecordsByNameserver: map[string]*state.NameserverRecordState{
 				oldNS1: {
@@ -534,7 +534,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 				},
 			},
 		})
-	})
+	}, nil)
 
 	snap := deps.state.GetSnapshot()
 
@@ -665,10 +665,9 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	w, deps := runFirstCheck(t, cfg, nil)
+	// Between the checks, save every nameserver the first check found
-
+	// as failed, and add, as answering, one that live DNS does not list.
-	// Save every nameserver the first check found as failed, and add
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
-	// one that live DNS does not list as having answered.
 		hs, _ := deps.state.GetHostnameState(testHost)
 		for _, nsState := range hs.RecordsByNameserver {
 			nsState.Status = "error"
@@ -680,8 +679,7 @@ func TestNSFailureAndRecovery(t *testing.T) {
 		}
 
 		deps.state.SetHostnameState(testHost, hs)
-
+	})
-	runCheck(t, w, deps)
 
 	assertNotified(t, deps, "NS Failure: "+testHost, "error")
 	assertNotified(t, deps, "NS Recovery: "+testHost, "success")